1. PURPOSE OF THE AGREEMENT AND DESCRIPTION OF SERVICES

This Agreement governs the conditions under which the Client contracts access to the "SOFIAS" technology platform (the "Platform" or "SOFIAS"), owned by the Provider, through which the following are granted:

A non-exclusive, non-transferable, and limited platform license to use SOFIAS for the development, management, and orchestration of artificial intelligence agents. This license includes access to the SOFIAS proprietary generalist and orchestrator agent, which acts as the entry point and coordination hub for all workflows on the Platform.

The contracting and deployment of additional agents, whether developed by the Provider or by third parties, integrated in self-contained and isolated containers using virtualization technology. Each additional agent shall be individually licensed under a monthly subscription, in accordance with the plan selected by the Client during the registration process or in their client area.

This Agreement shall apply to the services described in the preceding section, as well as to any other service the Provider may offer in connection with the Platform (collectively, the "Services").

The services included in this Agreement are:

• Access to the SOFIAS platform, including the generalist and orchestrator agent.
• Access to the additional agents selected and included in the contracted plan.
• Periodic updates to the Platform and the contracted agents.
• Technical support for errors or incidents related to the Platform.
• Unlimited user access, subject to the provisions of clause 5.2.
• Unlimited queries/conversations, subject to the provisions of clause 5.2.

The following are expressly excluded from the contracted services:

• Costs associated with non-open-source language models such as OpenAI, Claude, Gemini, or similar, when the Client opts to use them.
• Custom development services, specific configuration, or personalized adaptation of the Platform or the agents. These services may be contracted separately, subject to a budget agreed upon between the parties.
• Any other service not expressly included in this Agreement.

2. TERM AND RENEWAL

This Agreement shall have an initial term of twelve (12) months from the date of activation of the Client's account on the Platform (the "Term").

Unless the parties agree otherwise in writing, the Agreement shall automatically renew for additional periods of one (1) year, unless either party notifies the other in writing of its cancellation at least thirty (30) days prior to the expiration of the current Term.

3. TRIAL PERIOD

Each license activated on the Platform — both the platform license and each additional agent license contracted subsequently — includes a free trial period of fourteen (14) calendar days, counted from the moment of its individual activation.

No charges shall be made for the corresponding license during the trial period. After the fourteen (14) days have elapsed, if the Client has not cancelled the license before the expiration of the trial period, billing for the applicable fee shall be automatically activated and charged to the payment method registered by the administrator during the registration process.

The Provider shall notify the Client by electronic communication at least forty-eight (48) hours before the expiration of each trial period, reminding the Client of the imminent activation of the charge. The Client may cancel the license at any time before the end of the trial period, free of charge, from their client area.

By completing the registration process and registering their payment method, the Client expressly authorizes the Provider to make the corresponding automatic charge once the trial period for each license has ended, in accordance with the fees in effect at the time of contracting.

4. PRICING AND PAYMENT

The Client shall pay the Provider the applicable fees at any given time for the license to use the Platform and the Services, in accordance with the plan selected during the registration process (the "Fees"). The prices published on the Platform include Value Added Tax (VAT) at the rate in force at any given time.

The Fees are structured as follows:

Monthly fee for the platform license, which includes access to the SOFIAS generalist and orchestrator agent. Said fee is determined based on the plan selected by the Client according to the size of their company, in accordance with the plans published on the Platform at the time of registration.

Additional monthly fee for each supplementary agent deployed, in accordance with the fees published on the Platform at the time of its contracting.

The available plans and their prices are published on the Platform and are those in effect at the time of contracting. The Provider reserves the right to update plans and prices for new subscriptions, without affecting the conditions in force for the Client during the current Term.

The payment method is registered once by the administrator during the registration process. Said method shall be associated with the Client's account and shall be automatically used for all charges arising from subsequent license activations and cancellations, without the need to re-enter payment details. The Client may update their payment method at any time from the administration area.

Billing for each active license is carried out monthly in advance, through automatic charge to the registered payment method, within the first five (5) days of the corresponding month. The Client shall receive the corresponding invoice by email.

