Scope, Applicability & Acceptance

These Master Terms and Conditions (these "Terms") govern all contractual relationships between Shadhavar LLC, a Delaware limited liability company ("Shadhavar," "Company," "we," or "us"), and any business entity or individual acting in a professional capacity ("Client," "Customer," or "you") that purchases, subscribes to, or otherwise uses any products or services offered by Shadhavar.

These Terms constitute the entire agreement between the parties with respect to the subject matter hereof and supersede all prior or contemporaneous understandings, agreements, negotiations, representations, and warranties, whether written or oral, with respect to such subject matter.

These Terms apply to every order, accepted proposal, statement of work ("SOW"), invoice, purchase order, or subscription executed by any means, including electronic means. Acceptance of any proposal, activation of any service, or execution of any order constitutes unconditional acceptance of these Terms, notwithstanding any conflicting terms in Client's purchase orders or other documents.

These Terms may be supplemented by Schedules (A through J) and service-specific addenda, which are incorporated herein by reference. In the event of a conflict between these Terms and any Schedule, the Schedule shall prevail with respect to the specific subject matter addressed therein.

These Terms are further supplemented by Schedule G (Definitions & Glossary), which forms an integral part of this contractual framework, even when not physically attached to proposals, invoices, or purchase orders. Client acknowledges having received or having been afforded the opportunity to review all applicable Schedules prior to entering into any agreement.

Legal Qualification & Role of Shadhavar

2.1 — Resale and Intermediation of Cloud Solutions

Shadhavar acts exclusively as an authorized reseller and commercial intermediary of software and cloud solutions published by third-party vendors ("Vendors" or "Publishers"). Shadhavar is not the publisher, developer, direct host, or operator of any third-party cloud platform.

Client expressly acknowledges that cloud services are provided under the sole responsibility of the applicable Vendor, pursuant to such Vendor's terms of service, security policies, service level agreements ("SLAs"), and inherent limitations.

2.2 — Professional IT Services

For its integration, configuration, custom development, website creation and maintenance, hosting, training, and support activities, Shadhavar's obligations are limited to commercially reasonable efforts, expressly excluding any guarantee of specific results. Certain IT direction services may be subject to additional terms set forth in the applicable Schedule.

2.3 — Virtual CIO / IT Direction as a Service

Under certain service offerings, including those designated as "Virtual CIO" or "IT Direction as a Service" ("vCIO Services"), Shadhavar may be contractually engaged to provide outsourced IT direction, including strategic planning, IT governance, vendor coordination, team supervision, and advisory participation in IT-related decision-making processes.

Such outsourced IT direction is exercised within a strictly defined contractual scope, without conferring upon Shadhavar any authority as a corporate officer, general manager, or legal representative of Client, except as expressly provided in a duly executed Schedule or addendum. Shadhavar acts as a functional IT director under a best-efforts obligation; all strategic decisions or decisions that legally bind Client remain subject to approval by Client's authorized decision-makers in accordance with its internal governance.

Vendor Terms; Prevalence

Access to, activation of, and use of any third-party cloud solutions are contingent upon Client's prior and mandatory acceptance of the applicable Vendor's terms and conditions.

In the event of any conflict or inconsistency, the Vendor's terms shall prevail with respect to all matters concerning the functionality, availability, security, and intrinsic use of such third-party solutions.

Orders, License Activation & Irrevocability

Any written request by Client, whether submitted by email, portal, website, or any other electronic means, that results in the activation of a license or service shall constitute a firm and final order.

Failure to pay for an activated license constitutes a material breach of contract, disrupting the overall contractual balance and entitling Shadhavar to suspend or terminate all services, without prejudice to any collection action or other remedy available at law or in equity.

Shadhavar shall not be liable for any Vendor's refusal to cancel, modify, or refund an activated license.

Pricing, Invoicing & Payment

All prices are quoted in United States Dollars (USD), exclusive of applicable taxes unless otherwise stated. Unless otherwise specified, services are invoiced on an annual or recurring basis.

5.1 — Electronic Invoicing

Consistent with the Electronic Signatures in Global and National Commerce Act ("E-SIGN Act"), 15 U.S.C. §§ 7001-7006, and the Uniform Electronic Transactions Act ("UETA") as adopted by the applicable state, Client expressly and irrevocably consents to the transmission of invoices by electronic means. Electronic invoices shall constitute originals and shall have full evidentiary value between the parties.

5.2 — Default in Payment

Any late or missed payment shall, following written notice of default remaining uncured for ten (10) business days, result in the immediate suspension of all services, without prejudice to late payment charges, statutory interest, and collection costs.

Default on any single invoice shall constitute a default on all outstanding contractual obligations.

Renewal, Price Adjustments & Currency

Licenses and recurring services are renewed in accordance with the applicable Vendor's policies. Renewal fees are invoiced sixty (60) days prior to the renewal date.

Client acknowledges that Vendors may modify their pricing, terms, or commercial policies at any time. In the event of a material increase in costs, including but not limited to currency fluctuations, changes in Vendor pricing, or changes in applicable tax or regulatory requirements, Shadhavar reserves the right to adjust its pricing upon thirty (30) days' prior written notice.

Taxes & Tax Responsibilities

All fees and charges stated in any proposal, invoice, or order are exclusive of all applicable taxes, including but not limited to federal, state, and local sales taxes, use taxes, value-added taxes, and any other governmental charges (collectively, "Taxes").

Client shall be responsible for the payment of all Taxes associated with Client's purchases hereunder, excluding taxes based on Shadhavar's net income. If Shadhavar is required by law to collect any such Taxes, the applicable amount will be added to Client's invoice.

Client shall provide Shadhavar with any applicable tax exemption certificates prior to invoicing. In the absence of a valid exemption certificate, Shadhavar will collect and remit applicable Taxes as required by law.

Each party shall be solely responsible for its own tax compliance obligations, including but not limited to income tax filings, withholding obligations, and reporting requirements.

Technical Support, Security & Credentials

Shadhavar provides exclusively first-level (Tier 1) support, including functional assistance and support for configurations performed by Shadhavar.

Advanced support related to infrastructure, availability, or critical incidents of cloud solutions is the sole responsibility of the applicable Vendor.

Shadhavar does not store any user, administrator, or super-administrator passwords. Client remains solely responsible for the safekeeping, confidentiality, and use of its credentials.

Any account recovery or credential reset procedure is strictly subject to the applicable Vendor's procedures, tools, timelines, and technical constraints, without any guarantee of timing or outcome from Shadhavar.

Regulatory Changes & Price Neutrality

Prices agreed upon between the parties are exclusive of taxes and are established in accordance with the tax and regulatory framework in effect as of the date of the applicable agreement.

Any subsequent change in federal, state, or local tax, regulatory, or compliance requirements shall be passed through to Client and may result in an automatic adjustment to invoiced amounts, upon reasonable written notice.

Data Privacy, Confidentiality & Reversibility

Each party shall comply with all applicable data protection and privacy laws, including, without limitation, the California Consumer Privacy Act ("CCPA"), Cal. Civ. Code §§ 1798.100-1798.199, and any other applicable state privacy laws. Additional data processing terms are set forth in Schedule J (Data Processing Addendum).

Where Shadhavar processes personal data on behalf of Client, Shadhavar acts solely as a service provider (as defined under the CCPA) or processor, and shall process such data only pursuant to Client's documented instructions.

