# GENERAL Legal Center \ The Customer may access the 2024 Legal Center from the archive [\[here\]](https://legal-2024.scaleflex.com/). As of 1 October 2025, the Legal Center published by Scaleflex shall apply to all Customers and shall automatically override and replace any prior versions, unless the Customer has (i) executed a Master Services Agreement, (ii) entered into Special Business Terms via Order Form, or (iii) raised a concern within fifteen (15) days from the date the new terms or policies are publicly published and reached a written compromise with the Scaleflex Legal team. If no concern is raised within this fifteen (15) day period, or if the Customer continues to use the services thereafter, the Customer shall be deemed to have accepted the new terms. Any deviation from the Legal Center shall only be valid if expressly agreed in writing with Scaleflex. *** **UPDATE 2026/05/08 — SUPPORT POLICY** The Support Policy, initially published on 15 September 2025, has been updated to provide additional clarity regarding its application and interpretation. This update does not introduce any change to the scope, nature, or delivery of the services currently provided by Scaleflex. In the interest of transparency and good governance, we have therefore issued this dedicated communication to formally notify customers of the updated wording. # Standard Terms of Service \[TERM\_1] Created on: 31.07.2025 - Last modified / reviewed: 15.09.2025 These SCALEFLEX SAS Terms of Service (these "Terms") are entered into by and between SCALEFLEX SAS ("Scaleflex") and the entity that executed the applicable Order Form ("Customer"). These Terms incorporate by reference, as if fully set forth herein, Scaleflex’s Usage Policies (defined below). Any capitalized terms used but not defined in these Terms will have the meanings given to them in the Agreement and its associated documents 1. **The Services** **1.1.** Scaleflex offers two cloud-based Software-as-a-Service (SaaS) solutions, each with defined functionalities, features, and limitations: * “**Cloudimage**” is an image and video optimization solution, which includes a basic Asset Library and selected AI features. Cloudimage is made available through self-service plans with limited functionality and usage, as well as customized Enterprise plans. Cloudimage is not offered on-premise and does not provide full digital asset management capabilities. Advanced features, including indexation, organization, collaboration, and granular user rights management, are limited. Cloudimage is intended as an entry-level solution to support the scaling of asset catalogs prior to evolving to the Visual Experience Platform (“VXP”). * “**Visual Experience Platform**” or “VXP” is Scaleflex’s enterprise-only cloud-based Software-as-a-Service solution for image and video management, providing advanced digital asset management, AI-powered enrichment and transformation, internal and external asset sharing, and branded communication portals. The VXP is offered exclusively under Enterprise licenses and is not available on-premise. 2. **Plan and Order Form** **2.1.** Scaleflex will provide Customer with access to the Service in accordance with this Agreement and the applicable Order Form or Plan. Until an annual Plan, or an Order Form is executed by the Parties, Scaleflex is not required to provide any services or access to any Service. **2.2**. A Customer’s Affiliate may access and use the Service: (i) as a User under these Terms; or (ii) as a Customer under a separately executed Order Form between Customer’s Affiliate and Scaleflex that is governed by these Terms. Customer’s Affiliate will be solely liable to Scaleflex under such separately executed Order Form. 3. **Service Access Terms** **3.1. Rights We Grant You.** Unless otherwise stated, Scaleflex and/or its licensors own the intellectual property rights of the website and the Services. You or the respective right holder, holds any and all rights to the Origin Asset and the User Content, and Scaleflex does not own any rights to the Origin Asset, the User Content and the Transformed Asset except for the rights to provide the Services to You as explicitly stated below. You are granted a personal, worldwide, non-sub-licensable, non-assignable, revocable, non-exclusive license to access and use the Services. Subject to the license below, all these intellectual property rights are reserved. This license is for the sole purpose of letting You use and enjoy the Services in a way that these Terms and our usage policies allow. Any software that we provide You may automatically download and install upgrades, updates or other new features. You may be able to configure new features from Your Console. You may not copy, modify, distribute, sell or lease any part of our Services unless otherwise agreed, nor may you reverse engineer or attempt to extract the source code of that software, unless applicable laws prohibit these restrictions or you have our written permission to do so. **3.2. Rights You Grant Us.** Scaleflex’ Services let You upload, post, send, receive and store content. When You do that, you retain whatever ownership rights in that content you had to begin with. But You grant us a license to use that content in order to provide the Services to You. How broad that license is, depends on which Services you use and the settings you have selected. For all Services, You grant us a worldwide, non-exclusive, royalty-free license to host, store, transform and distribute the User Content. This license is for the limited purpose of operating, developing, providing and improving the Services and researching and developing new ones. Although we are not required to do so, You hereby authorize us to access, review, screen and delete your Customer Content at any time which would be in violation of these Terms as defined in Section 5 Customer Content. However, You alone remain responsible for the Customer Content you create, upload, post, send or store through the Services. **3.3.** You must not: a) republish material from the Scaleflex Websites (including republication on another website); b) sell, rent or sub-license material from the Scaleflex Websites; c) reproduce, duplicate, copy or otherwise exploit material on the Scaleflex Websites for a commercial purpose; d) redistribute material from the Scaleflex Websites (except for content specifically and expressly made available for redistribution) e) use a token which was not assigned to You by Scaleflex for Your own use; doing so may result in the suspension of Your account. **3.4. Acceptable Use.** The Service is designed and intended to hold and process Customer’s branding and marketing materials and its components or other digital assets as permitted by the [AUP.](/general/acceptable-use-policy) **3.5.** Customer and its Users will use the Product strictly in accordance with the AUP. 4. **Ownership of Intellectual Property Rights** **4.1.** The Customer retains all rights, title, and interest in and to the Customer Content. Customer hereby grants Scaleflex a non-exclusive, non-transferable, non-sublicensable license to use Customer Content only as necessary to provide the Service to Customer and to carry out its obligations under the Agreement. **4.2.** Scaleflex retains all rights, title, and interest in and to the Service and any documentation provided by Scaleflex and made available in the Service, including, but not limited to, all Service source code and object code. Scaleflex hereby grants to Customer all rights required for Customer to access and use the Service in accordance with the Agreement. **4.3.** Except as expressly stated in the Agreement, no rights are granted by either Party to the other with respect to its intellectual property. 5. **Customer Content** **5.1.** By using Customer Content in or through the Service, Customer represents and warrants that: (a) Customer owns the Customer Content and/or has the right to use it and the right to grant Scaleflex the rights as provided in the Agreement; (b) the Customer Content and Customer’s use of the Customer Content in or through the Service will not violate the privacy rights, publicity rights, intellectual property rights, contract rights or any other rights of any individual or entity; (c) the Customer Content and Customer’s use of the Customer Content will not violate any applicable laws; (d) Customer Content and Customer’s use of Customer Content is not threatening, abusive, harassing, stalking, defamatory, deceptive, false, misleading or fraudulent. Scaleflex reserves the right to take reasonably appropriate measures, including suspending Customer’s account, if Scaleflex receives credible notice alleging that Customer Content violates applicable law or the rights of any third party. Scaleflex will notify Customer in writing of such measures unless prohibited by applicable law. **5.2.** Scaleflex respects the copyrights of its users and any other person. If you believe that your copyrights are abused on the Service, please send us a written notification at: (“DMCA Notice”). Scaleflex will act in accordance with the [Scaleflex DMCA Copyright Policy](/general/dmca-copyrights-policy) in any Customer Content that is alleged to infringe the copyright of any third party. 6. **Scaleflex Obligations** **6.1.** Scaleflex will provide the Service with reasonable care and skill in a professional manner consistent with industry standards. **6.2.** Scaleflex reserves the right, in its sole discretion, to make changes to the Service that it deems necessary or useful to: (a) maintain or enhance the security, quality or delivery of the Service or its cost efficiency; (b) adapt to technical or commercial market changes; or (c) to comply with applicable law or enhance security measures. Such changes will not substantially impair the functionalities of the Service. 7. **Customer Obligations** **7.1.** The Customer will not copy documentation provided by Scaleflex, except as necessary for its Users to access and use the Service in accordance with the Agreement. **7.2.** Customer will reasonably cooperate with Scaleflex in its provision of the Service, including, without limitation, making available to Scaleflex the Specifications as reasonably requested by Scaleflex. **7.3.** Customer will provide Scaleflex with accurate and complete Specifications. Scaleflex will not be liable for any problems or issues arising from Customer’s inaccurate Specifications. In the event Customer discovers it has provided Scaleflex with inaccurate Specifications, it will promptly notify Scaleflex of such inaccuracies. **7.4.** If Customer fails to provide Scaleflex with Specifications within a reasonable timeframe, or in accordance with a timeframe provided in any applicable Order Form, Scaleflex may impose a Work Pause until it receives such Specifications from Customer. If a Work Pause lasts for more than 90 calendar days, Scaleflex may terminate the Agreement For Cause as provided in Section 19.3. 8. **Third Party Services** **8.1.** The Service does not require Third Party Services for its use. In the event, Customer uses Third Party Services, such use may be subject to third-party terms, disclaimers and policies. Scaleflex disclaims all liability arising in whole or in part from Customer’s use of Third Party Services, or Customer’s reliance on any privacy, data security, or other policies related to such Third Party Services. 9. **Data Protection** **9.1.** In the event the Service processes Personal Data within Customer Content, Scaleflex will be deemed a Processor and Customer a Controller (or the equivalent under applicable data protection law), and such processing will be governed by the DPA. **9.2.** Scaleflex may process Personal Data of Customer’s staff, representatives and Users, for the purposes of managing the business relationship, to provide and monitor access to the Service, to improve the Service and optimize its use. Scaleflex bases this processing on legitimate interest, and it will comply with its Global Privacy Policy, available at . 10. **AI and Machine Learning model training** **10.1.** Usage Data and Customer Content may be used to develop, train, or enhance artificial intelligence or machine learning models that are part of Scaleflex’ products and services, including third-party components of the Product, and Customer authorizes Scaleflex to process its Usage Data and Customer Content for such purposes. However, (a) Usage Data and Customer Content must be aggregated before it can be used for these purposes, and (b) Scaleflex will use commercially reasonable efforts consistent with industry standard technology to anonymize Usage Data and Customer Content before such use. Nothing in this section will reduce or limit Scaleflex’ obligations regarding Personal Data that may be contained in Usage Data or Customer Content under Applicable Data Protection Laws. Due to the nature of artificial intelligence and machine learning, information generated by these features may be incorrect or inaccurate. Product features that include artificial intelligence or machine learning models are not human and are not a substitute for human oversight. **10.2.** Please read carefully the [Scaleflex Artificial Intelligence Privacy Policy](/privacy-and-data-processing/data-processing/artificial-intelligence-privacy-policy). 10. **Pricing and Payment Terms** **11.1.** Scaleflex will invoice Customer in accordance with the terms set forth in the Order Form or Plan. Customer will be deemed to have received an invoice if Scaleflex has sent it to the relevant email address as specified in the Account Activation Form, Cloudimage console or VXP hub (account owner email or billing section). **11.2.** All Subscription Fees shall be paid in advance according to the billing schedule. Subscription Fees will be regarded as paid only after the payment has been confirmed. In the event that Customer is subject to the legacy payment schedule (payment in arrears), Scaleflex shall contact Customer to propose and agree upon an appropriate arrangement to facilitate the transition to the new payment schedule. **11.3.** In the event of a new registration/subscription, the Service will be made available shortly after the Fees have been paid. **11.4.** Unless otherwise provided, all prices are expressed in Euros. All Plan, other Services or Add-ons may be subject to currency exchange variations and will be reflected in your invoice. **11.5.** All prices are exclusive of value-added tax (VAT) and other government taxes, banking fees, and regulatory fees that have been or are later imposed. Each Party agrees to pay any tax assessed to it by a competent tax authority. Customer will remit payment in full to Scaleflex regardless of any taxes that are required to be deducted or withheld. Any regulatory fees or other costs imposed by a governmental entity (e.g., registration in a particular jurisdiction) that result from Customer’s subscription hereunder shall be the exclusive responsibility of Customer, whether paid by Customer directly or paid by Scaleflex and subject to reimbursement. **11.6.** Customer may dispute an invoice in good faith within twenty (20) calendar days of receiving the invoice by providing written notice to Scaleflex detailing the reasons for such dispute. Customer must timely pay any undisputed portion of the invoice. **11.7.** Prices shall remain unchanged for twelve (12) months or Initial Term from the Order Form or Plan Start Date. Thereafter, the Subscription Fee shall be increased annually by 2% (“Standard Indexation”) on each anniversary. In the thirty (30) days preceding each anniversary, Scaleflex may, by written notice, request an additional adjustment reflecting supplier-imposed and/or market-driven changes beyond its control, not exceeding ten percent (10%) of the total Contract amount, such adjustment applying until the next anniversary. **11.8.** If Customer uses a Purchase Order (“PO”), it must issue a PO upon execution of the Agreement, any renewal thereof, and any future add-on purchase. Any delay or failure in issuing a PO will not relieve the Customer of its payment obligations under the Agreement. Any terms and conditions in a Purchase Order will not apply to the Agreement. **11.9.** If Customer fails to timely satisfy its payment obligations, Scaleflex may apply a late payment fee equal to ten percent (10%) of the overdue amount, assessed per unpaid invoice. The late payment fee shall accrue without prejudice to Scaleflex’s other rights and remedies under this Agreement or applicable law. You herewith agree to waive any and all rights and further agree to refrain from initiating any claims, actions or proceedings against Scaleflex, its affiliates parties, partners, its officers, directors, employees, and agents in case of non-payment. **11.10.** Upon fifteen (15) business days’ written notice, Scaleflex may suspend access to the Service if Customer has failed to timely satisfy its payment obligations. **11.11.** All payment obligations are non-cancellable, and all amounts paid are non-refundable. **11.12.** Marketplace Purchases. In the event Customer purchases any Plan, Service, or Add-on through a third-party marketplace, such purchases shall be subject to the payment terms, billing processes, and refund policies of such third-party. Notwithstanding the foregoing, Customer acknowledges and agrees that any failure, delay, or mispayment in connection with such third-party transaction may result in the immediate suspension of access to the Service by Scaleflex until the payment matter is fully resolved to Scaleflex’s satisfaction. 12. **Overuse Consumption** **12.1.** Customer acknowledges and agrees that the Services may be subject to usage limitations as specified in the applicable Order Form, Plan, or Documentation. **12.2.** In the event Customer’s actual consumption exceeds the contracted limits, Scaleflex may (i) invoice Customer for such overuse at the then-current applicable rates, (ii) require Customer to upgrade to a higher Service Plan, or (iii) suspend or restrict access to the Services until the overuse is remedied. **12.3.** Any overuse charges shall be due and payable upon issuance of the corresponding invoice, and any late payment thereof shall be governed by Clause 11.9. 13. **Confidentiality** **13.1.** "**Confidential Information**" means any information that has come to either Party’s knowledge (whether before or after the execution of the first Order Form, whether orally, in writing, in electronic form or other media) by virtue of its business relationship with the other Party and that, among others, includes: (a) information that constitutes a trade secret; (b) information that is owned, developed or otherwise acquired by either Party, including the Party’s financial data, business plans, customer information, software, programming, systems and use documentation, technical information, technology, designs, ideas, inventions, data, data formats and files, and all copies and tangible embodiments thereof; (c) any information relating to software originating from Scaleflex; and (d) any other information that would be considered confidential by a reasonable person under the circumstances of its disclosure. **13.2.** While performing its obligations under the Agreement, either Party may deliver Confidential Information to the other. If a Party receives the Confidential Information of the other, such receiving Party will: (a) use such Confidential Information solely for the purpose of carrying out its obligations according to the Agreement; (b) take reasonable precautions to protect such Confidential Information (including all precautions that such Party employs with respect to its own confidential materials), (c) not divulge any such Confidential Information or any information derived therefrom to any third party; and (d) only divulge such Confidential Information to those of its employees, representatives, Affiliates, auditors or insurance brokers who have a reasonable need to know such information and are subject to confidentiality obligations at least as stringent as those in this Section 13. **13.3.** The provisions of Section 13.2 will not apply to: (a) any Confidential Information that (i) is or becomes generally available to the public through no improper action or inaction by the receiving Party or any of its employees, representatives, or Affiliates; (ii) was in possession of, or known by, the receiving Party prior to receiving it from the disclosing Party; (iii) was properly disclosed to the receiving Party without any obligation of confidentiality; or (iv) was discovered or created by the receiving Party without reliance on such Confidential Information; or (b) disclosures required by applicable law or to exercise its own rights under the Agreement, provided that the receiving Party (1) uses reasonable efforts to limit such disclosure and to obtain confidential treatment or a protective order with respect thereto, (2) allows the disclosing Party to participate in the proceedings related to such legal or court-ordered requirement (to the extent reasonably practical) and (3) reasonably cooperates with the efforts of the disclosing Party to contest or limit the scope of such required disclosure. 14. **Service Analysis** **14.1.** Scaleflex endeavors to continually improve the Service. In doing so, Scaleflex may collect Usage Data. Usage Data is used to develop new features or improve existing features of the Service. **14.2.** Such data is collected solely for internal purposes and shall not be sold, leased, or otherwise disclosed to third parties for commercial purposes. 15. **Warranties** **15.1.** Scaleflex warrants to Customer that, as of the Effective Date: (a) it has the full right, power and authority to enter into, and fully perform its obligations under the Agreement; and (b) the Service will conform in all material respects with the functionalities as described in the Order Form. Customer’s sole and exclusive remedy for any breach of warranty in Section 15.1(b) are set forth in the SLA. **15.2.** Customer warrants to Scaleflex that, as of the Effective Date: (a) it has the full right, power, and authority to enter into and fully perform its obligations under the Agreement; and (b) Users will comply with the Agreement. 15.3. EXCEPT AS EXPLICITLY STATED IN THE AGREEMENT, THE Service IS PROVIDED BY Scaleflex ON AN “AS-IS” BASIS. ALL OTHER WARRANTIES, WHETHER ORAL OR WRITTEN, EXPRESS OR IMPLIED OR CONTRACTUAL OR STATUTORY, ARE EXPRESSLY DISCLAIMED. WITHOUT LIMITATION, Scaleflex DOES NOT WARRANT THAT (a) THE OPERATION AND/OR USE OF THE Service WILL BE UNINTERRUPTED OR ERROR-FREE; (b) THE Service WILL PERFORM IN EVERY OPERATING ENVIRONMENT; (c) ALL DEFICIENCIES OR ERRORS IN THE Service ARE CAPABLE OF CORRECTION; OR (d) THE Service MEETS CUSTOMER’S REQUIREMENTS OR EXPECTATIONS. THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE SPECIFICALLY DISCLAIMED. 16. **Indemnifications** **16.1.** To the extent not prohibited by law, Scaleflex agrees to indemnify and defend Customer, its Affiliates, and its and their officers, directors, employees, agents, and representatives from and against any and all liabilities, expenses, damages and costs, including but not limited to, reasonable attorneys’ fees, related to all third party claims, charges and investigations that the Service, as delivered by Scaleflex and used as permitted under the Agreement, infringes or misappropriates the intellectual property rights of a third party. **16.2.** If a third party seeks an injunction claiming that a component of the Service infringes the intellectual property rights of a third party, and that injunction is not dismissed within 30 calendar days, or if a court of competent jurisdiction issues a judgment that the Service infringes upon the intellectual property rights of a third party, Scaleflex will, at its sole discretion: (a) obtain for Customer the right to continue using the infringing component; (b) replace or modify the infringing component; or (c) if (a) and (b) are not commercially feasible, allow Customer to terminate the use of the infringing component and reimburse to Customer any prepaid fees related thereto. **16.3.** To the extent not prohibited by law, Customer agrees to indemnify and defend Scaleflex, its Affiliates, and its and their officers, directors, employees, agents, and representatives (collectively, the "Scaleflex Entities"), from and against any and all liabilities, expenses, damages and costs, including but not limited to, reasonable attorneys’ fees, related to all third party claims, charges and investigations that Customer Content infringes the intellectual property rights or violates the data privacy rights of any third party. **16.4.** In order to be entitled to an indemnity, the indemnified Party must: (a) provide the indemnifying Party with prompt written notice, in no event more than thirty (30) calendar days after becoming aware of such a claim; (b) give the indemnifying Party sole control and authority over the defense and/or settlement of such claim; and (c) provide the indemnifying Party with reasonable assistance to defend and/or settle any such claim; and (d) take reasonable steps to mitigate its loss. **16.5.** This Section 16 provides the Parties’ exclusive remedies with respect to the subject matter of any indemnifiable claims. 17. **Limitations of Liability** **17.1.** NOTHING IN THE AGREEMENT WILL LIMIT A PARTY’S LIABILITY FOR GROSS NEGLIGENCE, WILFUL MISCONDUCT OR FRAUD. **17.2.** EXCEPT FOR A PARTY’S INDEMNIFICATION OBLIGATIONS NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, PUNITIVE DAMAGES (INCLUDING LOST OR ANTICIPATED REVENUES OR PROFITS), LOSS OF OPPORTUNITIES, REPUTATIONAL DAMAGES OR COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES ARISING FROM ANY CLAIM RELATING DIRECTLY OR INDIRECTLY TO THE AGREEMENT, WHETHER BASED ON WARRANTY, CONTRACT, TORT, OR OTHERWISE, EVEN IF SUCH PARTY WAS ADVISED OF OR OTHERWISE AWARE OF THE LIKELIHOOD OF SUCH DAMAGES. **17.3.** THE AGGREGATE LIABILITY OF EITHER PARTY WILL NOT EXCEED THE SUBSCRIPTION FEE PAYABLE BY CUSTOMER TO Scaleflex IN THE TWELVE MONTHS PRIOR TO THE EVENT GIVING RISE TO THE CLAIM. **17.4.** Scaleflex shall have no liability whatsoever to Customer for any expenses, damages and costs related to the non-functioning of the Service (whether in part or in whole) due to unavailability of the internet or due to changes in legislation or technical restrictions that limit access to or functionality of the Service. In the event of a change in laws or regulations in any of the countries in which Customer has Users, including changes to laws and regulations on cloud computing services, data protection and privacy, or Software as a Service, which impact Scaleflex’s ability to offer the Service, Customer accepts that Scaleflex may limit the availability of the Service in a manner to be determined in Scaleflex’s sole discretion, and Customer hereby releases Scaleflex from any liability relating to such limitation. If one of the events listed in this Section 17.4 takes place, Parties shall have a discussion in good faith to mitigate such event’s impact. 18. **Infrastructure Health Management** **18.1** In a continuous commitment to provide the most reliable and efficient services, Scaleflex will carry out routine maintenance checks and cleanups to maintain the health of its infrastructure. This clause shall apply mainly to Trial or Staging tokens. In the case that a token has not received any traffic for forty-five (45) consecutive days, Scaleflex will notify you through email that the token is at risk of being deleted. You will have a grace period of fifteen (15) days to respond and cancel the automated process; otherwise, the token will be removed. 19. **Term and Termination** **19.1.** An Order Form under the Agreement will become effective on the Effective Date and will continue in full force and effect for the Term specified in any applicable Order Form. **19.2.** Upon expiration of the Initial Term (as defined in an applicable Order Form) the Agreement will automatically renew for the duration of the Initial Term on the same Terms applicable immediately prior to expiration of the Agreement unless either Party provides written notice of its intention not to renew no less than sixty (60) calendar days prior to the expiration of the current Term. **19.3.** Either Party may terminate the Agreement, including any applicable Order Form, effective immediately upon written notice in the event of: (a) dissolution, liquidation, bankruptcy or insolvency of the other Party; or (b) the other Party’s Material Breach of the Agreement that has not been cured within thirty (30) calendar days of receiving written notice of the breach (each of sections (a) and (b), "a termination "For Cause"). In the event of Customer’s violation of the Usage Policies, Scaleflex may terminate the Agreement and any applicable Order Form immediately upon written notice to Customer. **19.4.** If the Agreement is terminated by Customer For Cause (as provided in Section 19.3), Scaleflex will not refund the pro-rata amount of any prepaid fees from the date of the event constituting such termination. **19.5.** If the Agreement is terminated by Scaleflex For Cause or for Customer’s violation of the Usage Policies, all outstanding amounts owed to Scaleflex for the remainder of the Term will become due and payable. **19.6.** Upon termination or expiration of the Agreement for any reason, Scaleflex will immediately terminate Customer’s access to the Service. All outstanding amounts owed to Scaleflex will immediately become due and payable upon expiration or termination by Scaleflex of the Agreement or the applicable Order Form. All payment obligations survive termination of the Agreement including any applicable Order Form. **19.7.** In the event of a conflict between the special conditions included in the signed quote or Order Form ("OF") or the signed Master Service Agreement ("MSA", if present) and the Standard Terms of Service, the Special Business Term included in the signed quote or OF shall take precedence, followed by the signed MSA. 20. **Termination Transition Period** **20.1.** Unless otherwise directed by Customer, commencing: (i) three (3) months prior to the expiration of the Agreement; (ii) upon any notice of termination or non-renewal of the Agreement; or (iii) three (3) months prior to any other ceasing of Service under the Agreement, and continuing for a period defined in the Termination Transition Plan but in no event less than four (4) months following the expiration or termination of this Agreement (unless a shorter time period is requested by Customer), Scaleflex will continue to provide the Services (including the Termination Assistance Services) as requested by Customer. After such four (4) month period (or such shorter time period as requested by Customer), unless otherwise directed by Customer, Scaleflex shall provide extensions of the Services (including the Termination Assistance Services) as requested by Customer in serial thirty (30) day extension terms for up to an additional two (2) months (such period, the “Termination Transition Period”). **20.2.** The entire duration of the Termination Transition Period must not exceed six (6) months, and Customer will be responsible for all costs. In addition to the Services as set forth in this Agreement, the Termination Assistance Services shall include, at a minimum, providing and maintaining current services until transition to a new solution, providing online technical support, cooperating with Customer or its designated vendor in developing required interfaces (any additional cost being supported by Customer), and such other services as shall be necessary or appropriate to facilitate, without material or extended interruption to the Services, the orderly transition of the Services Customer or its new provider of services in accordance with Scaleflex’ best practices. Customer shall have the same rights as provided in Section 5 during the transition period as it does during the Term. 21. **Governing Law and Jurisdiction** **21.1.** The Agreement is subject to the law of France and any disputes relating to these Terms will be subject to the exclusive jurisdiction of the applicable courts of Paris, France. **21.2. Amicable Dispute Resolution Process.** In the event of a dispute arising out or in connection with the Terms including any question regarding its existence, interpretation, validity or termination prior any judicial action, the parties shall use their best endeavors to try to resolve the dispute amicably within an agreed timeframe. This amicable dispute resolution process (i) shall not be interpreted as preventing any party to ask a court of competent jurisdiction to order all injunctive relief, interim and provisional measures that may be necessary in the circumstances and (ii) shall not restrain Scaleflex to suspend or discontinue in whatever manner the provision of and/or access to the Services. 22. **General Provisions** **22.1.** The Agreement, including for the avoidance of doubt, the Global Privacy Policy, Usage Policies, Data Processing Addendum and each Order Form, constitutes the entire agreement between the Parties as to the subject matter hereof and supersedes all prior documents, negotiations and drafts of such parties with respect to such subject matter, whether written or verbal. Any term of the Agreement may be waived, terminated or discharged only with the written consent of both Parties. The failure of either Party to insist upon the performance of any of the terms or conditions contained in the Agreement, and the failure of either Party to exercise any right under these Terms, may not be construed as a waiver or relinquishment of the future performance of any such term or condition or the future exercise of such rights. **22.2.** If any provision of the Agreement is held to be unenforceable, the Parties will renegotiate such provision in good faith in a manner reflecting the original intent of the Parties. If the Parties cannot agree upon an enforceable replacement for such provision, then (a) such provision will be excluded from the Agreement, (b) the balance of the Agreement will be interpreted as if such provision were so excluded and (c) thereafter, the Agreement will be enforceable in accordance with its terms. **22.3.** Neither Party may assign this Agreement in whole or in part, without the prior written consent of the other Party, and any such assignment will be null and void; provided, however, that the Parties may assign all of their rights and obligations under this Agreement to any one Affiliate for reasons of corporate restructuring or internal reorganization, or following an acquisition, a merger or sale of all or substantially all of the assigning Party’s assets. The Agreement will be binding upon and will inure to the benefit of the Parties permitted successors and assigns. **22.4.** Neither Party will be responsible for failure or delay of performance if caused by a Force Majeure Event. Each Party will use reasonable efforts to mitigate the effect of a Force Majeure Event. Either Party may terminate the Agreement immediately upon written notice, if the other Party is unable to perform its obligations under the Agreement due to causes stated in this Section 22.5 for more than 30 calendar days. **22.5.** Neither the Agreement nor any provision contained herein will be construed as creating or constituting a partnership, joint venture, or agency relationship between the Parties. The Parties are independent contractors engaged on a non-exclusive basis and neither Party has the power or authority to assume or create any obligation or responsibility on behalf of the other Party. **22.6.** In the event of any inconsistency between the documents making up the Agreement, the order of precedence will be: (i) the MSA, (ii) the Order Form; (iii) the Usage Policies; and (iv) these Terms. **22.7.** The Agreement is made for the benefit of the Parties and is not intended to benefit or be enforceable by any third party. The rights of the Parties to terminate, rescind, or amend the Agreement, or to reach any settlement relating to the Agreement, are not subject to the consent of any third party. **22.8.** Scaleflex may revise these Terms from time to time. Revised Terms will apply to the use of this website and the Services from the date of the publication of the revised Terms on this website. Scaleflex will post a notice on the website, newsletter and/or per email to You 14 calendar days prior to such change. In any event, we recommend that You often review this page to verify that You are familiar with the most recent version. Should any conflict between the Terms of a signed OF, or MSA (if present) and these Terms, both parties agree to refer to 22.6 in these Terms. 23. **Fight Against Corruption** **23.1.** Scaleflex acknowledges that it is aware of the rules set out by You regarding the prevention and fight against corruption and undertakes, on behalf of both itself and all persons under its responsibility or acting in its name and on its behalf, throughout the term of performance of this Agreement, to comply with: * the rules laid down therein; and * all international and local laws, regulations and standards relating to the fight against corruption applicable to it. **23.2.** Scaleflex warrants that neither it nor any person under its responsibility or acting in its name or on its behalf, has granted or will grant any offer, remuneration or payment or benefit of any kind, constituting or capable of constituting an attempted or actual act of corruption, directly or indirectly, for or in consideration of the award and/or performance of this Agreement. **23.3.** Scaleflex undertakes to inform You, without delay, of any information brought to its knowledge and which may constitute a breach of this clause. **23.4.** You reserve the right to request that Scaleflex communicate to it any elements it deems to be useful to establish that the latter has complied throughout the term of this Agreement with the laws and regulations related to the fight against corruption. **23.5.** Scaleflex undertakes to provide any assistance necessary to You to respond to a request from a duly authorized anti-corruption authority. 23.6. Any breach by the Scaleflex of the provisions of this section shall be deemed to be a material breach allowing You to terminate this Agreement without notice or compensation, subject to all damages which You may claim as a result of such breach. 24. **Contact** **24.1.** If You have any questions about these Terms or the use of the Services, please contact us per email: . 25. **Publicity** **25.1.** You agree that Scaleflex may reference and use Your name, logos and trademarks in Scaleflex marketing and promotional materials, including, but not limited to the Scaleflex Websites, solely for purposes of identifying You as a customer of Scaleflex. Otherwise, neither party may use the trade names, trademarks, service marks, or logos of the other party without the express written consent of the other party. 26. **Electronic Signature** **26.1** The Parties agree to execute this Agreement exclusively by means of secured electronic signature proceedings, in accordance with current regulations, intended to authenticate the identities of the signatories and to guarantee the integrity of this Agreement in an electronic format. The Parties agree that the electronic signature expresses their consent for this Agreement to be legally binding to the Parties and to constitute proof in an equally valid manner as a paper document bearing a handwritten signature. In witness whereof, the Parties hereto have caused the Agreement to be executed by their duly authorized representatives.   **SCHEDULE 1 - GLOSSARY** This Schedule sets forth all definitions applicable to and incorporated within this document.
Account Activation FormMeans the form the Customer provides to Scaleflex after signing the Order Form to designate the invoice recipient and share the relevant contact details for billing setup.
Acceptable Use Policy (“AUP”)means Scaleflex’s Acceptable Use Policy, available at https://legal.scaleflex.com/general/acceptable-use-policy
Agreementmeans these Terms and any applicable Order Form
Affiliatemeans any entity directly or indirectly owns or controls, is owned or controlled by, or is under common ownership or control with such entity, where (i) "ownership" means the direct or indirect ownership of more than 50% of the voting securities or equity interests of such entity and (ii) "control" means the direct or indirect power to direct or cause the direction of the management and policies of an entity.
Cloudimagemeans Scaleflex’s image and video optimization solution, which includes a basic Asset Library and selected AI features.
Customerincludes the legal entity signing the Order Form and any of its Affiliates, and their respective employees, independent contractors, agents. The legal entity signing the Order Form is solely liable for the acts and omissions for its, or for its Affiliates', employees, independent contractors or agents.
Customer Contentmeans any data (including personal data), such as electronic data, text, documents, pictures, videos, files or other materials uploaded to, generated by, and/or stored within the Service by Customer
Data Processing Addendum (“DPA”)means Scaleflex’s Data Processing Addendum, available at https://www.legal.scaleflex.com/data-processing-addendum/
Force Majeure Eventmeans an act of war, hostility, or sabotage; act of God; electrical, internet, or telecommunication outage that is not caused by the obligated Party; government restrictions; or other event outside the reasonable control of the obligated Party.
Initial Termmeans the fixed period commencing on the Project Start Date and continuing for the duration specified in the applicable Plan or Order Form, during which this Agreement remains in force prior to any renewal.
Material Breachmeans (i) any breach of a Party’s confidentiality obligations, (ii) infringement of third party intellectual property rights (subject to Section 15.2 with respect to infringement claims involving the Service; (iii) repeated non-material breaches cumulatively amounting to a material breach; (iv) Customer’s failure to keep its billing information up to date to the extent such failure interferes with Scaleflex’s ability to invoice Customer hereunder; and (v) any Work Pause in accordance with Section 7.4 that lasts more than ninety (90) days.
Order Form (“OF”)