The Provider may annually revise the applicable Fees in accordance with the year-on-year Consumer Price Index (CPI) published by the National Statistics Institute (INE) or the body that replaces it. Such revision shall be notified at least thirty (30) calendar days before its entry into force. In the event that the CPI is negative, the fees shall remain unchanged.

Optional configuration and adaptation services: independently of this Agreement, the Provider may provide initial configuration services, agent adaptation, or custom development. Such services, when requested by the Client and accepted by the Provider, shall be formalized through a specific budget or agreement between the parties, without forming part of the recurring Services covered by this Agreement.

5. ACCESS CREDENTIALS

Access to the Platform is performed through individual credentials, managed by each user on a personal and non-transferable basis. The Platform supports two authentication methods:

Native authentication: the user creates and manages their credentials (username and password) directly through the mechanisms provided on the Platform.

Federated authentication (SSO): access is performed through integration with the Client's corporate identity systems, such as Microsoft Azure Active Directory or Google Workspace. In this case, credential management lies entirely with the Client's identity system, and the Provider shall have no involvement in such management.

The administrator of the Client's account is responsible for managing the access permissions of users within their organization — registrations, deregistrations, and role modifications — through the Platform's administration area, regardless of the authentication method used.

Each user undertakes to diligently safeguard their credentials and to use them appropriately and confidentially. The Client shall be liable for any improper or unauthorized use arising from a lack of diligence in the custody of credentials, whether under native or federated authentication.

The Client undertakes to immediately notify the Provider of any unauthorized use, loss, theft, or suspected improper access. In such cases, the Provider may temporarily suspend the affected access. The Provider shall not be liable for damages arising from improper or negligent use of credentials by the Client, its users, or the Client's corporate identity systems.

6. CONDITIONS OF USE

The Client undertakes to use the Platform and Services diligently, in accordance with the provisions of this Agreement, the technical documentation provided by the Provider, and applicable legislation.

The optimal performance of AI agents deployed on the Platform is based on reasonable use. In the event that a usage pattern is detected that, on a sustained basis (for example, exceeding 3,000 requests per hour for more than five (5) days), generates unforeseen operating costs, the Provider may, if necessary, route the Client's requests through the low-priority channel and review the applicable particular conditions by mutual agreement in order to ensure the sustainability and quality of the Service.

The Platform shall be used exclusively for the purposes authorized under the contracted license, and any different use not envisaged or not authorized by the Provider is expressly prohibited.

The Client shall be responsible for obtaining and maintaining the equipment and services necessary to access the Platform, including hardware, software, network connections, and operating systems (the "Equipment"), as well as for its security.

The Client shall be solely responsible for its use of the Platform and Services, as well as for the processing and control of the data, files, content, and results generated, and for the use made thereof by its personnel or third parties under its control. The Provider shall in no event be liable for damages that may arise from: (i) the incorrect or unlawful use of the Platform; (ii) the breach of contractual or legal conditions; (iii) errors attributable to the Client, its personnel, or third parties outside the Provider; (iv) stored content or data that infringes the rights of third parties; or (v) actions carried out by agents configured by the Client.

7. USE RESTRICTIONS

The Client may not assign, sublicense, resell, rent, or transfer to third parties the usage rights granted under the Platform license, nor is the Client authorized to commercially exploit the Platform for purposes other than those provided for in this Agreement.

The Client may not reverse engineer, decompile, decrypt, disassemble, or attempt to access the source code of the software, in whole or in part. Nor may the Client modify, adapt, or create derivative versions of the Platform or the integrated agents, except with the express prior authorization of the Provider.

Furthermore, the Client is expressly prohibited from:

• Manipulating or interfering with the operation of the software, accessing restricted areas or functions, or circumventing security or control measures.
• Analyzing, scanning, testing for vulnerabilities, or disabling security systems of the Platform or the Provider's infrastructure.
• Storing unlawful, fraudulent content, or content that infringes the rights of third parties in the Provider's systems or through the software.
• Damaging, compromising, or attempting to gain unauthorized access to the Provider's systems and networks, as well as using hacking, intrusion, or similar tools.