Upon expiration or termination of the agreement, Shadhavar has no obligation to retain, escrow, or return any data. Export and migration mechanisms are the sole responsibility of the applicable Vendor.

Any assistance provided by Shadhavar in connection with data reversibility or migration constitutes a separate engagement, subject to a separate proposal and fees.

Transfer to Another Partner or Direct Vendor Billing

Client acknowledges that certain Vendors offer mechanisms for transferring account management to another authorized partner.

Shadhavar shall not impede any such transfer mechanisms when offered by the Vendor but does not guarantee their availability, timing, or terms.

If Client wishes to be billed directly by the Vendor, Client must initiate the necessary steps directly with the Vendor. Shadhavar assumes no obligation to intermediate, coordinate, or provide refunds in connection with any such transition.

Limitation of Liability

Indemnification

Client shall indemnify, defend, and hold harmless Shadhavar and its officers, directors, members, managers, employees, agents, and affiliates from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) Client's use of any services or products; (b) Client's breach of these Terms; (c) Client's violation of any applicable law or regulation; or (d) any third-party claim arising from Client's data, content, or business operations.

Disclaimer of Warranties

Suspension, Termination & Non-Refundability

Bank fees, commissions, tax withholdings, and wire transfer charges are non-refundable under all circumstances.

Any termination notice must be delivered by email or certified mail (or nationally recognized overnight courier), in compliance with the applicable contractual notice period.

Either party may terminate these Terms or any SOW for cause upon thirty (30) days' written notice if the other party materially breaches these Terms and fails to cure such breach within such thirty (30) day period.

Service Lock, Access Restriction & Degradation

In the event of payment default, material breach, or any other event entitling Shadhavar to suspend services under these Terms, Shadhavar may, at its sole discretion and without prior notice, implement any or all of the following graduated remedial measures:

(a) Restriction of Access: Shadhavar may restrict, limit, or revoke Client's access to administrative consoles, configuration panels, reporting dashboards, API endpoints, or any other service interface, including but not limited to Zoho administrative access managed by Shadhavar;

(b) Functionality Degradation: Shadhavar may reduce, disable, or limit specific features, modules, automations, integrations, or workflows previously configured or maintained by Shadhavar, without affecting the underlying Vendor-provided baseline functionality;

(c) Administrative Lock: Shadhavar may lock, freeze, or restrict any administrative credentials, API keys, automation tokens, or configuration access points under Shadhavar's management or control;

(d) Data Export Restriction: During any service lock period, Shadhavar shall have no obligation to assist with data export, migration, or reversibility, and may restrict access to any Shadhavar-managed backup, reporting, or data processing tools;

(e) Third-Party Notification: Where Shadhavar manages vendor relationships on Client's behalf, Shadhavar may notify applicable Vendors of Client's default status, without liability for any consequences thereof.

Service lock measures are cumulative and non-exclusive. They do not constitute a waiver of any other remedy available to Shadhavar under these Terms, at law, or in equity. Full service restoration shall be contingent upon: (i) complete cure of the underlying default; (ii) payment of all outstanding amounts, including accrued interest and fees; and (iii) payment of a service restoration fee, as determined by Shadhavar at the time of restoration, in an amount not to exceed fifteen percent (15%) of the outstanding balance.

Assignment

Shadhavar reserves the right to assign or transfer all or part of this agreement, including in connection with a restructuring, sale of assets, merger, or change of control, without requiring Client's consent. Client may not assign or transfer any rights or obligations under these Terms without Shadhavar's prior written consent.

Force Majeure

Neither party shall be liable for any failure or delay in performing its obligations where such failure or delay results from a Force Majeure Event. "Force Majeure Event" means any event beyond the reasonable control of the affected party, including but not limited to: acts of God, natural disasters, epidemics, pandemics, war, terrorism, civil unrest, government actions or orders, labor disputes, power or telecommunications failures, cyberattacks, or failure of third-party vendors or internet service providers.

Governing Law

These Terms and any dispute arising out of or related to these Terms shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles.

Dispute Resolution; Arbitration

Any dispute, claim, or controversy arising out of or relating to these Terms, or the breach, termination, enforcement, interpretation, or validity thereof, including the determination of the scope or applicability of this agreement to arbitrate, shall be determined by binding arbitration administered by the American Arbitration Association ("AAA") in accordance with its Commercial Arbitration Rules.

The arbitration shall be conducted by a single arbitrator. The place of arbitration shall be Wilmington, Delaware. The language of the arbitration shall be English.

Judgment on the award rendered by the arbitrator may be entered in any court having jurisdiction thereof. The arbitrator shall have the authority to grant any remedy or relief that a court of competent jurisdiction could order or grant.

Account Opening & Financial Conditions

Prior to the first order, Client may be required to complete an account application with Shadhavar. Shadhavar may request administrative and financial documentation to verify Client's legal status and creditworthiness.

Shadhavar reserves the right to grant, modify, or revoke any payment terms, credit lines, or special conditions at any time and without prior notice. Absent a specific written agreement, all orders are payable in advance of delivery or activation.

Delivery of Products

Any delivery timelines communicated or agreed upon by Shadhavar are provided as estimates only and are based on projected average timelines.

No delivery delay shall give rise to penalties, damages, or termination of the agreement at Shadhavar's expense.

Upon delivery, all products are placed under the legal custody of Client, who assumes all risk of loss, theft, or damage.

Inspection & Acceptance of Deliveries

In the event of damage, shortage, or apparent non-conformity, Client must note all necessary reservations on the delivery receipt and confirm them in writing to Shadhavar within three (3) business days.

Absent timely and documented objection, products shall be deemed conforming and definitively accepted.

Hardware Sales & Warranties

Products are sold in accordance with manufacturer specifications. The applicable warranty is exclusively that of the manufacturer or Vendor. Shadhavar provides no warranty of its own beyond those required by applicable law.

No returns shall be accepted for products that have been customized, configured, or activated at Client's request.

Product-Related Services

Upon Client's express request and Shadhavar's written acceptance, Shadhavar may provide or arrange for configuration, commissioning, or training services related to products sold. Such services are strictly limited to products supplied by Shadhavar and are billed at the rates in effect at the date of order.

Payment Terms

Unless otherwise agreed in writing, all invoices are payable upon receipt, in immediately available funds, by wire transfer or ACH payment to the account designated by Shadhavar. Credit card payments via Stripe or other authorized payment processors may be accepted subject to Shadhavar's approval and applicable processing fees.

Any dispute regarding an invoice must be notified in writing within five (5) business days of receipt. Failure to dispute an invoice within this period constitutes irrevocable acceptance of the invoiced amount.

Chargeback & Payment Dispute Protection

25A.1 — Dispute Resolution Before Chargeback

Client agrees to contact Shadhavar directly in writing prior to initiating any payment dispute, chargeback, or reversal through any payment processor, credit card issuer, bank, or financial institution (collectively, a "Payment Dispute"). Client shall provide Shadhavar with a minimum of ten (10) business days to investigate and resolve any billing concern before initiating any Payment Dispute.

25A.2 — Chargeback as Material Breach

Client acknowledges and agrees that any Payment Dispute initiated without prior written notice to Shadhavar as required by Section 25A.1, or any Payment Dispute initiated in bad faith, or any Payment Dispute relating to services that have been delivered, activated, or consumed, shall constitute a material breach of this Agreement.

