Effective Date: September 12th, 2025
This Master Services Agreement (this "Agreement") is a legally binding agreement governing access to and use of Palm's Services. This Agreement is entered into between PalmFinance, Inc., a Delaware corporation ("Palm") and the entity or person placing an Order or accessing or using the Services ("Client"). If you are placing an Order or accessing or using the Services on behalf of a company, organization, or other entity, then that entity is the Client. In that case, you are binding that entity to this Agreement and you represent and warrant that you are authorized to do so. This Agreement also incorporates Palm’s Developer API Terms of Service and includes an arbitration clause and class action waiver that applies to you and the organization (including any parent organization, subsidiaries, and/or sister companies) you represent that you have the authority to bind. Please read the Developer API Terms of Service and this Agreement carefully as they may significantly affect your legal rights, including your right to file a lawsuit in court.
THIS AGREEMENT GOVERNS CLIENT’S PURCHASE AND RECEIPT OF THE SERVICES. CAPITALIZED TERMS HAVE THE DEFINITIONS SET FORTH HEREIN. BY ACCEPTING THIS AGREEMENT, BY (1) CLICKING A BOX INDICATING ACCEPTANCE, (2) EXECUTING A STATEMENT OF WORK (“SOW”) OR ORDER FORM THAT REFERENCES THIS AGREEMENT, OR (3) USING AND/OR ACCESSING THE SERVICES, CLIENT AGREES TO THE TERMS OF THIS AGREEMENT. IF THE INDIVIDUAL ACCEPTING THIS AGREEMENT IS ACCEPTING ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, SUCH INDIVIDUAL REPRESENTS THAT THEY HAVE THE AUTHORITY TO BIND SUCH ENTITY AND ITS AFFILIATES TO THESE TERMS AND CONDITIONS, IN WHICH CASE THE TERM “CLIENT” SHALL REFER TO SUCH ENTITY AND ITS AFFILIATES. IF THE INDIVIDUAL ACCEPTING THIS AGREEMENT DOES NOT HAVE SUCH AUTHORITY, OR DOES NOT AGREE WITH THESE TERMS AND CONDITIONS, SUCH INDIVIDUAL MUST NOT ACCEPT THIS AGREEMENT AND MAY NOT RECEIVE THE SERVICES.
The "Effective Date" of this Agreement is the earlier of (a) the date on which Client first accesses or uses the Services and (b) the date on which Client's first Order is agreed to by Palm.Palm may modify this Agreement from time to time in accordance with Section 10 (Modifications to this Agreement) below.
1.1. Access. Subject to the Client's full and ongoing compliance with this Agreement, Palm may, in its sole discretion, grant to Client a limited, revocable, non-exclusive, non-transferable, and non-sublicensable right, during the applicable Order Term, to: (i) internally access and use the application programming interface materials provided by Palm (the "API") solely as necessary to enable an application that is both owned and operated exclusively by Client and that has been expressly approved in writing by Palm (the "Client Application") to interoperate with the Palm provided products and services described at https:/ /www.getpalm.com/ (collectively with the API, the "Services"), (ii) use the Services in such Client Application provided to end users (consumers or businesses) (the "End Users") for the use case permitted by Palm in writing, including, but not limited to, as set forth in the applicable Order or in the Palm dashboard, and (iii) use the End User information and data provided via the Services (collectively, the "Output") solely in such Client Application for such use case. All use of the Services and Output must be only as provided in this Agreement, only in accordance with Palm's applicable technical user documentation and subject to the applicable use case, Client Application, and business unit restrictions (if any). The "Order" means, whether available on Palm's website or otherwise, a Palm order form, pricing schedule, pricing plan, or rate card for the Services.
1.2. Restrictions. Client shall not, and shall not permit, enable or assist any third-party to: (i) attempt to reverse engineer, decompile, disassemble, or otherwise attempt to derive or discover the source code, object code, structure or underlying structure, ideas, know-how, or algorithms of the Services or any portion thereof; (ii) modify, adapt, translate, or create derivative works based on the Services, Output, or any associated materials; (iii) make the Services or Output (or any derivative work thereof) available to, or use the Services or Output (or any derivative work thereof) for the benefit of any third party other than Client or End Users in the manner expressly approved by Palm in writing; (iv) sell, resell, license, sublicense, distribute, rent, lease, outsource, time-share, or otherwise commercially exploit the Services or Output (or any derivative work thereof) to any third-party, or include any Services or Output in a service bureau, time-sharing, or equivalent offering; (v) publicly disseminate, disclose or benchmark any information from any source regarding the performance or functionality of the Services or Output without Palm’s prior written consent; or (vi) use the Services or Output to create, train, or improve a competing product or service, or for any purpose other than the expressly permitted use case; or (vii) remove, obscure, or alter any proprietary notices, trademarks, or other designations of origin on or in the Services or Output. Client shall use the Services and Output solely (a) in accordance with the rights expressly granted in this Agreement, (b) in compliance with the Palm Developer API Terms of Service (available at https:/ /www.getpalm.com/developer/terms), and (c) in compliance with all applicable laws, rules, and regulations, including privacy, data protection, and consumer-protection laws. Notwithstanding anything to the contrary, the Client accepts and assumes all responsibility for complying with all applicable laws and regulations in connection with all of Client's activities involving any Services, Output, or End User data. Palm may, in its discretion, monitor, audit, and verify Client’s use of the Services to ensure compliance with this Agreement. Any use of the Services or Output beyond the scope of the rights granted herein constitutes a material break and may result in immediate suspension or termination of Client’s access. In addition, Client acknowledges and agrees that Palm is neither a "consumer reporting agency" nor a "furnisher" of information to consumer reporting agencies under the Fair Credit Reporting Act ("FCRA") and the Output is not a "consumer report" under the FCRA and cannot be used as or in such manner. Client represents, warrants and covenants that it will not, and will not permit or enable any third-party to, use the Services (including Output) as a or as part of a "consumer report" as that term is defined in the FCRA or otherwise use the Services (including Output) such that the Services (including Output) would be deemed "consumer reports" under the FCRA. Client shall comply with Schedule 1 (Addendum to Master Services Agreement) and any product specific or territorial exhibits, addenda, or attachments that apply to the Services used by Client. In the event of any inconsistency between this Agreement and such additional documents, the terms most protective of Palm’s rights and interests shall prevail unless expressly stated otherwise in writing by Palm.
1.3. Ownership. Except for the limited rights expressly granted under this Section 1, all rights, title, and interest in and to the Services, including without limitation the API, Output, software, documentation, data models, algorithms, interfaces, products, derivative works, and any other technology, materials, or intellectual property developed, used, or provided by Palm in connection with this Agreement, are and shall remain the sole and exclusive property of Palm. To the extent the Client provides Palm with any feedback relating to the Services (including, without limitation, feedback related to usability, performance, interactivity, bug reports and test results) ("Feedback"), Palm will own all right, title and interest in and to such Feedback (and the Client hereby makes all assignments necessary to achieve such ownership). For the avoidance of doubt, all End User Data, information, data, or materials made available, transmitted, or otherwise provided through the Services (collectively, “End User Data”) shall be and remain the exclusive property of Palm. Client acknowledges that it acquires no ownership rights or interests of any kind in any End User Data, whether received directly or indirectly through the Services, and that its access to such End User Data is solely for the limited purpose expressly authorized by Palm under this Agreement and the applicable Order. Palm retains all right, title, and interest in and to (i) the End User Data itself, (ii) any and all aggregated, anonymized, or derived data created, generated, or processed through the operation, use, or improvement of the the Services, including all metadata, analytics, models, or usage statistics, and (iii) any intellectual property rights therein. Client shall not use, store, disclose, transfer, or otherwise process End User Data for any purpose other than the expressly permitted use case. Upon Palm’s request or upon termination of this Agreement, Client shall promptly delete or return all End User Data in its possession, subject to applicable law.