The Platform incorporates control mechanisms that allow the Provider to verify compliance with these conditions. In the event of unauthorized use, the Provider may revoke the license and immediately suspend access to the Platform, without prejudice to any legal actions that may apply.

8. INTELLECTUAL AND INDUSTRIAL PROPERTY

All intellectual and industrial property rights relating to the SOFIAS Platform and the Services, including the base software, its architecture, design, interfaces, source code, orchestration systems and containers, technical documentation, user manuals, graphic material, as well as the associated trade names, trademarks, and logos, belong to and shall at all times remain the exclusive property of the Provider, including any improvement, evolution, or update made thereto.

The contracting of the service does not in any case imply the assignment of intellectual property rights over the Platform or over the agents developed by the Provider. The Client acquires only a non-exclusive, non-sublicensable license limited to the functional and temporal scope described in this Agreement. The Provider expressly reserves all rights not specifically granted to the Client.

In the case of agents developed by third parties and integrated into the Platform, the Client acknowledges that their use is governed by the license conditions established by such developers, without this implying any assignment by the Provider.

The Client undertakes to respect at all times the intellectual and industrial property rights of the Provider and of the third parties whose agents it uses.

9. MAINTENANCE, SUPPORT, AND AVAILABILITY

The Provider shall provide basic technical support for the resolution of errors and incidents related to the Platform and the agents developed by it, included in the license price. Support shall be available through the email address support@sofias.ai.

Maintenance includes both corrective and evolutionary actions, the latter at the Provider's discretion. Updates to the Platform and the contracted agents shall be made periodically and shall be included in the license price. Support shall not cover agents developed by third parties, except with regard to their compatibility and technical integration with the Platform.

The Provider's commitment is to maintain a minimum average monthly availability of 99%, excluding periods of scheduled maintenance and interruptions beyond its control. The following shall not be considered breaches of the service level: periods of unavailability caused by: (i) scheduled maintenance; (ii) force majeure events; or (iii) issues outside the Provider's control, such as network outages, Internet service provider failures, power outages, or external attacks.

Scheduled maintenance shall be carried out, whenever possible, outside regular usage hours. The Provider shall notify the Client at least forty-eight (48) hours in advance when such tasks may affect access to the Platform.

10. AI AGENTS (PROVIDER AND THIRD PARTIES)

The Client acknowledges and accepts that both the AI agents developed by the Provider and those developed by third parties and integrated into the Platform are subject to the terms established in this Agreement. In the case of third-party agents, the Client must also comply with the additional terms and conditions established by such third parties.

The Client is responsible for reviewing, accepting, and complying with the terms of third-party agents before using them through the Platform. The Provider shall not be liable for the Client's compliance with such terms.

The Provider reserves the right to modify, limit, suspend, or discontinue functionalities of AI agents that are affected by legislative or regulatory changes.

The Client understands and accepts that the content generated by the agents, whether proprietary or third-party, is provided "as is," without any express or implied warranty. The use of the generated results is the exclusive responsibility of the Client, who assumes the obligation to evaluate and verify their suitability, accuracy, and relevance.

The Provider shall not be liable for damages arising from the Client's failure to comply with the terms and conditions of third-party agents. The Client undertakes to indemnify and hold the Provider harmless against any claim related to such non-compliance.

11. PROHIBITION ON MODEL TRAINING

The Client undertakes not to use the Platform to train, create, or develop other AI models or machine learning systems, whether using agents developed by the Provider or those of third parties. In particular, the Client may not use the Platform or the content generated by the agents to create, train, test, or improve, directly or indirectly, machine learning algorithms or AI systems, including models, architectures, or weights.

12. LIMITATION OF LIABILITY

The Provider shall in no event be liable to the Client or to third parties for any damage, loss, cost, indemnification, penalty, or harm arising from: (i) the Client's breach of the obligations established in the Agreement; (ii) the Client's breach of legal obligations applicable to it; (iii) errors or lack of diligence attributable exclusively to the Client, its personnel, or third parties outside the Provider; or (iv) the contractual relationships maintained by the Client with its customers, suppliers, or any person or company with whom the Provider has no legal relationship.