25A.3 — Remedies Upon Unauthorized Chargeback

Upon the occurrence of any unauthorized or bad-faith Payment Dispute, Shadhavar shall be entitled, in addition to all other remedies available at law or in equity, to:

(a) Immediately suspend all services and implement service lock measures pursuant to Section 15A;

(b) Recover the full disputed amount, plus a chargeback administration fee of $250.00 per occurrence (or the actual costs incurred by Shadhavar in connection with the Payment Dispute, whichever is greater);

(c) Recover all costs associated with the Payment Dispute, including but not limited to payment processor fees, bank fees, investigation costs, and reasonable attorneys' fees;

(d) Engage third-party collection agencies or initiate legal proceedings for recovery of all amounts due, plus all associated costs and fees;

(e) Report the Payment Dispute to credit reporting agencies and payment processor fraud prevention systems, to the extent permitted by applicable law;

(f) Terminate this Agreement and all related SOWs immediately, without further cure period, and accelerate all outstanding amounts.

25A.4 — Stripe-Specific Provisions

Where payment is processed through Stripe or any other third-party payment processor: (a) Client acknowledges that Shadhavar bears the financial risk of chargebacks and that unauthorized disputes directly impact Shadhavar's payment processing capability; (b) Client consents to Shadhavar providing transaction records, service delivery evidence, and communication logs to the payment processor in response to any Payment Dispute; (c) Client acknowledges that repeated chargebacks may result in permanent termination of Client's ability to pay by credit card, requiring payment by wire transfer or ACH only.

25A.5 — Good Faith Dispute Safe Harbor

Nothing in this Section 25A shall prevent Client from exercising legitimate dispute rights in good faith where: (a) Client has first notified Shadhavar in writing and allowed the ten (10) business day resolution period to expire without resolution; (b) the dispute relates to services that were not delivered or activated; or (c) the charge was unauthorized (i.e., not initiated or approved by Client). In such cases, Shadhavar shall cooperate in good faith with the dispute resolution process.

Late Payment & Penalties

Any late or defaulted payment shall result, automatically and without further notice, in:

(a) Immediate acceleration of all amounts due, including amounts not yet matured;

(b) Late payment interest at the rate of one and one-half percent (1.5%) per month (or the maximum rate permitted by applicable law, whichever is lower);

(c) A flat administrative collection fee of $150.00;

(d) Immediate suspension of all pending deliveries and services.

Acceleration & Revocation of Payment Terms

In the event of any payment default, Shadhavar reserves the right to revoke any payment terms or credit facilities and to demand immediate payment of all outstanding amounts.

No Set-Off

Client shall not set off, deduct, or withhold any amounts owed to Shadhavar against any claimed or actual amounts owed by Shadhavar to Client, without Shadhavar's prior written consent.

Client Insurance

Client shall maintain, at its own expense, such insurance coverage as is commercially reasonable and appropriate to cover risks associated with its use of the products and services provided hereunder.

Subcontracting

Shadhavar reserves the right to subcontract all or part of the performance of any engagement without affecting its contractual obligations to Client.

Notices

All notices, demands, or other communications required or permitted hereunder shall be in writing and shall be deemed effective upon: (a) personal delivery; (b) the second business day after deposit with a nationally recognized overnight courier; (c) the date sent by email with confirmed receipt; or (d) five (5) business days after deposit in the United States mail, certified, return receipt requested.

Miscellaneous

32.1 — Severability

If any provision of these Terms is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

32.2 — Waiver

No failure or delay by Shadhavar in exercising any right hereunder shall constitute a waiver of such right.

32.3 — Language

These Terms are drafted in the English language, which shall be the sole binding version.

32.4 — Headings

Section and subsection headings are for convenience of reference only and shall not affect the interpretation of these Terms.

32.5 — Counterparts & Electronic Execution

These Terms and any SOW or Schedule may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one instrument. Electronic signatures shall have the same legal effect as original signatures, pursuant to the E-SIGN Act and UETA.

32.6 — Relationship of the Parties

The relationship between Shadhavar and Client is that of independent contractors. Nothing in these Terms shall be construed to create any agency, partnership, joint venture, or employer-employee relationship.

32.7 — Third-Party Beneficiaries

These Terms are for the sole benefit of the parties and their respective permitted successors and assigns. Nothing herein shall confer any rights upon any third party.

ZOHO SOLUTIONS

A.1 — Purpose & Scope

This Schedule sets forth the terms applicable to any provision, integration, configuration, support, subscription, licensing, or service related to software solutions published by Zoho Corp. or its affiliates ("Zoho Solutions"). This Schedule is an autonomous contractual document, integrated into the Master Terms. In the event of a conflict, this Schedule prevails over the Master Terms.

A.2 — Tripartite Contractual Architecture

The contractual relationship regarding Zoho Solutions is based on three independent relationships: (a) Client ↔ Zoho: license and use agreement (Zoho ToS, policies, and SLAs); (b) Client ↔ Shadhavar: services, integration, advisory, and Tier 1 support agreement; (c) Zoho ↔ Shadhavar: non-exclusive partnership and reseller agreement.

No provision of this Schedule shall be construed as creating any agency, representation, joint liability, or joint guarantee between Shadhavar and Zoho.

A.3 — Mandatory Acceptance of Zoho Terms

Access to Zoho Solutions is contingent upon Client's prior, express, and unreserved acceptance of Zoho's Terms of Service, privacy policies, security policies, and SLAs, as defined and updated by Zoho. Client acknowledges that these documents are independent of Shadhavar's Terms, may be unilaterally modified by Zoho, and are binding upon Client without Shadhavar having any ability to oppose or amend them.

A.4 — Shadhavar's Status; No Publisher Liability

Shadhavar acts exclusively as an authorized integration partner, non-exclusive reseller, and independent service provider. Shadhavar is not the publisher, host, or operator of Zoho Solutions and does not guarantee the availability, continuity, or performance of Zoho Solutions. Shadhavar provides no SLA commitments with respect to Zoho Solutions. All liability related to the intrinsic operation of Zoho Solutions rests exclusively with Zoho.

A.5 — License Activation & Irrevocability

A.6 — Pricing, Payment & Financial Risk

When Shadhavar procures or activates Zoho licenses on behalf of Client, full prepayment is an essential and material condition. In the event of late, missed, or failed payment: (a) Zoho may suspend, restrict, or deactivate all or part of the Zoho Solutions; (b) Shadhavar shall not be liable for any technical, operational, or financial consequences of such suspension; and (c) Client remains liable for all amounts due to Shadhavar. Client assumes all financial risk associated with Zoho's billing and suspension policies.

A.7 — Support Levels

Shadhavar provides exclusively Tier 1 (N1) support: functional assistance, usage guidance, and support for configurations performed by Shadhavar. Tier 2/Tier 3 publisher support (bug fixes, platform availability, maintenance, updates, and enhancements) is the sole responsibility of Zoho under its own SLAs. No penalty, indemnity, or performance guarantee may be claimed against Shadhavar in respect of Zoho's SLAs.

A.8 — Data, Compliance & Information Protection

Client remains solely responsible for all data processed through Zoho Solutions, including its legality, accuracy, and regulatory compliance. Shadhavar acts as a service provider or processor, pursuant to applicable US privacy laws, only upon Client's documented instructions. Shadhavar shall not be liable for: (a) processing performed directly by Client; (b) technical or security decisions made by Zoho; or (c) data loss or corruption attributable to Zoho or Client misuse.