1.4. Privacy and Authorizations. Before any End User accesses or interacts with the Client Application in a manner that uses or interfaces with the Services, Client represents, warrants and covenants that it has provided all legally required notices and obtained all valid consents, authorizations, and permissions necessary under applicable law to enable Palm to collect, use, disclose, or otherwise process End User data provided by Client in accordance with Palm's then-current end user privacy policy (currently available at https://www.getpalm.com/privacy) and any supplemental privacy disclosures Palm may issue from time to time. Client shall ensure that its privacy notices and consent mechanisms accurately describe Palm’s role in processing End User data and do not impose any additional obligations or representations on Palm. Client shall not (i) make, publish, or authorize any statements, promises, commitments or representations to End Users regarding data privacy or use that conflict with, expand upon, or are otherwise inconsistent with Palm’s end user privacy policy, or (ii) interfere with, modify, or impede any independent efforts by Palm to provide notice to or obtain consent from End Users. Palm reserves the right to review and require Client to modify its End User disclosure and consent materials to ensure compliance with applicable laws and Palm’s privacy requirements. Failure by Client to promptly implement such modifications will constitute a material breach of this Agreement.
1.5. Permitted Service Providers. Client may permit its employees, agents, contractors and service providers to access the Services and Output on Client's behalf (such parties, the "Permitted Service Providers"). Client will be responsible for all Permitted Service Providers' compliance with the terms and conditions of the Agreement (including, without limitation, such terms and conditions as they relate to the use of the Services and Output), and Client represents and warrants that it will: (i) not make the Services or Output available to any third parties aside from Permitted Service Providers; (ii) ensure that Permitted Service Providers are only using the Services and Output for the sole benefit of, and solely on behalf of, Client; (iii) ensure that Permitted Service Providers are not using the Services or Output for their own benefit or purposes, including to improve their own products (except to the extent necessary for the Permitted Service Providers to provide its services to, on behalf of, and for the sole benefit of Client); and (iv) contractually require Permitted Service Providers to only use the Services and Output for the sole benefit of, and solely on behalf of, Client and contractually prohibit Permitted Service Providers from using the Services or Output for their own purposes or benefit. Client is responsible under Section 2 (Payments) of the Agreement for any fees or charges incurred by its Permitted Service Providers in their use of the Services. If Client enables any third parties as Permitted Service Providers, Client (and not Palm) remains solely responsible for its relationships with such third parties and for any related billing matters, technical support, or disputes.
1.6. Development Accounts. In addition to allowing production access to the Services as described in Section 1.1 ("Production Access"), Palm may offer free sandbox or development accounts for the Services ("Development Accounts"). Client may use Development Accounts solely for internal evaluation of the Services to determine whether to place a paid Order, and not for Production Access or any other purpose. In using Development Accounts, Client must comply with Palm's relevant documentation, policies, and instructions, including as relates to the data types and use cases eligible for Development Accounts. Palm may make available different types of Development Accounts, and each Development Account may have limited functionality and other usage limits. Palm may modify or disable Development Accounts (and delete related data submitted by Client or provided by Palm) without notice or liability to Client. Palm has no support obligations for Development Accounts. Subject to this paragraph, Development Accounts remain subject to the terms and conditions of this Agreement, including without limitation Sections 1.2 (Restrictions) through 1.5 (Permitted Service Providers), 1.7 (Compliance Reviews), 6 (Warranty; Disclaimer), and 7 (Limitation of Liability).
1.7. Compliance Reviews. To access or use the Services, whether Development Accounts or Production Access, Client must successfully pass Palm's compliance reviews, which may include automated verifications, online questionnaires, and requests for information ("Compliance Reviews"). As part of the Compliance Reviews, Client must provide prompt responses to Palm's requests for information about Client, the Client Application, Client's business and associated entities, and Client's intended use of the Services. Client represents and warrants that all information it provides to Palm as part of Compliance Reviews will be accurate and complete, and Client will immediately notify Palm if any previously provided information is out-of-date or becomes inaccurate. Client may be required to complete more than one Compliance Review, for instance, to enable Development Accounts or upgrade to Production Access, or as requested by Palm based on changes in Client's use of the Services or increased risk factors. Client's passage or failure of any Compliance Review is in Palm's sole discretion. If Client fails any Compliance Review or fails to provide prompt and complete responses within three business days after Palm's requests for information (even if Client has passed a previous Compliance Review or received provisional access to the Services), Palm may suspend, revoke, or terminate Client's access to the Services, without notice or liability to Client.
1.8. Non-GA Services. From time to time, Palm may, in its sole discretion, make available to Client certain Palm features, functions, products, or services that are not yet generally available to Palm's clients ("Non-GA Services"). Palm may invite Client to access such Non-GA Services for evaluation, testing, or feedback purposes. Client’s participation is voluntary and may be terminated by either Party at any time. Non-GA Services may be identified as alpha, beta, trial, pilot, limited release, developer preview, non-production or by a similar designation. Client acknowledges and agrees that all Non-GA Services are made available solely for temporary evaluation purposes, may be incomplete or contain defects, may contain bugs or errors, may be subject to additional terms, and may not meet the same level of security, reliability, or functionality as generally available Palm offerings. Non-GA Services are provided “AS IS” and “AS AVAILABLE,” without any warranties, representations, or commitments of any kind, whether express, implied, statutory, or otherwise. CLIENT ASSUMES ALL RISKS ASSOCIATED WITH THE USE OF NON-GA SERVICES AND HEREBY IRREVOCABLY RELEASES AND DISCHARGES PALM, ITS AFFILIATES, AND THEIR RESPECTIVE OFFICERS, EMPLOYEES, AND CONTRACTORS FROM ANY AND ALL LIABILITIES, CLAIMS, OR DAMAGES ARISING OUT OF OR RELATED TO SUCH USE. Palm may modify, suspend, or discontinue any Non-GA Services at any time, with or without notice, and without any obligation to continue its development or make it generally available. Palm does not promise or represent that Non-GA Services will be made generally available or included in the Services.
Client shall pay Palm all fees and charges for the Services as set forth in each applicable Order (the "Payments"). Unless otherwise specified in an Order, all Payments shall be due and payable within thirty (30) days from the date of Palm's invoice, without offset, deduction, or counterclaim of any kind. Unpaid invoices are subject to a finance charge of 1.5% per month or the maximum permitted by law, whichever is lower, from the due date until paid in full. Client shall also be responsible for all costs of collection incurred by Palm, including reasonable attorneys’ fees and expenses. The Client shall be responsible for all taxes associated with Services other than taxes based on Palm's net income. All amounts paid or payable under this Agreement are non-refundable (unless required under applicable law), non-cancellable, and not subject to setoff. Client’s obligation to pay all fees shall survive termination or expiration of this Agreement. Palm reserves the right to suspend or terminate Client’s access to the Services if any invoice remains unpaid for more than ten (10) days after written notice of delinquency.
3.1. Term of Agreement. This Agreement shall commence on the Effective Date and shall continue in effect until terminated in accordance with this Agreement. On the effective date of termination of this Agreement, all Orders under the Agreement will also terminate unless otherwise agreed by Palm and the Client.
3.2 Term of Orders. Unless otherwise specified in the Order, (i) each Order will have a term of twelve (12) months (an "Initial Term") commencing on the effective date of such Order; (ii) following the Initial Term, each Order shall automatically renew for successive one (1) year periods (each a "Renewal Term") unless either Party provides written notice of non-renewal at least sixty-five (65) days prior to the expiration of the then-current Term; and (iii) Palm reserves the right to modify pricing, fees, and rate structures upon at least seventy-five (75) days' prior written notice. Any such adjustments shall automatically apply to the next Renewal Term without further action required by the Parties. Client acknowledges that continued use of the Services after the effective date of any renewal or fee adjustment constitutes acceptance of such revised terms.