means the agreement between Scaleflex and the Customer that sets forth the details of the Service purchased, the applicable fees and usage limitations and incorporates the SOW.

"Party" or "Parties" means Scaleflex or Customer, as applicable

Subscription Plan or Planmeans the Customer’s enrolment in, and right to access and use, the specific package of Services identified in the applicable Plan, subject to the terms and conditions of this Agreement and the corresponding fees. For the avoidance of doubt, all Public Plans are available on a twelve (12)-month subscription basis only.
Purchase Order (“PO”)means a purchase order or similar document, a formal, legally binding document issued by the Customer to Scaleflex, specifying the Services to be provided, along with agreed-upon prices, quantities, and terms.
Renewal Termmeans the term set forth in the applicable renewal document.
Service

means Scaleflex’s software-as-a-service Service, including applications, solutions and related onboarding, support and maintenance services as set forth in the SLA.

A “Service” can either be Cloudimage or one of the solutions delivered by Scaleflex Visual Experience Platform.

Service Level Agreement (“SLA”)means Scaleflex’s standard Service Level Agreement, available at: https://www.legal.scaleflex.com/service-level-agreement/
Special Business Termmeans any provision, condition, or requirement that deviates from or supplements the Standard Terms of this Agreement, as expressly agreed in writing by the Parties, and applicable to specific transactions, projects, or circumstances.
Specificationsmeans any documents, data, designs, list of functional and technical requirements, or other information that the Customer makes available to Scaleflex or that Scaleflex reasonably requests in connection with the provision of the Service.
Statement of Work (“SOW”)means the statement of work set forth in the Order Form, which describes the onboarding and project-specific activities and related fees
Third Party Servicesmeans the statement of work set forth in the Order Form, which describes the onboarding and project-specific activities and related fees
Termmeans the Initial Term and any subsequent Renewal Term.
Usage Data

means metrics and information collected by Scaleflex regarding Customer’s use of the Service, including but not limited to data on how Users interact with the Service.

"Usage Policies" means Scaleflex’s AUP and SLA.