A.9 — Audits & Cooperation

Client acknowledges that Zoho may conduct audits or verifications for contractual, technical, or regulatory reasons. Shadhavar may cooperate with Zoho in this context, without assuming any obligation of result, additional guarantee, or increased liability.

A.10 — Account Transfer, Unmapping & Direct Billing

Zoho may, at Client's request or pursuant to its internal policies, terminate Client's association with Shadhavar ("unmapping") and transfer account management to another authorized partner or direct Zoho billing. Such a decision is independent of Shadhavar's will, does not affect Client's financial obligations to Shadhavar, and does not result in automatic termination of services rendered or extinction of amounts due.

A.11 — Service Changes, Suspensions & Discontinuation

Client acknowledges that Zoho may modify its offerings, evolve its features, or suspend or discontinue all or part of the Zoho Solutions. Such decisions shall not engage Shadhavar's liability or give rise to any claim for indemnification, refund, or termination at Shadhavar's expense.

A.12 — Enhanced Limitation of Liability

Shadhavar shall not be liable for: (a) failures, unavailability, or interruptions of Zoho Solutions; (b) unilateral decisions by Zoho; or (c) data loss attributable to Zoho or Client. In all events, Shadhavar's liability remains subject to the limitations set forth in the Master Terms.

A.13 — Acceptance & Enforceability

This Schedule is deemed accepted by: (a) manual or electronic signature; (b) electronic validation; (c) acceptance of a proposal, purchase order, or invoice referencing this Schedule; or (d) any activation or use of Zoho Solutions.

PROFESSIONAL SERVICES (ZOHO)

B.1 — Purpose, Scope & Hierarchy

This Schedule sets forth the terms applicable to professional services provided by Shadhavar in connection with Zoho Solutions, particularly in enterprise, multi-user, multi-entity, or mission-critical contexts. It supplements the Master Terms and Schedule A. In the event of a conflict, this Schedule B prevails over the Master Terms.

B.2 — Types of Services

Services may include, without limitation: opportunity and functional scoping studies; business workshops and process modeling; Zoho functional architecture; advanced integration, configuration, and automation; custom development and extensions; data migration; deployment assistance and change management; and post-go-live support. Each engagement is strictly limited to the scope defined in the applicable proposal or SOW.

B.3 — Project Governance & Responsibilities

Client shall designate a project sponsor with decision-making authority. Any approval, arbitrage, or instruction given by such sponsor shall irrevocably bind Client. Shadhavar assumes no responsibility for Client's business governance, internal organization, or strategic management.

B.4 — Nature of Commitment (Enhanced Best Efforts)

Services are provided on an enhanced best-efforts basis, consistent with professional standards of cloud integrators. Shadhavar does not guarantee: (a) any specific business outcome; (b) any operational or financial performance; or (c) any specific regulatory compliance particular to Client's industry. Client acknowledges that Zoho Solutions are standard solutions and not custom-developed software.

B.5 — Dependency on Client Decisions & Data

Services depend upon information, data, and approvals provided by Client, and upon Client's organizational, functional, and technical decisions. Shadhavar shall not be liable for: (a) inaccurate or incomplete information; (b) decisions taken by Client contrary to advice or warnings given; or (c) organizational or human resource impacts of the project.

B.6 — Scheduling, Timelines & External Dependencies

Timelines are estimates only and are contingent upon Client team availability, validation of intermediate deliverables, and absence of Zoho or third-party blocking issues. Any delay attributable to Client, Zoho, or a third party shall automatically suspend Shadhavar's timeline obligations, without penalty.

B.7 — Delivery, Testing & Deemed Acceptance

Deliverables shall be deemed accepted: (a) absent written, reasoned, and detailed objection within five (5) business days; or (b) upon production deployment or actual use. Requests for enhancement, optimization, or evolution do not constitute non-conformities.

B.8 — Change Management

Any change to scope, functional evolution, or unanticipated addition requires prior written agreement, a supplemental proposal, and, where applicable, a timeline adjustment. No free updates or implied evolutions are owed.

B.9 — Data Migration (Large Volumes)

Where the engagement includes data migration: (a) Client remains responsible for the quality, structure, and compliance of source data; (b) Shadhavar assumes no obligation of result regarding the completeness of migrated data; and (c) final validation is Client's sole responsibility. Any data migration is deemed accepted after validation or operational use.

B.10 — Access, Security & Continuity

Client guarantees access to necessary environments, availability of key users, and compliance with internal security policies. Shadhavar shall not be liable for any incident resulting from late, incomplete, or restricted access.

B.11 — Intellectual Property & Usage Rights

B.11.1 — Default: License Model (Standard)

Unless the applicable SOW or proposal expressly specifies the "IP Assignment" tier described in Section B.11.2 below, all deliverables, configurations, scripts, automations, architectures, documentation, and work product created by Shadhavar in the course of the engagement (collectively, "Work Product") shall remain the exclusive intellectual property of Shadhavar.

Under the standard license model, Client receives upon full payment: (a) a perpetual, non-exclusive, non-transferable, non-sublicensable license to use, execute, and operate the Work Product solely for Client's internal business purposes; (b) no right to modify, reverse-engineer, decompile, or create derivative works from the Work Product, except to the extent expressly permitted by applicable law; and (c) no right to transfer, assign, sublicense, or make available the Work Product to any third party, including affiliates, successors, or acquirers, without Shadhavar's prior written consent.

Shadhavar retains the unrestricted right to reuse all methodologies, techniques, know-how, frameworks, code libraries, templates, and general approaches embodied in the Work Product for other clients and engagements, provided that Client's confidential information and proprietary data are not disclosed.

B.11.2 — Optional: IP Assignment Model (Premium)

Where the applicable SOW or proposal expressly designates the engagement as an "IP Assignment" engagement (which shall be subject to a premium fee structure as specified therein), the following terms apply in lieu of Section B.11.1:

(a) Assignment: Upon full and final payment of all amounts due under the applicable SOW (including any change orders), Shadhavar hereby assigns to Client all right, title, and interest in and to the Work Product, including all copyrights, patent rights (to the extent applicable), trade secret rights, and other intellectual property rights therein;

(b) Retained Rights: Notwithstanding the foregoing assignment, Shadhavar expressly retains: (i) all pre-existing intellectual property, tools, libraries, frameworks, and methodologies owned by or licensed to Shadhavar prior to the engagement ("Pre-Existing IP"), which are licensed to Client on a non-exclusive, perpetual basis solely to the extent necessary to use the Work Product; (ii) all general knowledge, skills, experience, techniques, and know-how acquired or developed during the engagement; and (iii) all rights in any third-party components, open-source software, or Vendor-provided elements incorporated into the Work Product, which remain subject to their respective license terms;

(c) Cooperation: Shadhavar shall, upon Client's reasonable request and at Client's expense, execute such documents and take such actions as may be reasonably necessary to perfect and protect Client's rights in the assigned Work Product;

(d) Condition Precedent: The IP assignment described herein is expressly conditioned upon full payment. No assignment is effective until all amounts are paid in full. In the event of payment default, all rights revert to Shadhavar automatically and without further action.

