End User License Agreement (v.2606)

This END USER LICENSE AGREEMENT (“Agreement”) is a legal agreement between The Escal Institute of Advanced Technologies, Inc. /dba SANS Institute, ("SANS") and the entity or organization accessing or using the Products or Services (“End User Customer” or “Customer”). SANS and End User Customer may be referred to in this Agreement individually as a "Party" and together as the "Parties”. This Agreement also incorporates any Product Specific Terms, as defined herein, that may apply to specific Products and Services.

This Agreement governs End User Customer’s use of the Products and Services regardless of whether such Products or Services were obtained directly from SANS or through an authorized reseller, distributor, partner, or other provider authorized by SANS. By using the Products or Services, the End User Customer agrees to be bound by the terms of this Agreement.

By accessing, using, or permitting Named Users to access the Products or Services, the individual accepting this Agreement represents and warrants that they are authorized to bind the applicable End User Customer to this Agreement.

1. DEFINITIONS.

1.1. Applicable Data Protection Legislation means any data protection regulation that may apply in the context of the Agreement, including, where applicable, (i) the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (“GDPR”) and the laws and regulations adopted to implement the GDPR, (ii) the UK GDPR and the Data Protection Act 2018, (iii) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (iv) the Privacy Act 1988 (Cth) and the Australian Privacy Principles; (v) the Personal Data Protection Act of 2012 and subsidiary regulations; (vi) the Act on the Protection of Personal Information (“APPI”); and (vii) any other laws or regulations relating to the Processing of Personal Data.

1.2. Confidential Information means non-public information disclosed by SANS in connection with the Products or Services that is identified as confidential or that reasonably should be understood to be confidential, including non-public training content, assessments, pricing, platform functionality, technical information, security-related information, and related documentation.

1.3. End User Customer means the entity or organization utilizing the Products or Services solely for its own internal workforce training and security awareness purposes.

1.4. End User Customer Materials means End User Customer-sourced data or materials not provided by SANS or its suppliers, that are used in connection with Workforce Training Materials, such as End User Customer-sourced content, logos, artwork, or media.

1.5. Engagement Materials means SANS fact sheets, FAQs, help files, media files, newsletters, posters, and screensavers provided or made available to facilitate use of the SANS Products. Engagement Materials do not include Workforce Training Materials themselves.

1.6. License Term means the period during which End User Customer is authorized to access and use the applicable Product(s) and/or Service(s).

1.7. Named User means an individual authorized by End User Customer to access the Products or Services under a unique login credential.

1.8. Personal Data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

1.9. Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.10. Product Specific Terms means any supplemental terms, addenda, acceptable use requirements, platform terms, flow-down terms, or service-specific conditions, including but not limited to the Workforce Training Services Supplemental Terms for use of the Products and Services, the Workforce Litmos Services Supplemental Terms for a subscription to Litmos US, L.P., and Workforce Phishing Services Supplemental Terms for use of Workforce Phishing Services, as defined therein.

1.11. Product(s) means the product(s) to be provided by SANS and made available to End User Customer.

1.12. Services means the services to be performed by SANS for End User Customer.

1.13. Workforce means SANS Workforce Security and Risk Training provided in accordance with this Agreement.

1.14. Workforce Training Materials means Workforce Security and Risk Training videos, interactive programs, online training content, exams, assessments, electronic materials, and other training Products. Each Product is licensed separately.

2. SUBSIDIARY AUTHORITY

2.1. Provision Products and Services. Notwithstanding any other provision of this Agreement, it is expressly understood and agreed that wholly owned subsidiaries of The Escal Institute of Advanced Technologies, Inc. ("Parent") are authorized to engage in the provision of Products and Services under this Agreement.

2.2. Transfer of Rights. In such instances, any wholly owned subsidiary of Parent providing the Products and Services shall be deemed a Party to this Agreement. The participating subsidiary shall assume all rights, obligations, and duties ascribed to the Parent under this Agreement, and shall be bound by the terms and conditions herein, to the same extent as the Parent.