Any liability of the Provider to the Client shall be limited exclusively to direct damages suffered by the Client as a consequence of a breach attributable to the Provider. Except in cases of willful misconduct or gross negligence, the Provider's maximum liability shall in no event exceed the sum of the amounts paid by the Client in the twelve (12) months immediately preceding the occurrence of the damage.

13. LICENSE CANCELLATION AND TERMINATION OF THE AGREEMENT

13.1 Voluntary License Cancellation

The Client may cancel any active license — whether the platform license or the license for any additional agent — at any time, autonomously from their client area on the Platform, without the need for prior notice to the Provider.

The cancellation shall take effect at the end of the calendar month in which it is requested. During that period, the Client shall maintain full access to the cancelled license. From the first day of the following month, access and billing for said license shall cease.

The cancellation of the platform license entails the simultaneous cancellation of all active agent licenses linked to the account, as well as the termination of this Agreement, with the same temporal effects described in the preceding paragraph.

13.2 Non-Payment and Service Suspension

In the event that the automatic charge to the registered payment method cannot be processed for any reason, the Provider shall notify the Client of such incident by electronic communication. If seven (7) calendar days have elapsed since the notification and the Client has not regularized the payment or updated their payment method, the Provider may temporarily suspend access to the Platform and all associated Services.

The suspension does not interrupt the current contractual period nor does it exempt the Client from its payment obligation. From the day following the expiration of the payment deadline, late-payment interest shall accrue at the legal rate established in Article 7 of Law 3/2004 of December 29, or the regulation that replaces it.

If thirty (30) calendar days have elapsed since the suspension of service and the non-payment has not been remedied, the Provider may definitively terminate the Agreement, with cancellation of all active licenses and closure of the account. In such case, the Client shall pay all outstanding amounts, without prejudice to any legal actions the Provider may take for the damages caused.

13.3 Termination for Serious Breach

The Provider may terminate this Agreement and immediately suspend access to the Platform in the event of a serious breach by the Client of the obligations established herein — including, in particular, the cases provided for in clauses 6, 7, and 11 — by written notice to the Client and without prejudice to the Provider's right to claim such compensation as may legally correspond. Termination shall entail the automatic cancellation of all active licenses and closure of the account.

14. CONFIDENTIALITY

For the purposes of the Agreement, Confidential Information shall mean all information and documentation that the Provider and the Client provide or exchange under the Agreement that is designated as confidential or that should reasonably be understood as such given the nature of the information and the circumstances of its disclosure. All technical information related to the Services and the Platform shall especially be considered as such.

The party receiving Confidential Information (the "Receiving Party") undertakes to: (i) not disclose or divulge the Confidential Information without the prior authorization of the Disclosing Party; (ii) adopt the same diligence it uses for the custody of its own confidential information; (iii) restrict access solely to those persons who need it for the performance of the Agreement; and (iv) use it exclusively for the purposes of this Agreement.

Information that: (i) is or becomes publicly available without the intervention of the Receiving Party; (ii) has been independently developed by the Receiving Party; (iii) was in the possession of the Receiving Party prior to its disclosure; or (iv) must be disclosed by legal requirement or by court order, shall not be subject to the obligation of confidentiality.

15. PERSONAL DATA PROTECTION

Within the framework of the provision of the Services, the Provider shall process personal data on behalf of the Client, the former acting as Data Processor and the latter as Data Controller, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on the Protection of Personal Data. This Agreement constitutes the binding legal act governing such processing in accordance with Article 28.3 of the GDPR.

The processing of data by the Provider shall consist of the access, processing, transmission, and storage of personal data necessary for the provision of the Services. The data shall be processed for the sole purpose of enabling the operation of the AI agents deployed by the Client through the Platform.

The personal data processed may include identification, contact, and professional data, as well as other data determined by the Client concerning employees, customers, suppliers, or other data subjects. The Client shall inform the Provider of any relevant changes in the categories of data and warrants that it has a sufficient legal basis for their processing through the Platform.