B.11.3 — Third-Party & Open-Source Components

Client acknowledges that Work Product may incorporate or depend upon third-party components, Vendor APIs, open-source libraries, or Zoho platform elements. Shadhavar makes no representation regarding Client's ability to use such components independently of the applicable Vendor's platform or license terms. The IP rights described in this Section B.11 apply solely to the original work created by Shadhavar and do not extend to any third-party or Vendor-owned components.

B.12 — Independence from Zoho Evolutions

Client acknowledges that Zoho may modify, evolve, or remove features. Shadhavar guarantees neither the permanence of configurations performed nor their ongoing compatibility with Zoho changes. Any required adaptation constitutes a new engagement.

B.13 — Specific Limitation of Liability

Shadhavar shall not be liable for indirect losses, organizational impacts, revenue or profit losses, or decisions made based on deliverables. Shadhavar's liability is strictly limited per the Master Terms.

B.14 — End of Engagement; No Automatic Reversibility

Upon completion of the engagement: (a) no obligation for ongoing maintenance, support, or reversibility is included; and (b) any subsequent work requires a new agreement or proposal.

TRAINING SERVICES

C.1 — Purpose & Hierarchy

This Schedule sets forth the terms applicable to professional training services delivered by Shadhavar in connection with Zoho Solutions, for end users, functional or technical administrators, and designated internal contacts. It supplements the Master Terms, Schedule A, and Schedule B.

C.2 — Nature & Scope of Training

Training is exclusively pedagogical and operational in purpose, aimed at presenting Zoho Solutions features, conveying best practices, and supporting functional understanding. Training does not constitute official Zoho certification, does not confer certified administrator status, and does not guarantee any level of competence or autonomy.

C.3 — Enhanced Best Efforts

Training is provided on an enhanced best-efforts basis. Shadhavar does not guarantee the attainment of any specific proficiency level, the absence of post-training errors, or the conformity of future usage with Client's business expectations. Results depend on participants' attendance, initial skill level, and active engagement.

C.4 — Formats & Logistics

Training may be delivered in-person, remotely, or in a hybrid format. Practical details (duration, format, language, number of participants) are specified in the applicable proposal or order.

C.5 — Prerequisites & Client Obligations

Client shall: (a) designate participants meeting the necessary prerequisites; (b) ensure their effective availability; (c) provide functional and accessible Zoho environments; and (d) ensure the stability of access credentials and accounts. Any failure may affect training quality without engaging Shadhavar's liability.

C.6 — Training Materials

Where expressly provided in the proposal, Shadhavar may make training materials available (documents, presentations, guides, digital media, or recordings). Such materials are provided: (a) for educational purposes only; (b) as-is, as of the training date; and (c) without commitment to update. Training materials do not constitute official Zoho documentation or an opposable technical reference.

C.7 — No Update Obligation

Shadhavar has no obligation to update training materials, adapt them to Zoho evolutions, or provide supplemental documentation. Any updated materials constitute a separate deliverable, subject to written agreement and separate billing.

C.8 — Intellectual Property

All training materials remain the exclusive intellectual property of Shadhavar. Client receives a non-exclusive, non-transferable license for internal use, limited to trained participants. Any reproduction, distribution, integration into internal procedures, third-party training, or commercial use is prohibited without prior written authorization.

C.9 — Evaluation; No Certification

Any evaluation (questionnaire, feedback, test) serves internal and pedagogical purposes only and does not constitute an official validation, certification, or competence guarantee.

C.10 — Cancellation, Rescheduling & No-Show

Any commenced training is fully due. In the event of late cancellation, rescheduling, or participant no-show, Shadhavar reserves the right to invoice all or part of the service at the agreed rates.

C.11 — Specific Limitation of Liability

Shadhavar shall not be liable for post-training usage errors, operational decisions made by Client, business/financial/organizational impacts, or subsequent Zoho evolutions.

C.12 — No Post-Training Support

Training is a standalone, one-time engagement. No ongoing assistance, support, maintenance, or post-training help is included unless expressly stipulated in a separate agreement. Post-training support requires a dedicated subscription.

C.13 — Confidentiality

Training may involve access to Client's internal information. Each party undertakes to maintain the confidentiality of such information. Shadhavar retains no Client data beyond what is strictly necessary for training delivery.

SUPPORT, ADMINISTRATION & MANAGED SERVICES

D.1 — Purpose & Hierarchy

This Schedule sets forth the terms applicable to support, application administration, and managed services provided by Shadhavar for Zoho Solutions. It supplements the Master Terms and Schedules A through C.

D.2 — Separate Subscription; No Implied Obligations

Support, administration, and managed services are not included, offered, or implied. They require a distinct, paid subscription, accepted by Client through an appropriate contractual instrument (proposal, purchase order, SOW, or equivalent). No provision of the Master Terms, other Schedules, or course of dealing shall be construed as creating any obligation for ongoing support, application administration, managed services, or permanent assistance. Any work performed absent an express subscription constitutes a one-time, separately billable engagement.

D.3 — Services Covered

When subscribed, services may include, without limitation: Tier 1 functional support; Zoho usage assistance; user, role, and profile administration; ongoing functional configuration and application adjustments; functional reconfigurations; coordination with Zoho publisher support; and non-technical application supervision.

D.4 — Express Exclusions

Expressly excluded unless otherwise agreed in writing: Zoho publisher support (Tier 2/3); any availability, continuity, or performance guarantee; any obligation of result; custom development or major projects; heavy evolutionary maintenance; reversibility or outbound migration services; and any intervention necessitated by unauthorized third-party actions.

D.5 — No SLA; No Continuity Guarantee

Support and managed services are provided without any SLA commitment. Any response times communicated are purely indicative and non-binding. Shadhavar does not guarantee Zoho Solutions availability, the absence of incidents, or service restoration in case of Zoho-attributable interruptions.

D.6 through D.14

Sections D.6 through D.14 address: Shadhavar's role as independent application service provider; Client obligations (designated contacts, accurate information, valid access, compliance with Zoho usage recommendations); Zoho evolutions and adaptation as separate engagements; managed services scope (functional administration without governance/strategic responsibility); no transfer of responsibility; billing (per subscription terms, no proration); termination (automatic cessation, no post-term support); limitation of liability (per Master Terms); and acceptance.

VIRTUAL CIO / IT DIRECTION AS A SERVICE

E.1 — Purpose & Hierarchy

This Schedule sets forth the terms applicable to the "Virtual CIO" or "IT Direction as a Service" ("vCIO Services") offering, under which Shadhavar serves as the outsourced IT Direction function for Client, within a structured and limited contractual framework. This Schedule is autonomous and independent of application-specific or software-specific services. In the event of a conflict, this Schedule E prevails over the Master Terms.

E.2 — Nature of the vCIO Mission

Under vCIO Services, Shadhavar performs: (a) outsourced IT direction; (b) strategic and operational IT planning; (c) IT governance and coordination of internal and external stakeholders; and (d) oversight of continuity, security, and IT architecture. This mission is performed on an enhanced best-efforts basis and not as a guarantee of results, given the complexity of IT environments and dependency on third-party vendors, suppliers, and operators. The exact scope is defined in the applicable SOW.

E.3 — Covered IT Systems

The scope of IT systems covered is strictly limited to what is contractually defined in the proposal, order, or SOW. Covered systems may include: business applications; internal or outsourced infrastructure; cloud services; and third-party IT vendors. Any element not expressly included remains outside scope and under Client's sole responsibility.