Visual Experience PlatformScaleflex’s enterprise-only cloud-based Software-as-a-Service solution for image and video management, providing advanced digital asset management, AI-powered enrichment and transformation, internal and external asset sharing, and branded communication portals.
Work Pausemeans a temporary suspension of the applicable Service by Scaleflex in accordance with Section 7.4.
# Trial Terms Of Use \[TERM\_2] Created on: 01.01.2024 – Last modified / reviewed: 15.09.2025 **Disclaimer:** Please be advised that Scaleflex has implemented an upgrade to the Cloudimage Service. Accordingly, all subscription plans purchased prior to September 30, 2025 must be migrated to an updated plan, unless otherwise expressly authorized in writing by Scaleflex’s management. Furthermore, the Cloudimage FREE/PERSONAL and APPSUMO plans will be permanently discontinued, and all services associated with these plans will be terminated, effective October 1, 2025. For any inquiries or to discuss available options, please contact the Scaleflex Support Team at The Trial (as defined below) is offered free of charge for a period of thirty (30) days (“Trial Period”), unless the Trial Period is extended by Scaleflex in its sole discretion. The Trial is intended solely for the evaluation of Scaleflex products. Activation of the Trial requires the provision of a valid credit card. The Trial shall automatically convert into a paid subscription to the smallest available plan upon expiration of the Trial Period, unless the Customer terminates the Trial prior to such expiration. By activating the Trial, the Customer expressly agrees to such automatic conversion and to pay all applicable fees in full. The Trial Terms of Use ("Agreement") contains the terms and conditions that govern your access to and use of the Trial and is an agreement between Scaleflex ("Scaleflex", "we", "us", or "our") and you or the entity you represent ("you", "your"). This Agreement takes effect when you click the "Get started" button and checkbox presenting these terms. You represent to us that you are lawfully able to enter into contracts (e.g., you are not a minor). If you are entering into this Agreement for an entity, such as the company you work for, you represent to us that you have legal authority to bind that entity. 1. **License Agreement** PLEASE READ THESE TERMS OF USE CAREFULLY BEFORE REGISTERING FOR A TRIAL. SCALEFLEX WILL ONLY LICENSE THE TRIAL TO YOU IF YOU FIRST ACCEPT THE TERMS OF THIS AGREEMENT. The Trial is owned by Scaleflex or an official Scaleflex Partner, and is copyrighted and licensed, not sold. The term “Trial” means the original program and all whole or partial copies of it, including portions merged into other programs. Scaleflex grants to you a limited, non-exclusive, non-assignable, non-transferable, revocable worldwide license for the Trial, as specified in these Terms of Use. You agree to ensure that anyone who uses the Trial does so only for your authorized use and complies with the terms of these Terms and Conditions and Scaleflex’s Acceptable Use Policy. Scaleflex will not charge you for the rights granted to you under this license. 2. **License** The Trial is intended for evaluation purposes of the Products ONLY. You may not: (a) use, copy, merge, or transfer the Trial except as provided in these Terms of Use; (b) reverse assemble, reverse compile, or otherwise translate the Trial except as specifically permitted by law without the possibility of contractual waiver; (c) sublicense, rent, or lease the Trial; or (d) supply or provide copies of the Trial to third parties, or allow external access to the Trial. **2.1. Trial Eligibility.** The Trial is strictly limited to new customers who have not previously registered for or utilized any Scaleflex Services. Any entity or individual that has previously used Cloudimage or VXP under any plan, including but not limited to legacy plan (FREE, PERSONAL, APPSUMO, STARTUP, PRO, or ENTERPRISE), is expressly excluded from Trial eligibility. Any deviation from this exclusivity requires prior written authorization from the Scaleflex Sales team. Scaleflex reserves the right to verify prior usage and, at its sole discretion, take enforcement action as defined in Section 2.2 against any account found to be in violation of this requirement. **2.2. Enforcement of Eligibility.** Any account found to be infringing the eligibility rules set forth in Section 2.1 shall have its Trial status revoked and be automatically converted to a paid subscription without prior notification to the Customer. Upon such conversion, the Customer will be charged immediately for the smallest available plan at the then-current rates. Failure to satisfy this payment obligation in full upon issuance of the charge shall result in the immediate suspension of access to the Service, including all associated tokens and data, until the payment matter is resolved to Scaleflex's satisfaction 3. **Warranty** THIS TRIAL IS SUPPLIED "AS IS", WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE OR UNINTERRUPTED OR ERROR FREE USE OF THE TRIAL OR THAT DEFECTS WILL BE CORRECTED OR THAT THE TRIAL OR THE SERVER THAT MAKES IT AVAILABLE ARE FREE OF VIRUSES OR ANYTHING ELSE WHICH MAY BE HARMFUL OR DESTRUCTIVE. THE ENTIRE RISK ARISING OUT OF USE OR PERFORMANCE OF THE TRIAL AND ANY DOCUMENTATION REMAINS WITH YOU. 4. **Limitation of Liability** SCALEFLEX WILL NOT BE LIABLE FOR ANY SPECIAL, INCIDENTAL, OR INDIRECT DAMAGES OR FOR ANY ECONOMIC CONSEQUENTIAL DAMAGES (INCLUDING LOST PROFITS OR SAVINGS), EVEN IF SCALEFLEX, OR ITS RESELLER, HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SCALEFLEX will not be liable for: 1) loss of, or damage to, your records, or data; or 2) any damages claimed by you based on any third-party claim. You agree to indemnify and hold Scaleflex and its employees and agents harmless to the fullest extent from and against all liabilities, legal fees, damages, losses, costs, and other expenses in relation to any claims or actions brought against Scaleflex arising out of or in any related to your breach of the Terms of Use or other liabilities arising out of your use of the Trial. Nothing in the Terms of Use shall be construed so as to exclude or limit the liability of Scaleflex or that of its employees or agents in ways that cannot be excluded or limited by law. 5. **General** This agreement is governed by the laws of France. Any dispute arising from the Terms of Use shall be settled before the competent court in Paris, France. You may terminate your license at any time. If you do so, all your license rights to the Trial are terminated. Scaleflex may terminate your license if you fail to comply with the terms of this Agreement. If Scaleflex does so, all your license rights to the Trial are terminated and you must destroy all your copies of it. You agree to comply with all applicable laws and regulations. 6. **Privacy** Any Personal Information collected during use of the Trial will be handled in accordance with Scaleflex’s Privacy Policy. Please also note that the Trial contains tools provided by third-party service providers and therefore we cannot guarantee the privacy of all your materials. This includes such information as your personal details (name, email, company, any phone number you choose to provide); portal settings (language, content, texts, permissions); and portal information (behavior, events, actions performed, number of logins, creation and login dates, syncs to third-party service providers). # Acceptable Use Policy \[TERM\_3] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 This Acceptable Use Policy (“AUP”) relates to any Product offered by Scaleflex, whether it is provided directly or through another party. By accessing or using the Product, Customer (on behalf of itself and its Users) agrees to the terms of this AUP and will be held responsible for any violations hereof. Capitalized terms not otherwise defined herein shall have the meanings ascribed to them in the Agreement between Customer and Scaleflex. 1. **Prohibited use and content** For the purposes of this AUP, Customer Content, as may also be referred to as Customer Data in some other documents, is defined as any data (including Personal Data), such as electronic data, text, documents, pictures, videos, files or other materials uploaded to, generated by, and/or stored within the Product by Customer. Scaleflex does not access Customer Content without explicit instructions from Customer or upon reasonable written notice to the extent required by applicable law, and accordingly relies on Customer’s compliance with this AUP with respect to Customer Content. Customer may not upload Customer Data or use the Products in a manner that: **1.1.** violates any local, state, national or international applicable laws and regulations, including any regulation on data protection, privacy, direct marketing, artificial intelligence, or any provision of the Agreement; **1.2.** fails to secure any required consents from data subjects, when applicable; **1.3.** advocates or induces illegal activity; **1.4.** infringes or misappropriates the Intellectual Property Rights of another party (for purposes of this AUP, “Intellectual Property Rights” means all and any copyright, know-how, rights in inventions, patents, trade secrets, trademarks and trade names, service marks, design rights, rights in get-up, database rights and rights in data, the right to sue for passing off, utility models, domain names, rights in goodwill and all similar or equivalent rights and in each case, whether registered or not, including any application to protect or register such rights and all renewals and extensions of such rights or applications, whether vested, contingent or future, and wherever existing), by, among other things, publishing, posting, uploading, or otherwise distributing any software, music, videos, or other material protected by intellectual property rights; **1.5.** is threatening, abusive, harassing, defamatory, deceptive, false, misleading, or fraudulent; **1.6.** involves uploading files that contain viruses, malware, corrupted files, or any other similar software or programs that may damage the operation of another person's computer; **1.7.** downloads any file that Customer knows, or reasonably should know, cannot be legally distributed in that way; **1.8.** falsifies or deletes any author attributions, legal or proprietary designations, labels of the origin or source of software, or other material contained in a file that is uploaded; **1.9.** harvests or otherwise collects information about others, including e-mail addresses, without a valid legal basis to do so, or store data for any purposes other than using the Product. 2. **Product Security and Integrity** Customer will use the Product for Customer’s internal business purposes only and will not violate the security or integrity of the Product in any way, including but not limited to: **2.1.** willfully tampering with the security of the Product or generally abuse the Product; **2.2.** interfering with or disrupts the Product or servers or networks connected to the Product; **2.3.** using any high-volume automated means (including robots, spiders, scripts or similar data gathering or extraction methods) to access the Product or any other accounts, computer systems, or networks connected to the Product (each a "System") **2.4.** accessing data on the Product not intended for Customer; **2.5.** logging into a server or account on the Product that Customer is not authorized to access; **2.6.** attempting to probe, scan, or test the vulnerability of any Product or to breach the security or authentication measures or breach or circumvent any security or authentication measures, including without limitation, by scanning, penetrating testing and/or submitting the Product to bug bounty programs; **2.7.** attempting to gain unauthorized access to any portion of the Product whether through hacking, password mining, or any other means; or **2.8.** interfering with or creating an undue burden on the Product, including without limitation, by sending a virus, overloading or denying service, spamming or by scripting, or **2.9.** monitoring data or traffic on a system without permission. Customer shall comply with Scaleflex’s Responsible Disclosure Policy located at [www.legal.scaleflex.com/responsible-disclosure-policy](http://www.legal.scaleflex.com/responsible-disclosure-policy) 3. **Prohibited Commercial Use** Unless Customer has Scaleflex’s express prior written permission, Customer shall not in any way: **3.1.** use, remove, or alter any name, logo, tagline, or other mark of Scaleflex within the Product, or , rebrand, white label, or otherwise market or distribute the Product under any other name, mark, or brand; **3.2.** identify itself or its User(s) as Scaleflex’s employee(s), contractor(s), or agent(s); **3.3.** lease, distribute, license, sell, or otherwise commercially exploit the Product or make the Product available to a third party other than as contemplated in the Agreement; 3.4. access the Product for the purposes of building a competitive product or service or reproducing any features, functions or graphics. 4. **API & Integration Services** **4.1.** Scaleflex’s software development kits (“SDK”) and application programming interface (“API”) documentation are available on developer.scaleflex.com. The documentation describes how Customer may use the SDK and API and build integrations with third party applications. **4.2.** Scaleflex sets and enforces limits on Customer’s use of the API in Scaleflex’s sole discretion. Customer agrees to, and will not attempt to circumvent, such limitations, including without limitation any traffic limits included in the Order Form between Customer and Scaleflex. **4.3.** Customer shall not: * use the API to replicate or compete with any Services offered by Scaleflex; * sell access or sublicense the API for use by a third party; or * transmit any malware or other computer program that may damage, harmfully interfere with, surreptitiously intercept, or expropriate any system or data. **4.4.** Scaleflex may monitor Customer’s use of the API to ensure quality, improve Scaleflex’s products and services, and verify Customer’s compliance with the Agreement. **4.5.** Customer shall keep confidential all API access credentials, passwords, and tokens. **4.6.** Scaleflex reserves the right to improve and modify the API at any point. Customer may be required to use those modified versions. 5. **Monitoring and Enforcement** **5.1.** Scaleflex has the sole discretion to determine whether Customer Content or Customer's use of the Product violates this AUP. All Customer Content or actions that are performed by Customer’s Users, are the sole responsibility of Customer. **5.2.** Customer shall notify Scaleflex promptly of any access or use of the Product in violation of this AUP that it is becoming aware of. 6. **Scaleflex may:** * investigate violations of this AUP or misuse of the Product; * take measures to prevent security threats, fraud, or other illegal, malicious, or inappropriate activity and to ensure compliance with this AUP; * notify Customer of violations of this AUP or misuse of the Product and, as the case may be, immediately or after a reasonable remedy timeframe, suspend or terminate use of the Product, or disclose, subject to due validation by Scaleflex’s Chief Legal Officer or an external law firm representative, any Customer activity that it suspects violates any law or regulation to appropriate law enforcement officials, regulators or judicial or administrative courts or other appropriate third parties. If Scaleflex makes this type of required disclosure Scaleflex will notify Customer, unless Scaleflex is required to keep the disclosure confidential. 7. **Updates to the AUP** Scaleflex may update and change any part or all of this AUP. If Scaleflex updates or changes this AUP, the updated AUP will be made available at [www.legal.scaleflex.com](http://www.legal.scaleflex.com). Scaleflex will notify Customer with an email or a notification in the Scaleflex Product of any material changes or updates. The updated AUP will become effective and binding thirty (30) days after it has been posted. When Scaleflex changes this AUP, the "Updated" date below will be changed to reflect the date of the most recent version (“Update Effective Date”). Scaleflex encourages Customer to review the online AUP periodically. If Customer objects to any such changes, Customer's sole recourse shall be to cease using the Product. Continued use of the Product following the Update Effective Date of any such changes shall indicate Customer's acknowledgement of such changes and agreement to be bound by the updated AUP. # DMCA Copyrights Policy \[TERM\_4] Created on: 14.01.2020 - Last modified / reviewed: 15.09.2025 Scaleflex SAS ("Scaleflex") respects the intellectual property rights of others and requests the users of its services to do the same. If you believe that certain content, which appears on Scaleflex cloud-based image management solution (the "Service"), infringes upon copyrights that you own or represent, you may send Scaleflex's designated copyright agent ("Copyright Agent") a written notification, stating the location of the copyrighted work claimed to be infringed, in accordance with the provisions of the Digital Millennium Copyright Act ("DMCA"). Upon your notification, Scaleflex may remove or disable access to any such content. To be effective, your notification of claimed infringement must be a written communication provided to the Copyright Agent that includes substantially the following: 1. A physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed; 2. Identification of the copyrighted work claimed to be infringed via using the Service, or if multiple copyrighted works are covered by a single notification, a representative list of such works; 3. Identification of the material that is claimed to infringe or to be the subject of infringing activity and that access to which is to be disabled, and information reasonably sufficient to permit Scaleflex to locate the material; 4. Information reasonably sufficient to permit Scaleflex to contact you, such as an address, telephone number, and, if available, an electronic mail address at which you may be contacted; 5. A statement that you have a good faith belief that the use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; 6. A statement that the information in the notification is accurate, and under penalty of perjury, that you are authorized to act on behalf of the owner of an exclusive right that is allegedly infringed. Following receipt of your communication, Scaleflex may ask you to provide further or supplemental information, prior to removing any content which was displayed on the Service, as Scaleflex deems necessary to comply with the provisions of the DMCA. Scaleflex may also provide the registered user who uploaded the allegedly infringing content with your contact details, in order for that person to be able to contact you directly and communicate with you regarding your notification. Submission of the Notice Copyright Agent Details Please submit your notice to our Copyright Agent at: or mail it to the following address: Scaleflex SAS Att: Copyright Agent 53 Chemin de Beauregard 38330 Saint-Nazaire-Les-Eymes France Please note that the Copyright Agent receives DMCA notifications only. Any other matters, such as comments, requests and other messages should be referred to: . Counter notification As the registered user who uploaded the allegedly infringing content, you may submit a counter-notification to the Copyright Agent. To be effective, your counter notification must be a written communication provided to the Copyright Agent that includes substantially the following: 1. Your physical or electronic signature; 2. Identification of the material to which access has been disabled and the location at which the material appeared before access to it was disabled. 3. A statement under penalty of perjury that you have a good faith belief that the material was disabled as a result of mistake or misidentification of the material to be disabled; 4. Your name, address, and telephone number, and a statement that you consent to the jurisdiction of the Court of Paris, France. After receipt of a counter notification, Scaleflex will promptly provide the person who submitted the claimed copyright infringement notification with a copy of the counter notification, and will inform that person that Scaleflex will replace the removed material, or cease disabling access to that material 10 business days. Scaleflex will then replace the removed the material and cease disabling access to it between 10 to 14 business days following receipt of the counter notification, unless the Copyright Agent first receives notice from the person who notified Scaleflex of the claimed copyright infringement that such person has filed an action seeking a court order to restrain the registered user from engaging in infringing activity relating to the material on Scaleflex's system or network. **Repeat infringements** Scaleflex may deny or cancel any individual use of the Service, or terminate your user account, if Scaleflex determines in its sole discretion that you are a repeat infringer. A repeat infringer is a user who has been notified of infringing activity more than once or a user that his or her uploaded material was removed from the Service more than once. Scaleflex may decide, at its sole discretion, that a sufficient reason exists for the immediate termination of your account for any reason, at any time. In these cases Scaleflex may terminate your account immediately. Scaleflex may notify you that it canceled your account by sending a message to the e-mail address that you provided during the registration process. Such notification will come into effect immediately. **Misrepresentations** Under the provisions of the DMCA, any person who knowingly materially misrepresents: (1) that material is infringing, or (2) that material was removed or disabled by mistake or misidentification, will be liable for any damages, including costs and attorneys’ fees, that Scaleflex may incur, if it is injured by such misrepresentation, as the result of its reliance upon such misrepresentation in removing or disabling access to the material claimed to be infringing. # Website Terms Of Use \[TERM\_5] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 1. **Acceptance of Terms** Your access to, and use of hub.scaleflex.com or any other website owned and/or operated by Scaleflex ("the Website") is subject to Scaleflex’s terms of use, including these Website Terms of Use, Scaleflex’s Privacy Policy, and the other legal notices, disclaimers, and policies contained on this Website ("Terms of Use"). **a.** You will not use the Website for any purpose that is unlawful or prohibited by the Terms of Use. **b.** The Website is not for use by any minors (defined as those who are not at least 18 years of age), and you are therefore prohibited from using this website if you are a minor. **c.** By using the Website, you indicate that you fully accept the Terms of Use. If you do not accept the Terms of Use, you must immediately stop using the Website. d. Scaleflex reserves the right to: **i.** Change the Terms of Use at any time, and your continued use of the Website following any such changes shall be deemed to be your acceptance of such change; **ii.** Change or remove (whether temporarily or permanently) the Website or any part of it without notice and you confirm that Scaleflex shall not be liable to you for any such change or removal. 2. **General Terms** **a.** If you breach any obligation under the Terms of Use, Scaleflex will be entitled to, at its sole discretion: i. Immediately suspend your access to the Website; and/or ii. Terminate our subscription agreement with you for cause, if you are a Scaleflex customer. **b.** You acknowledge that Scaleflex may disclose information regarding your use of the Website to satisfy any law, regulation, government request, court order, subpoena, or other legal process. If Scaleflex makes this type of required disclosure, we will notify you, unless we are required to keep the disclosure confidential. Further, any such disclosure will be subject to our Privacy Policy \[link]. **c.** Scaleflex is not obligated to, but may choose to, remove any prohibited materials and deny access to any person who violates the Terms of Use \[link]. We further reserve all other rights. **d.** Scaleflex may update and change any part or all of the Terms of Use \[link]. If we update or change the Terms of Use, the updated version will be posted publicly at the Terms of Use, which will constitute notice of such change. The updated Terms of Use will become effective and binding on the next business day after posting. When we change the Terms of Use, the "Updated" date will be updated to reflect the date of the most recent version. We encourage you to periodically review the online Terms of Use. 3. **Links to Third Party Websites** The Website may contain links to other websites run by third parties. Scaleflex does not control, or assume any responsibility for, the content or practices of these other websites. Our provision of these links does not amount to our endorsement of these other websites, nor their content, owners, or practices and you acknowledge and agree that Scaleflex is not responsible for the content or availability of any such sites. 4. **Scaleflex Trademark Use & Copyright** **a.** Unless you have our express prior written permission, you may not use, remove or alter any name, logo, tagline or other mark of ours or the Scaleflex Service, or any identifier or tag generated by the Website, including without limitation: **i.** As a hypertext link to any website or other location (except as provided for or enabled expressly by us); and/or **ii.** To imply identification with us as an employee, contractor, agent, partner, or other similar representative capacity. **b.** All copyright, trademarks, and other intellectual property rights in the Website and its content (including without limitation the Website design, text, graphics, and all software and source codes connected with the Website) are owned by or licensed to Scaleflex, or are otherwise used by Scaleflex, as permitted by law. **c.** In accessing the Website, you agree that none of the content may be downloaded, reproduced, transmitted, stored, sold, or otherwise distributed without the prior written consent of Scaleflex, as the copyright holder. This excludes the downloading, copying, and/or printing of pages of the Website for strictly personal and non-commercial use. 5. **Disclaimers & Limitation of Liability** **a.** The Website is provided “AS IS” and on an “AS AVAILABLE” basis, without any representation, warranty, or endorsement of any kind made by Scaleflex, whether express or implied, including but not limited to the implied warranties of satisfactory quality, fitness for a particular purpose, non-infringement, compatibility, security, and accuracy. **b.** To the extent permitted by law, Scaleflex will not be liable for any indirect or consequential loss or damage whatsoever, including without limitation loss of business, opportunity, data, or profits arising out of or in connection with the use of the Website. **c.** Scaleflex makes no warranties that the functionality of the Website will be uninterrupted or error-free, that defects will be corrected or that the Website or the server that makes it available are free of viruses or anything else which may be harmful or destructive. **d.** Nothing in the Terms of Use shall be construed so as to exclude or limit the liability of Scaleflex or that of its employees or agents in ways that cannot be excluded or limited by law. **e.** The contents of the Website do not constitute advice and should not be relied upon in making, or refraining from making, any decision. 4. **Indemnity** You agree to indemnify and hold Scaleflex and its employees and agents harmless to the fullest extent from and against all liabilities, legal fees, damages, losses, costs, and other expenses in relation to any claims or actions brought against Scaleflex arising out of or in any related to your breach of the Terms of Use or other liabilities arising out of your use of this Website. 5. **Severability** If any of the Terms of Use should be determined to be unenforceable or invalid for any reason by any court of competent jurisdiction, then such Term and Condition shall be severed and the remaining Terms of Use shall survive and remain in full force and effect. 6. **Entire Agreement** The Terms of Use, including legal notices, disclaimers, and other policies contained on this Website, constitute the entire agreement between Scaleflex and you in relation to your use of the Website, and supersede all prior agreements and understandings between you and Scaleflex with respect to the Website. 7. **Governing Law & Forum** The Terms of Use shall be governed by French law. Any dispute arising from the Terms of Use shall be settled before the competent court in Paris, France. # Integrations Terms Of Use \[TERM\_6] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 1. **Introduction** These Integrations Terms of Use describe how Scaleflex provides and supports integrations. By accessing or using integrations, Customer agrees to be bound by these Integrations Terms of Use. To the extent not covered in these Integrations Terms of Use the Agreement between Customer and Scaleflex will apply. By entering into these Integrations Terms of Use on behalf of a company or other legal entity, you represent that you have the authority to bind such entity to these Integrations Terms of Use. 2. **Scaleflex Applications** Please note that integrations developed by Scaleflex (“Scaleflex Applications”) connect the Serviceswith other software(s) and are not required to use the Product. Scaleflex has no control over the product roadmap and development of such other software(s). Even so, Scaleflex will make reasonable efforts to keep Scaleflex Applications compatible with the other software(s). By using Scaleflex Applications, Customer acknowledges that they are provided “as is”, without warranty of any kind, whether express or implied. Scaleflex will have no liability whatsoever, including indemnification for damages, losses, or claims that arise from Scaleflex Applications, including from any modification, combination, or development of Scaleflex Applications that are not performed by Scaleflex. 3. **Non-Scaleflex Applications** Customer acknowledges that certain software features may be available that integrate with the Product which are developed, provided, or offered by third-party providers (“Non-Scaleflex Applications”). Such Non-Scaleflex Applications are not required to use the Product. Scaleflex does not warrant and is not responsible or liable for any aspect of Non-Scaleflex Applications, regardless of whether they are designated or promoted by Scaleflex as "certified," "approved", "recommended", or similar; offered directly by Scaleflex or via its app marketplace; or discussed during any promotion or sales process. The terms and conditions of Customer’s use of Non-Scaleflex Applications are strictly between Customer and the third-party provider. Customer agrees that, if it chooses to use Non-Scaleflex Applications, Scaleflex may grant third-party providers access to the Customer Data to the extent required for the interoperation of such Non-Scaleflex Applications with the Product, and Scaleflex shall not be responsible for any resulting or related disclosure, modification, or deletion of Customer Data. 4. **Integrations Support** For Scaleflex Applications, Scaleflex will provide the level of support included in Customer’s Subscription. For Non-Scaleflex Applications, Scaleflex will not be obligated to provide support beyond maintaining the basic information included in the Knowledge Base and Customer will seek support from that third party directly. Please rest assured that, Scaleflex is still responsible for: (i) maintaining its API in accordance with the API endpoint usages stated in Scaleflex’s API Documentation; (ii) taking steps in case of a malfunctioning integration in order to determine if the API is functioning in accordance with the API Documentation; and (iii) rectifying API malfunctions discovered under (ii) that are the result of a deviation on Scaleflex’s part from the API Documentation. 5. **API** For application programming interface (API) usage, please consult the Scaleflex API Terms of Use, which can be accessed and downloaded directly at: [www.legal.scaleflex.com/api-terms-of-use/](http://www.legal.scaleflex.com/api-terms-of-use/). 6. Privacy Provisions for Specific Integrations **General Principles.** Certain integrations may require additional privacy and data protection measures, in compliance with the EU General Data Protection Regulation (GDPR) and applicable French law. These specific measures are supplementary to the general commitments set forth in these Terms of Use. **Vendor-Specific Measures.** For each third-party vendor, details on data processing, purposes, and specific privacy safeguards are provided in the annex to these Terms (the “Annex”). The Annex forms an integral part of the present Terms of Use. **Precedence.** In the event of a conflict between the general provisions of these Terms and the vendor-specific measures contained in the Annex, the latter shall prevail for the relevant integration. **Updates.** Scaleflex may update or amend the Annex at any time, in line with legal requirements or changes in third-party practices. Users are encouraged to consult the Annex regularly.   **ANNEX 1 - SHOPIFY APP PRIVACY** Created on: 01.01.2024 – Last Updated on: 19.09.2025 Specific integrations will sometimes require additional privacy elements to be described. A list of specific privacy measures and details per third party vendor can be found below. 1. Shopify App Privacy The Scaleflex x Shopify Connector, referred to as "the App," seamlessly integrates Scaleflex DAM with Shopify, known as "the Service," catering to merchants utilizing Shopify for their online stores. This Privacy Policy outlines the process of collecting, utilizing, and sharing personal information when you install or use the App in conjunction with your Shopify-powered store. Please note that the Service was previously marketed under the name ‘Filerobot,’ which may continue to appear on the Shopify marketplace until this designation is fully replaced. For the global privacy and policy please navigate to the parent page. 1.1. Personal Information collection by the App Upon installing the App, certain information from your Shopify account will be automatically accessible to us: * Your merchant store URL / ID
- Your products IDs and Image Assets 1.2. Utilization of your Personal Information We gather those personal information to provide the Service and operate the App. Furthermore, we use this data to: * Distinguish product image data between merchants
- Change image URLs to Filerobot's image URLs * Optimize user experience 1.3. Your Rights If you are a European resident, you have the right to access, correct, update, or delete the personal information we have about you. For this, please reach out to us through the provided contact information below. Additionally, if you are a European resident, note that we process your information to fulfil contracts with you (e.g., orders) or pursue our legitimate business interests. 1.4. Changes to Privacy Policy To reflect changes in practices or for operational, legal, or regulatory reasons, we might update this privacy policy periodically. 1.5. Contact Information For inquiries about our privacy practices specifically related to the use of our Shopify connector App, as well as questions or complaints, please reach out using the following: Email: | **France HQ** | **United States** | **Bulgaria** | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | |

53 Chemin de Beauregard

38330 Saint Nazaire Les Eymes

France

|

3500 South Dupont Highway

Dover DE 19901

United States

|

20 Dimitar Dimov str.,

et. 4, ap. 20

1164 Sofia, Lozenets

Bulgaria

| # Annex 1 - Scaleflex Apps Privacy \[TERM\_6] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 Specific integrations will sometimes require additional privacy elements to be described. A list of specific privacy measures and details per third-party vendor can be found below. 1. **Shopify App Privacy** The Scaleflex x Shopify Connector, referred to as "the App," seamlessly integrates Scaleflex DAM with Shopify, known as "the Service," catering to merchants utilizing Shopify for their online stores. This Privacy Policy outlines the process of collecting, utilizing, and sharing personal information when you install or use the App in conjunction with your Shopify-powered store. Please note that the Service was previously marketed under the name ‘Filerobot,’ which may continue to appear on the Shopify marketplace until this designation is fully replaced. For the global privacy and policy please navigate to the parent page. **1.1. Personal Information collection by the App** Upon installing the App, certain information from your Shopify account will be automatically accessible to us: * Your merchant store URL / ID * Your products IDs and Image Assets **1.2. Utilization of your Personal Information** We gather those personal information to provide the Service and operate the App. Furthermore, we use this data to: * Distinguish product image data between merchants * Change image URLs to Filerobot's image URLs * Optimize user experience **1.3. Your Rights** If you are a European resident, you have the right to access, correct, update, or delete the personal information we have about you. For this, please reach out to us through the provided contact information below. Additionally, if you are a European resident, note that we process your information to fulfil contracts with you (e.g., orders) or pursue our legitimate business interests. **1.4. Changes to Privacy Policy** To reflect changes in practices or for operational, legal, or regulatory reasons, we might update this privacy policy periodically. **1.5. Contact Information** For inquiries about our privacy practices specifically related to the use of our Shopify connector App, as well as questions or complaints, please reach out using the following: Email: | **France HQ** | **United States** | **Bulgaria** | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | |

53 Chemin de Beauregard

38330 Saint Nazaire Les Eymes

France

|

3500 South Dupont Highway

Dover DE 19901

United States

|

20 Dimitar Dimov str.,

et. 4, ap. 20

1164 Sofia, Lozenets

Bulgaria

| # API Terms of Use \[TERM\_7] Created on: 15.09.2025 - Last modified / reviewed: 15.09.2025 Thank you for choosing to use and develop on the Scaleflex API. To use the API, Customer shall accept these terms and all other operating rules, policies, and other procedures that are part of its Agreement with Scaleflex and which Scaleflex may publish in the API documentation and on its website from time to time (collectively, the “Terms”). If not defined here, capitalized terms have the meaning stated in the Agreement between Customer and Scaleflex. 1. **API Access** **1.1. Authorization.** By using the API, you acknowledge that you are authorised to bind Customer, have read and understood the Terms, and agree on Customer’s behalf to the Terms in their entirety. If you do not, or are not able to make these statements, you are prohibited from using the API. **1.2. License.** Except as stated in these Terms, Scaleflex hereby grants to Customer a limited, non-exclusive, non- assignable, non-transferable, revocable license, to access and use the API and to build integrations between the API and other software applications, websites, or products (collectively, “Applications”) for Customer’s internal business purposes. This license is subject to the limitations set forth in the terms below. If Customer violates these restrictions, Scaleflex will automatically terminate Customer’s API license. **1.3. Third Party Access.** These Terms will apply to Customer and any third parties and end users to which Customer gives API access. As such, Customer shall cause third parties and end users to comply with the Terms, and will be responsible for any such third party and end user access as if it were by Customer itself. 2. **Use of API** **2.1. API Documentation.** The API documentation is available at and describes how to effectively use the API and build integrations with other Applications. Please note that parts of the API might be undocumented. Given that these undocumented aspects of the API may change at any time, Customer shall not rely on these behaviours. **2.2. Limits.** Scaleflex sets and enforces limits on Customer’s use of the API in Scaleflex’s sole discretion and may change the limits from time to time by updating the API documentation. Customer shall not attempt to exceed or circumvent limitations on access, calls, or other uses of the API, and shall not otherwise use the API in a manner that is excessive, abusive, or otherwise fails to comply with the API documentation. **2.3. API Restrictions and Responsibilities.** Customer shall not: (i) use the API to replicate or compete with core products or services offered by Scaleflex; (ii) sell access or sublicense the API for use by a third party; (iii) transmit any malware or other computer program that may damage, harmfully interfere with, surreptitiously intercept, or expropriate any system or data; (iv) reverse-engineer or attempt to extract the source code from the API or any other Scaleflex product or service; (v) cache or store Customer Data accessed via the API other than for reasonable periods in order to use Customer’s Application; (vi) engage in any deceptive, misleading, illegal, or unethical activities or other activities that may be detrimental to the API, Scaleflex, Scaleflex’s customers, or the public; (vii) conduct penetration tests or vulnerability scans of the API and other Scaleflex systems or networks without the prior written permission of Scaleflex and outside of the scope of [Scaleflex’s Responsible Disclosure Policy](/privacy-and-data-processing/data-processing/responsible-disclosure-policy). **2.4. Monitoring.** Scaleflex may monitor Customer’s use of the API to ensure quality, improve Scaleflex’s products and services, and verify Customer’s compliance with the Terms. Upon Scaleflex’s request, Customer shall assist Scaleflex in such efforts by providing information about Customer’s Application and storage of Customer Data, which may also include providing access to Customer’s Application and other materials related to Customer’s use of the API. **2.5. Confidential Matters.** Customer shall keep confidential all API access credentials, passwords, and tokens, and shall endeavour to prevent and discourage third parties from making unauthorised use of Customer’s credentials. 3. **Use of Scaleflex Trademarks, Attribution, and Publicity** **3.1.** Customer shall not modify Scaleflex Trademarks and shall only use them in accordance with the requirements in this section and only while these Terms are in effect. “Scaleflex Trademarks” includes the Scaleflex name and logo, any word, phrase, image, or other designation that identifies the source or origin of any of Scaleflex’s products or services. **3.2.** Customer shall: (i) only use Scaleflex Trademarks as made available to Customer by Scaleflex; (ii) only use Scaleflex Trademarks in connection with Customer’s Application; and (iii) immediately discontinue the use of Scaleflex Trademarks upon Scaleflex’s request. Customer shall not use Scaleflex Trademarks in a disparaging, misleading, or confusing way, including suggesting partnership with or sponsorship, endorsement, or approval by Scaleflex. **3.3.** Customer hereby grants to Scaleflex all necessary rights to produce and distribute incidental depictions, including screenshots, videos, or other Customer Data from Customer’s Application, as well as to use Customer’s company or product names and logos to promote, market, and demonstrate the functionality of the API and associated Scaleflex products or services. 4. **Reservation** At any point in the future, Scaleflex may: (i) modify the API and require Customer to use those modified versions; or (ii) independently develop products or services that may compete with Customer’s Application. 5. **Disclaimers, Limitation of Liability and Indemnities** **5.1. NO WARRANTIES.** THE API AND ALL RELATED SERVICES AND INFORMATION ARE PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT ANY WARRANTIES OF ANY KIND, AND SCALEFLEX DISCLAIMS ALL WARRANTIES AND CONDITIONS, WHETHER EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF PERFORMANCE, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. CUSTOMER ACKNOWLEDGES THAT SCALEFLEX DOES NOT WARRANT THAT USE OF THE API WILL BE UNINTERRUPTED, TIMELY, SECURE, ERROR-FREE, OR VIRUS-FREE, NOR DOES SCALEFLEX MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM USE OF THE API, AND NO INFORMATION, ADVICE OR SERVICES OBTAINED BY CUSTOMER FROM SCALEFLEX OR THROUGH RELATED DOCUMENTATION SHALL CREATE ANY WARRANTY NOT EXPRESSLY STATED IN THESE TERMS. **5.2. LIMITATION OF LIABILITY.** TO THE GREATEST EXTENT PERMITTED BY LAW, SCALEFLEX SHALL NOT BE LIABLE TO CUSTOMER OR ANY THIRD PARTY IN RELATION TO THE API FOR ANY INDIRECT OR CONSEQUENTIAL DAMAGES, INCLUDING COSTS AND LOSS OF PROFITS, DELAY, BUSINESS, SAVINGS, OR LOSS OR CORRUPTION OF DATA, EVEN IF ADVISED OF THE POSSIBILITY OT THESE DAMAGES, AND REGARDLESS OR WHETHER ARISING FROM BREACH OF WARRANTY, CONTRACT, NEGLIGENCE, OR ANY OTHER FORM OR THEORY OF LIABILITY. **5.3. Indemnities.** Customer shall defend, indemnify, and hold harmless Scaleflex, its affiliates, and their respective directors, officers, employees, and agents from and against any and all indemnifiable claims, including damages, claims, actions, demands, suits, costs, liabilities, losses, and expenses (including reasonable attorney fees, disbursements, and court costs) arising out of or in any way related to its: (i) use of the API or Customer’s Application; (ii) Content uploaded, posted, transmitted, or otherwise made available through the API or relates services; or (iii) breach of these Terms. # Support Policy \[TERM\_8] Created on: 28.06.2022 - Last modified / reviewed: 08.05.2026 ### **1. Definitions** The following capitalised terms have the meanings set out below throughout this Support Policy and any Order Form or Agreement that incorporates it by reference.
Agreementmeans the master services agreement, order form, or other written contract between Scaleflex and Customer governing use of the Scaleflex Technology.
Business Hoursmeans the hours during which support is available for the Customer's Support Plan, as specified in Section 7.
Calendar Daymeans 24 hours (00:00–23:59)
Cloudimagemeans the Scaleflex image optimisation and CDN delivery service, including all APIs, SDKs, plugins, and supporting infrastructure.
Customermeans the legal entity that has entered into an Agreement with Scaleflex.
Data Backup Service (DBS)means Scaleflex's optional service preserving digital media for a Customer-specified retention period of 30–90 days from upload.
Data Durabilitymeans the ability of the Scaleflex platform to maintain stored data in a complete and uncorrupted state, free from bit rot, drive failure, or corruption.
Data Replication Service (DRS)means Scaleflex's baseline data protection mechanism, which replicates Customer data across at least two geographically distinct data centres.
Feesmeans the amounts payable by Customer to Scaleflex under the Agreement for the relevant subscription period.
Free Trialmeans any trial period during which Customer accesses Scaleflex Technology before the commencement of a paid subscription. No SLA or service credit entitlement applies during a Free Trial.
Incidentmeans an unplanned interruption or degradation of the Scaleflex Technology reported to Scaleflex via a supported channel.
Monthly Availability Percentage

means, for a given calendar month: (A ÷ (B − C)) × 100, where

  • A = minutes the Scaleflex Technology was available (including interruptions under 5 consecutive minutes, excluding minutes counted under C);
  • B = total minutes in that month;
  • C = minutes of unavailability attributable to a Scaleflex Technology Exclusion.

"Available" means the Scaleflex Technology is accessible to Customer for transmitting and receiving data, as measured by Scaleflex server logs.

Monthly Availability SLAhas the meaning set out in Section 8.
Response Timemeans the elapsed time between Scaleflex's receipt of a valid support request and its first substantive acknowledgement, measured in Business Hours or calendar hours as specified per plan.
Scaleflexmeans Scaleflex SAS and its affiliates operating the Scaleflex Technology.
Scaleflex Technologymeans collectively Cloudimage, the Visual Experience Platform (VXP), and any associated APIs, management consoles, and platform infrastructure made available under the Agreement.
Scaleflex Technology Exclusionhas the meaning set out in Section 9.
Scaleflex Technology SLA Support Channelmeans the designated email address support@scaleflex.com, or such other channel as Scaleflex may notify Customer of in writing.
Scheduled Downtimehas the meaning set out in Section 8(b).
Service Creditmeans a credit applied against Customer's future Fees as described in Section 9, constituting Customer's sole and exclusive remedy for an SLA Failure.
SLA Failuremeans any failure by Scaleflex Technology to attain the applicable Monthly Availability SLA in a calendar month, excluding failures attributable to a Scaleflex Technology Exclusion.
Support Planmeans the tier of support (Standard, Advanced, or Premium) purchased by Customer under the Agreement.
Visual Experience Platform (VXP)means the Scaleflex digital asset management and experience platform, including storage, workflow, transformation, and delivery features.
### **2. Scope of Support** **2.1. Included Support Activities** Scaleflex technical support covers the following in relation to the Scaleflex Technology: * Diagnosis and resolution of platform-level Incidents reported by Customer; * Guidance on configuration of Scaleflex APIs, SDKs, plugins, and integrations; * Assistance with onboarding and initial platform setup; * Interpretation of platform behaviour and documented feature operation; * Communication of workarounds where a permanent resolution is pending; * Provision of release notes, upgrade notices, and Scheduled Downtime communications. **2.2. Excluded Activities** The following are outside the scope of technical support: * Development, debugging, or modification of Customer's own application code or third-party integrations; * Training services (available separately under a statement of work); * Issues arising from Customer's failure to comply with documented implementation guidelines; * Support for unsupported, end-of-life, or beta product features; * Issues attributable to a Scaleflex Technology Exclusion (see Section 10). **2.3. Language of Support** Due to Scaleflex’s global customer base, our primary languages for support are English and French. However, as a courtesy, Scaleflex Support accepts tickets submitted to in other languages and will make reasonable efforts to respond in the same language. Please note that any calls or live interactions will be conducted in English or French only. German and Spanish may be available on a case-by-case basis. ### **3. Supported Products** **3.1. Cloudimage** Cloudimage is Scaleflex's image CDN and optimisation service. Support covers the core delivery pipeline (CDN caching, URL-based image transformations, resizing, compression, format conversion), the Cloudimage API and management console, and officially supported plugin integrations. **3.2. Visual Experience Platform (VXP)** VXP is Scaleflex's digital asset management and experience platform. Support covers asset upload, storage, tagging, search, workflow automation, asset transformation, and delivery features, including the VXP API, web application, and official integrations. ### **4. Support Access Model** Scaleflex offers three Support Plans for paid subscriptions, as specified in the Order Form. During any Free Trial period, regardless of the plan indicated, only best-efforts support applies, and no SLA commitment is in force. | **Feature** | **Standard** | **Advanced** | **Priority \*\*** | | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------- | | **Support Availability** |

Mon–Fri

09:00–17:00 CET

|

Mon–Fri

04:00–23:00 CET

| 24 / 7 / 365 | | **Uptime SLA** | 99.90% | 99.95% | 99.99% | | **Contact Channels** | Email / Ticketing | Email / Ticketing | Dedicated Email + Ticketing + Chat | |

Dedicated resources

Support Engineer

Success Manager

|

No

No

|


Optional

8-hours allocated

|


Custom

Custom

| |

Support language

Written

Oral

|


Global

English, French

|


Global

English, French

|


Global

English, French

| | **Free Trial** | Best-Efforts only |


| | **\*\* Note: We may cover oral technical support in German and Spanish.** Response time commitments are measured in Business Hours unless otherwise specified. Business Hours for each plan tier are defined in Section 7. ### **5. Incident Severity Levels** All Incidents must be assigned a Severity level at the time of submission. Scaleflex reserves the right to reclassify an Incident if the reported Severity does not accurately reflect the operational impact. Escalation and reclassification requests are handled under the process in Section 12. **5.1. Severity 1 (S1) — HIGH** S1 is declared when the Scaleflex Technology is entirely unavailable or experiencing a failure that renders core functionality inaccessible for all or a material proportion of Customer's end-users, and no viable workaround exists. *Operational examples:* * *Complete failure of Cloudimage CDN delivery (images not loading across all or most regions);* * *Full unavailability of the VXP platform, including asset management and delivery APIs;* * *Severe data integrity failure affecting stored assets at the platform level;* * *Service outage exceeding 5 consecutive minutes as recorded in Scaleflex server logs.* Upon S1 declaration, Scaleflex will assign a dedicated Incident manager, provide status updates at least every 60 minutes, and engage all appropriate engineering resources until resolution or a confirmed workaround is in place. **5.2. Severity 2 (S2) — MEDIUM** S2 is declared when one or more significant features are substantially degraded, affecting a meaningful subset of Customer's end-users or use cases, and while a workaround may exist, it is insufficient or adds an unsustainable workload for continued normal business operation. *Operational examples:* * *Significant Cloudimage CDN performance degradation (elevated error rates or latency exceeding documented thresholds);* * *VXP upload or workflow automation failures affecting a material portion of assets;* * *Prolonged loss of access to the management console without impact to live delivery.* **5.3. Severity 3 (S3) — LOW** S3 is declared for issues with low operational impact where full workarounds are available, and business operations continue without material disruption. S3 also covers general usage questions, configuration assistance, and non-urgent feature requests. *Operational examples:* * *Incorrect metadata display for a limited number of assets in VXP;* * *Questions about API parameters, SDK usage, or integration configuration;* * *Non-urgent feature enquiries or documentation clarifications.* ### **6. Response and Resolution Targets** The table below sets out contractually committed Response Time targets by Severity level and Support Plan. Resolution time targets are operational objectives and do not constitute separate SLA commitments, given that resolution timelines depend on the nature and complexity of the underlying issue.
SeverityDefinitionStandardAdvancedPriority
S1 – CriticalComplete service unavailability or severe data integrity failure affecting all or a majority of end-users. No viable workaround. Includes full Cloudimage CDN outage or VXP pipeline failure.< 4 Business Hours< 4 Business Hours< 2 Hours (24/7)
S2 – MajorSignificant degradation of core features impacting a subset of users. A partial workaround exists, but is insufficient for normal operations. Includes degraded transformation speeds or intermittent API failures.< 1 Business Day< 12 Business Hours< 6 Business Hours
S3 – MinorLow-impact issue affecting limited users or non-critical features. Full workaround available. Includes UI cosmetic defects, non-urgent configuration questions, or feature enquiries.< 2 Calendar Days< 1 Calendar Day< 12 Business Hours
**S1 Incidents:** For Standard or Advanced plan customers, S1 Incidents occurring outside Business Hours will receive an initial response within 1 hour of the next Business Day opening. Priority plan customers receive S1 response 24/7/365 within 2 hours of reporting. **Service Outage (> 5 consecutive minutes):** Regardless of Support Plan, when a verified service outage exceeding 5 consecutive minutes is confirmed, all Customers gain access to 24x7 email support at with a guaranteed response time of 1 hour until the outage is resolved. ### **7. SLA and Service Availability Framework** **7.1. Scheduled Downtime** Scaleflex may, at its discretion, modify or upgrade the Scaleflex Technology in a manner requiring planned unavailability ("Scheduled Downtime"). Scaleflex will: * Use commercially reasonable efforts to limit Scheduled Downtime to under four (4) hours per event; * Provide Customer with at least seventy-two (72) hours' prior written notice of any Scheduled Downtime; * Conduct Scheduled Downtime during low-traffic windows wherever practicable. * Scheduled Downtime is excluded from Monthly Availability Percentage calculations and does not constitute an SLA Failure. **7.2. Measurement** Monthly Availability is measured using Scaleflex's server logs and internal monitoring systems. Scaleflex maintains records of uptime data for a minimum of three (3) months. **7.3. Data Durability** Scaleflex ensures data durability through two mechanisms: * **Data Replication Service (DRS):** All Customer Data is replicated across a minimum of two geographically separate data centres. Customer acknowledges that if an asset is deleted by an authorised user, it will be removed from all replication locations and will not be recoverable. Basic archiving using cold storage, where applicable, is performed in a single location only and does not benefit from multi-site replication. Scaleflex will not retain Customer Data beyond the period required under its Data Privacy Policy and applicable law, including the GDPR. * **Data Backup Service (DBS):** Available as an optional add-on, DBS preserves all digital media uploaded to the Scaleflex environment for a retention period specified by the Customer, ranging from 30 to 90 days from the date the data is stored and backed up. The applicable retention period must be agreed upon in the Order Form. In the event of a system-wide disaster, Scaleflex targets restoration from backup within one (1) Calendar Day. ### **8. Service Credits** **8.1. Credit Schedule** If Scaleflex fails to achieve the applicable Monthly Availability SLA in any calendar month for reasons other than a Scaleflex Technology Exclusion, Customer is entitled to a Service Credit in accordance with the following schedule: | **Monthly Availability** |

Standard

(target 99.90%)

|

Advanced

(target 99.95%)

|

Priority

(target 99.99%)