3.3 Termination. (i) For Cause. Either party may terminate this Agreement and any applicable Orders upon written notice if the other party materially breaches this Agreement and fails to cure within thirty (30) days after receipt of written notice. Notwithstanding the foregoing, Palm may immediately suspend or terminate any or all Services, without liability, if Palm determines or reasonably believes that (a) there has been unauthorized access to or misuse of the Services through Client's account, (b) continued provision of the Services may cause material harm to Palm’s systems, networks, reputation, business interests or subject Palm to legal or regulatory risk or any other liability, or (c) Client has materially breached Section 1 or 2 of this Agreement. For clarity, notice of termination for an Order will not be construed to be notice of termination for this Agreement or for any other Order.(ii) For Convenience. Provided that no active Orders remain in effect, Palm may terminate this Agreement at any time, for any reason or no reason, upon at least thirty (30) days' prior written notice to Client. Client may not terminate this Agreement for convenience prior to completion of the Initial Term of its first active Order. (iii) Effect of Termination. Upon termination or expiration of any Order under this Agreement: (i) all rights and licenses granted to Client under the terminated Order or this Agreement shall immediately cease; (ii) Client shall promptly discontinue all use of the terminated Services and related APIs and, upon Palm’s request, return or permanently destroy all Palm materials, documentation, and Confidential Information; and (iv) Palm shall have no further obligation to maintain or provide access to End User Data or Output. Except for Section 1.1 with respect to any terminated Order, all provisions of this Agreement that by their nature should survive termination, including those concerning confidentiality, ownership, payment obligations, disclaimers, limitations of liability, and indemnification, shall survive any termination or expiration of this Agreement or any Order.Client shall pay Palm all fees and charges for the Services as set forth in each applicable Order (the "Payments"). Unless otherwise specified in an Order, all Payments shall be due and payable within thirty (30) days from the date of Palm's invoice, without offset, deduction, or counterclaim of any kind. Unpaid invoices are subject to a finance charge of 1.5% per month or the maximum permitted by law, whichever is lower, from the due date until paid in full. Client shall also be responsible for all costs of collection incurred by Palm, including reasonable attorneys’ fees and expenses. The Client shall be responsible for all taxes associated with Services other than taxes based on Palm's net income. All amounts paid or payable under this Agreement are non-refundable (unless required under applicable law), non-cancellable, and not subject to setoff. Client’s obligation to pay all fees shall survive termination or expiration of this Agreement. Palm reserves the right to suspend or terminate Client’s access to the Services if any invoice remains unpaid for more than ten (10) days after written notice of delinquency.
During the term of this Agreement and thereafter, each party (a "Disclosing Party") may disclose to the other party (a "Receiving Party") certain confidential, proprietary, or non-public materials and information ("Confidential Information"). Confidential Information includes, without limitation, all technical, financial, business, and operational information, whether disclosed orally, in writing, electronically, or otherwise, and whether or not marked “Confidential” or with a similar legend, that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure. For the avoidance of doubt, all information relating to the Services, the API, Output, data models, performance, security, pricing, commercial terms, and this Agreement shall be deemed the Confidential Information of Palm without the need for any marking or designation. Receiving Party will maintain the confidentiality of the Confidential Information and will not disclose such information to any third-party without the prior written consent of the Disclosing Party. Receiving Party will only use the Confidential Information internally for the purposes contemplated under this Agreement. The obligations in this Section 4 will not apply to any information Receiving Party can demonstrate, by written evidence: (i) was or becomes generally available to the public without breach of this Agreement, (ii) is developed by the Receiving Party independently from the Disclosing Party's Confidential Information, (iii) is disclosed to Receiving Party by a third-party without restriction and without breach of any duty owed to the Disclosing Party, or (iv) was in the Receiving Party's lawful possession prior to the disclosure to the Receiving Party and was not obtained by the Receiving Party either directly or indirectly from the Disclosing Party. Receiving Party may disclose Confidential Information as required by law, regulation, or court order; provided that, Receiving Party provides Disclosing Party with prompt written notice and cooperates to seek confidential treatment or a protective order of such information.
At any time, upon Disclosing Party's request, Receiving Party will return to Disclosing Party all Disclosing Party's Confidential Information in its possession, including, without limitation, all copies and extracts thereof. Notwithstanding the foregoing, (a) Receiving Party may disclose Confidential Information to any third-party to the limited extent necessary to exercise its rights, or perform its obligations, under this Agreement, or to any prospective acquirer of Receiving Party; provided that, all such third parties are bound in writing by obligations of confidentiality and nonuse at least as protective of the Disclosing Party's Confidential Information as this Agreement and (b) all Feedback, the Services API, Output, and related services and documentation shall constitute the exclusive Confidential Information and property of Palm.Client shall pay Palm all fees and charges for the Services as set forth in each applicable Order (the "Payments"). Unless otherwise specified in an Order, all Payments shall be due and payable within thirty (30) days from the date of Palm's invoice, without offset, deduction, or counterclaim of any kind. Unpaid invoices are subject to a finance charge of 1.5% per month or the maximum permitted by law, whichever is lower, from the due date until paid in full. Client shall also be responsible for all costs of collection incurred by Palm, including reasonable attorneys’ fees and expenses. The Client shall be responsible for all taxes associated with Services other than taxes based on Palm's net income. All amounts paid or payable under this Agreement are non-refundable (unless required under applicable law), non-cancellable, and not subject to setoff. Client’s obligation to pay all fees shall survive termination or expiration of this Agreement. Palm reserves the right to suspend or terminate Client’s access to the Services if any invoice remains unpaid for more than ten (10) days after written notice of delinquency.
Client shall defend, indemnify, and hold harmless Palm, its affiliates, and each of their respective officers, directors, employees, agents, successors, and assigns (collectively, the “Palm Indemnitees”) from and against any and all third-party claims, actions, suits, demands, regulatory inquiries, investigations, proceedings, losses, liabilities, damages, fines, penalties, costs, and expenses (including reasonable attorneys’ fees and expenses) arising out of or relating to: (i) Client’s or any Permitted Service Provider’s use, misuse, or inability to use the Services, API, or Output; (ii) Client’s actual or alleged breach of this Agreement, any Order, or any applicable law, rule, or regulation (including data protection, privacy, and consumer-protection laws); (iii) any claim or dispute between Client (or any of its affiliates, service providers, or End Users) and a third party, including any End User; or (iv) Client’s gross negligence, willful misconduct, or failure to obtain necessary authorizations, consents, or rights for its activities under this Agreement. Palm shall promptly notify Client in writing of any claim for which it seeks indemnification, provided that any delay in notice shall not relieve Client of its obligations except to the extent materially prejudiced. Palm shall have the right, at its sole option and expense, to assume exclusive control of the defense and settlement of any claim subject to indemnification hereunder. Client shall fully cooperate with Palm in such defense and shall not settle any claim without Palm’s prior written consent.Client shall pay Palm all fees and charges for the Services as set forth in each applicable Order (the "Payments"). Unless otherwise specified in an Order, all Payments shall be due and payable within thirty (30) days from the date of Palm's invoice, without offset, deduction, or counterclaim of any kind. Unpaid invoices are subject to a finance charge of 1.5% per month or the maximum permitted by law, whichever is lower, from the due date until paid in full. Client shall also be responsible for all costs of collection incurred by Palm, including reasonable attorneys’ fees and expenses. The Client shall be responsible for all taxes associated with Services other than taxes based on Palm's net income. All amounts paid or payable under this Agreement are non-refundable (unless required under applicable law), non-cancellable, and not subject to setoff. Client’s obligation to pay all fees shall survive termination or expiration of this Agreement. Palm reserves the right to suspend or terminate Client’s access to the Services if any invoice remains unpaid for more than ten (10) days after written notice of delinquency.
This indemnification obligation is in addition to, and not in lieu of, any other remedies available to Palm under this Agreement, at law, or in equity.
THE SERVICES, API, OUTPUT, AND ALL RELATED MATERIALS AND SERVICES ARE PROVIDED "AS IS" AND “AS AVAILABLE.” TO THE MAXIMUM EXTENT PERMITTED BY LAW, PALM AND ITS AFFILIATES, SUPPLIERS, LICENSORS, AND DISTRIBUTORS EXPRESSLY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NONINFRINGEMENT, ACCURACY, RELIABILITY, SECURITY, OR THAT THE SERVICES OR OUTPUT WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE FROM DEFECTS, MALWARE, OR OTHER HARMFUL COMPONENTS. WITHOUT LIMITING THE FOREGOING, PALM MAKES NO WARRANTY OR REPRESENTATION REGARDING (i) THE RESULTS, OUTPUT, OR INFORMATION OBTAINED THROUGH THE SERVICES, (ii) THE AVAILABILITY OR PERFORMANCE OF ANY THIRD-PARTY SYSTEMS OR DATA SOURCES, OR (iii) THE SERVICES’ ABILITY TO MEET CLIENT’S OR ANY END USER’S REQUIREMENTS OR EXPECTATIONS.CLIENT ACKNOWLEDGES THAT USE OF THE SERVICES AND OUTPUT IS AT ITS SOLE RISK. IF AND TO THE EXTENT ANY WARRANTY CANNOT BE DISCLAIMED UNDER APPLICABLE LAW, THE DURATION OF ANY SUCH WARRANTY SHALL BE LIMITED TO THE SHORTEST PERIOD PERMITTED BY LAW.