2.3. Obligations of Parent. Notwithstanding the foregoing, it is further understood that this Section 2 does not relieve the Parent of any of its obligations under this Agreement. The Parent remains fully liable and responsible for the performance of all its obligations under this Agreement, irrespective of the participation of its subsidiaries.

3. GRANT OF LICENSE.

3.1. End User Customer is granted a limited, non-exclusive, non-transferable, and non-sublicensable license during the applicable License Term to permit its Named Users to access and use the Workforce Training Materials and Engagement Materials solely for End User Customer’s internal training and awareness purposes. End User Customer may not provide, resell, sublicense, transfer, distribute, host, or otherwise make the Products or Services available to any third party except as expressly authorized in writing by SANS. End User Customer is responsible for all access to and use of the Products or Services by its Named Users.

3.2. Engagement Materials: (i) are not subject to “per user” limitations; (ii) are provided as digital files only, and (iii) may be modified or updated by SANS from time to time.

3.3. End User Customer shall not:

3.3.1. copy, reproduce, distribute, display, modify or create derivative works from the Products or Services except as expressly permitted;

3.3.2. reverse engineer, decompile, disassemble, or attempt to derive source code;

3.3.3. use the Products or Services to develop competing products or services;

3.3.4. use automated tools, bots, scraping technologies, automated querying, data extraction methods, or similar technologies against the Products or Services except as expressly authorized by SANS;

3.3.5. share credentials or permit unauthorized access;

3.3.6. interfere with platform integrity or security;

3.3.7. use the Products or Services for unlawful, deceptive, or unauthorized purposes; or

3.3.8. use the Products or Services to train, validate, or develop machine learning or artificial intelligence systems.

4. PERFORMANCE STANDARDS. SANS may modify, suspend, or discontinue portions of the Products or Services from time to time and will use commercially reasonable efforts to maintain general availability of the hosted Products and Services.

5. CONFIDENTIALITY.

5.1. End User Customer shall protect SANS’ Confidential Information using reasonable safeguards and shall not disclose or use such Confidential Information except as necessary to access and use the Products or Services in accordance with this Agreement.

5.2. Confidential Information does not include information that:

5.2.1. is or becomes publicly available without breach of this Agreement;

5.2.2. was lawfully known to End User Customer without confidentiality obligations prior to disclosure by SANS; or

5.2.3. is independently developed without use of SANS’ Confidential Information.

5.3. End User Customer shall maintain reasonable administrative, technical, and physical safeguards to protect login credentials and prevent unauthorized access to the Products or Services.

5.4. End User Customer shall notify SANS without undue delay upon becoming aware of unauthorized access to the Products or Services or unauthorized disclosure of SANS’ Confidential Information.

6. INTELLECTUAL PROPERTY.

6.1. End User Customer acknowledges that SANS and its licensors retain all right, title, and interest in and to the Products, Services, Workforce Training Materials, Engagement Materials, and related intellectual property rights. Nothing in this Agreement transfers SANS’ exclusive ownership of its intellectual property or Confidential Information.

6.2. End User Customer may not: (i) except as expressly provided in this Agreement, use, copy, modify, translate, or merge any such information or create derivative works therefrom; (ii) disable or circumvent any SANS licensing control feature; (iii) reverse-engineer, disassemble, or decompile such information, or otherwise attempt to access or determine its underlying source code, underlying user interface techniques or algorithms, or permit any such actions; (iv) distribute, lend, sublicense, rent or lease the above; and/or (v) attempt to build a competitive service or product, or copy any feature, function or graphic for competitive purposes. All rights not expressly granted are reserved by SANS.

6.3. End User Customer retains ownership of End User Customer Materials.

7. DATA PROTECTION.

7.1. In order to perform the Services under this Agreement, SANS is required to Process Personal Data. SANS shall comply with the Applicable Data Protection Legislation.