| | ----------------------------------- | ---------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | ≥ 99.99% | No credit | No credit | 5% of monthly fee | | 99.95% – 99.98% | No credit | No credit | 7.5% of monthly fee | | 99.90% – 99.94% | No credit | 5% of monthly fee | 7.5% of monthly fee | | < 99.90% | 5% of monthly fee | 7.5% of monthly fee | 10% of monthly fee | Maximum credit cap (all tiers): 10% of the affected calendar month's Fees. Credits may not be cumulated above this cap Service Credits are calculated as a percentage of the Fees paid by Customer for the affected calendar month, prorated to the Scaleflex Technology service experiencing the SLA Failure. Credits will not be awarded or accumulated in excess of the 10% monthly cap under any circumstances. **8.2. Exclusive Remedy** Service Credits constitute Customer's sole and exclusive remedy for any SLA Failure. No SLA Failure shall entitle Customer to a cash refund, termination for cause, or any other remedy not expressly set out in this Support Policy, except as may be required by mandatory applicable law. **8.3. Credit Request Procedure** To be eligible for a Service Credit, Customer must submit a claim to within the calendar month immediately following the month in which the SLA Failure occurred. The claim must include all of the following: * The affected calendar month; * The specific date, start time (including time zone), duration, and Scaleflex Technology service(s) impacted for each alleged incident; * The affected Customer account token; * Documented evidence corroborating the claimed incident (for example, error logs or monitoring screenshots; confidential information should be redacted before submission). * Failure to provide sufficient detail to allow Scaleflex to verify the claim will result in the claim being rejected. Scaleflex will not extend deadlines for Service Credit claim submissions. **8.4. Credit Application** Where a valid claim is confirmed, Scaleflex will apply the applicable Service Credit against the Fees payable by Customer for the month immediately following the month in which the claim is confirmed. Service Credits may not be applied retroactively, exchanged for cash, or transferred to a third party. **8.5. Non-Eligible Circumstances** Service Credits do not apply in the following circumstances: * During any Free Trial period; * Where the unavailability is attributable to a Scaleflex Technology Exclusion (Section 10); * Where Customer has an outstanding overdue payment at the time the SLA Failure occurred; * Where Customer's failure to comply with Section 11 contributed to the SLA Failure; * Where the claim is submitted outside the required timeframe. ### **9. Exclusions and Limitations** **9.1. Scaleflex Technology Exclusions** No failure to achieve an SLA shall constitute an SLA Failure, and no Service Credit shall be payable, where such failure is caused directly or indirectly by any of the following: a. Free Trial: Any availability failure occurring during a Free Trial period. b. Scheduled Downtime c. Customer Direction: Actions or omissions by Scaleflex in compliance with a written request or instruction from Customer. d. Unauthorised Use: Access to or use of the Scaleflex Technology contrary to the Agreement or Scaleflex's published acceptable use policies. e. Customer Breach: Any failure attributable to Customer's breach of the Agreement. f. Customer Non-Participation: Customer's failure to respond in a timely manner to requests for participation in the identification or resolution of an Incident. g. Infrastructure and Connectivity Failures: Failures, degradations, or fluctuations in electrical supply, internet connectivity, network infrastructure, or telecommunications equipment, including those caused by Customer's conduct or circumstances beyond Scaleflex's reasonable control. h. Third-Party Technology: Failures caused by Customer's or a third party's equipment, software, or services not within the exclusive control of Scaleflex. i. Security Threats: Limitation or suspension of the Scaleflex Technology in response to a significant security threat to the platform or Customer data (for example, a DDoS attack or malware incident). j. Unauthorised Modifications: Modifications to the Scaleflex Technology not made or expressly authorised in writing by Scaleflex, including custom HTML, CSS, or JavaScript injected by Customer. k. Non-Essential Components: Unavailability of components not essential to core service delivery, including the Scaleflex public website, reporting dashboards, and administration tools, provided the core service remains operational. l. Pre-Release Features: Unavailability of features designated as alpha, beta, Early Access Programme, trial, or released for testing purposes. m. Internet Access: Issues arising from internet access or connectivity problems beyond Scaleflex's network demarcation point. n. Suspension or Termination: Unavailability arising from Scaleflex's lawful suspension or termination of Customer's access rights under the Agreement. o. Force Majeure: Events beyond Scaleflex's reasonable control, including natural disasters, governmental or regulatory actions, court orders, strikes or labour disputes, acts of civil disobedience, and acts of war. **9.2. General Limitations** Support does not extend to: (i) products, features, or versions no longer supported by Scaleflex; (ii) issues reproducible only in non-production or customer-managed environments; (iii) consulting or professional services activities; or (iv) matters arising from Customer's failure to apply recommended updates or patches within a reasonable period after notification. ### **10. Customer Responsibilities** Customer must fulfil the following responsibilities to enable effective support and to maintain eligibility for SLA commitments and Service Credits: * **Designated Contacts:** Customer must designate at least one authorised technical contact responsible for submitting and managing support requests, and must notify Scaleflex promptly of any changes. * **Incident Reporting:** Customer must report Incidents promptly and accurately through designated support channels. Initial reports should include: the affected service(s), Severity level, a description of the issue, steps to reproduce, impact assessment, and relevant logs or error messages. * **Cooperation:** Customer must cooperate actively with Scaleflex's support personnel during investigation and resolution of Incidents, including providing access to relevant systems, configurations, or logs as reasonably requested. * **Timely Response:** Customer shall respond promptly to all reasonable requests for information or action from Scaleflex. Any Incident placed on hold due to Customer delay or failure to respond shall be excluded from Response Time targets and all related SLA calculations for the duration of such hold period. * **Implementation Compliance:** Customer must implement and use the Scaleflex Technology in accordance with Scaleflex's published documentation, API guidelines, and integration specifications. * **Security Obligations:** Customer is responsible for maintaining the security of its account credentials, authorised users, and any custom integrations. * **Update Management:** Customer is encouraged to apply recommended platform updates, patches, and configuration changes within a reasonable period following notification by Scaleflex. ### **11. Escalation Process** **11.1. Standard Escalation Path** If Customer believes an Incident is not being addressed with appropriate urgency, Customer may request escalation at any time by: Notifying the assigned support engineer via the active support ticket, requesting escalation to a senior engineer or Incident manager; For verified or suspected S1 Incidents, contact directly with the subject line: "ESCALATION – \[Ticket Number] – S1". **11.2. Escalation Response** Upon receipt of a valid escalation request, Scaleflex will: * Acknowledge the escalation within 2 Business Hours; * Assign an Incident manager or senior engineer to review the case; * Provide Customer with an updated assessment of status, timeline, and next steps within 4 Business Hours of acknowledgement. **11.3. Severity Reclassification** Either party may request reclassification of an Incident's Severity level if circumstances change or if the initial classification is believed to be inaccurate. Reclassification will be agreed between the Customer's designated contact and the assigned Scaleflex Incident manager. Response Time targets will be recalculated from the time of reclassification. **11.4. Escalation to Management** Where a Customer remains dissatisfied with the resolution of an escalated Incident, or where an S1 Incident is not resolved within 8 hours, Customer's Account Manager or Customer Success Manager (if applicable) may be engaged to coordinate executive-level attention. Premium plan customers may request direct engagement with Scaleflex's Head of Support at any time. ### **12. Governing law** This Support Policy, and any dispute or claim arising out of or in connection with it or its subject matter (including non-contractual disputes or claims), is governed by and construed in accordance with the law of France, consistent with the Agreement and Scaleflex's Terms of Service (§21.1). ### **13. Versioning and Policy Updates** Scaleflex reserves the right to modify this Support Policy at any time in accordance with Scaleflex's Terms of Service (§22.8) and the applicable Legal Center.
# PRIVACY & DATA PROCESSING # Global Privacy Policy # Global Privacy policy \[PRIVACY\_1] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 Scaleflex SAS and its related entities and subsidiaries (“Scaleflex”) understands that visitors to our website (“the Website”), potential customers, and Users of Scaleflex products (“Products”) care about how their information is collected, used, processed, transferred, stored, and shared. Also, as a European company, we are legally obligated to comply with EU data privacy regulations. This Global Privacy Policy describes Scaleflex’ commitment to protecting your privacy. It forms a part of our Website Terms of Use, Trial Terms of Use, and Standard Terms of Service, and all other documents incorporated therein (“Terms”). Any capitalized terms not defined in this Global Privacy Policy are defined as set out in the Terms. Please familiarize yourself with this Global Privacy Policy. This Global Privacy Policy is formally reviewed annually and is updated as often as necessary. Updates will be posted publicly on the Website. If we make substantive changes to the purposes and policies set out here, we will update this page and we will inform Product Users by email or in-application notification. This Global Privacy Policy provides information on how Scaleflex handles data as a data controller, meaning all data we process for our own purposes. Where Scaleflex is a processor or a sub-processor of data, that activity is generally governed by a Data Processing Agreement. 1. **What We Collect and How We Use It** **1.1. Website.** When you visit the Website, you are not required to actively provide any information, but we may collect some of your Personal Data and Navigation Information, as set out in Section 1.3 below. We collection some Personal Data, and we may collect some Navigation Information, when you contact us via the Website chat function, sign up to download or receive information from us, or sign up to use our Products. Some information is collected via the Website using cookies. See our Cookies Policy. **1.2. Scaleflex Products.** We may collect Personal Data and Navigation Information from Users of our Products to help us provide, administer, and improve our Products. In order to use the Products, you will need to provide your full name and email address to us. To make changes to the permissions you give us, please visit your Scaleflex User profile. **1.3. Collected Data** * “**Personal Data**” refers to any information that can be used to identify you personally. For our purposes, this may include your (first and last) name, email address, User ID, company name, address, phone number and information about you that is publicly available online via sites like Facebook, LinkedIn, Twitter, and Google, data you write in a contact form, your project role, your uploads, your preferences and your account settings. * “**Navigation Information**” refers to information about your computer, device, visits to the Website, and use of the Products. For our purposes, this includes which website you visited prior to visiting us or which link or campaign you clicked on to reach our website, your IP address, geographical location (city and/or country), browser type and version, ISP information, referral source, length of visits, pages viewed, language preferences and heat mapping. In some cases Navigation Information may also be Personal Data. Generally, we may use your Personal Data and Navigation Information for the following purposes: (a) Personalizing the Website for the legitimate purpose of improving your browsing experience. We retain Personal Data processed for this purpose until your browsing session with us has ended or until such time as you no longer have a profile with us; (b) Managing your Scaleflex account in performance of our agreement. We retain Personal Data processed for this purpose until we receive an actionable request to delete a User’s Personal Data, or in the case of termination or expiration of our agreement with a customer, we delete Personal Data as agreed in the Terms; (c) Understanding User preferences for the legitimate purpose of improving our Products. We may retain Personal Data processed for this purpose until you withdraw your consent; (d) Linking your information to learn your preferences and those of people like you for the legitimate purpose of improving our offerings. We may retain Personal Data processed for this purpose until you withdraw your consent; and (e) Contacting you for direct marketing purposes. We may retain Personal Data processed for this purpose until you withdraw your consent. **1.4. Supporting Suppliers.** The Website and Products integrate some services provided by third parties. We may share some of your information with these suppliers so they can provide their services, including payment processing, removing repetitive information from prospect lists, analyzing data, marketing support, customer and/or User profiling, business development, and customer service. To ensure that your Personal Data is collected, processed, used, stored, and transferred securely and in accordance with applicable law, Scaleflex uses third parties that provide sufficient guarantees to implement appropriate technical and organizational measures to protect your information. For such third parties that may transfer Personal Data outside the European Economic Area, Scaleflex confirms that it implements appropriate safeguards for such transfers (e.g. EU Standard Contractual Clauses, and binding corporate rules). Please note, the terms and privacy policies of such third parties may apply to you as well, in particular: Google Analytics, Google Optimize, Google Ads, Google Tag Manager, Google Recaptcha, Hotjar, Twillio, Stripe, Salesforce, Hubspot, Clearbit, and Zendesk. Your acceptance of applicable third-party terms is required to access the Website and Products. Disclaimer: This overview of supporting suppliers provides a current view. Scaleflex strives to keep this list as up to date as reasonably possible. **1.5. Third-Party Websites.** The Website and Products may contain links to third-party websites. Such links do not amount to an endorsement of such other websites. Scaleflex is not responsible for other websites. **1.6. Social Media Buttons.** On our Website we may use the social media plug-ins from Facebook, Twitter, LinkedIn, Vimeo, and YouTube, each marked with its logo. Plug-ins are also used for the embedded video players on our Website. We have implemented these plug-ins using a two-click solution. When you surf on our Website, no information is initially collected by social media plug-ins. if you click on one of the plug-ins or videos will your information be transmitted. When you activate a plug-in, data is automatically transmitted to that provider. These social media platforms have their own data privacy policies. **1.7. Customer Testimonials.** We publish customer testimonials on the Website or in other marketing materials which may contain some Personal Data. Scaleflex obtains consent from the customer and the featured individuals prior to publication. This consent may be withdrawn by email to . **1.8. Information of Children.** The Website and Products are for business use and are not intended for or targeted toward children under 16 (“Children”). We do not knowingly collect any information about Children. We encourage parents and legal guardians to monitor the internet usage of their Children and ensure they do not provide personal information to Scaleflex. If you believe that we have collected information about Children, please contact us at so that we can delete the information. **1.9. We Do Not Sell Personal Data.** We do not sell your Personal Data. 2. **Personal Data Retention and Security** **2.1. Retention of Personal Data.** We retain Personal Data for as long as we reasonably consider it to be necessary for the purposes for which it was collected, after which time we will delete the information. You can request deletion of your Personal Data as described in Section 3 below. **2.2. Security of Personal Data.** Data security is a matter of critical importance. Scaleflex uses a wide range of security measures to safeguard your data against unauthorized access and disclosure and we continually evaluate our security program to ensure its effectiveness. Amazon Web Services provides our servers and maintains them in high-security controlled environments pursuant to the AWS Cloud Security policy. **2.3. Transfer of Personal Data.** As an international company with customers and Users worldwide, we may transfer and access Personal Data around the world, including to and from the United States. To comply with applicable law, we maintain strong data protection and privacy controls to protect your Personal Data during cross-border and international transfers, as well as during periods of storage in foreign countries (e.g. EU Standard Contractual Clauses, and binding corporate rules). We believe that your essential privacy rights are not contingent on your nationality or residency. While applicable law always governs data privacy matters, we intend for this Global Privacy Policy to apply generally to Users and their Personal Data around the world. Nevertheless, privacy law is a constantly changing landscape so we reserve the right to deviate from this Global Privacy Policy where applicable law provides for a different approach. **2.3.a. Data Hosting Locality.** Customers who purchase a paid subscription can choose where the image processing and caching will take place. We operate data centers in 3 locations: Canada, France and Singapore. Image processing can be limited to one or more of these data centers upon request. Similarly, customers can request only CDN nodes in specific regions to be used for delivering the images to their end users. **2.4. Required Disclosure of Your Personal Data.** We may use or disclose your Personal Data if we reasonably determine that such use or disclosure is necessary to (a) protect our rights, operations, or Users; (b) comply with applicable laws, a valid court order, or other legal process; or (c) otherwise perform our contractual obligations with our customers. We may transfer the data we control, including Personal Data, in the event of a company reorganization, merger, or sale. 3. **Your Data and Your Rights** As a general matter, depending on local data protection laws, you have rights that may include: * Clear information on our processing of your Personal Data; * Access your Personal Data that we hold, together with the right to have inaccuracies corrected; * To have your Personal Data delivered to you in a standard electronic format; * To object to our processing of your Personal Data, and to prevent solely automated decision making or profiling; and * To restrict our processing of your Personal Data, or have your Personal Data deleted. **3.1. Exercising Your Rights.** If you wish to exercise your rights with respect to your Personal Data, you can email your request to or send postal mail to: Scaleflex SAS Attn: Copyright Agent / Legal Team – Privacy 53 Chemin de Beauregard 38330 Saint-Nazaire-Les-Eymes, France We will generally respond to your request within 30 days. If you wish to unsubscribe from an email list, please click the “unsubscribe” link found at the bottom of our emails. If you work for one of Scaleflex’ customers, the best course is to ask the customer to delete your Personal Data. If you want to raise a complaint about the way we process your Personal Data or the way we have handled a request, please contact us. You may file a complaint with the data protection authority of any country where you live or work or where Scaleflex operates. Product Users can withdraw consent by adjusting their User profile settings in the Products. Please note that the collection, processing, use, sharing, storage, and transfer of your Personal Data may be necessary for you to make use of our services and that Scaleflex customers and Users cannot unsubscribe from important User emails. 4. **EU General Data Protection Regulation (GDPR)** The GDPR is a new European privacy regulation which replaces the current EU Data Protection Directive (“Directive 95/46/EC”) on May 25th 2018. The GDPR aims to strengthen the security and protection of personal data in the EU and harmonize EU data protection law. If a company collects, transmits, hosts or analyzes personal data of EU citizens, GDPR requires the company to use third-party data processors who guarantee their ability to implement the technical and organizational requirements of the GDPR. The GDPR applies to all organizations operating in the EU and processing “personal identifiable data” of EU residents. Personal data is any information relating to an identified or identifiable natural person. **4.1. Data minimisation.** According to article 5, clause 1(c) of the GDPR text, Data collected on a subject should be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed” We only collect and store data required for our service to run. We call these data the Service Data. Service Data is any information, including personal data, which is stored in or transmitted via the Scaleflex services, by, or on behalf of, our customers and their end-users. 5. **California Consumer Privacy Act (CCPA) Supplement** The CCPA is effective January 1, 2020. If you are a resident of California, this supplement to the Global Privacy Policy sets out additional rights and information for you. Many obligations under the CCPA are addressed in other provisions of the Global Privacy Policy. This Supplement is meant to fill in the gaps for California residents and the terms used in this Supplement are either defined in the Global Privacy Policy or in the text of the CCPA. **CCPA Consumer Rights** * The right to access, and to know both the categories of personal information and the specific personal information we collect; * The right to have your personal information deleted, subject to some legal limitations; * The right to request disclosure of the personal information collected; and * The right to disclosure of information disclosed for valuable consideration. **Submitting Requests under CCPA** California residents may submit requests for information under the CCPA to Scaleflex by email to . Please be as specific as possible when you exercise your rights under CCPA and submit a request regarding your personal information. Under the CCPA, we are obligated to verify your identify before we process your request. **No Discrimination** Scaleflex will not discriminate against you in pricing, user experience, or any other way for exercising any of your rights under the CCPA. 6. **Service Data definition** In order for the Scaleflex Service to function following data are collected: * Images and image URLs you provide to Scaleflex for processing and delivery * Analytics about the delivery of the images processed by Scaleflex. These analytics do not contain and process any personal identifiable data * Access logs on the Content Delivery Networks (CDNs) used by Scaleflex to deliver images to your end users. These logs contain the IP addresses of the end users requesting an image delivered by Scaleflex, which is considered as personal identifiable data according to GDPR and is subject to additional measures to comply with it, outlined in our DPA. The IP address is the only personal information we and our sub-processors process and store temporary in our logging database. We store a pseudonymised version of the IP address for up to in our logging database. Because we are not able to guarantee that all of our sub-processors store the users IP address in a pseudonymised matter, we have created our Data Processing Addendum (DPA), which, together with the Scaleflex Terms and Conditions form the Principal Agreement you enter to with Scaleflex SAS, the company offering the Scaleflex service. In addition to the data we collect in order to provide our Service to you, we use analytical tools to track the way visitors of the Scaleflex website use the website and aggregate this information in order to improve it. Additional information on the trackers we use can be found in our Privacy Policy. **6.1. Categories of data processed** **a. End User Personal Data.** Scaleflex processes Personal Data included within Customer Content (“End User Personal Data”) when providing the Services to Customer. Upon the Customer’s choice, End User Personal Data may include data such as: * Login credentials; * Subscriber name and contact information; * Financial or other transaction information; * Other Personal Data relating to the individual data subject as set by Customer. **b. Logged Personal Data.** CDN providers process Personal Data that is included in log files when performing the Services for Customer (Logged Personal Data”). Logged Personal Data is Personal Data logged by CDN Providers' servers, relating to the access to Customer Content over the CDN providers' platform by Customer’s end users, as well as logged personal data associated with user activity and interaction with web and internet protocol sessions transiting CDN providers’ servers as part of a data subject’s session with the Customer’s web property. Logged Personal Data include such data as: * End user IP addresses; * URLs of sites visited with time stamps (with an associated IP address); * Geographic location based upon IP address and location of CDN providers' server; **6.2. Service Data ownership.** From a privacy perspective, the customer is the controller of Service Data, and Scaleflex is a processor. This means that throughout the time that a customer subscribes to services with Scaleflex, the customer retains ownership of and control over Service Data in its account. **6.3. Removal and pseudonymization of Service Data.** As data processor under GDPR, we are required to offer our customers the option to correct, amend or delete personal data. Our Invalidation API allows you to remove all data related to an image from the Scaleflex (Cloudimage) cache, processing servers and CDN. Personal data (visitor's IP address) is pseudonymised as per the contractual commitments outlined in our DPA. In addition, we remove the personal data we store according to the following rules: | **Type of Data** | **Removed after** | | ---------------------------------- | ----------------- | | Visitor's pseudonymised IP address | 30 days | | Cached images | 30 days | **6.4. Who are Scaleflex’ sub-processors?** Scaleflex maintains an up-to-date list of the names and locations of all sub-processors used for hosting or other processing of Service Data, which can be found under sub-processors. Should you have any more questions about one or more sub-processors, you can email . By adopting a Scaleflex solution, you will be added to an emailing list to receive updates on our sub-processor list. # Cookies and Similar Tracking Technologies Policy \[PRIVACY\_2] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 This Cookies and Similar Technologies Policy (this “Policy”) provides you with general information about cookies and similar tracking technologies (collectively, “Tracking Technologies”) as well as how and for what purposes Scaleflex SAS and its affiliates (“Scaleflex”, “we”, “us” or “our”) use such Tracking Technologies on the Scaleflex website (“Website”). Please take the time to read this Policy. If you have questions or comments, you are welcome to contact us at: . **What Are ‘Cookies’?** Cookies are small files with pieces of information, normally consisting of just letters and numbers, which websites use when users visit them. Software on the users’ devices (for example, a web browser) can store cookies and send them back to the website the next time they visit, to make a specific function of the website work and to provide information about the user’s activities on the website. **For What Purposes Are Cookies Being Used?** Cookies are used in numerous ways. For example, when analysing traffic to a website or tracking users’ browsing behaviour. Cookies are widely used as they allow a website to recognize a user’s device. Cookies and other similar technologies help websites to remember the visitors and their activities, for example, the user’s login details, or the goods users wish to buy when they add goods to their online basket or proceed to the checkout on an internet shopping website. **What Are ‘Session’ and ‘Persistent’ Cookies?** **“Session Cookies”** are removed from your device once you close your browser session. **“Persistent Cookies”** last for longer periods on your device – after you close your browser session. A user can delete previously set persistent cookies manually or configure the browser settings to delete cookies, as further described below. **What Are ‘First-party’ and ‘Third-party’ Cookies?** First-party cookies are set directly by the website that the user is visiting. For the purpose of this Policy, these are cookies that are set directly by this Website. Third-party cookies are set by a domain other than the one visited by the user. For the purpose of this Policy, these are cookies that are set by service providers of this Website. **What Are ‘Similar Technologies’?** Functions usually performed by a cookie can be achieved by other means. This could include, for example, using certain characteristics to identify devices so that visits to a website can be analysed. Any technology that stores or accesses information on the user’s device is relevant for this purpose, and therefore it includes, for example, HTML5 local storage, Local Shared Objects and fingerprinting techniques. Additionally, technologies like scripts, tracking pixels and plugins, wherever these are used – are also considered as similar technologies. For example, many companies, including us, conduct electronic marketing and incorporate a tracking pixel in email messages. The pixels record information including the time, location and operating system of the device used to read the email. **Does Scaleflex Use Tracking Technologies?** Yes, we do. We use both Session Cookies and Persistent Cookies as part of your experience on this Website so that we can facilitate the use of the Website’s features and tools, keep track of your preferences, improve your experience with our Website, for web analytics and for marketing purposes. Some cookies are strictly essential for the operation of this Website while other cookies help to improve our services and marketing activities. The same rule goes for all Tracking Technologies that we use. When a Tracking Technology contains personal data, then the Scaleflex Privacy Policy applies as well. **Does Scaleflex Need to Obtain My Consent for Using Tracking Technologies?** Yes, however only with respect to the Tracking Technologies that are not strictly essential for the operation of this Website. For essential Tracking Technologies Scaleflex does not need your consent. If you do not agree to accept our cookies or other Tracking Technologies that are not strictly essential for the operation of this Website, we will make commercially reasonable efforts to provide you with as similar level of services as we can. **Can I Manage My Tracking Technologies Preferences?** Every browser allows you to manage your Tracking Technologies preferences, usually found in the “Help” or “Settings” sections of the web browser. Here are some links to some commonly used web browsers: (a) Google Chrome; (b) Microsoft Edge; (c) Mozilla Firefox; (d) Microsoft Internet Explorer; (e) Opera; (f) Apple Safari. You can turn off certain third-party targeting or advertising cookies by visiting the following link: Network Advertising Initiative. To find out more about cookies, including how to see what cookies have been set, you can visit the following websites: [www.aboutcookies.org](http://www.aboutcookies.org) and [www.allaboutcookies.org](http://www.allaboutcookies.org). Some web browsers offer a “Do Not Track” (“DNT”) signal. A DNT signal is an HTTP header field indicating your preference for tracking your activities on our services or through cross-site user tracking. This Website does not respond to DNT signals. **Will We Change This Policy?** We update this Policy, when needed. Every time we will change this Policy, we will post a notice on this Website if our policy update includes substantial changes and obtain your consent once again, where required under applicable laws. # Sub Processors \[PRIVACY\_3] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 **Introduction** Scaleflex SAS (“Scaleflex”, "Cloudimage", "Filerobot") uses certain sub-processors (including members of the Scaleflex Group and third parties, as listed below), subcontractors and content delivery networks to assist it in providing the Scaleflex Services as described in the Terms of Use. **What is a Sub-processor** A sub-processor is a third-party data processor engaged by Scaleflex, including entities from within the Scaleflex Group, who has or potentially will have access to or process Service Data (which may contain Personal Data). Scaleflex engages different types of sub-processors to perform various functions as explained in the tables below. Scaleflex refers to third parties that do not have access to or process Service Data but who are otherwise used to provide the Services as “subcontractors” and not sub-processors. **Due Diligence** Scaleflex undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed sub-processors that will or may have access to or process Service Data. **List of sub-processors** You will find below the list of our suppliers, which qualify as data sub-processors. We have signed DPAs with all of them and are keeping this list up-to-date. | **Entity Name** | **Entity Type** | **Entity Country** | | ------------------------------------------------- | --------------- | ------------------ | | OVH SAS | IAAS provider | France | | Akamai Technologies SARL (Cloud Compute / Linode) | IAAS provider | France | | Amazon Web Services, Inc | IAAS provider | Ireland | | Microsoft Inc (Azure) | IAAS provider | Ireland | |

Google Cloud

(Vertex AI & Vision)