Client shall pay Palm all fees and charges for the Services as set forth in each applicable Order (the "Payments"). Unless otherwise specified in an Order, all Payments shall be due and payable within thirty (30) days from the date of Palm's invoice, without offset, deduction, or counterclaim of any kind. Unpaid invoices are subject to a finance charge of 1.5% per month or the maximum permitted by law, whichever is lower, from the due date until paid in full. Client shall also be responsible for all costs of collection incurred by Palm, including reasonable attorneys’ fees and expenses. The Client shall be responsible for all taxes associated with Services other than taxes based on Palm's net income. All amounts paid or payable under this Agreement are non-refundable (unless required under applicable law), non-cancellable, and not subject to setoff. Client’s obligation to pay all fees shall survive termination or expiration of this Agreement. Palm reserves the right to suspend or terminate Client’s access to the Services if any invoice remains unpaid for more than ten (10) days after written notice of delinquency.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL PALM, ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS BE LIABLE TO CLIENT OR ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, PUNITIVE, OR ENHANCED DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, REVENUE, DATA, BUSINESS, GOODWILL, OR ANTICIPATED SAVINGS, EVEN IF PALM HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR SUCH DAMAGES WERE FORESEEABLE. WITHOUT LIMITING THE FOREGOING, PALM SHALL HAVE NO LIABILITY FOR ANY (A) LOSS, CORRUPTION, OR INTERRUPTION OF DATA OR OUTPUT (WHETHER DIRECT OR INDIRECT), (B) FAILURE OR DELAY OF THE SERVICES, OR (C) ANY THIRD-PARTY SYSTEMS, INTEGRATIONS, OR NETWORKS USED IN CONNECTION WITH THE SERVICES. TO THE FULLEST EXTENT PERMITTED BY LAW, PALM’S AGGREGATE CUMULATIVE LIABILITY (WHETHER IN CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE) ARISING OUT OF OR RELATING TO THIS AGREEMENT OR ANY ORDER SHALL NOT EXCEED, IN THE AGGREGATE, THE TOTAL FEES ACTUALLY PAID BY CLIENT TO PALM UNDER THE RELEVANT ORDER DURING THE SIX (6) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO LIABILITY. IF NO FEES HAVE BEEN PAID, PALM’S LIABILITY SHALL BE LIMITED TO ONE HUNDRED U.S. DOLLARS (US $100.00). THE LIMITATIONS SET FORTH IN THIS SECTION SHALL APPLY NOTWITHSTANDING THE FAILURE OF ANY LIMITED REMEDY TO ACHIEVE ITS ESSENTIAL PURPOSE AND REGARDLESS OF THE THEORY OF LIABILITY ASSERTED, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE. MULTIPLE CLAIMS SHALL NOT EXPAND THE FOREGOING LIMITATIONS. THE EXCLUSIONS AND LIMITATIONS IN THIS SECTION FORM AN ESSENTIAL BASIS OF THE BARGAIN BETWEEN THE PARTIES AND SHALL SURVIVE TERMINATION OR EXPIRATION OF THIS AGREEMENT AND ANY ORDER.
Notwithstanding anything to the contrary, Client agrees that it will not use End User Data and/or Output as direct training input for developing, fine-tuning, pre-training, or otherwise optimizing any large language models (LLMs), machine learning models, or other artificial intelligence systems (collectively, “AI Models”). This restriction applies solely to the use of End User Data and/or Output as training material, and does not limit Client’s ability to operate, maintain, or improve its systems in ways that do not rely on data as model-training input. For clarity, nothing in this Section restricts or prohibits Client from: (a) performing system-level optimization, safety tuning, performance monitoring, or analytics that do not use End User Data and/or Output as training data; (b) using aggregated, anonymized, or statistical information that does not identify or permit reconstruction of End User Data and/or Output; (c) retaining minimal logs or metadata necessary for fraud detection, security, compliance, abuse prevention, system reliability, or troubleshooting, provided Client does not use such information to train AI Models; or (d) using third-party AI or cloud services in connection with the Services, so long as Client uses commercially reasonable efforts to ensure such third parties do not use End User Data and/or Output as training input in violation of this Section. Client’s obligations under this Section shall be subject to a commercially reasonable efforts standard.
Client shall not, and shall not permit any third party to use End User Data or Outputs, in whole, or in part, to train, fine-tune, retrain, seed, calibrate, adapt, evaluate, test, or otherwise develop AI technologies. Client shall further not use AI technologies to analyze, probe, benchmark, test, or otherwise evaluate the behavior, structure, performance, or characteristics of Palm’s Services, nor attempt to derive models, rules, or system logic from End User Data and/or Outputs.
If any provision of this Agreement is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable. This Agreement is not assignable or transferable by Client except with Palm's prior written consent; provided, however, that Client may, upon prior written notice to Palm, transfer and assign its rights and obligations under this Agreement to an affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets to which this Agreement relates. If such a transfer or assignment is made in favor of a direct competitor of Palm, then Palm may terminate this Agreement upon written notice to Client. Palm may freely assign this Agreement. This Agreement is the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements, communications, and other understandings relating to the subject matter of this Agreement, and all waivers and modifications must be in a writing signed by both parties, except as otherwise provided herein. No agency, partnership, joint venture, or employment is created as a result of this Agreement. Palm's notice address is PalmFinance, Inc., 2 Embarcadero Ctr San Francisco, CA 94111, Attn: Legal; with a copy (which does not constitute notice) to legalnotices@getpalm.com. Any notices in connection with this Agreement will be in writing and sent by first class mail, confirmed facsimile or major commercial rapid delivery courier service to the address specified above (or such other address as may be properly specified by written notice hereunder). Email notice will be permitted by Palm if sent to the Client's account email address.
Any delay in or failure of performance by either party under this Agreement will not be considered a breach of this Agreement and will be excused to the extent caused by any occurrence beyond the reasonable control of such party including, but not limited to, acts of God, power outages, governmental actions and requirements, and the acts and omissions of Palm's data suppliers. During the term of this Agreement, (a) Client agrees to participate in case studies and other similar marketing efforts reasonably requested by Palm; (b) Palm may disclose that Client is a Palm customer to third parties; and (c) Palm may include on and in Palm's website, case studies, marketing materials, and conference presentations and other speaking opportunities, Client's testimonials and other feedback regarding the Services, name, website URL, use case, and logo and other marks. Upon request from Client, Palm will promptly stop making the disclosure and use described in the foregoing sentence except to the extent already included in any then-existing materials.
This Agreement will be governed by the laws of the State of California, without regard to the conflict of law provisions thereof. The application of 1980 United Nations Convention on Contracts for the International Sale of Goods is expressly excluded. Except for claims for injunctive or equitable relief or claims regarding intellectual property rights (which may be brought in any competent court), any dispute arising under this Agreement will be administered by the American Arbitration Association (“AAA”) under its Commercial Arbitration Rules by a single arbitrator appointed in accordance with such Rules. The arbitration will take place in San Francisco, California, USA, in the English language and the arbitral decision may be enforced in any court of competent jurisdiction. With respect to any court challenge to AAA jurisdiction to arbitrate any claim or dispute arising or relating to this Agreement, the parties consent to exclusive jurisdiction and venue in the state and Federal courts located in San Francisco, California. With respect to all disputes arising in relation to this Agreement, but not subject to the preceding arbitration provision, the parties consent to exclusive jurisdiction and venue in the state and Federal courts located in San Francisco, California.
From time to time, Palm may modify this Agreement. Palm will use commercially reasonable efforts to notify Client of the modifications and the effective date of such modifications through communications via Client's account, email, or other means.