E.4 — IT Governance & Decision-Making

Shadhavar manages operational IT governance for the covered scope, including: defining and implementing IT strategy; prioritizing projects and actions; and coordinating technical stakeholders. Final strategic decisions — particularly those involving significant financial commitments, major legal or organizational choices, or structurally impactful changes — remain Client's responsibility. Client retains ultimate authority for approval and override.

E.5 — Business Continuity & Risk Management

Shadhavar implements reasonable measures to manage IT continuity, including: coordination of continuity and recovery plans; major incident management and supervision; and IT risk identification and monitoring. Shadhavar does not guarantee the absence of incidents, interruptions, or failures, particularly when caused by external events, third-party providers, vendors, or Client-approved decisions.

E.6 — Information Security

Shadhavar coordinates and oversees IT security measures for the covered scope, including: defining security policies and procedures; monitoring applicable standards and best practices; and coordinating corrective actions. Shadhavar's mission shall not be construed as an absolute security guarantee, insurance coverage, or assumption of criminal or regulatory liability for cyber risks.

E.7 — Regulatory Compliance Assistance

Shadhavar assists Client in identifying applicable IT regulatory requirements and implementing IT compliance best practices. Client remains solely responsible for: actual compliance with all legal and regulatory obligations; and all filings, audits, certifications, and decisions based on Shadhavar's recommendations.

E.8 — Staff Augmentation & Resource Provision

Under vCIO Services, Shadhavar may provide specialized human resources on an as-needed basis, including: technicians; systems or network engineers; application or security specialists; and IT project managers. Such resources: (a) remain under Shadhavar's exclusive hierarchical and disciplinary authority; (b) operate under Client's functional coordination for mission purposes; and (c) shall not be deemed Client employees or create any employment relationship. Client shall not direct the manner and means by which such resources perform their work. Resource provision is billed per day consumed at contractually defined rates.

E.9 — No Unlawful Staff Leasing

Resource provision is conducted in full compliance with applicable labor laws and does not constitute unlawful staff leasing, temporary employment, or labor brokerage. Shadhavar retains: administrative and payroll management; and responsibility for qualification and replacement of resources as needed.

E.10 — Vendor & Publisher Relations

Shadhavar may coordinate with Client's IT vendors, publishers, and suppliers, without any general power of attorney, legal representation authority, or substitution for Client in its contractual commitments. All contractual engagements require Client's express validation.

E.11 — No Agency or Delegation of Authority

The vCIO mission does not constitute: (a) a general or special power of attorney; (b) a legal delegation of authority; or (c) an assumption of Client's executive management. Shadhavar acts within a contractual IT direction mission, under Client's decisional control and authority.

E.12 through E.16

Sections E.12 through E.16 address: Client obligations (information, access, designated contacts, timely approvals); specific limitation of liability (limited to contractual scope, direct proven damages, capped per Master Terms); duration, exit, and transition (reasonable transition period, no exhaustive reversibility); billing (retainer and/or per-diem model); and acceptance.

LIMITED POWERS OF ATTORNEY & DELEGATION OF AUTHORITY

F.1 — Purpose & Contractual Framework

This Schedule sets forth the conditions under which Client may grant Shadhavar limited powers of attorney and/or delegation of operational authority in connection with vCIO Services (Schedule E). No power of attorney, representation, or delegation exists without express written activation of this Schedule, duly executed by both parties. This Schedule supersedes and replaces all prior versions.

F.2 — Default: No Implied Authority

By default, Shadhavar holds no power of attorney, representation, or delegation on behalf of Client. Any authority granted to Shadhavar is: strictly limited; expressly defined; non-exclusive; revocable; and exercised under the control of Client's authorized officer. This Schedule does not constitute a general power of attorney, global management delegation, or assimilation of Shadhavar to a corporate officer.

F.3 — Framework 1: Limited IT Representation (Recommended)

Under this framework, Client grants Shadhavar a limited and special power of attorney exclusively for: representing Client with IT vendors and suppliers; participating in meetings, negotiations, and operational exchanges; executing purchase orders or IT commitments within a contractually defined financial cap; and validating routine technical services within the covered IT scope. This authority excludes general contract signing, structurally significant legal commitments, and strategic decisions not expressly authorized.

F.4 — Framework 2: Partial IT Delegation of Authority

Under this framework, Client grants Shadhavar a delegation of operational IT authority, limited to the defined scope, including: routine operational IT decisions; technical arbitrage between solutions or vendors; and coordination of IT teams and vendors. This delegation is limited to the defined IT scope, excludes criminal/labor/tax liability, remains under the authorized officer's authority, and is revocable at any time.

F.5 — Framework 3: IT Direction with Powers Equivalent to Internal CIO (Exceptional)

This framework is exceptional and applies only when Client expressly requests that Shadhavar exercise powers equivalent to those of an internal Chief Information Officer. Activation requires: precise definition of conferred powers; explicit and elevated financial caps; procurement by Shadhavar of appropriate liability insurance; and express exclusion of any corporate officer status. Even under this framework, Shadhavar is not a corporate officer, does not exercise general management, and acts within an exceptional and limited contractual framework.

F.6 through F.9

Sections F.6 through F.9 address: hierarchy, control, and reporting (Client retains supervision and revocation power); revocability and duration (revocable at any time without indemnity, terminates automatically with Schedule E); liability limitations; and acceptance (signature or express SOW reference required).

DEFINITIONS & GLOSSARY

G.1 — Purpose

This Schedule defines the technical, legal, and operational terms used throughout the Master Terms and all Schedules.

G.2 — General Definitions

"Client" means any business entity or individual acting in a professional capacity that contracts with Shadhavar.

"Company" or "Shadhavar" means Shadhavar LLC, a Delaware limited liability company.

"Master Terms" means the Master Terms & Conditions document, as amended from time to time.

"Schedule" means a contractual document supplementing the Master Terms, having the same binding force.

"SOW" (Statement of Work) means a contractual document describing the precise scope, duration, execution modalities, and financial terms of a specific engagement. A SOW is not a standalone contract but an activation and implementation document under the Master Terms.

"Purchase Order" means a document by which Client confirms its intent to subscribe to a contractually defined service.

G.3 — Service-Related Definitions

"Support" means limited functional or technical assistance, provided on-demand, always separately subscribed and paid, without any guarantee of continuity, performance, or service level.

"Managed Services" means the administration, management, and supervision of systems or applications within a defined scope, without global transfer of responsibility or obligation of result.

"vCIO Services" / "Virtual CIO" / "IT Direction as a Service" means outsourced IT direction by which Shadhavar performs strategic planning, IT governance, coordination, and supervision of Client's information systems, on an enhanced best-efforts basis. This does not constitute executive management or a global delegation of authority, except as expressly agreed.

"IT Concierge & Technology Advisory" means personalized assistance in researching, identifying, analyzing, recommending, connecting, or coordinating access to IT products, services, solutions, or vendors, without any purchase, supply, representation, or contracting commitment on behalf of Client, except pursuant to a specific written mandate.

G.4 — Liability-Related Definitions

"Best Efforts" / "Commercially Reasonable Efforts" means the obligation to deploy professional, reasonable means consistent with industry standards, without guaranteeing the achievement of a specific result.

"Obligation of Result" means a commitment to achieve a specified outcome. No obligation of result is assumed by Shadhavar except by express written agreement.

"Power of Attorney" means a contractually conferred authority to represent Client for the accomplishment of strictly defined and limited acts.