| AI provider | Ireland | | Akamai Technologies SARL | CDN provider | France | | CDNetworks Europe, Co. Ltd. | CDN provider | United Kingdom | | FASTLY | CDN provider | USA | | Amazon Web Services, Inc (Cloudfront) | CDN provider | Ireland | | Salesforce.com EMEA Ltd | CRM provider | United Kingdom | | HubSpot | CRM provider | France | | Zendesk, Inc | STS provider | USA | **Definition** | IAAS | Infrastructure-as-a-Service | | ---- | -------------------------------- | | AI | Artificial Intelligence | | CDN | Content Delivery Networks | | CRM | Customer Relationship Management | | STS | Support Ticketing System | # Data Privacy Addendum \[PRIVACY\_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 This Data Processing Addendum, including its Schedules, (“DPA”) supplements and forms an integral part of the agreement as governed by the Scaleflex Standard Terms and Conditions available at [www.legal.scaleflex.com](http://www.legal.scaleflex.com) (“Terms”) or any other agreement between Customer and the applicable Scaleflex contracting entity (“Scaleflex”) governing the use and access of the Product (“Agreement”). This DPA reflects the parties’ agreement with regard to the Processing of Personal Data by Scaleflex on behalf of the Customer in connection with the Product. Unless otherwise defined in this DPA or the Agreement, all capitalised terms used in this DPA will have the meanings given to them in Section 1 of this DPA. Any other relevant terms will have the meanings given to those terms under Applicable Law. 1. **Definitions.** “**AI**” means Artificial Intelligence. These (opt-in only) features, will be offered in conjunction with the Product, and used based on Customer’s sole discretion. AI features bring the capability to analyse data, make predictions, and automate tasks. “**AI Policy**” means Scaleflex' Artificial Intelligence Privacy Policy. This AI Policy provides Customer guidelines on the use of AI features within the product, emphasising data handling and privacy considerations, accessible here. “**CCPA**” means the California Consumer Privacy Act Cal. Civ. Code § 1798.100 et seq., and any amendments or supplements thereto, including the final California Consumer Privacy Act Regulations. Further specified in Schedule 6 to this DPA. “**Controller**” means the entity which determines the purposes and means of the Processing of Personal Data. “**Customer**” means the legal entity that is a party to the Agreement with Scaleflex. “**Data Protection Legislation**” means all laws and regulations, including but not limited to national, supranational and state-level privacy law(s), applicable to the Processing of Personal Data under the Agreement. “**Data Subject**” means the identified or identifiable person to whom Personal Data relates. “**EEA**” means the European Economic Area. “**GDPR**” means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). “**Personal Data**” means any information relating to an identified or identifiable natural person where such data is Processed by Scaleflex on behalf of Customer. “**Processing**” (and all verb tenses) means any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; “**Processor**” means the entity which Processes Personal Data on behalf of the Controller. “**Sensitive Categories of Data**” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs; trade-union membership; genetic data, biometric data processed solely to identify a human being; health-related data; data concerning a person's sex life or sexual orientation. “**Sub-Processor**” means a Processor engaged by Scaleflex. “**Standard Contractual Clauses**” means, according to the Standard Contractual Clauses set forth in Schedule 5 to this DPA, (a) where the GDPR applies, the Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (“EU SCCs”), or (b) where the UK GDPR applies, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses of 21 March 2022 (“UK Addendum”). “**Supervisory Authority**” means an independent public authority established or recognized under Data Protection Laws. "**UK GDPR**" means the Data Protection Act 2018, as well as the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419). 2. **Processing of Personal Data.** **2.1. Scope, Roles and Details of the Processing.** This DPA, including any Schedules and Annexes, applies when Personal Data is processed by Scaleflex pursuant to the Agreement. Regarding the Processing of Personal Data, Customer is the Controller, Scaleflex is the Processor and Scaleflex will engage Sub-Processors pursuant to the requirements set forth in Section 6 below. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 1 to this DPA. **2.2. Customer’s Processing of Personal Data.** Customer shall, in its use of the Product, Process Personal Data in accordance with the requirements of Data Protection Legislation, including any applicable requirement to provide notice to Data Subjects of the use of Scaleflex as Processor. For the avoidance of doubt, Customer’s instructions for the Processing of Personal Data shall comply with Data Protection Legislation. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data. If Customer chooses to enable any AI features within the Agreement, Scaleflex' AI Policy will apply. Customer specifically acknowledges that its use of the Product will not violate the rights of any Data Subject that has opted-out from sales or other disclosures of Personal Data, to the extent applicable under the CCPA. **2.3. Scaleflex Processing of Personal Data.** Scaleflex shall treat Personal Data as Confidential Information and shall Process Personal Data on behalf of and only in accordance with Customer’s documented instructions for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); and (ii) Processing initiated by Users in their use of the Product. 3. **Instructions.** **3.1. Customer Affiliates.** Customer represents that it is authorised to give data processing instructions to Scaleflex and to otherwise act on behalf of any Customer Affiliates under this DPA. **3.2. Documented Instructions.** This DPA and the Agreement are Customer’s complete and final documented instructions at the time of signature of the Agreement with Scaleflex for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately and in writing. **3.3. Exception.** If Scaleflex is required by law to conduct additional processing, it shall inform Customer of that legal requirement before Processing, unless such notification is prohibited by law. **3.4. Instructions likely to violate Data Protection Legislation.** If, in Scaleflex' opinion, Customer’s instructions are either likely to violate Data Protection Legislation, Scaleflex is entitled to refuse to follow such instructions and shall inform Customer of the reasons for its refusal. In such cases, Customer shall provide alternative instructions in a timely manner and Scaleflex may cease all Processing of the impacted Personal Data (other than secure storage thereof) until it receives acceptable instructions. 4. **Scaleflex Personnel.** **4.1. Confidentiality Obligations.** Scaleflex ensures that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, and have executed written confidentiality agreements. **4.2. Limited Access.** Scaleflex ensures that Scaleflex' access to Personal Data is limited to those personnel performing services in accordance with the Agreement. **4.3. Data Protection Officer.** Scaleflex has appointed a data protection officer (“DPO”). The appointed DPO may be reached at . 5. **Security of Processing.** **5.1. Measures.** Scaleflex has implemented and shall maintain appropriate technical and organisational measures to protect Personal Data against accidental, unauthorised, or unlawful destruction, loss, alteration, disclosure, and access (“Security Measures”), as described in Schedule 3 of this DPA, including as appropriate: a. the pseudonymisation and encryption of Personal Data; b. the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of Processing systems; c. subject to the Service Level Agreement, the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and d. the regular testing, assessment, and evaluation of the effectiveness of the Security Measures. **5.2.** Customer has made an independent determination as to whether these Security Measures meet the Customer's requirements. **5.3.** Third Party Certifications. Scaleflex has obtained third party certifications as set forth in Schedule 3 of this DPA. Upon Customer’s written request, but not more than once per year, and subject to the confidentiality obligations set forth in the Agreement, Scaleflex shall make available to Customer a copy of Scaleflex' then most recent third-party certification and audit report, as applicable. 6. **Sub-Processors.** **6.1. General Authorization.** Customer agrees that Scaleflex may use Sub-Processors to fulfil its contractual obligations under this DPA or to provide certain services on its behalf. **6.2. Sub-Processor Obligations.** Scaleflex will enter into a written agreement with the Sub-Processor and Scaleflex will impose on Sub-Processors data protection obligations not less protective than those in this DPA. **6.3. Sub-Processor List.** Scaleflex currently uses the Sub-Processors listed in Schedule 2 to this DPA. A list of Sub-Processors is also available on Scaleflex' website at (“Sub-Processors”). Scaleflex will update the Sub-Processors Page with any new Sub-Processor and notify Customer at least 30 calendar days before such Sub-Processors will begin to Process Personal Data. **6.4. Objection Right.** Customer may object to the use of a new Sub-Processor on a reasonable and legitimate basis. In the event Customer objects to a new Sub-Processor, Customer shall provide written notice to within the 30 calendar day notice period set out in Section 6.3, outlining Customer’s specific concerns about the new Sub-Processor in order to give Scaleflex the opportunity to address such concerns. Scaleflex may, at its sole discretion, (i) not appoint the Sub-Processor and/or propose an alternate Sub-Processor; (ii) take the steps to address the Customer’s specific concerns and obtain Customer’s written consent to use the Sub-Processor; or (iii) make available to Customer the Scaleflex Product(s) without the particular aspect that would involve use of the objected-to Sub-processor. If Scaleflex is unable or determines in its reasonable judgement that it is commercially unreasonable to do any of the options in Section 6.4 (i)-(iii), Customer may terminate the Agreement in accordance with section 19.3 of the Terms. **6.5. Liability.** Scaleflex will remain responsible for the performance of a Sub-Processor to the same extent Scaleflex would be responsible if performing the services of each Sub-Processor directly under the terms of this DPA. 7. **Rights of Data Subject.** Scaleflex will, to the extent legally permitted, notify Customer without undue delay if Scaleflex receives a request from a Data Subject to exercise the Data Subject’s rights set forth in Data Protection Legislation, especially Chapter III of GDPR (“Data Subject Request”). Taking into account the nature of the Processing, Scaleflex will assist Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to Data Subject Requests under Data Protection Legislation. To the extent Customer is unable to address a Data Subject Request, Scaleflex will upon Customer’s request provide commercially reasonable efforts to assist Customer in responding to such Data Subject Request. To the extent legally permitted, Customer will be responsible for any costs arising from Scaleflex' provision of such assistance. 8. **Assistance.** Taking into account the nature of Processing and the information available to Scaleflex, Scaleflex will provide reasonable assistance and cooperation to Customer in respect of its relevant obligations under Articles 32 to 36 GDPR. To the extent legally permitted, Customer will be responsible for any costs arising from Scaleflex' provision of such assistance. 9. **Personal Data Breach Notification.** Scaleflex will notify Customer without undue delay, but always within 48 hours, after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise Processed by Scaleflex or its Sub-Processors of which Scaleflex becomes aware (“Personal Data Breach”). Notification of Personal Data Breaches, if any, will be delivered by email at the email address specified for notices in the applicable Order Form, if no email address is specified, to one or more of Customer’s Product administrators. Scaleflex' obligation to notify Customer of a Personal Data Breach is not an acknowledgement by Scaleflex of any fault or liability with regard to the Personal Data Breach. 10. **Return and Deletion of Personal Data.** **10.1.** Upon Customer’s request to Scaleflex will return or delete Personal Data in accordance with the timeframes specified in the Agreement, unless European Union law or the laws of a EU member state requires that Scaleflex retains the Personal Data. Scaleflex may delete Personal Data six months after termination or expiration of the Agreement. Scaleflex shall dispose Personal Data in accordance with the latest method(s) of data sanitising, as detailed in NIST 800-88 (“Guidelines for Media Sanitization”). **10.2.** Notwithstanding anything to the contrary in this DPA, Scaleflex may retain Personal Data if and for as long as required by law. **10.3.** Personal Data stored in Scaleflex' auto-backup or archival systems will be deleted automatically after 180 days after back-up, or otherwise as soon as technically possible. Upon written request, Scaleflex shall provide a certificate to Customer certifying that Customer Data has been destroyed. **10.4.** If Customer provides Personal Data on a hard drive or other forms of removable media, such removable media must be encrypted or password protected. In collaboration with Customer, Scaleflex shall either return the removable media to Customer, or securely destroy such removable media by using a certified third party. A certificate of destruction can be made available to Customer upon request. 11. **Customer Audits.** **11.1. Summary Report of Internal Audit.** In addition to Section 5.3, Scaleflex will on a regular basis audit the security of the systems that it uses to Process Personal Data. Upon Customer’s written requests, Scaleflex will make available to Customer a summary of the results of this audit ("Summary Report") to demonstrate compliance with the obligations under this DPA. **11.2. Customer Audit.** If Customer substantiates that the Summary Report cannot satisfactorily demonstrate Scaleflex' compliance and that it has a justifiable suspicion that Scaleflex is in breach of this DPA, Customer may conduct an audit on Scaleflex' premises, not more than once per year, and subject to the confidentiality obligations set forth in the Agreement and following conditions: a. Customer must provide at least 30 days’ prior written notice to . Such notice must indicate the reasons for the audit request, and will be effective upon Scaleflex' confirmation of receipt; b. Audits will be conducted within a mutually agreed scope, duration, and timing; performed by Customer, or a third party that is pre-approved by Scaleflex, such approval not to be unreasonably withheld; and conducted within Scaleflex' normal business hours and with best efforts taken to avoid disruption of Scaleflex' business operations; **11.3. Cost.** The cost of an audit on Scaleflex' premises will be borne by Customer, unless a Material Breach (as defined in the Agreement) of this DPA is found, in which case Scaleflex will bear the costs. **11.4.** Nothing in this Section 11 varies or modifies the Standard Contractual Clauses nor affects any Supervisory Authority's or Data Subject's rights under the Standard Contractual Clauses. 12. **Transfers of Personal Data to Third Countries.** **12.1. Regions.** Customer may specify the location where Customer Data, including Personal Data, will be Processed in the Agreement (“Region”). Except as necessary to provide the Product and services initiated by Customer, or as necessary to comply with the law, Scaleflex will not transfer Personal Data from Customer’s selected Region. A transfer to a third country shall take place only if the conditions of Chapter V. GDPR are complied with. **12.2. Application of Standard Contractual Clauses.** Scaleflex will enter into Standard Contractual Clauses with each affiliate and/or Sub-Processor where the Processing of Personal Data is transferred outside the EEA, either directly or via onward transfer, to any third country not recognized by the European Commission as providing an adequate level of protection for Personal Data. The Standard Contractual Clauses will not apply to Personal Data that is not transferred, either directly or via onward transfer, outside the EEA. **12.3. Revision of Standard Contractual Clauses.** Parties agree that, in the event the Standard Contractual Clauses are revised or replaced by a competent authority, they shall execute any updated or replacement Standard Contractual Clauses in order to ensure continued compliance with Data Protection Legislation. It shall be the Customer's obligation to inform Scaleflex about the location of their end users to facilitate proper data processing and compliance with applicable Data Protection Legislation. **12.4. Order of precedence.** If the Standard Contractual Clauses apply, nothing in this Section 12 varies or modifies the Standard Contractual Clauses. 13. **Limitation of liability.** Each party’s liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’ section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together. 14. **Entire Agreement, Hierarchy.** Except as amended by this DPA, the Agreement will remain in full force and effect. If there is a conflict between any other agreement between the parties including the Agreement and this DPA, the terms of this DPA will take precedence to the extent of such conflict. 14. **Term and termination.** This DPA shall enter into force at the same time as the Agreement and shall automatically terminate upon any termination or expiration of the Agreement. 15. **List of Schedules.** * Schedule 1: Details of the Processing of Personal Data * Schedule 2: Sub-Processors and Scaleflex Entities * Schedule 3: Security Measures * Schedule 4: Details of the Processing * Schedule 5: Cross Border Transfers * Schedule 6: CCPA Addendum * Annex A: Technical and Organisational Measures # Schedule 1: Details of Processing of Personal Data \[PRIVACY\_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 **Nature and Purpose of Processing.** Scaleflex will Process Personal Data as necessary to provide the Product pursuant to the Agreement and as further instructed by Customer in its use of the Product. **Duration of Processing.** Subject to Section 10 of this DPA, Scaleflex will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing. **Categories of Data Subjects.** Customer may store Personal Data in the Product, the extent of which is determined and controlled by Customer in its sole discretion. The sole Personal Data required for the use of the Product relates to the following categories of Data Subjects: * Employees of Customer * Customer’s Users Upon Customer’s sole discretion, additional Data Subjects might be relevant for the use of (opt-in) AI features within the Product: * Data Subjects in Customer Assets **Types of Personal Data.** Customer may store Personal Data in the Product, the extent of which is determined and controlled by Customer in its sole discretion. The sole categories of Personal Data required for the use of the Product are: * First and last name * Email address * IP addresses Upon Customer’s sole discretion, additional categories might be used for the use of (opt-in) AI features within the Product: * Biometric data **Special categories of data.** The Product is not intended for Customer to store Sensitive Categories of Data, which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person (unless AI features have been enabled), data concerning health or data concerning a natural person’s sex life or sexual orientation, or Personal Data relating to criminal convictions and offences. Notwithstanding the foregoing, when AI features have been enabled, Scaleflex highly advises Customer against including Special Categories of Data within Scaleflex' asset labelling taxonomy, particularly in tags or free-form text. # Schedule 2: Sub-Processors and Scaleflex Entities \[PRIVACY\_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 Scaleflex works with certain third parties, as listed below, to provide specific functionalities within the Product(s). In order to provide the relevant functionality these Sub-Processors access Customer Data. Their use is limited to the indicated activities:
Entity nameSub-Processor activityEntity country
OVH SASIAAS providerFrance
Microsoft Inc (Azure)IAAS providerIreland
Amazon Web Services, IncIAAS providerIreland
Salesforce.com EMEA LtdCustomer Relationship Management providerUnited Kingdom
HubSpotCustomer Relationship Management providerFrance
Zendesk, IncSupport ticketing providerUSA
**Scaleflex entities** \ The following entities are part of the corporate structure of Scaleflex. Depending on the geographic location of the Customer, Scaleflex may also engage one or more of the following entities as Sub-Processors.
Entity nameSub-Processor activityEntity country
Scaleflex SASParent companyFrance
Scaleflex Inc.SubsidiaryUnited States
**Content Delivery Networks (“CDN”)** \ Scaleflex may use CDN to assist with the delivery of the Product(s). CDNs do not have access to Customer Data itself, but are systems commonly used to provide fast delivery of content based on the geographic location of the individual accessing the content and the origin of the content provider:
Entity nameSub-Processor activityEntity countryCDN Location
Amazon Web Services, Inc (Cloudfront)Content Delivery Network providerIrelandGlobal
Akamai Technologies SARLContent Delivery Network providerFranceGlobal
CDNetworks Europe, Co. Ltd.Content Delivery Network providerUnited KingdomGlobal
FASTLYContent Delivery Network providerUSAGlobal
# Schedule 3: Security Measures \[PRIVACY\_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 Scaleflex will implement and maintain the following Security Measure to adequately protect Customer’s Personal Data. Customer understands and agrees that these Security Measures are subject to technical progress and development and Scaleflex is therefore expressly allowed to implement adequate alternative measures as long as the general security level described in this Schedule 3 is maintained: 1. **Technical measures** **1.1. Access control.** Scaleflex shall prevent unauthorised access to data processing systems. Personnel shall only have access to Customer data when it’s necessary for them to perform their job. Customer data shall not be read, copied, modified or deleted without authorization. **1.2. Entry control.** Scaleflex shall prevent that data processing systems can be accessed by unauthorised parties. **1.3. Logging control.** Scaleflex shall ensure that all events in the data processing systems can subsequently be checked. **1.4. Transmission control.** Scaleflex shall ensure that Personal Data cannot be read, copied, altered or removed without authorization during electronic transmission. **1.5. Data at rest.** Scaleflex shall ensure the appropriate encryption of data at rest. **1.6. Data in transit.** Scaleflex shall ensure that data over the public internet is encrypted at rest according to industry best practices. **1.7. Separation control.** Scaleflex shall ensure that data collected for various purposes are processed separately. **1.8. Reliability control.** Scaleflex shall ensure that all functions of the data processing system are available and occurring malfunctions are notified. **1.9. Integrity control.** Scaleflex shall ensure that stored Personal Data cannot get damaged by malfunctions of the system or that damaged data can be replaced by the original and correct data. **1.10. Availability control.** Scaleflex shall ensure that Personal Data is protected against unintentional destruction or loss and therefore available for the Customer. 2. **Organisational measures** **2.1. Admission Control.** Scaleflex shall prevent unauthorised persons from gaining access to Scaleflex premises. **2.2. Security and awareness training.** Scaleflex shall maintain a security awareness program that includes the appropriate training of personnel on Scaleflex' security policies. **2.3. Personnel screening.** Criminal background checks shall be performed for all employees before hiring. Additionally, Scaleflex will ensure that all employees have executed written confidentiality agreements. **2.4. Information security management process.** Scaleflex shall maintain established documentation covering the Scaleflex information security management system. **2.5. Business continuity management process.** Scaleflex shall maintain a business continuity management system, that defines the processes and procedures in the event of a disaster, including the testing and reviewing of the disaster recovery plans. **2.6. Regular evaluation of Security Measures.** Scaleflex shall ensure a process for regular testing, assessing and evaluating the effectiveness of technical and organisational measures to ensure a level of security appropriate to the risk of processing. # Schedule 4: Details of the Processing \[PRIVACY\_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 **I. LIST OF PARTIES** **Data exporter(s):** * Name: The entity identified as **Customer** in the DPA. * Address: The address specified in the DPA or in the Agreement. * Contact person's name, position and contact details: The contact details specified in the DPA or in the Agreement. * Activities relevant to the data transferred under these Clauses: Use of the Scaleflex Product(s). * Signature and date: By entering into the Agreement, data exporter is deemed to have signed these Standard Contractual Clauses set forth under schedule 5, including their Annexes, as of the Effective Date of the Agreement. * Role (Controller/Processor): Controller **Data importer(s):** * Name: The entity identified as **Scaleflex** in the DPA * Address: The address specified in the DPA or in the Agreement. * Contact person's name, position and contact details: The contact details specified in the DPA or in the Agreement. * Activities relevant to the data transferred under these Clauses: Provision of the Scaleflex Product(s). * Signature and date: By entering into the Agreement, data importer is deemed to have signed these Standard Contractual Clauses set forth under schedule 5, including their Annexes, as of the Effective Date of the Agreement. * Role (Controller/Processor): Processor **II. DESCRIPTION OF TRANSFER** **Nature of the processing.** Scaleflex will Process Personal Data as necessary to provide the Product pursuant to the Agreement and as further instructed by Customer in its use of the Product. **Categories of Data Subjects whose Personal Data is transferred.** Customer may store Personal Data in the Product, the extent of which is determined and controlled by Customer in its sole discretion. The sole Personal Data required for the use of the Product relates to the following categories of Data Subjects: * Employees of Customer * Customer’s Users Upon Customer’s sole discretion, additional Data Subjects might be relevant for the use of (opt-in) AI features within the Product: * Data Subjects in Customer Assets **Categories of Personal Data transferred.** Customer may store Personal Data in the Product, the extent of which is determined and controlled by Customer in its sole discretion. The sole categories of Personal Data required for the use of the Product are: * First and last name * Email address * IP addresses Upon Customer’s sole discretion, additional categories might be used for the use of (opt-in) AI features within the Product: * Biometric data **Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.** The Product is not intended for Customer to store sensitive categories of data, which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person (unless AI features have been enabled), data concerning health or data concerning a natural person’s sex life or sexual orientation, or Personal Data relating to criminal convictions and offences. Notwithstanding the foregoing, when AI features have been enabled, Scaleflex highly advises Customer against including Special Categories of Data within Scaleflex' asset labelling taxonomy, particularly in tags or free-form text. **The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).** The frequency of the transfer is a continuous basis for the duration of the Agreement, unless otherwise agreed upon in writing. **Purpose(s) of the data transfer and further processing.** Scaleflex will Process Personal Data as necessary to provide the Product pursuant to the Agreement and as further instructed by Customer in its use of the Product. **The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period.** Scaleflex may delete Personal Data six months after termination or expiration of the Agreement, unless European Union law or the laws of an EU member state requires that Scaleflex retains the Personal Data for a longer period. Personal Data stored in Scaleflex' auto-backup or archival systems will be deleted automatically after 180 days after back-up, or otherwise as soon as technically possible. **For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing.** Specified on Scaleflex' website at (“Sub-Processors”). Sub-Processors will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing. # Schedule 5: Cross-Border Transfers \[PRIVACY\_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 **PART 1 – EEA Cross Border Transfers** 1. The parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to an EEA Transfer. 2. Module Two (Controller to Processor) of the Standard Contractual Clauses shall apply where the EEA Transfer is effectuated by Customer as the data Controller of the Personal Data and Scaleflex is the data Processor of the Personal Data. 3. Specifications. The following clauses of the Standard Contractual Clauses, have either been amended in accordance with the applicable Privacy Regulation, or require additional specifications as set forth below:
Clause 7(Docking Clause) shall not apply.
Clause 9Section 6 of the DPA specifies the procedure for appointing Sub-Processors and the timeframe for providing prior notice of any changes related to the Sub-Processors list, set forth in Schedule 2 of this DPA.
Clause 17These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the same governing law stated in the Agreement, as long as it is the law of one of the EU Member States allowing for third-party beneficiary rights, otherwise, the governing law will be the law of France.
Clause 18(b)Disputes and Complaints will be resolved before the courts of the EU Member State, listed in Clause 17.
Annex I.AShall be completed according to Schedule 4, I. List of Parties, Data exporter(s) of the DPA.
Annex I.BShall be completed according to Schedule 4, I. List of Parties, Data importer(s) of the DPA.
Annex I.CIn accordance with Clause 13, the data exporter’s competent Supervisory Authority will be determined in accordance with the GDPR.
Annex IIThe Technical and Organisational Measures, as mentioned in the Data Processing Agreement (DPA) under Annex A, are incorporated as Annex II in the Standard Contractual Clauses.