Development Accounts: Client must accept the modifications to continue accessing or using Development Accounts. If Client objects to the modifications, its exclusive remedy is to cease any and all access and use of Development Accounts.
Client may be required to click to accept or otherwise agree to the modified Agreement in order to continue accessing or using the Services, and in any event continued access or use of the Services after the modified version of this Agreement goes into effect will constitute Client's acceptance of such modified version.
Effective as of the Effective Date, this Addendum to the Master Services Agreement ("Addendum") is hereby incorporated in and expressly made a part of the Agreement. Through the Services, Client may receive or access certain information relating to End Users provided to Palm by a bank, government entity, financial institution, or other data source (each, as designated by Palm, "Information Partner" and such information referred to as “End User Data”). The term "End User Data" shall have the same meaning as defined in the Master Services Agreement.
Client may be required to click to accept or otherwise agree to the modified Agreement in order to continue accessing or using the Services, and in any event continued access or use of the Services after the modified version of this Agreement goes into effect will constitute Client's acceptance of such modified version.
a. End User Consents. Client will provide all notices and obtain all express consents from each End User as required under applicable laws in connection with Client's use, storage and other processing of any End User Data (such notices and consents, the "Express Consents"). Express Consents will be clear and conspicuous and will generally specify the categories of End User Data that Client will receive and how Client will use, store and otherwise process it, in addition to any other required disclosures under applicable laws. Client will maintain records (which may include technical logs, screenshots, versions of Express Consents obtained) to demonstrate its compliance with this Section 1(a) and will promptly provide such records to Palm upon request.
b. Scope of Access. Client will only access End User Data for which it has obtained Express Consents from the End User for the use case reviewed and permitted by Palm in writing that is consented to by the applicable End User (such use case, the "Permitted Use Case"). Key factors Palm will consider during its review include whether the use case is appropriate and useful to provide the End User with the Client Application that the End User has enrolled in, whether the Client Application provides a direct benefit to the End User, and whether the use case directly supports the development of new or improved product features for the benefit of End Users, and the jurisdiction(s) in which the Client operates and/or stores End User Data. If Client possesses End User Data that exceeds the scope of the End User's Express Consents, Client will use industry-standard means to permanently and securely delete ("Delete") such End User Data.
c. Data Use. Client will use, store and otherwise process End User Data solely in accordance with the End User's Express Consents and applicable laws.
d. Data Disclosure. Client will not disclose, transfer, syndicate or distribute End User Data to any third party (including its Permitted Service Providers) (" Data Sharing ") except in each case with the End User's Express Consents and in accordance with applicable laws. Notwithstanding anything to the contrary, Client will not sell End User Data.
e. Data Deletion. Client will promptly Delete any End User Data upon request by the applicable End User; provided that Client may retain copies of End User Data solely to the extent required by applicable laws.
f. No Attribution. Client will not charge End Users any fees attributable to an Information Partner for (a) access to its End User Data or (b) use of End User's account with an Information Partner in connection with the Client Application. In addition, Client will not publicize its receipt of End User Data from specific Information Partners under the Agreement or this Addendum.g. No Other Access. Client will only access End User Data through the Services or another manner that uses the Information Partner authorized APIs. Client will not "screen scrape" data from Information Partners or collect an End User's log-on credentials for Information Partner accounts, and will not otherwise knowingly obtain from a third party End User data that was originally sourced through screen scraping. Client will immediately Delete any such End User log-on credentials in its possession. Client will maintain records to demonstrate compliance with this Section 1(g) and will provide them to Palm upon request.
a. Compliance with Laws. Client will comply with all applicable privacy, security and other laws, including, as applicable, the Gramm-Leach-Bliley Act, the California Consumer Privacy Act, and all other laws relating to End User Data. Client will not use, store, disclose, or otherwise process any End User Data for any purpose not permitted under applicable laws.
b. Information Security Program. Client will maintain a comprehensive written information security program approved by its senior management (" Infosec Program "). The Infosec Program will include administrative, technical and physical measures designed to: (a) ensure the security of End User Data, (b) protect against unauthorized access to or use of End User Data and anticipated threats and hazards to End User Data and(c) ensure the proper disposal of End User Data. The Infosec Program will be appropriate to Client's risk profile and activities, the nature of the Client Application, and the nature of the End User Data received by Client. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and best practices such as AICPA Trust Service Criteria for Security, NIST 800-53, or ISO 27002 and will comply with applicable laws. Client will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware and other malicious code in the Client Application or on Client's systems.
c. Security Breach Obligations. Client will promptly notify Palm (and in no event after more than 48 hours) upon becoming aware of any actual or suspected Security Breach, providing a description of all known facts, the types of End Users affected, and any other information that Palm may reasonably request. Client will reasonably cooperate with Palm in investigating and remediating Security Breaches. Client will be responsible for the costs of investigating, mitigating, and remediating the Security Breach, including costs of credit monitoring, call centers, support, and other customary or legally required remediation. "Security Breach" means any event that compromises the Client Application or Client's systems or that does or reasonably could compromise the security, integrity or confidentiality of End User Data or result in its unauthorized use, disclosure or loss.
d. Information Partner Confidential Information. If Palm discloses to Client any confidential or proprietary materials of an Information Partner (such materials, "Information Partner Confidential Information"), such materials will be subject to the same obligations that apply to Palm's Confidential Information under the Agreement. Information Partner Confidential Information will also be subject to the same obligations as End User Data under this Section 2 (Client Obligations) of this Addendum.
e. Oversight and Cooperation. Client will promptly provide all reasonably necessary information and cooperation requested by Palm, an Information Partner, or any entity with examination, supervision, or other legal or regulatory authority over Palm or an Information Partner. In the event that Palm has a good faith reason to believe that Client is not in material compliance with this Addendum, Palm will notify Client and, at Palm's option, Client will promptly provide sufficient documentation to demonstrate such material compliance or submit to a third-party audit by a firm selected from a Palm approved list of audit firms to verify such compliance. Palm and Information Partners may also conduct technical or operational assessments of Client, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit.
f. Information Sharing. Where required by an Information Partner and to the extent relevant to a Client's access or use of End User Data from that Information Partner, Palm may share with such Information Partner certain information related to Client's compliance with this Addendum, including with respect to Client's Infosec Program. Palm will request that such Information Partner treat any such information in a confidential manner.
g. Insurance. Client will maintain insurance coverage appropriate to Client's risk profile and activities, the nature of the Client Application, and the nature of the End User Data received by Client; provided that such coverage will be no less than industry standard and will include cybersecurity liability insurance.
h. Access Frequency. Client will comply with any guidelines provided by Palm regarding Client's frequency of "batch" pulls of End User Data. Palm may enforce such guidelines in accordance with its standard practices, which may include throttling, suspension or termination of Client's access.
The Clauses are hereby incorporated and apply to the extent that in the provision of the Services personal information that is subject to the GDPR, UK or Swiss Data Protection Law is transferred out of the European Economic Area, UK and/or Switzerland (collectively, "Europe") either directly or via onward transfer to any country or recipient outside of Europe that has not been recognized by the applicable Data Protection Law as offering an adequate level of protection for End User Data. In the event that the Clauses are amended, replaced or repealed by the European Commission or applicable law, the Parties shall work together in good faith to enter into any updated version of the Clauses or negotiate in good faith an alternative way for the transfer of End User Data to be conducted in compliance with Data Protection Laws.
“Clauses” means (1) with respect to any End User Data originating from the Eastern Economic Area of Switzerland, Module 2 of the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 approved by Commission implementing decision (EU) 2021/914, as set out at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj as of 8 November 2021 (the “EU SCCs”); and (2) with respect to End User Data originating from the United Kingdom, the EU SCCs as supplemented by the International Data Transfer Addendum approved pursuant to S119A(1) Data Protection Act 2018 (the “UK SCCs”); each as amended, supplemented, updated or replaced from time to time.From time to time, Palm may modify this Agreement. Palm will use commercially reasonable efforts to notify Client of the modifications and the effective date of such modifications through communications via Client's account, email, or other means
Palm may suspend or terminate Client's access to the Services or End User Data, in whole or in part, if it believes Client has breached this Addendum or where Client's use of the Services or End User Data could violate or give rise to liability under any Palm agreement (including Palm's agreement with any Information Partner) or pose a risk of harm, including reputational harm, to any End User, Information Partner, the Services, or Palm and its affiliates. In addition, an Information Partner may suspend Client's access to End User Data with respect to such Information Partner.From time to time, Palm may modify this Agreement. Palm will use commercially reasonable efforts to notify Client of the modifications and the effective date of such modifications through communications via Client's account, email, or other means.