"Delegation of Authority" means a limited and supervised contractual transfer of certain operational powers from Client to Shadhavar, without global transfer of responsibility or assimilation to a corporate officer.

G.5 — Supplemental Definitions

"Force Majeure Event" has the meaning set forth in Section 17 of the Master Terms.

"Vendor" or "Publisher" means any entity publishing or providing software, platforms, or solutions used by Client, independent of Shadhavar.

"Third-Party Provider" means any person or entity, other than Shadhavar, providing services or products to Client within its IT ecosystem.

"Work Product" has the meaning set forth in Section B.11 of Schedule B.

"Pre-Existing IP" has the meaning set forth in Section B.11.2(b) of Schedule B.

"Payment Dispute" has the meaning set forth in Section 25A.1 of the Master Terms.

"Data Breach" has the meaning set forth in Section J.2 of Schedule J.

"Personal Data" has the meaning set forth in Section J.2 of Schedule J.

IT CONCIERGE & TECHNOLOGY ADVISORY SERVICES

H.1 — Purpose & Framework

This Schedule sets forth the terms applicable to IT Concierge & Technology Advisory services. It supplements the Master Terms and integrates with Schedule F (Powers of Attorney) and Schedule G (Definitions).

H.2 — Service Description

IT Concierge services constitute personalized, on-demand assistance aimed at facilitating Client's access to IT products, services, solutions, or vendors. Services may include: research, identification, and qualification of solutions or vendors; technology watch and comparative analysis; connecting Client with potential vendors; coordinating exchanges between Client and third parties; and assisting with requirements structuring and needs expression.

H.3 — Legal Nature

IT Concierge services constitute a best-efforts obligation. Unless expressly stipulated otherwise in a separate signed document, the service does not entail: any purchase, supply, or delivery obligation; contractual negotiation on Client's behalf; contract execution in Client's name; legal, commercial, or financial representation; or any guarantee of a specific product, service, vendor, price, or timeline.

H.4 — No Implied Agency

The service creates no implied agency or power of attorney. Any mission involving purchases, expense commitments, contract signing, or third-party representation on Client's behalf requires a specific written mandate pursuant to Schedule F.

H.5 through H.9

Sections H.5 through H.9 address: respective responsibilities (Client retains all final decision authority); financial terms (fee independent of purchase amounts, no commissions); limitation of liability; independence from other Schedules; and governing law (Delaware).

SERVER MANAGEMENT & INFRASTRUCTURE SERVICES

I.1 — Purpose & Hierarchy

This Schedule sets forth the terms applicable to managed server services provided by Shadhavar when infrastructure is hosted by third-party providers. It supplements the Master Terms and Schedule G.

I.2 — Scope of Services

Managed server services consist of technical administration, monitoring, and preventive/corrective maintenance of Client's server(s) within a strictly defined scope. Services may include: operating system administration; critical service monitoring; corrective incident response; and preventive maintenance.

Expressly excluded: hosting services; application development; and any obligation regarding business continuity or performance. Website availability and performance, including CMS platforms (e.g., Magento), are not contractual commitments and remain outside the managed server scope.

I.3 — Third-Party Hosting; No Hosting Liability

Client acknowledges that the server is hosted by an independent third-party provider. Shadhavar is neither a hosting provider nor a datacenter operator. Hardware, network, and electrical availability are the sole responsibility of the hosting provider. No liability shall be attributed to Shadhavar for datacenter failures, hardware incidents, or network interruptions.

I.4 — Nature of Commitment

Services are performed on an enhanced best-efforts basis. Shadhavar does not guarantee: any specific uptime rate; any absolute recovery time; or the absence of incidents.

I.5 — Service Tiers

I.5.1 — Essential Tier

Scope: Server OS, critical services, basic monitoring. Indicative response times: Critical incidents ≤ 8 business hours; Non-critical incidents: 24–48 business hours. Hours: Monday–Friday, 9:00 AM–6:00 PM (local time). On-call: Not included. After-hours interventions available on request only, with no guaranteed response time, billed at prevailing rates.

I.5.2 — Advanced Tier

Scope: Server infrastructure, critical application services, proactive monitoring. Indicative response times: Critical ≤ 4 business hours; Non-critical ≤ 24 business hours. Hours: Monday–Friday, 9:00 AM–6:00 PM. On-call: Available upon activation per SOW terms; after-hours coverage possible but without permanent availability guarantee; after-hours response times are indicative and non-binding.

I.5.3 — Premium Tier

Enhanced scope: Proactive advanced monitoring, preventive risk analysis, technical reporting. Indicative response times: Critical ≤ 1 business hour; Non-critical ≤ 8 business hours. Hours: Monday–Friday, 9:00 AM–6:00 PM. On-call: Included, enabling after-hours coverage. Excludes Force Majeure Events. Does not constitute a 24/7 commitment or guarantee of result.

I.6 — On-Call: Unified Framework

On-call enables exceptional mobilization of technical resources outside standard hours. It does not constitute: a permanent availability guarantee; a 24/7 SLA; or an obligation of result. After-hours response times are indicative, dependent on incident nature, and contingent upon infrastructure and third-party provider accessibility.

I.7 through I.13

Sections I.7 through I.13 address: Client obligations (valid access, architecture change notifications); backup and security (supervised execution, no absolute restoration guarantee); express exclusions (development, bug fixes, performance guarantees); liability limitations; duration and termination; governing law (Delaware); and acceptance.

DATA PROCESSING ADDENDUM (DPA)

J.1 — Purpose, Scope & Applicability

This Data Processing Addendum ("DPA") forms part of the Master Terms and governs the processing of Personal Data by Shadhavar on behalf of Client in connection with the services provided under these Terms.

This DPA applies to the extent that Shadhavar processes Personal Data that is subject to applicable Data Protection Laws in the course of providing services. In the event of a conflict between this DPA and any other provision of these Terms, this DPA shall prevail with respect to the processing of Personal Data.

This DPA does not apply to data processed by third-party Vendors (including Zoho) under their own terms and privacy policies. Client's relationship with such Vendors is governed by the applicable Vendor's data processing terms.

J.2 — Definitions

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws, including but not limited to the CCPA, GDPR (where applicable), and US state privacy laws.

"Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data, including but not limited to: the California Consumer Privacy Act (CCPA) and its amendments (CPRA); the Virginia Consumer Data Protection Act (VCDPA); the Colorado Privacy Act (CPA); the Connecticut Data Privacy Act (CTDPA); the Utah Consumer Privacy Act (UCPA); the Texas Data Privacy and Security Act (TDPSA); the European General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, to the extent applicable; and any other applicable federal, state, or international data protection or privacy law.

"Controller" means the entity that determines the purposes and means of the processing of Personal Data. For the purposes of this DPA, Client is the Controller.

"Processor" / "Service Provider" means the entity that processes Personal Data on behalf of the Controller. For the purposes of this DPA, Shadhavar is the Processor (or "Service Provider" under the CCPA).

"Sub-processor" means any third party engaged by Shadhavar to process Personal Data on behalf of Client.

"Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

J.3 — Roles & Responsibilities

Client, as Controller, determines the purposes and means of processing Personal Data and is responsible for: (a) ensuring that it has a lawful basis for the collection and processing of Personal Data; (b) providing all required notices to and obtaining all required consents from data subjects; (c) ensuring the accuracy and completeness of Personal Data provided to Shadhavar; and (d) complying with all applicable Data Protection Laws in its use of the services.