4. To the extent there is any conflict between the Standard Contractual Clauses and any other terms in this DPA, the provisions of the Standard Contractual Clauses will prevail. **PART 2 – UK Cross Border Transfers** **I. Part one: Tables**
Table 1The Parties: as stipulated in Schedule 4, I. List of Parties of this DPA.
Table 2Selected SCCs, Modules and Selected Clauses: as stipulated in Schedule 5, Part 1 – EEA Cross Border Transfers, of this DPA.
Table 3Appendix Information: means the information which must be provided for the selected modules as set out in the Appendix of the EU SCCs, and which for this Part 2 is set out in Schedule 5, Part 1 – EEA Cross Border Transfers, of this DPA.
Table 4Ending this Addendum when the Approved Addendum changes. The Parties that may end this Addendum as set out in Section 19: ☒ Importer ☐ Exporter ☐ neither Party
**II. Part two: Mandatory Clauses** \ Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, shall apply. Specifications. The following clauses of the Standard Contractual Clauses, have either been amended in accordance with the applicable Privacy Regulation, or require additional specifications as set forth below:
Part I, clause 16Shall not apply. For the avoidance of doubt, these Clauses are governed by the laws of England and Wales. Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.
Part I, clause 17The Parties are deemed to have accepted the format of this UK cross Border Transfer schedule, as of the Effective Date of the Agreement.
# Schedule 6: CCPA Addendum \[PRIVACY\_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 This CCPA Addendum (“CCPA Addendum“) forms part of the Data Protection Addendum (“DPA“), to the extent applicable for the provision for the Product, between Customer and the applicable Scaleflex contracting entity (“Scaleflex”). In the event of a conflict between the terms and conditions of the DPA and those of this CCPA Addendum, this Addendum shall prevail. Capitalised terms used but not defined in this Addendum shall have the meanings given in the Agreement. 1. **Definitions** * “**Business**”, “**Collects**”, “**Consumer**”, “**Business Purpose**”, “**Sell**”, “**Service Provider**”, and “**Share**” shall have the meanings given to them in §1798.140 of the CCPA. * “**Business Purpose**” has the meaning given in Section 5 of this CCPA Addendum. * “**California Consumer Privacy Act**” or “**CCPA**” means Title 1.81.5 California Consumer Privacy Act of 2018 (California Civil Code §§1798.100—1798.199), as amended or superseded from time to time. * “**California Privacy Rights Act**” or “**CPRA**” means the California Privacy Rights Act of 2020 (2020 Cal. Legis. Serv. Proposition 24, codified at Cal. Civ. Code §§1798.100 et seq.), and its implementing regulations, as amended or superseded from time to time. * “**Personal Information**” means personal information as defined by §1798.140 of the CCPA submitted to Scaleflex for processing pursuant to the Agreement. 2. **Scope.** This CCPA Addendum only applies where, and to the extent that, Scaleflex processes Personal Information that is subject to the CCPA and/or the CPRA on behalf of Customer as a Service Provider in the course of providing the Product pursuant to the Agreement. 3. **Business Purpose.** Scaleflex shall only collect and process Personal Information as a Service Provider upon lawful documented instructions from Customer, including those in the Agreement, this CCPA Addendum, and Customer’s configuration of the Product or as otherwise necessary to provide the Product specified in the Agreement (the “Business Purpose”). Scaleflex will not process the Personal Information for any purpose other than for the Business Purpose, except where and to the extent permitted by the CCPA. 4. **Scaleflex obligations** **4.1.** Customer is a Business and appoints Scaleflex as its Service Provider to Collect and process the Personal Information for the Business Purpose. Scaleflex is responsible for its compliance with its obligations under this CCPA Addendum and for compliance with its obligations as a Service Provider under the CCPA. Customer is responsible for compliance with its own obligations as a Business under CCPA and shall ensure that it has provided notice and has obtained (or shall obtain) all consents and rights necessary under the CCPA for Scaleflex to collect and process the Personal Information for the Business Purpose. **4.2.** Scaleflex shall not: (a) Sell the Personal Information; (b) retain, use, or disclose the Personal Information for any purpose other than for the Business Purpose; (c) retain, use, or disclose the Personal Information outside of the direct business relationship between Scaleflex and Customer (except where Scaleflex has engaged a subprocessor to assist in the provision of services); (d) Share or process the Personal Information for targeted and/or cross context behavioural advertising; (e) combine Personal Information with any other data if and to the extent this would be inconsistent with the limitations on Service Providers under the CCPA. Scaleflex certifies that it understands and agrees to comply with the restrictions set out in this section 4.2. Scaleflex shall notify Customer if it determines that it cannot meet its obligations under the CCPA. **4.3.** If the CCPA permits, Scaleflex may aggregate, de-identify, or anonymize Personal Information so it no longer meets the Personal Information definition, and may use such aggregated, de-identified, or anonymized data for its own research and development purposes 5. **Assistance with Customer’s CCPA obligations** **5.1.** Scaleflex will reasonably cooperate and assist Customer with meeting Customer’s CCPA compliance obligations and responding to CCPA-related inquiries, including responding to verifiable consumer requests, taking into account the nature of Scaleflex' processing and the information available to Scaleflex. **5.2.** Scaleflex must notify Customer without undue delay if it receives any complaint, notice, or communication that directly or indirectly relates to either party's compliance with the CCPA. Specifically, Scaleflex must notify Customer without undue delay, if it receives a verifiable consumer request under the CCPA. 6. **Audits.** Scaleflex permits Customer to monitor its compliance with this CCPA Addendum subject to Section 11 in the DPA “Customer Audits”. 7. **Notification.** Scaleflex agrees to notify Customer if Scaleflex makes a reasonable determination that it can no longer meet its obligations under this CCPA Addendum or CCPA requirements. 8. **Selling.** Scaleflex certifies that it understands the rules, requirements and definitions of the CCPA and agrees to refrain from selling (as such term is defined in the CCPA) any Personal Information. # Annex A: Technical and Organisational measures \[PRIVACY\_3] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 **ANNEX A : TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA** **Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.** Data importer will implement and maintain the technical and organisational measures to adequately protect the data exporter’s Personal Data as further described in the DPA. Data exporter understands and agrees that these technical and organisational measures are subject to technical progress and development and Scaleflex is therefore expressly allowed to implement adequate alternative measures as long as the general security level described in the DPA is maintained. **For transfers to (Sub-) Processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a Processor to a Sub-Processor, to the data exporter.** Scaleflex selects its Sub-Processors very carefully, all of which undergo stringent security assessments and intakes. Scaleflex has imposed on them data protection obligations that correspond to the data protection provisions in the contractual relationship between Customer and Scaleflex. Taking into account the state of the art, costs of implementation, and nature of the processing, our Sub-Processors shall maintain appropriate technical and organisational measures to protect Personal Data against accidental, unauthorised, or unlawful destruction, loss, alteration, disclosure, and access (“Security Measures”), including, as appropriate: (a) the pseudonymisation and encryption of Personal Data; (b) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of Processing systems; (c) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and (d) the regular maintenance, testing, assessment, evaluation, and updating of the effectiveness of the Security Measures. # GDPR\_Standard Contractual Clauses (SCC) \[PRIVACY\_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 (MODULE 2 - Controller to Processor Transfer) - In accordance with Commission Implementing Decision (EU) 2021/914 These Standard Contractual Clauses (“SCCs”) are entered into by and between Scaleflex SAS, established in the European Economic Area (“EEA”), and Scaleflex Inc., located in the United States, for the purpose of governing the cross-border transfer of personal data between the two entities. Pursuant to Articles 44 et seq. of Regulation (EU) 2016/679 (the “GDPR”), such transfer requires appropriate safeguards, as the United States is not subject to an adequacy decision by the European Commission. By executing these Clauses, the Parties commit to ensuring a level of data protection that is essentially equivalent to that guaranteed within the European Union. **List of Parties:** **Data Exporter:** * Name: Scaleflex SAS * Address: 53 Chemin du Beauregard, 38330 Saint-Nazaire-Les-Eymes, France * Contact Person: Jean-François Lecas, Chief Experience Officer & DPO * DPO Contact: * Relevant Activities: Data Controller **Data Importer:** * Name: Scaleflex Inc. * Address: 3500 South Dupont Highway, Dover DE 19901 * Contact Person: Jean-François Lecas, Managing Director North America * DPO Contact: * Relevant Activities: Data Processor **Clause 1 - Purpose and Scope** These Standard Contractual Clauses aim to ensure the compliance of personal data transfers from the EEA to a third country (the United States), in accordance with Article 46 of the GDPR. **Clause 2 - Description of the Transfer** | **Categories of Data Transferred** | **Categories of Data Subjects** | | --------------------------------------------------------------------- | ------------------------------------ | | Technical identifiers (IP addresses, logs, metadata) | End customers of the data controller | | Authentication data (professional email) | Employees of clients | | Multimedia content associated with users (images, videos, file names) | Technical administrators | **Purpose of the Transfer:** Personal data is transferred to Scaleflex Inc. for the exclusive purpose of enabling: * Corrective and evolutive maintenance of services provided by Scaleflex SAS, including the diagnosis of anomalies affecting media file processing that contain personal data. * Advanced technical support (L1/L2/L3), particularly the analysis of assistance requests requiring secure access to the concerned data to reproduce or resolve incidents reported by clients. * Continuous infrastructure monitoring (NOC - Network Operations Centre), for performance, availability, security, and integrity management of services. * Research and Development (R\&D) on Scaleflex products and services, for strictly internal purposes of technological improvement (e.g., optimisation of media processing algorithms), without using data for other purposes or external communication. **Duration of Processing:** For the term of the contract between Scaleflex SAS and its clients + 30 days. **Location of Processing:** United States (Scaleflex Inc.). **Clause 3 - General Obligations** Scaleflex Inc. undertakes to: * Process personal data only on documented instructions from Scaleflex SAS. * Implement appropriate technical and organisational measures. * Alert Scaleflex SAS in the event of a security incident or unauthorised access request. * Not transfer data to another sub-processor without the prior written consent of Scaleflex SAS and without the signature of a sub-SCC. **Clause 4 - Additional Safeguards** In accordance with the Schrems II judgment, the parties agree on the following safeguards: * Data is encrypted at rest and in transit, and Scaleflex Inc. does not have access to the encryption keys. * In the event of an access request by U.S. authorities, Scaleflex Inc. shall: * Immediately inform Scaleflex SAS, unless legally prohibited. * Legally oppose any request that is manifestly excessive or non-compliant. **Clause 5 - Governing Law and Jurisdiction** These clauses are governed by French law. In the event of a dispute, the competent jurisdiction shall be that of Paris. | **Scaleflex SAS** | **Scaleflex Inc.** | | ----------------------- | -------------------------------- | | Emil Novakov | Jean-François Lecas | | Chief Executive Officer | Managing Director, North America | # Data Processing # Responsible Disclosure Policy \[DATA\_1] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 At Scaleflex, we are committed to keeping our systems, network and product(s) secure. Despite the measures we take, the presence of vulnerabilities will always be possible. When such vulnerabilities are found, we’d like to learn of them as soon as possible, allowing us to take swift action to shore up our security. **Under Scaleflex’ Responsible Disclosure Policy, you are allowed to search for vulnerabilities, so long as you don’t​:** * execute or attempt to execute a Denial of Service (DoS) * make changes to a system * install malware of any kind * social engineer our personnel or customers (including phishing) * scan or run tests in a manner that would degrade the operation of the service or negatively affect our customers in any way * physically attack or damage Scaleflex property, offices or data centers or attempt to do so * run tests on third party applications, websites or services that integrate with or link to Scaleflex * scan or attack the Scaleflex infrastructure or attempt to do so Breaching the above restrictions may result in Scaleflex launching an investigation and/ or taking legal action to the greatest extent of Scaleflex’ legal obligation and rights or that of our partners and customers. If you do discover a vulnerability, please contact us as soon as possible by sending an (encrypted) email to ​ or . **What we ask of you:** * Submit your vulnerability report as soon as possible after discovery * Do not abuse or exploit discovered vulnerabilities in any way for any purpose * Do not share discovered vulnerabilities with any entities or persons other than Scaleflex and its employees until after Scaleflex has confirmed the vulnerability has been resolved * Provide us with adequate information to enable us to investigate the vulnerability properly (to be able to investigate properly, we will need to be able to efficiently reproduce your steps) * Provide us with information required to contact you (at least telephone number or business email address) **What we promise:** * We will respond to your report within 5 business days of receipt, with our evaluation of the report and an expected resolution date. * We will keep you regularly informed of our progress toward resolving the vulnerability. * If you have followed the above instructions, we will not take any legal action against you regarding the report. **Rewards and attribution:** * Please do not ask for a reward before sharing the vulnerability, as we need to evaluate your report before responding. * If you report a vulnerability that is unknown to us, and if you are not from a country where we are prohibited by law from making payments (e.g. due to sanctions), we may decide to offer you a reward based upon our assessment of the criticality of the vulnerability. **Assets in scope:** * * Accounts that can be self-provisioned at **Out of scope assets:** * \*.scaleflex.com * \*.cloudimage.io * \*.filerobot.com **Acquisitions:** For all our acquisitions, in order to give our development and security teams time for internal review and remediation, we will introduce a six-month blackout period. Vulnerabilities reported in that period will not qualify for a reward. **Out of scope vulnerabilities:** * Vulnerabilities affecting users of outdated or unsupported browsers or platforms * Password and account recovery policies, such as reset link expiration or password complexity * Issues that require unlikely user interaction * Attacks requiring MITM or physical access to a user's device * Attacks that require prior access to a user's email account * Reports from automated tools or scanners * Clickjacking/UI Redressing * Reflected file download * Verbose error pages (without proof of exploitability) * SSL/TLS Best Practices * Incomplete/Missing SPF/DKIM * Fingerprinting / banner disclosure on common/public services * Disclosure of known public files or directories, (e.g. robots.txt) * Content spoofing (text injection) * Tabnabbing * OPTIONS HTTP method enabled * Recently disclosed zero-day vulnerabilities that had an official patch for less than 30 days will be awarded on a case by case basis * Presence of autocomplete attribute on web forms * Use of a known-vulnerable library (without proof of exploitability) * CSV Injection * Missing HTTP Security Headers (without proof of exploitability) * "Self" Cross-Site Scripting (unless if it is part of a chain) * Missing cookie flags * Missing best practises in Content Security Policy **The following template can be used when submitting a vulnerability:**
TitleDescription
# Description[Description of the identified vulnerability]
# Steps to reproduce
  1. Step 1
  2. Step 2
  3. [...]
# Impact[What could an attacker achieve by exploiting the vulnerability​]
Any report submitted in relation to this Responsible Disclosure Policy will be handled with great care with regards to the privacy of the reporter. We will not share your personal information with third parties without your permission, unless we are legally required to do so. # Artificial Intelligence Privacy Policy \[DATA\_2] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 This Artificial Intelligence Privacy Policy (“AI Policy”) applies to Customers’ use of Scaleflex products and/or services (the “Product”) that incorporate artificial intelligence capabilities, as further set forth in a Customer’s subscription agreement relating to the Product (the “Agreement”). This AI Policy is intended to provide Customers with additional information regarding Scaleflex’ handling of Customers’ Personal Information and guidelines for Customers' use of AI functionalities within the Product, including data handling and privacy considerations. 1. **Definitions** **1.1.** “**AI**” means Artificial Intelligence. AI features may be purchased and used as part of Customer’s subscription for the Product, as further detailed in the Agreement. AI features are intended for use in analysing data, making predictions, and automating tasks. **1.2.** For purposes of this AI Policy, Scaleflex shall be a “**Processor**” and/or "**Service Provider**”, as the terms are defined under applicable privacy law. **1.3.** For purposes of this AI Policy, Customer shall be the “**Controller**”, as the term is defined under applicable privacy law. **1.4.** “**Customer Data**” means electronic data, text, documents, pictures, videos, or other materials uploaded to, generated and/or stored within the Product by Customer and Users. **1.5.** Any terms used but not defined herein, such as “**Personal Data**”, “**Sensitive Personal Data**”, “**Data Subject**” and “**Data Subject Request**” shall have the meaning given to them in accordance with the Agreement and/or the applicable privacy laws, including, but not limited to the General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the "GDPR")." 2. **Human Oversight of AI** By using AI features in the Product, Customer acknowledges and agrees that any action or decision that may impact an individual’s privacy rights (for example, the application of tags and other metadata to an individual’s photograph or recorded likeness) shall be subject to human oversight and intervention as needed. Under GDPR and other applicable privacy laws, individuals have the right to not be subjected to decisions solely based on automated processing (including “profiling”) that may affect their privacy rights. Customer shall comply with applicable laws and regulations in its use of AI features. 3. **Compliance with Laws: Customer Data Subjects’ Rights** **3.1.** In accordance with GDPR and other applicable laws and regulations, Customer, as the Controller of Personal Data processed using Scaleflex’ AI features, understands and acknowledges its requirement to fulfil Data Subjects’ requests related to assets uploaded by Customer and its end users. This includes providing Data Subjects with (i) clear and comprehensive information regarding how Personal Data is processed; (ii) access to Personal Data held by Customer, with the right to request corrections for any inaccuracies; (iii) the option to receive Personal Data in a standard electronic format; (v) the right to object to the processing of Personal Data by Customer and to prevent exclusive reliance on automated decision-making or profiling; (vi) the ability to impose restrictions on the processing of data subjects’ Personal Data or request its deletion by Customer; and (vii) the right to be informed about the sale or sharing of Personal Data as well as the opportunity to opt out. **3.2.** Scaleflex, in accordance with GDPR and other applicable laws and regulations, will assist Customer in fulfilling Data Subjects’ access requests, as outlined in Section 3.1 above. Scaleflex will offer necessary support and information to enable the Customer to meet its obligations and ensure compliance with applicable regulations. Upon Customer's written request, Scaleflex may additionally provide Customer with the option to complete a Data Protection Impact Assessment (DPIA) pertaining to any AI features that may be connected to a Data Subject’s access request. 4. **Security Requirements** Scaleflex shall maintain and frequently review policies for information security which include administrative, physical and technical safeguards required to ensure the confidentiality, integrity, availability and continuity of the Product. Ⓘ *The following Section 5 shall apply only when Customer has purchased and implemented AI “facial recognition” features for the Scaleflex Product.* 5. **Biometric Data (Facial Recognition)** **5.1.** As used in this AI Policy, “Biometric Data” means any Personal Data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow for or confirm the unique identification of that natural person, such as facial images. **5.2.** Customers are responsible for developing and complying with their own “Biometric Data retention policies,” as may be required under applicable law and regulation. **5.3.** Biometric Data may constitute “Sensitive Personal Data” under GDPR and other applicable privacy laws. Accordingly, Scaleflex shall use reasonable care to store, transmit and protect from unauthorised disclosure any Biometric Data it processes, and shall store, transmit, and protect from unauthorised disclosure all Biometric Data using the same standard of care with which Scaleflex stores, transmits, and protects its own personally identifiable information, taking all reasonable measures to comply with applicable laws and regulations. **5.4.** Customer shall advise its users regarding the collection, use, storage and disclosure of users’ Biometric Data, as provided herein, and shall ensure that it has the appropriate approvals in place prior to collecting, storing, and/or using the such Biometric Data within the Product. **5.5.** Upon termination and/or expiration of the Agreement, Scaleflex shall comply with the data retention and deletion provisions set forth in the applicable Data Processing Addendum (“DPA”), including with respect to Biometric Data. 5. **Changes to this AI Policy** This AI Policy will be subject to formal review annually, and updated as necessary. Updates will be posted publicly on the Website. If we make material changes to the purposes and policies set out here, we will update this page and inform Customers by email or in-application notification. Customers with questions regarding this policy or the functionality of our AI features should contact their Customer Success Manager for prompt assistance and clarification. # Data Processing Commitments \[DATA\_3] Created on: 12.04.2020 - Last modified / reviewed: 15.09.2025 — **Disclaimer:** The present document is exclusively applicable to companies that have expressly requested that their data be hosted within the European Union. It shall not be construed as applicable to any entity that has not made such a request, nor shall it confer any rights or obligations upon parties not expressly identified herein. — In accordance with the GDPR Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and as described into the Scaleflex Data Processing Addendum, Scaleflex is committed to process your data in Europe only, unless instructed otherwise. Over the past years, Scaleflex has carefully selected partners which deliver their business in respect with the GDPR regulations and which allow Scaleflex to provide the quality of services within the data protection rules. Scaleflex is committed to protecting our customers' data and ensuring that the content we get from them is safely handled and that all of our processing activities are performed in accordance with GDPR legislation as part of our Data Privacy commitment. In order to provide peace of mind to our customers, Scaleflex has chosen OVHcloud as its primary infrastructure provider, with datacenters throughout Europe, strong GDPR policy, and as a processor, OVH commits to: * Processing personal data solely for the purposes of carrying out the services correctly: OVH will never process your information for any other purposes (marketing, etc.). * Keeping your data inside the EU and only in countries recognised by the European Union as offering a sufficient degree of protection, provided that you do not select a datacenter located in a geographical area outside the EU. * Informing you if we have enlisted a subcontractor to process your personal data: to date, no services involving any access to data you have stored as part of the service have been subcontracted outside the OVH Group. * Applying strict security standards to provide a high level of security for our customers. * Reporting any data breach to you without "undue delay". * Helping you meet your regulatory obligations, by providing you with comprehensive information on our services. Scaleflex hereby confirms that, upon an express request by the User for their data to remain within the European Union, such data will be securely processed and hosted in our French OVH datacenters, in full compliance with applicable EU and French data protection laws. | Jean-François Lecas | Emil Novakov | | ------------------- | -------------- | | CXO, Scaleflex | CEO, Scaleflex | # ENVIRONMENTAL, SOCIAL AND GOVERNANCE # Global Code of Conduct & Ethics \[ESG\_1] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025 This **Global Code of Conduct & Ethics** (“Code”) is made on behalf of Scaleflex SAS and its subsidiaries (collectively referred to as “Scaleflex” or “we”). Scaleflex is a global SaaS provider of a Visual Experience platform that offers organizations a smart way to create, find and share creative files and branding materials. Scaleflex has eight offices globally and conducts business in six countries. This Code demonstrates the values Scaleflex holds as a business organization and the minimum standards Scaleflex expects from everyone that we conduct business with. This Code applies to everyone conducting business with Scaleflex including but not limited to employees, members of the Board of Directors, contractors, officers, partners, consultants or other contingent workers of Scaleflex. If you are conducting business with Scaleflex, it is your responsibility to read, understand, fully acknowledge and adhere to what is stated in this Code and in all other linked policies and documents. This Code demonstrates the minimum standards that Scaleflex expects from everyone working at or doing business with Scaleflex. This Code does not change any legal or contractual obligations that you may otherwise have with Scaleflex. Scaleflex reserves the right and has the sole discretion to modify or update this Code at any time. 1. **Environmental, Social, Governance** At Scaleflex we align our policies and we use United Nations Sustainable Development Goals (SDGs) as a guideline for our reporting. We have adopted and are implementing a set of policies that clearly focus on the areas that are important for our business and the various stakeholders we interact with. We have developed methodologies that assist us in quantifying and explaining our journey towards achieving our goals in line with the SDGs and have a set of policies and papers on environmental and social fields. **1.1. Environmental.** Our business and actions are aimed at reducing the impact on the environment by taking actions aimed at environmental sustainability. By taking climate focused actions, we ensure our suppliers and business operations reduce environmental footprint. Our policies are in line with the following goals: * **Goal 7**: Usage of affordable and sustainable energy: we ensure that we minimize the use of energy through the usage of energy efficient equipment. Our heating policy requires that heaters are adjusted temporarily to a minimum of 1 and a maximum of 4. * **Goal 12**: Ensure sustainable consumption and production pattern: We are a paperless company. We use our best efforts to make use of local products and suppliers. At our offices we use only reusable cups and glasses. * **Goal 3**: Take actions to combat climate change and its impact: IT recycles laptops, we encourage the use of public means of transportation, hybrid work policy. **1.2. Social.** We acknowledge the role human and social capital play in our business. We work at improving our business practices to ensure they are equitable and promote growth. We offer a conducive environment for work, provide opportunities for learning and development. We embrace diversity, equity and inclusion and provide a safe environment for work. We ensure that our employees earn a fair and living wage and feel they are a part of the decision-making process of the company. Our policies are in line with these specific targets: * **Goal 3**: Provide a healthy and safe environment while undertaking activities/policies that ensure the well-being of all: safety equipment available, provision of social activities like after work hangouts, Bright Funds donation matching platform, Quan and Open up wellbeing platforms, buddy system. * **Goal 4**: Learning opportunities for all: We have a thriving L\&D department that provides learning and continuous improvement initiatives, LinkedIn Learning. * **Goal 5**: Embracing gender equality: DEI committee and initiative to ensure that all Scaleflex Heroes have the freedom to be their true and authentic selves. * **Goal 8**: Promotion of inclusion and decent and productive work environment for all: our office is accessible to all and provides all the comfort and ergonomic tools needed for work. * **Goal 11**: Make the workspace safe and sustainable: we recycle in line with the local regulations of the locality where our offices are located. **1.3. Governance.