Client will indemnify, defend and hold harmless each Information Partner, Palm, and the affiliates of each of the foregoing from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs and expenses arising from or in connection with: (a) any Security Breach resulting in unauthorized disclosure of End User Data or (b) Client's unauthorized or improper use of End User Data (including any unauthorized Data Sharing, transmission, access, display, storage or loss). This Section 4 is not subject to any limitation of liabilities set forth in the Agreement. Each Information Partner is a third-party beneficiary of this Section 4.
In the event of a conflict with the Agreement, the terms and conditions of this Addendum will govern and prevail. Capitalized terms used in this Addendum and not otherwise defined will have the meanings ascribed to them in the Agreement. All provisions of this Addendum will remain in force in the event of this Addendum's or the Agreement's termination or expiration.
THIS ADDENDUM WILL ONLY APPLY IF CLIENT HAS PURCHASED "PLATFORM SUPPORT (BASIC)".
Terms used but not defined in this Addendum will be defined as set forth in the Agreement.
Palm will provide the following support for the Services set forth above, to the extent and in the manner described in Sections 1 - 4 of this Addendum:
- 24/7 access to Palm support dashboard, docs, and ticketing;
- Support team availability and response time commitments from 9am-5pm PST for applicable service issues;
- Upkeep/maintenance of Palm APIs;
- Monitoring, upkeep, and maintenance of Palm's data access connections to Information Partners; and
- Access to shared services of the Palm platform, including but not limited to, crossproduct APIs, and Palm-generated access tokens.
1. General Support. Palm will provide Support, via Palm support personnel or the Palm dashboard, to Client towards answering questions related to operational use of the Services and resolving errors in the Client Application that are determined to be, or are highly probable to be, the result of a defect caused by Palm design or engineering or the result of a complex interaction between the Client Application and the Services that cannot be resolved by Client, and which errors require product engineering knowledge or expertise towards isolating and affecting a resolution.
2. Basic Support. Following Client’s submission of a Ticket during Business Hours, Palm's support team will use commercially reasonable efforts to provide to Client an Informative Response within six (6) hours. "Business Hours" means the hours between 9:00AM and 5:00PM PST, Monday through Friday, excluding U.S. federally observed holidays. "Ticket" means a support case or ticket opened by Client on the Palm dashboard to report an error concerning Client's use of the Services.
3. Exclusions. Notwithstanding anything to the contrary in this Addendum or the Agreement, Palm will have no responsibility or liability for or in connection with any errors, problems, unavailability, delays in response time, suspension, or termination of the Services, or any other performance issues that arise from: (i) Client's inability to receive data from the Services due to errors, problems, or unavailability of Palm's data providers (e.g., Information Partners); (ii) use by End Users; (iii) inaccurate or missing information in Client's API call or an API call that is otherwise invalid; (iv) factors outside of Palm's reasonable control, including but not limited to any force majeure event, Internet access issue, and related or similar problems; (v) Client's software or hardware; (vi) third party software or hardware; (vii) abuses or other activity that leads to a suspension or termination or violates the Agreement; or (viii) planned downtime or maintenance.
4. Effectiveness of Obligations. Notwithstanding anything to the contrary in this Addendum or the Agreement, solely so long as the pricing for Basic Support effective as of the Effective Date via the applicable Order ("Basic Support Fee") remains effective: (i) Palm will provide the Basic Support (and otherwise comply with Section 2 of this Addendum). For the avoidance of doubt, in the event that the Basic Support Fee becomes ineffective (e.g., due to Client electing not to continue its Basic Support Fee commitment in accordance with the applicable Order, or electing to renew the applicable Order neither with the Basic Support Fee intact nor with higher pricing for Basic Support replacing the Basic Support Fee), then as of the effective date of such change Section 2 of this Addendum will no longer apply.
1. Requested Information. In connection with certain features and functionalities of the API, Client may be required to provide to Palm certain End User information and documentation, including without limitation, the End User's name, phone number, address, e-mail, employer identification number (EIN), social security number (SSN), driver’s license details, passport number and associated details, date of birth and business information and documentation (such End User information and documentation, the "Requested Information"). Client represents and warrants that (a) all Requested Information provided to Palm is true, accurate, and complete and (b) Client has provided all notices and obtained all consents required under applicable laws, regulations, and third-party agreements for (i) Client to share all Requested Information with Palm and (ii) Palm to collect, use, disclose, and otherwise process all Requested Information in accordance with Palm's end user privacy policy (currently available at https://www.getpalm.com/privacy), including without limitation, to provide the Services to Client. Client further covenants that it will not (a) make representations or other statements with respect to any Requested Information that are contrary to or otherwise inconsistent with the Agreement, this Exhibit A, or Palm's end user privacy policy or (b) interfere with any independent efforts by Palm to provide End User notice or obtain End User consent. The parties acknowledge and agree that any information of or related to End Users that is provided to Client via the Services will be considered Output for purposes of the Agreement and this Exhibit A.
2. Client’s Palm Account. As a condition to accessing and using the Services, Client expressly authorizes Palm to create, register, and maintain a Palm-generated account on Client’s behalf (the “Client Palm Account”). Client shall provide Palm with all information, documentation, and verifications reasonably requested by Palm to establish, validate, and maintain the Client Palm Account. Palm may, in its sole discretion, verify the accuracy, authenticity, and completeness of such information through internal procedures or third-party verification services prior to granting access to the Services. Client acknowledges and agrees that (i) creation, activation, and continued operation of the Client Palm Account are subject to Palm’s verification and approval, and (ii) Palm may, at any time and from time to time, require Client to update, confirm, or re-verify its information, credentials, ownership structure, or authorization status as a condition of continued access to or use of the Services. Palm reserves the right to suspend, restrict, or terminate the Client Palm Account, or Client’s access to any or all Services, immediately and without liability, if any information provided by Client is incomplete, inaccurate, misleading, or cannot be verified or re-verified to Palm’s satisfaction. Client shall promptly notify Palm of any change in its ownership, control, business status, or any other information previously provided to Palm. Palm shall have the right, at its discretion and upon reasonable notice, to audit or review Client’s records, systems, and data relevant to the Client Palm Account or use of the Services, whether directly or through an independent auditor, to verify Client’s compliance with this Agreement and the accuracy of any information or representations made to Palm. Client shall cooperate fully with any such audit or review.
3. Secondary Investors. Client may request that Palm disclose Output for the Services to Secondary Investors using the token integration mutually agreed to by Palm and Client. "Secondary Investor" means a third-party investor or purchaser of a product originated by Client and provided to an End User, with which investor or purchaser Palm maintains a separate technical integration. Client represents and warrants that Client has provided all notices and obtained all consents required under applicable laws, regulations, and third-party agreements for Palm's disclosure of Output to Secondary Investors. Notwithstanding any Palm technical integration or anything in the Agreement or this Exhibit A to the contrary, (a) Client is solely responsible for its own relationships with Secondary Investors, including any related billing matters, technical support, or disputes; (b) Client will enter into legally binding written agreements with each Secondary Investor that are consistent with all applicable terms and conditions of the Agreement and this Exhibit A, including, without limitation, Sections 1.1 (Access) and 1.2 (Restrictions) of the Agreement and other terms and conditions relating to use of Output; and (c) Client will remain responsible for Secondary Investors' compliance with all such terms and conditions.
4. Additional Indemnity. Client will defend, indemnify, and hold Palm harmless against all third-party claims, actions, proceedings, regulatory investigations, damages, losses, judgments, settlements, costs, and expenses (including attorneys' fees) arising from or in connection with any (a) breach by Client of this Exhibit A, (b) infringement, misappropriation, or other violation of any third party's intellectual property or other rights by any of the Requested Information provided by Client to Palm, (c) acts or omissions of Secondary Investors related to Output, and (d) dispute arising among Client, Secondary Investors, and/or End Users relating to the disclosure, use, or other processing of Output provided pursuant to this Exhibit A.