Shadhavar, as Processor / Service Provider, shall: (a) process Personal Data solely on behalf of and in accordance with Client's documented instructions, unless required by applicable law (in which case Shadhavar shall inform Client of such legal requirement before processing, unless prohibited by law); (b) not sell, share (as defined under the CCPA/CPRA), or use Personal Data for any purpose other than providing the services; (c) not combine Personal Data with data from other sources except as necessary to provide the services; and (d) comply with applicable Data Protection Laws in its capacity as Processor.

J.4 — Processing Instructions & Scope

The subject matter, duration, nature, and purpose of processing, the types of Personal Data processed, and the categories of data subjects are as described in the applicable SOW or, absent a specific SOW, as reasonably necessary for the performance of the services.

Shadhavar shall not process Personal Data for any purpose other than providing the contracted services, unless: (a) directed to do so in writing by Client; (b) required by applicable law; or (c) necessary to detect data security incidents, protect against fraudulent or illegal activity, or maintain the security of the services.

J.5 — Security Measures

Shadhavar shall implement and maintain appropriate technical and organizational security measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, taking into account: (a) the state of the art; (b) the costs of implementation; (c) the nature, scope, context, and purposes of processing; and (d) the risk to the rights of data subjects.

Such measures shall include, at a minimum and where applicable: (a) encryption of Personal Data in transit and at rest; (b) access controls and authentication mechanisms; (c) regular testing and evaluation of security measures; (d) employee confidentiality obligations and training; (e) incident response procedures; and (f) secure data disposal processes.

J.6 — Sub-processors

Client hereby grants Shadhavar general written authorization to engage Sub-processors for the processing of Personal Data, subject to the following conditions:

(a) Shadhavar shall maintain a current list of Sub-processors, which shall be made available to Client upon written request;

(b) Shadhavar shall notify Client of any intended addition or replacement of Sub-processors at least fifteen (15) days prior to such change;

(c) Client may object to such addition or replacement by providing written notice within ten (10) days of receiving notification. If Client objects on reasonable grounds related to data protection, the parties shall negotiate in good faith to resolve the objection. If no resolution is reached within thirty (30) days, Client may terminate the affected services without penalty;

(d) Shadhavar shall impose on each Sub-processor, by way of a written agreement, data protection obligations no less protective than those set forth in this DPA;

(e) Shadhavar shall remain fully liable to Client for the performance of each Sub-processor's data protection obligations.

J.7 — Data Breach Notification

Shadhavar shall notify Client without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Data Breach affecting Personal Data processed on behalf of Client. Such notification shall include, to the extent available:

(a) A description of the nature of the Data Breach, including the categories and approximate number of data subjects and records concerned;

(b) The name and contact details of Shadhavar's designated point of contact;

(c) A description of the likely consequences of the Data Breach;

(d) A description of the measures taken or proposed to address the Data Breach, including measures to mitigate its potential adverse effects.

Shadhavar shall cooperate with Client in investigating and remediating the Data Breach and shall provide such additional information as Client may reasonably request. Shadhavar shall not notify any third party (including regulatory authorities or data subjects) of a Data Breach without Client's prior written consent, unless required by applicable law.

J.8 — Data Subject Rights

Shadhavar shall assist Client, by appropriate technical and organizational measures and to the extent reasonably practicable, in fulfilling Client's obligations to respond to requests from data subjects exercising their rights under applicable Data Protection Laws (including rights of access, rectification, erasure, data portability, restriction of processing, and objection to processing).

If Shadhavar receives a request directly from a data subject, Shadhavar shall promptly redirect the data subject to Client and shall not respond to such request directly, unless authorized to do so by Client.

J.9 — Data Return & Deletion

Upon termination or expiration of the services (or upon Client's earlier written request), Shadhavar shall, at Client's election: (a) return all Personal Data to Client in a commonly used, machine-readable format; or (b) securely delete or anonymize all Personal Data in Shadhavar's possession or control, unless retention is required by applicable law.

Shadhavar shall certify in writing that it has complied with this Section J.9 within thirty (30) days of Client's request.

For clarity, this Section J.9 applies only to Personal Data under Shadhavar's direct control. Data held by third-party Vendors (including Zoho) is subject to such Vendors' own data retention and deletion policies.

J.10 — Audits & Compliance Verification

Shadhavar shall make available to Client, upon reasonable written request and no more than once per twelve (12) month period (unless a Data Breach has occurred), such information as is reasonably necessary to demonstrate Shadhavar's compliance with this DPA.

Client may, at its own expense and upon thirty (30) days' prior written notice, conduct or commission an independent third-party audit of Shadhavar's processing activities and security measures, subject to: (a) reasonable scope, timing, and confidentiality restrictions; (b) a maximum duration of two (2) business days per audit; and (c) non-disclosure of audit results to third parties except as required by law or regulatory authority.

Shadhavar may satisfy audit requests by providing: (a) a current SOC 2 Type II report (or equivalent certification); (b) a completed security questionnaire; or (c) a summary of its current security measures and compliance posture. If such documentation reasonably addresses Client's audit objectives, Client shall accept it in lieu of an on-site audit.

J.11 — International Data Transfers

To the extent that the processing of Personal Data involves transfers of Personal Data from one jurisdiction to another (including transfers from the European Economic Area, United Kingdom, or Switzerland to the United States, or from the United States to other jurisdictions), each party shall ensure that such transfers comply with applicable Data Protection Laws.

Where required by applicable law, the parties shall enter into appropriate data transfer mechanisms, including but not limited to: (a) Standard Contractual Clauses (SCCs) as adopted by the European Commission; (b) the EU-US Data Privacy Framework, to the extent applicable and certified; or (c) any other legally recognized transfer mechanism.

J.12 — CCPA-Specific Provisions

To the extent that Shadhavar processes Personal Information (as defined under the CCPA) on behalf of Client:

(a) Shadhavar is a "Service Provider" as defined under Cal. Civ. Code § 1798.140(ag);

(b) Shadhavar shall not sell or share (as defined under the CCPA/CPRA) Personal Information;

(c) Shadhavar shall not retain, use, or disclose Personal Information for any purpose other than performing the services specified in these Terms, or as otherwise permitted by the CCPA;

(d) Shadhavar shall not combine Personal Information received from Client with Personal Information received from or on behalf of another person or entity, or collected from Shadhavar's own interactions with data subjects, except as permitted by the CCPA;

(e) Shadhavar hereby certifies that it understands the restrictions set forth in this Section J.12 and shall comply with them.

J.13 — Limitation of Liability

Each party's total aggregate liability under or in connection with this DPA shall be subject to the limitations of liability set forth in the Master Terms (Section 12). This DPA does not create any independent or additional liability beyond the limitations established in the Master Terms.

J.14 — Duration & Survival

This DPA shall remain in effect for as long as Shadhavar processes Personal Data on behalf of Client. The obligations of confidentiality and data protection set forth herein shall survive any termination or expiration of these Terms to the extent Shadhavar retains any Personal Data.

J.15 — Acceptance & Enforceability

This DPA is deemed accepted upon: (a) execution of the Master Terms; (b) acceptance of any SOW referencing this DPA; or (c) any engagement in which Shadhavar processes Personal Data on behalf of Client. This DPA is fully enforceable against and binding upon both parties.