The Provider undertakes to:

• a) Process personal data only in accordance with the Client's documented instructions, including with regard to international transfers, unless required by law to do otherwise, in which case it shall notify the Client in advance.
• b) Ensure that persons authorized to process personal data are subject to confidentiality obligations, which shall remain in effect after the termination of the Agreement.
• c) Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk in accordance with Article 32 of the GDPR, including: data segregation between containers, encryption, authentication and access controls, and incident management procedures.
• d) The Provider may subcontract processing operations related to the provision of the Service. The Client grants general authorization for subcontracting with providers of technology infrastructure, storage, security, technical support, and AI model providers. The list of sub-processors shall be available on the Platform and shall be kept up to date. Any substantial change shall be communicated at least fifteen (15) days in advance.
• e) Assist the Client in responding to requests from data subjects exercising their rights under Articles 15 to 22 of the GDPR.
• f) Assist the Client in fulfilling its obligations relating to security (Art. 32 GDPR), notification of security breaches (Arts. 33 and 34 GDPR), data protection impact assessments (Art. 35 GDPR), and prior consultation with the supervisory authority (Art. 36 GDPR).
• g) Notify the Client, without undue delay and within a maximum period of 24 hours, of any personal data breach of which it becomes aware.
• h) At the Client's choice, delete or return all personal data once the provision of the Services has ended, unless Union or Member State law requires their retention.
• i) Make available to the Client all information necessary to demonstrate compliance with the obligations established in this clause and allow audits to be carried out during business hours and with reasonable prior notice.
• j) Inform the Client if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

The Provider shall not transfer personal data outside the European Economic Area without the Client's prior authorization and without appropriate safeguards having been established in accordance with Articles 44 to 50 of the GDPR.

The Client undertakes to inform data subjects of the processing carried out through the Platform, as well as of the identity of the Provider as Data Processor, in accordance with Articles 13 and 14 of the GDPR.

Upon termination of the Agreement, the Provider shall, at the Client's choice, return or destroy all personal data processed, certifying in writing its compliance with this obligation. If the Provider is legally required to retain any of the data, it shall guarantee their confidentiality and shall not process them for any purpose other than that which justifies their retention.

16. NOTIFICATIONS

Any notification from the Client to the Provider shall be made by email with acknowledgment of receipt to the following address: support@sofias.ai. A communication shall be deemed made and received when it is made in writing by any means that provides evidence of its receipt.

17. MISCELLANEOUS

In the event that any provision of the Agreement is deemed invalid or unenforceable, such provision shall be limited or eliminated to the minimum extent necessary so that the remainder of the Agreement shall continue in full force and effect.

The Agreement may not be assigned by the Client without the prior written consent of the Provider. However, the Provider may transfer and assign any of its rights and obligations without the need for prior consent.

In the event that the Provider is unable to fulfill its contractual obligations in whole or in part due to force majeure, the performance of the affected obligations shall be suspended without any liability on the part of the Provider for the time required. Force Majeure shall mean any cause or circumstance beyond the reasonable control of the Provider, including, by way of example, strikes, service interruptions, natural disasters, pandemics, civil unrest, armed conflicts, or cyberattacks.

When a Force Majeure event occurs, the Provider shall notify the Client as soon as possible. If the Force Majeure event lasts for more than three (3) months, the parties shall consult each other to try to find an appropriate solution. If no solution is reached within the following thirty (30) days, the Provider may terminate the Agreement by written notice to the Client.

18. GOVERNING LAW AND JURISDICTION

The Agreement is of a commercial nature and is governed by Spanish law. The parties agree to submit any dispute arising in connection with the interpretation, performance, or termination of the Agreement to the jurisdiction of the Courts and Tribunals of the city of Donostia – San Sebastián (Gipuzkoa), expressly waiving any other jurisdiction that may apply to them.

By completing the registration process on the Platform and accepting these conditions, the company administrator declares that they have read, understood, and fully accepted this Agreement on behalf of the organization they represent.