1.1. "Client Data" means data in electronic form that is transmitted through the Services by, or on behalf of, Client and/or End Users, as applicable. For the avoidance of doubt, Output (as defined in the Agreement) does not include Client Data that is returned back to Client as a part of the Identity Kit or Compliance Kit Services.
1.2. "Palm Identity Services" means the Palm Identity ("PALM ID") Services that collect Client Data from Client or End Users to provide the services requested.
1.3. "PALM ID Services" means the Services comprised of Palm Identity, as applicable, and includes the Dashboard.
1.4. "Services" collectively refers to the PALM ID Services.
1.5. "Dashboard" means the PALM ID Services dashboard.
1.6. "DPPA" means the Drivers Privacy Protection Act, 18 U.S.C. § 2721, et. seq.
1.7. "PII" means Client Data relating to an End User that is provided to Palm by Client and that Palm does not already possess or process in its capacity as an independent data controller, and that is deemed "personal data," "personal information," or any analogous term under applicable privacy or data protection laws.
For the purposes of this Exhibit B, references to "controller" and "processor" under this Exhibit B will be replaced with any corresponding terms with analogous meanings defined under applicable laws (for example, "business" and "service provider" under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020).From
2.1. Access. Client may use the Palm Identity (“PALM ID”) Services subject to, and only in accordance with, applicable laws, the Agreement (including this Exhibit B), and any agreements between Client and End Users (for clarity, including any privacy policy or terms of service). Additionally, without limiting the foregoing, Client may only use the PALM ID Services for the purpose of: (i) in the normal course of its business to verify the accuracy of information submitted by End Users, (ii) to match provided Client Data for screening purposes; (iii) identifying, verifying, and matching End Users with their registered business entities or the business owner; (iv) reviewing, validating, and maintaining End Users’ required business documentation, including but not limited to operating agreement, driver’s license, passports, SSN/EIN information, and related corporate records, to determine current and ongoing compliance with applicable state filing requirements and obligations; and (v) screening provided Client Data for compliance purposes in the normal course of Client’s business operations. Client shall not use PALM ID Services for any other purpose, including any unrelated identity verification, risk-scoring, marketing, or profiling use case not expressly authorized by Palm in writing.
2.2. Instructions. To enable Palm to provide PALM ID Services to Client, Client will instruct Palm as further specified in this Exhibit B. In accordance with this Exhibit B, such instructions will include direction to Palm regarding: (i) the applicable Client Data that will be processed by PALM ID Services on behalf of Client and its End Users and when such processing will occur; and (ii) the End Users who will provide Client Data through PALM ID Services. Client hereby directs and authorizes Palm to take all actions reasonably necessary to deliver the Services, including the processing, verification, preparation, and submission of End User documentation. Without limiting the foregoing, Client’s instructions to Palm expressly include authorization for Palm to: (i) receive, collect, process, evaluate, and match Client Data and End User-provided business documentation, including operating agreements, driver’s licenses, passports, EIN materials, and other corporate records required for compliance verification; (ii) prepare, complete, execute, and file state, federal, or other regulatory documentation on behalf of End Users, including required business filings, annual reports, amendments, certificates, and other compliance submissions necessary to maintain End Users’ good standing; (iii) provide and coordinate additional compliance-related services, including acting as a registered agent or facilitating registered agent services for End Users where authorized by End Users and applicable law; and (iv) process such Client Data and documentation at the times and in the manner Palm determines appropriate to deliver the PALM ID Services effectively. Client shall ensure that Palm is informed of the End Users whose documentation, filings, and compliance needs will be submitted through or supported by the PALM ID Services, and Client shall not instruct Palm to process any data or take any action that Client is not legally permitted to authorize.
2.3. Consent. Client represents, warrants, and covenants that, prior to any End User accessing or using the PALM ID Services, Client will provide all required notices to, and obtain all valid consents, authorizations, delegations, and powers of attorney from, each applicable End User as required under all applicable laws, regulations, and third-party agreements. Such consents and authorizations must expressly permit: (i) Client to collect, submit, disclose, and otherwise process End User information and documentation, including but not limited to operating agreements, EIN materials, government-issued identification (e.g., driver’s license or passport), and any other business records necessary for compliance verification; (ii) Palm (including Palm’s affiliates, subcontractors, service providers, and data sources) to collect, receive, access, verify, analyze, use, disclose, and otherwise process such End User documentation and Client Data as required to provide the PALM ID Services or exercise Palm’s rights under this Exhibit B; (iii) Palm to prepare, complete, execute, submit, and file any state, federal, or regulatory documentation on behalf of End Users, including but not limited to entity formation documents, amendments, annual reports, compliance filings, beneficial ownership filings, licenses, renewals, certificates, and any other submissions required to keep End Users in good standing with applicable authorities; and (iv) Palm to act as, or facilitate the provision of, registered agent or agent-for-service-of-process services for End Users in any jurisdiction where such services are offered, including the ability to receive, access, review, and forward legal notices, government correspondence, compliance-related notifications, service of process, and related communications, and to exercise a limited power of attorney granted by the End User solely for the purposes of (a) preparing, executing, and filing business, compliance, or regulatory documents; (b) designating or updating a registered agent or agent for service of process; and (c) taking any other actions legally necessary to perform the PALM ID Services on the End User’s behalf. Client shall maintain complete and accurate records demonstrating such End User notices, consents, and authorizations, and shall promptly provide such records to Palm upon request. Palm shall have no obligation to perform any filing, submission, registered agent service, or power-of-attorney authorized actions unless and until Palm has received adequate proof, directly or indirectly, of valid End User authorization. Palm may decline to perform any such services if Palm determines, in its sole discretion, that any required authorization is invalid, incomplete, insufficient, or inconsistent with applicable law or Palm’s internal risk controls.
2.4. Client Data. Client grants to Palm and its affiliates, a limited and non-exclusive license to copy, store, configure, display, back test, transmit, and otherwise process Client Data and End User documentation as necessary to provide PALM ID Services and develop enhancements. Without limiting the immediately prior sentence, Palm will: (i) use Client Data at the direction of Client; and (ii) disclose Client Data to subcontractors subject to restrictions similar to those of Palm under this Exhibit B. Notwithstanding anything to the contrary, Palm may disclose Client Data as required by law or court order; provided that, to the extent legally permissible, Palm will promptly notify Client of such requirement and use best efforts to limit such disclosure. Subject to the foregoing in this paragraph, Client will retain its existing rights in and to Client Data and, as between the parties, will retain ownership of Client Data. For the avoidance of doubt and notwithstanding the other provisions of this Exhibit B, the parties hereto acknowledge and agree that Palm may use, reproduce, disclose, or otherwise exploit de-identified or anonymized Client Data (i.e., Client Data from which PII has been removed, de-identified, or anonymized) in any way in Palm's sole discretion. Palm reserves the right to provide the PALM ID Services, through use of its subcontractors and/or affiliates or otherwise, worldwide.
3.1. Processing on Client's Behalf. Client acknowledges and agrees that, solely with respect to the Client Data and End User documentation processed in relation to the PALM ID Services: (i) Client will determine the purpose and means by which such data is processed; (ii) Palm will act on Client's instructions with respect to how, what, when, and why such data is to be processed by Palm; and that therefore (iii) Client will be deemed a data controller with regard to such Client Data and End User documentation; and (iv) Palm will be deemed a data processor with regard to such Client Data and End User documentation. Client will direct applicable End Users to Client's privacy policy for any queries or requests regarding such End Users' rights with respect to, and the processing of, the PII applicable to the PALM ID Services. For the avoidance of doubt, Client acknowledges and agrees that Client's privacy policy controls with respect to the processing of all PII applicable to the PALM ID Services and that Client is, and will remain, responsible for maintaining and making available any data retention policy or provision regarding Palm's storage of PII on Client's behalf in relation to Palm's provision of the PALM ID Services hereunder. Palm will not: (a) process the PII for any purpose other than as necessary to perform the Services on behalf of the Client; (b) process the PII for a commercial purpose other than providing the Services to the Client; (c) sell any PII, (d) process the PII outside of the direct business relationship between Client and Palm; or (e) combine the PII with any other personal information Palm collects (directly or via any third party) other than as expressly permitted for processors under applicable laws.