7.2. With respect to Personal Data processed in connection with the Products or Services, End User Customer acts as controller (or equivalent legal role under applicable law), and SANS acts as processor or service provider on behalf of End User Customer.

7.3. End User Customer is responsible for providing all notices and obtaining all consents required under applicable data protection laws related to its Named Users.

7.4. End User Customer acknowledges that the Products and Services may operate within shared or multi-tenant hosted environments.

7.5. To the extent required under applicable data protection law, the SANS DPA shall apply to SANS’ Processing of Personal Data under this Agreement.

8. REPRESENTATIONS AND WARRANTIES. Each Party represents that it has the legal authority to enter into this Agreement.

9. INTELLECTUAL PROPERTY CLAIMS.

9.1. SANS shall defend End User Customer against third-party claims alleging that the authorized use of the Products or Services infringes a third party’s United States patent, copyright, or trademark rights, and SANS shall pay damages finally awarded against End User Customer by a court of competent jurisdiction or agreed to in settlement by SANS, provided that:

9.1.1. End User Customer promptly notifies SANS of the claim;

9.1.2. SANS has sole control of the defense and settlement of the claim; and

9.1.3. End User Customer reasonably cooperates with SANS at SANS’ expense.

9.2. SANS shall have no obligations under this Section to the extent a claim arises from:

9.2.1. modifications not made by SANS;

9.2.2. combination of the Products or Services with third-party products, services, or content;

9.2.3. unauthorized use of the Products or Services; or

9.2.4. End User Customer Materials.

9.3. If the Products or Services become, or in SANS’ opinion are likely to become, the subject of an infringement claim, SANS may:

9.3.1. modify the affected Products or Services;

9.3.2. obtain rights permitting continued use; or

9.3.3. terminate access to the affected Products or Services.

9.4. THIS SECTION STATES SANS’ SOLE AND EXCLUSIVE LIABILITY, AND END USER CUSTOMER’S EXCLUSIVE REMEDY, FOR ANY INTELLECTUAL PROPERTY INFRINGEMENT CLAIMS RELATING TO THE PRODUCTS OR SERVICES.

10. END USER CUSTOMER RESPONSIBILITY. End User Customer shall be responsible for claims arising from:

10.1. End User Customer Materials;

10.2. unauthorized use of the Products or Services; or

10.3. End User Customer’s violation of applicable law or this Agreement.

11. DISCLAIMER OF WARRANTY AND LIMITATION OF LIABILITY.

11.1. IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES OR LIABILITIES OR FOR ANY LOST PROFITS, LOST SAVINGS OR LOSS OF REVENUES, ARISING FROM OR RELATING TO THIS AGREEMENT OR THE SANS PRODUCTS OR SERVICES, EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

11.2. IN NO EVENT SHALL SANS’ LIABILITY ARISING UNDER THIS AGREEMENT EXCEED THE AMOUNTS PAID FOR THE APPLICABLE PRODUCTS OR SERVICES GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY.

12. COMPLIANCE WITH LAWS. Each Party shall comply with applicable laws in connection with its use or provision of the Products and Services.

13. GOVERNING LAW; JURISDICTION. This Agreement is governed by the laws of the State of Maryland, excluding its conflict of laws principles. Any dispute arising out of or relating to this Agreement shall be resolved exclusively by binding arbitration conducted in Maryland, USA in the English language.

14. EXPORT COMPLIANCE. The Products, Services, and related technology provided under this Agreement may be subject to export control, sanctions, and trade compliance laws and regulations of the United States and other applicable jurisdictions. End User Customer shall not access, use, export, re-export, transfer, or permit access to the Products or Services in violation of applicable export control or sanctions laws, including by any person or entity located in a prohibited jurisdiction or identified on a restricted party list maintained by the United States government. End User Customer agrees to cooperate with SANS as reasonably necessary for SANS to comply with applicable export compliance and recordkeeping obligations.