3.2 FCRA. Client acknowledges and agrees that Palm is neither a "consumer reporting agency" nor a "furnisher" of information to consumer reporting agencies under the FCRA and the Client Data is not a "consumer report" under the FCRA and cannot be used as or in such. Client represents and warrants that it will not, and will not permit or enable any third party to,use the Services or any Client Data as a or as part of a "consumer report" as that term is defined in the FCRA or otherwise use the Services or any Client Data such that the Services (or any Client Data) would be deemed "consumer reports" under the FCRA.
3.3. Client Responsibilities. Notwithstanding any non-Client technical integration or anything in this Exhibit B or the Agreement to the contrary, Client is solely responsible for its own relationships with End Users, including any related billing matters, technical support, or disputes. Without limiting anything in this Exhibit B or the Agreement, Client will publish and maintain an easily accessible, legally sufficient (i) terms of service regarding each applicable End User's use of the Client's services and (ii) privacy policy. Client will promptly notify Palm upon making any material changes to such Client terms of service and/or privacy policy. Client is, and will remain, solely responsible and liable for each End User's and each Permitted Service Provider's use of and access to the Services. Client will have sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of all Client Data, and for verifying the same.
3.4. Palm Responsibilities. In connection with its processing of any Client Data, Palm will comply with all obligations applicable to it as a processor under applicable laws and provide the same level of privacy protection as is required by applicable laws. Client reserves the right upon notice to Palm to take reasonable and appropriate steps to stop and remediate unauthorized use of PII. Palm will make available to Client all information reasonably necessary to demonstrate its compliance with the obligations in this Exhibit B and applicable laws, to the extent such information is related to the Services.
3.5 Data and Artificial Intelligence. Client expressly acknowledges and agrees that Palm, its affiliates, subcontractors, licensors, and service providers may collect, access, use, process, analyze, enrich, convert, adapt, and transform Client Data and End User documentation, including all information, materials, and records submitted, transmitted, or otherwise made available through the Services, for any and all purposes related to the development, training, operation, testing, evaluation, maintenance, enhancement, and improvement of Palm’s artificial intelligence models, machine-learning systems, analytics engines, datasets, data products, and related technologies (collectively, “AI Improvements”). Palm may use such data for AI Improvements in identifiable, pseudonymized, aggregated, de-identified, or anonymized form, to the fullest extent permitted by applicable law. Any processing of personal information shall comply with applicable data-protection laws. Client further acknowledges and agrees that Palm may create, derive, generate, or develop derivative works, enriched data sets, model outputs, synthetic data, embeddings, features, inferences, analytical insights, algorithmic improvements, or any other machine-learning artifacts from or incorporating Client Data or End User documentation. Palm shall exclusively own all right, title, and interest in and to all such derived data, AI Improvements, outputs, models, enhancements, and related intellectual property, regardless of whether such materials include or are based on Client Data or End User documentation. Nothing in this Agreement restricts or limits Palm’s right to use, disclose, commercialize, license, or otherwise exploit any de-identified, anonymized, aggregated, or synthetic version of Client Data or End User documentation for any lawful purpose, including AI training, benchmarking, research, analytics, validation, and product or service development, all in Palm’s sole discretion. Client irrevocably waives any claim or interest in any AI Improvements, derived data, or outputs created by or for Palm, and acknowledges that such materials are not considered Client Data, End User documentation, or Confidential Information of Client.
3.6 Compliance with the DPPA. Client certifies, represents, and warrants that all of Client’s, and all Permitted Service Providers’, access to, use of, disclosure of, and purposes relating to the Services, including any access to or processing of personal information derived from motor vehicle records, shall at all times be strictly limited to and fully compliant with the permissible uses expressly authorized under the DPPA, and any applicable state analogs. Client shall not, and shall not permit any third party to, use the Services or any data obtained through the Services for any purpose not expressly permitted under the DPPA, including but not limited to marketing, solicitation, surveillance, investigations, or any other prohibited use. Client is solely responsible for verifying, documenting, and maintaining evidence of its compliance with the DPPA and the applicability of any asserted permissible use category. Client shall ensure that each Permitted Service Provider: (i) is expressly bound by written obligations no less protective than those set forth herein; (ii) understands and complies with all DPPA restrictions; and (iii) accesses and uses any DPPA-regulated data solely on Client’s behalf and solely for a DPPA-permissible purpose. Client shall immediately notify Palm in writing of any suspected or actual non-compliance with the DPPA relating to the Services. Palm may immediately suspend or terminate access to any Services if Palm believes that Client or any Permitted Service Provider has violated, or may be at risk of violating, the DPPA or any applicable law.
Palm makes no warranty with respect to, and disclaims all liability as pertaining to, the accuracy of any data: (i) uploaded to or otherwise provided to or for the Services by or on behalf of Client or End Users; and (ii) provided by, as processed by, or otherwise originating from Palm or Palm's data sources in relation to the Services. With respect to the Services, Palm disclaims all liability for the errors and omissions of Palm and its data sources.
5.1. Palm InfoSec Program. Palm will use commercially reasonable efforts to develop, implement, maintain, and enforce a written information security program ("Palm InfoSec Program") that contains administrative, technical, and physical controls that are appropriate to Palm's size and the complexity, nature, and scope of the Services. The Palm InfoSec Program will be reasonably designed to: (i) ensure the security and confidentiality of Client Data; (ii) protect against any anticipated threats or hazards to the security or integrity of Client Data; and (iii) protect against unauthorized access to or use of Client Data. The Palm InfoSec Program will comply with all information and data security requirements promulgated by applicable state and federal laws and regulations in the U.S. Palm will review and test the design and operational effectiveness of the Palm InfoSec Program at least annually.Additionally, Palm will use commercially reasonable efforts to obtain and maintain an SSAE No. 18 SOC 2 assessment for the Services. Until such assessment is completed, Palm will maintain administrative, technical, and physical safeguards consistent with industry standards for service providers of similar size and nature. Once Palm has obtained a SOC 2 report, and no more than once per calendar year, Palm will, upon reasonable request from Client, provide Client with access to the Executive Summary of Palm’s then-current SOC 2 report or successor assessment conducted by an independent third-party assessor.
5.2. Security Incident. If Palm becomes aware of any event that: (i) compromises the security, integrity, or confidentiality of PII; and (ii) results in the unauthorized access, use, disclosure, or loss of PII (collectively, a "Security Incident"), then to the extent that such Security Incident occurred on or affects any systems or facilities owned or operated by Palm, and unless prohibited by applicable law, Palm will promptly, following Palm becoming aware of such Security Incident: (a) notify Client and reasonably assist Client in satisfying any of its notification obligations imposed under applicable laws in connection with any Security Incident; and (b) investigate and use commercially reasonable efforts to remedy and mitigate the effects of the Security Incident.
Upon termination or expiration of an Order relating to the Services: (i) Client will destroy or return to Palm all Services documentation provided to Client relating to such Order; (ii) following Palm's receipt of Client's request in writing, Palm will delete (rather than return) all Client Data stored on Palm's servers relating to such Order, unless retention of the Client Data is required under applicable law or it’s own Retention and Deletion Policy; and (iii) Client will have thirty (30) days to download any Client Data relating to such Order before Palm may delete such information. Palm disclaims all liability pertaining to: (a) Palm's deletion of such Client Data after such termination or expiration; and (b) Client's use of the Services and Client Data (including, for clarity, any other deletion of Client Data) after such termination or expiration.
Client's indemnification obligations in the Agreement are deemed to include: (i) breaches by Client of this Exhibit B; (ii) acts or omissions of Client employees, affiliates, clients, or contractors; (iii) disputes or claims relating to the disclosure or use of Client Data by Client or its Permitted Service Providers.
Palm may update the Services and their relevant documentation from time to time; provided that Palm will use commercially reasonable efforts to notify Client in the event of material changes to the Services in the manner and to the extent Palm notifies all of its relevant clients of the same, towards ensuring that such clients may continue to use the Services with minimal interruption.