15. NOTICES. SANS may provide notices, disclosures, updates, or other communications relating to the Products or Services electronically, including through the platform, by email, or by posting updated terms on an applicable SANS website. End User Customer is responsible for maintaining accurate contact information associated with its account. End User Customer may contact SANS regarding this Agreement at contractadmin@sans.org or such other address as designated by SANS.

16. TERM AND TERMINATION.

16.1. This Agreement is effective upon End User Customer’s access to, use of, or acceptance of the Products or Services (the “Term”).

16.2. License Term. End User Customer’s rights to access and use the Products and Services continue only for the duration of the applicable authorized License Term.

16.3. Suspension or Termination by SANS. SANS may suspend or terminate End User Customer’s or any Named User’s access to the Products or Services immediately upon notice if:

16.3.1. End User Customer or a Named User breaches this Agreement or applicable Product Specific Terms;

16.3.2. SANS reasonably believes the Products or Services are being used:

16.3.2.1. in violation of applicable law;

16.3.2.2. in a manner that compromises platform integrity or security;

16.3.2.3. for unauthorized, deceptive, competitive, or prohibited purposes; or

16.3.2.4. in connection with credential sharing, unauthorized access, automated extraction tools, or artificial intelligence or machine learning training activities prohibited under this Agreement;

16.3.3. continued access presents a legal, operational, or security risk to SANS, its systems, or other users;

16.3.4. SANS is required to suspend or terminate access pursuant to applicable law, judicial process, governmental request, or law enforcement action; or

16.3.5. the applicable subscription or authorization permitting access to the Products or Services expires, terminates, or is revoked.

16.4. Termination by End User Customer. End User Customer may cease use of the Products or Services at any time.

16.5. Effects of Termination. Upon expiration or termination of End User Customer’s access rights under this Agreement:

16.5.1. all rights granted under this Agreement immediately terminate;

16.5.2. End User Customer and its Named Users shall immediately cease accessing and using the Products and Services;

16.5.3. to the extent reasonably practicable, End User Customer shall destroy any retained copies of Workforce Training Materials not automatically rendered inaccessible through the applicable platform; and

16.5.4. provisions of this Agreement that by their nature are intended to survive termination shall survive, including, without limitation, provisions relating to confidentiality, intellectual property, disclaimers, limitations of liability, export compliance, and governing law.

17. MISCELLANEOUS.

17.1. Order of Precedence. In the event of conflict, Product Specific Terms shall control over this Agreement with respect to the applicable Products or Services.

17.2. Assignment. End User Customer may not assign this Agreement without SANS’ prior written consent. SANS may assign this Agreement without restriction.

17.3. Waiver. The failure of either Party to exercise or enforce any right or provision of this Agreement shall not constitute a waiver of such right or provision or a waiver of the right of such Party to thereafter enforce each and every provision of this Agreement.

17.4. Severability. If a particular provision of this Agreement is terminated or held by a court of competent jurisdiction to be invalid, illegal, or unenforceable, that provision of the Agreement will be enforced to the maximum extent legally permissible, and the remainder of this Agreement will continue in full force and effect.

17.5. Headings. The headings or titles preceding the text of the sections and subsections of this Agreement are inserted solely for convenience of reference, and shall not constitute a part of this Agreement, nor shall they affect the meaning, construction or effect of this Agreement.

17.6. Independent Contractor. SANS is an independent contractor and not an employee, agent, affiliate, partner or joint venturer with or of End User Customer.

17.7. Entire Agreement. This Agreement, together with any applicable Product Specific Terms, governs End User Customer’s use of the Products and Services.

17.8. Amendments. SANS may update or modify this Agreement or applicable Product Specific Terms from time to time by posting an updated version on the applicable SANS website or platform. Continued access to or use of the Products or Services following the effective date of the updated terms constitutes End User Customer’s acceptance of the revised Agreement.