** Scaleflex is committed to ethics, social benefits and embracing equality in our corporate and management governance structure. We seek to ensure that our actions are anchored in best corporate governance practices by being ethical and responsible. Our governance policies use these goals as standards: * **Goal 12**: Ensure sustainable consumption and production patterns: support local suppliers through our purchases. * **Goal 16**: Promote peaceful and inclusive societies for sustainable development, access to justice for all, effective, accountable and an inclusive institution at all levels: culture council, fair access for promotion, equal opportunity employer and encourage Scaleflex Heroes to engage in voluntary activities. 2. **Compliance with Applicable Laws and Regulations** Scaleflex takes compliance with applicable laws and regulations very seriously. Everyone that conducts business with Scaleflex is strictly prohibited from engaging in any unlawful activity. Scaleflex expects all of its customers, employees and suppliers to comply with applicable laws and regulations and notify Scaleflex in case of any actual or suspected breach of applicable laws. The areas Scaleflex expects compliance include but are not limited to: ● All anti-bribery laws, including the United States Foreign Corrupt Practices Act (FCPA) and the United Kingdom Bribery Act. ● Antitrust and fair competition laws.Labor laws; and ● laws and regulations concerning data privacy and information security. **2.1. Anti-Bribery and Corruption.** Scaleflex is committed to complying with all applicable anti-bribery laws and regulations and has no tolerance for bribery, corruption, and all related illegal and unethical business practices. Scaleflex has a Global Anti-Bribery and Corruption policy that demonstrates how Scaleflex upholds the importance of anti-bribery laws and expects full compliance with its Global Anti-Bribery and Corruption Policy without exception. For more details, please see Scaleflex’ Anti-Corruption Code of Conduct Policy. **2.2. Modern Slavery.** We are committed to respecting internationally recognized human rights laws and preventing any violations in our organization’s supply chain. For more details, please see Scaleflex’ Modern Slavery Statement. 3. **Diversity, Equity and Inclusion at Scaleflex** Scaleflex Love is the principle that guides the way we grow our teams, support our employees, and celebrate our differences. At Scaleflex, a diverse, inclusive, and equitable workplace is one where all employees, whatever their ethnicity, color, sex (including intersex status), age, religion, disability, sexual orientation, gender identity or expression, national origin or physical and mental ability are valued and respected. Our commitment is for all Scaleflex Heroes to have the freedom to be their true authentic selves. Just as we are never finished innovating, Scaleflex’ commitment to being An Even Better Scaleflex is a constant, evolving commitment that includes education, listening, and action. With 17+ nationalities represented across the organization; nurturing diversity is intrinsic to Scaleflex’ culture. By integrating our different points of view, perspectives, and backgrounds, we create an environment that fosters growth and promotes individual wellbeing. **3.1. Equal Employment Opportunity.** Scaleflex is an equal opportunity employer. We are committed to complying with all federal, state, national and local laws providing equal employment opportunities, and all other employment laws and regulations. It is our intent to maintain a work environment that is free of harassment, discrimination, or retaliation based on race (including natural hairstyle), color, ancestry, religion (including religious dress and grooming practices), gender, sex (including pregnancy, childbirth, breastfeeding or related medical conditions), sexual orientation, gender identity or expression, transgender (including whether or not you are transitioning or have transitioned), intersex status, national origin, age, marital status, physical or mental disability, medical condition, military or veteran status, or genetic information and other characteristics protected under state, federal or local laws. We want all employees to treat others with respect and professionalism and as such: * All decisions to hire or promote people are based on skills, experience, and/or potential. * We strive to reduce bias in every process. * We commit to equal pay for equal work. * We will make accommodations to help people with disabilities. * We conduct diversity and communication training. * We will not tolerate discriminatory, offensive, or inappropriate behavior. We ask you to report any discriminatory action against yourself or your colleagues to a member of management, People & Talent, or the Anonymous reporting platform. Scaleflex will not retaliate against anyone who files a complaint or participates in any workplace investigation or complaint process, and will not tolerate or permit retaliation by management, employees, or co-workers. 4. **Anti-Harassment and Anti-Bullying** Scaleflex is committed to providing a workplace free from discrimination, harassment, bullying and retaliation. Therefore, Scaleflex will not tolerate harassment of any form based on the following protected categories: race (including natural hairstyle), color, ancestry, religion (including religious dress and grooming practices), gender, sex (including pregnancy, childbirth, breastfeeding or related medical conditions), sexual orientation, gender identity or expression, transgender (including whether or not you are transitioning or have transitioned), intersex status, national origin, age, marital status, physical or mental disability, medical condition, military or veteran status, or genetic information and other characteristics protected under state, federal or local and national laws. Such conduct in any form is outrightly prohibited in the workplace, at work- related functions, or outside of work if it affects Scaleflex Heroes in the workplace. We implore all to use common sense to ensure that no actions are perceived as negative and remember that it's not just the intention of the remarks or actions that determine whether harassment has taken place—it is also the impression such remarks or actions make. Any suspected or actual breach of the above should immediately be reported to Scaleflex’ Anonymous Counselors. All Scaleflex Heroes must ensure you understand this policy and your obligations. 5. **Whistleblower Policy** Scaleflex Heroes are expected to act in an ethical manner in all commitments to Scaleflex. Scaleflex is committed to the highest possible ethical standards and encourages everyone associated with Scaleflex to commit to acting in the best interest of Scaleflex whilst adhering to French, EU and all other applicable local and international laws. Should you suspect fraud, abuse, or misuse of Scaleflex resources or assets, encountered dishonest actions or deeds, suspect a conflict of interest, or any other behavior that violates Scaleflex polices or applicable laws and regulations, you have a responsibility to report the violation or suspected violation to the appropriate person(s) or entities as indicated below. (Complaints of suspected harassment, discrimination or retaliation should be reported in accordance with the procedure outlined in the Policy Against Harassment, Discrimination and Retaliation.) In addition to suspected harassment, discrimination, or retaliation, examples of other concerns or complaints that should be reported include, but are not limited to: * Misuse of Scaleflex fund or resources * Conflicts of interest * Safety concerns * Potential illegal conduct * Acts that threaten or likely to threaten public health Anyone who reports a violation in good faith will not suffer adverse employment consequences or be disadvantaged with respect to work. Anyone who in any way adversely affects the employment of an employee who raises a good faith complaint or concern will be subject to disciplinary action, up to and including termination of employment. Employees should report violations or suspected violations to the culture council using the laid down internal reporting procedure. Anonymous reporting is assured and available through the Scaleflex Anonymous reporting procedure. All reports involving a potential violation are treated seriously and will be fully investigated to determine the facts and resolution appropriate under the circumstances and substantive feedback report will be issued. 6. **Prohibition of Improper Payments** All Scaleflex Heroes are required to use lawful practices involving payments to customers, political parties, officials, candidates, or governmental authorities. As a result, kickbacks and bribes offered with the intent of inducing or rewarding specific buying decisions or actions are strictly prohibited. No ScaleHero may offer to make direct or indirect payments of value in the form of compensation, gifts or contributions. For more details, please see Scaleflex’ Anti-Corruption Code of Conduct Policy. 7. **Confidential Information and Scaleflex Property Policy** During your relationship with Scaleflex, you may have access to confidential and proprietary data that is owned by Scaleflex or is in Scaleflex’ possession under non-disclosure obligations agreed with third parties. Confidential information and proprietary data are not generally known by competitors or within Scaleflex’ field of business. You will be asked to sign a confidentiality agreement with Scaleflex, which regulates how you treat such information. This information (hereinafter referred to as “Confidential Information”) includes but is not limited to: (a) information relating to Scaleflex that is not generally known to the public or that constitutes a trade secret; (b) information that is owned, developed or otherwise acquired by Scaleflex, including Scaleflex’ financial data, technical information, systems and use documentation; and (c) other information that would reasonably be considered confidential. To protect Scaleflex’ interest in this valuable asset, you must: Not use any such Confidential Information for your personal benefit or for the benefit of any person or entity other than Scaleflex, and Use your best efforts to limit access to such Confidential Information to those who have a need to know it for the business purposes of Scaleflex. 8. **Drug & Alcohol and Smoke-Free Policy** Scaleflex is committed to protecting the safety and well-being of all Scaleflex Heroes in our workplace. We recognize that alcohol abuse and drug abuse pose a significant threat to our goals. Scaleflex is a drug-free workplace, which means that you can’t possess, use, sell, distribute, manufacture, purchase, transfer, or cultivate drugs in the office. Drinking in the office after working hours before the office is closed and during scheduled happy hours is permitted although we ask you to use good judgment and act as a responsible ScaleHero, keeping the drinking after work hours to a minimum. Scaleflex is a smoke-free environment. Smoking, chewing, use of e-cigarettes/pipes, and other tobacco and nicotine products is not permitted at any time in Scaleflex work areas, vehicles, or client work areas or vehicles. Any individual who conducts business for Scaleflex or applies for a position with Scaleflex is covered by our drug & alcohol and smoke free workplace policy. Our policy includes, but is not limited to, full- time Scaleflex Heroes, part-time Scaleflex Heroes, volunteers, contractors, interns, and applicants. Our drug- free workplace policy is intended to apply whenever anyone is representing or conducting business for Scaleflex. Therefore, this policy applies during all working hours, whenever an individual is conducting business or representing Scaleflex, and while an individual is on call, on Scaleflex property, and at a Scaleflex-sponsored event. 9. **Data Privacy and Security** At Scaleflex, we are committed to protecting the privacy and security of our customers' personal and confidential information. We recognize the importance of data privacy and cybersecurity in today's digital age, and we take the necessary steps to safeguard our customers' information and prevent any unauthorized access, theft, or disclosure. **9.1. Data Privacy.** We collect and process personal information in accordance with applicable data protection laws and regulations, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). We only collect and use personal information for the purposes for which it was collected only after the proper legal basis has been established. We take the following measures, amongst others, to protect our customers' personal information: * Regular security assessments to identify and address potential vulnerabilities * Encryption of personal information during transmission and storage * Access controls and logging mechanisms to prevent unauthorized access to personal information * Secure disposal of personal information when it is no longer needed **9.2. Cybersecurity.** We maintain a comprehensive cybersecurity program to protect our systems, networks, and data from cyber threats. Our cybersecurity program includes the following measures: * Regular security assessments and vulnerability testing to identify and address potential risks * Implementation of security controls to prevent unauthorized access, malware, and other cyber threats * Encryption of sensitive data during transmission and storage * Monitoring of network traffic and logs to detect and respond to cyber incidents * Regular training and awareness programs for employees and third-party service providers on cybersecurity best practices * Resilient business continuity management program * Secure Development principles * Infrastructure security based on industry best practices We are committed to continuously improving our cybersecurity program and complying with applicable laws and regulations. 10. **Raising Issues & Reporting Violations** Stay vigilant against any possible violations of this Code and be proactive in case you spot an issue relating to the violation of this Code. Every person within our organization or conducting business with Scaleflex has the responsibility to prevent, detect and report suspected violations of this Code. Any suspected violation should be reported to the Scaleflex Legal Team or People at . # Anti-Corruption Code of Conduct \[ESG\_2] Created on: 09.08.2022 - Last modified / reviewed: 15.09.2025 **INTRODUCTION** Ethical values have always been at the heart of SCALEFLEX SAS (“SCALEFLEX”) strategy and development. Law no. 2016-1691 of 9 December 2016 on transparency, the fight against corruption and on the modernisation of economic life (known as the “Sapin II” law) strengthened this ethical requirement. In this connection, the anti-corruption code of conduct hereunder has been adopted. It is intended to recall all the basic principles relating to the fight against corruption and influence peddling and to identify, within SCALEFLEX and the companies it controls (the “**SCALEFLEX**”), the risky situations and the rules of conduct to be adopted in this regard (the “**Code of Anti-Corruption Conduct**”). The objective of this Anti-Corruption Code of Conduct is zero tolerance for corruption. The Anti-Corruption Code of Conduct is incorporated into the internal regulations of SCALEFLEX companies affected by these arrangements. It is available on the intranet site of each relevant SCALEFLEX company and is available to the human resources department of each such company. This Anti-Corruption Code of Conduct applies to all directors, corporate officers and permanent staff (permanent employees) and casual employees (interns, fixed-term employment contracts, work-study contracts, apprenticeship contracts, temporary workers, on-site service providers) of SCALEFLEX (hereinafter the “Employees”). Everyone has the duty to read carefully and understand the rules set out in this Code of Anti-Corruption Conduct and to exercise discernment and common sense in dealing with the various situations that may arise. **Emil Novakov, CEO — SCALEFLEX SAS** *** 1. **PRESENTATION OF THE DOCUMENT AND SCOPE** This document describes the policy and main components of SCALEFLEX’s corruption risk prevention, reduction and control system. This Anti-Corruption Code of Conduct applies to all of the following: * Employees of the company SCALEFLEX; * Employees of companies wholly owned by SCALEFLEX; * Employees of companies of which SCALEFLEX has a majority shareholding. With regard to companies of which SCALEFLEX owns a stake of less than 50%, SCALEFLEX, in consultation with other shareholders, ensures that the fundamental elements of a corruption risk prevention approach are set out in these companies’ compliance policies. In accordance with the “SAPIN 2” law, this Anti-Corruption Code of Conduct is appended to the internal regulations of each relevant French company of SCALEFLEX and also applies to foreign subsidiaries after being implemented in line with the country’s legislative framework. In any event, if local legislation is stricter than the principles set out in the Anti-Corruption Code of Conduct, the strictest rule must be complied with. 2. **CONCEPTS OF CORRUPTION AND INFLUENCE PEDDLING** The general term “corruption” comprises corruption and influence peddling. **a. Corruption.** Corruption is the act of soliciting or accepting, directly or indirectly, offers, promises, gifts, present or any advantages for oneself or others to carry out or have carried out, or refrain from carrying out an act defined as a job duty or task, or carry out an act facilitated by such duty or task1. There are two types of corruption: **Corruption is active** when it is the person who corrupts who initiated the corruption (“the corrupter”) by offering or providing a sum of money or any other consideration or advantage in exchange for a service. {% hint style="info" %} (1) In accordance with Articles 432-11, 433-1 and 433-25 of the Penal Code, committing a corruption offence may give rise to the following sanctions: * Natural person: 5 to 10 years’ imprisonment and a fine of 500,000 to 1,000,000 euros or double the proceeds of the offence, depending on whether it is private corruption or the corruption of a public official; * Legal person: 2,500,000 to 5,000,000 euros or double the proceeds of the offence, plus additional penalties, depending on whether it is private corruption or the corruption of a public official. {% endhint %} **Corruption is passive** when the act of corruption is at the initiative of the person who is corrupted (the “person corrupted”), by demanding or accepting money or any other benefit in exchange for a service (2). Finally, corruption is said to be **public** when it involves persons exercising a public office (3) (hereinafter a “**Public Official**”) and **private** when the corruption offence involves individuals or legal entities in the private sector only. **b. Influence peddling.** Influence peddling is identified where an undue gift or advantage is offered or consented for the recipient to use his/her influence, actual or alleged, with a view to obtaining a favourable decision from a public authority (4). 3. **ACTS OF CORRUPTION** a. Gifts, other benefits and facilitation payments * **Gifts and other benefits.** Anti-corruption rules prohibit gifts and other benefits from being offered to or received by a third party for the purpose of gaining an undue advantage or unjustifiably exercising any influence on any official action. **⇒** “**Gifts**” refers to gifts received from a business partner or offered to a business partner at a special event (e.g. birthday, Christmas). This may include, for example, a box of chocolates, a bottle of wine, a book or a pen. **⇒** The term “**other benefits**” includes, but is not limited to, business meals, travel, business events, invitations and entry tickets to sporting events or shows, etc. **◊ SCALEFLEX rules to comply with:** * SCALEFLEX ensures that “gifts” and “other benefits” are always received IN COMPLIANCE WITH THE LAW and in total TRANSPARENCY. {% hint style="info" %} (2) French law incriminates active corruption and passive corruption in the same way. (3) The concept of public official must be interpreted broadly and covers any person in a position of public authority, entrusted with a public service mission or vested with a public power of attorney, on behalf of himself/herself or others. Any other person considered to be a public official under the national law of a country must also be considered a public official. (4) In accordance with the aforementioned articles, committing the offence of influence peddling gives rise to the same sanctions as those provided for where the offence of corruption is committed. {% endhint %} * Employees must communicate to their business partners SCALEFLEX’s rules regarding “gifts” and “other benefits” and enquire about their own. o Offering or accepting a “gift” or “another benefit” must remain EXCEPTIONAL. o “Gifts” or “other benefits” offered to or received from a Public Official are PROHIBITED. o No Employee should be influenced by “gifts” or “other benefits” encouraging them to make bad decisions or decisions that are non-objective on business matters. If the person responsible for a decision accepts “gifts”, they should not be a factor, particularly in the decision-making process. o “Gifts” or “other benefits” are given in a STRICTLY PROFESSIONAL CONTEXT. They may not be received at the Employee’s home and may only be made to the Employee or the business partner, to the exclusion of their relatives. o “Gifts” and “other benefits” must be of REASONABLE VALUE and must not exceed the following thresholds: **⇒ Specific rules for “gifts”:** * Accepting “gifts” is tolerated if the unit value of the “gift” does not exceed €50 including tax. Beyond this threshold, an Employee must obtain the prior approval of his/her line manager to accept “gifts”. * An Employee must always obtain the prior approval of his/her line manager to offer “gifts” to a business partner, regardless of the amount. o The total amount of “gifts” received per person, per year and per business partner must not exceed €300 including tax. Beyond this threshold, an Employee must obtain the prior approval of his/her line manager to accept “gifts”, regardless of the amount. **⇒ Specific rules for “other benefits” (excluding business meals)**: * If an Employee accepts “other benefits” (excluding business meals) such as travel or professional events, this is tolerated only if these relate to the Employee’s normal activity and SCALEFLEX’s projects and activities and if their estimated value is less than €150 including tax. * Beyond this threshold, an Employee must obtain the prior approval of his/her line manager to accept these “other benefits”. * An Employee must strictly obtain the prior approval of his/her line manager to accept “other benefits” that are more exceptional such as invitations or entry tickets to shows or sporting or cultural events when they are greater than €150 including tax. * If an Employee offers “other benefits” (excluding business meals) to a business partner, this must be validated by the line manager of the department concerned, regardless of the amount and nature. ⇒ **Specific rules for business meals:** * It is permitted for an Employee to accept a business meal if the meal is of reasonable value. * When a business partner is invited to a business meal, the rules and limits set out in the expense reports policy must be complied with. This is available to the human resources department of each of the companies concerned. * If the above requirements are not met, the “gift” or “other benefit” must be RETURNED IMMEDIATELY by the Employee, accompanied by a letter of thanks recalling the rules of SCALEFLEX regarding the acceptance of “gifts” and “other benefits”. * If in doubt, consult your line manager or the Anti-Corruption Officer. * **Facilitation payments.** Facilitation payments are generally unofficial payments of small amounts requested by Public Officials or private sector natural or legal persons intended to facilitate or ensure the smooth running of the services expected of them. **◊ SCALEFLEX rules to comply with:** * SCALEFLEX PROHIBITS all facilitation payments. **b. Donations, contributions to charitable activities and sponsorship** SCALEFLEX may be required to work for civil society through donations and sponsorship. **⇒** “**Gifts**” means voluntary payments of cash or contributions in the form of tangible property generally made for social, cultural or scientific purposes and granted without any service by the recipient in return. **⇒** “**Sponsorship**” means financial support, skills or material provided by an enterprise and without seeking a direct economic contribution, to an organisation engaged in a non- profit activity, in order to support a general interest activity (art and culture, science, humanitarian and social projects, research, etc.). The sponsor intends to confer a gratuitous benefit, and his/her actions are mainly selfless. These donations and sponsorship activities may be considered as acts of corruption when they are carried out in order to obtain an undue advantage. **◊ SCALEFLEX rules to comply with:** * Donations, contributions to charitable activities and sponsorship are permitted if they actually serve a PURPOSE IN THE GENERAL INTEREST and contribute to the community in accordance with SCALEFLEX policy or that of its entities. * All donations, charitable contributions and sponsorship made on behalf of a company of SCALEFLEX must be reported to the manager of the company concerned in order to be APPROVED, and must be duly RECORDED. **c. Sponsorship.** Sponsorship is a communication technique that involves a company (sponsor) contributing financially and/or materially to a social, cultural or sporting action to gain a direct benefit, namely the “sponsor” company promoting its values and raising its profile. The sponsor’s contribution is not assessed as a gift but as a communication expense; the sponsor has business interests and his/her actions are selfless. **◊ SCALEFLEX rules to comply with:** * The sponsorship must be APPROVED IN WRITING BEFOREHAND by the manager of the company concerned and must be duly RECORDED. * SCALEFLEX will ENSURE that the sponsorship service and the consideration (for example in the form of marketing or communication activities) are always in conjunction with each other appropriately. **d. Lobbying.** Lobbying is any activity intended to influence the decisions or guidelines of a government or an institution to promote a particular cause or expected outcome. Lobbying becomes corruption in the event that the lobbyist pays or offers privileges to a Public Official in order to encourage him/her to support legislation or activities that promote the business of his/her client. **◊ SCALEFLEX rules to comply with:** * Demonstrate INTEGRITY, INTELLECTUAL PROBITY and TRANSPARENCY in all relations with public institutions and/or Public Officials, regardless of the situation or interest defended. * Do not seek to obtain an UNDUE political or regulatory ADVANTAGE. **e. Political contributions.** Political contribution means any contribution (payment of money or any other benefit such as gifts, benefits or advertising) for the purpose of providing support to a political party, candidate or elected representative. **◊ SCALEFLEX rules to comply with:** * Political contributions paid by or on behalf of the company are PROHIBITED. * No donation must be made to political parties, foundations or institutions with close links with political parties. **f. Recruitment.** The recruitment of a new Employee may potentially give rise to an act of corruption in the event that SCALEFLEX is granted an undue advantage by a third party in return for hiring a particular candidate. **◊ SCALEFLEX rules to comply with:** * Any undue advantage granted by a third party in exchange for the recruitment of an Employee is PROHIBITED. **g. Acquisitions, equity investments and joint ventures.** In case of the acquisition of companies or assets relating to an entire business division, or the acquisition of shareholdings, mergers or joint ventures, it must be ensured that the target company or the partner does not or has not acted improperly under the applicable anti- corruption laws, and complies with the legislation in force in this area. In the aforementioned operations, SCALEFLEX could be held criminally or civilly liable with significant business, financial and reputational repercussions. **◊ SCALEFLEX rules to comply with:** * INCLUDE AN ANTICORRUPTION COMPONENT in PRIOR AUDIT PROCESSES. * INCLUDE AN ANTICORRUPTION CLAUSE in the contracts to be entered into in connection with the aforementioned transactions. **h. Record- and book-keeping.** Books and records mean all accounting, financial and business records. It is essential that transactions be transparent, fully documented and allocated to accounts that reflect their actual nature. **◊ SCALEFLEX rules to comply with:** * The books and records of SCALEFLEX must ACCURATELY REFLECT the transactions carried out and must be prepared in accordance with accounting standards in force. * All SCALEFLEX CONTROLS AND APPROVAL PROCEDURES are to be applied. 4. **BUSINESS PARTNERS** The main business partners of SCALEFLEX include: * clients; * suppliers and subcontractors; * intermediaries; * advisors (consultants, business bankers, lawyers, etc.). Each of the companies in the relevant SCALEFLEX has prepared a specific document entitled “business partner assessment guide”, detailing the rules for evaluating their respective business partners. It is available on the intranet site of each relevant SCALEFLEX company and is available to the legal department of each such company. In particular with regard to purchases, the purchasing decisions of SCALEFLEX must be based solely on the quality of the products and services offered, which can be verified objectively. **◊ SCALEFLEX rules to comply with:** * Prior to entering into a business relationship with a business partner, PRIOR CHECKS relating to its integrity shall be carried out in accordance with internal procedures. * Any recourse to a business partner must result in a WRITTEN CONTRACT being drafted. o Any written contract with a business partner must contain a CLAUSE certifying that the business partner complies with the laws and regulations combating corruption, and ensure that the contract is nullified in the event of a breach of these rules. * Payments made in favour of a business partner, which can only be made after submitting a duly validated INVOICE, must always be for a REMUNERATION APPROPRIATE AND PROPORTIONATE to the service rendered. 5. **CONFLICTS OF INTEREST** If, in the ordinary course of business, an Employee is required to make a decision in which his/her own business or private interests conflict with the business interests of SCALEFLEX companies, this may be considered a conflict of interest. **◊ SCALEFLEX rules to comply with:** * Employees must PRIORITISE SCALEFLEX INTERESTS by refraining from promoting their own business or private interests. * No CONCOMITANT EMPLOYMENT is permitted if it risks harming the interests of SCALEFLEX companies. For more information, please refer to the terms of your employment contract, your collective agreement and the applicable internal guidelines. * Unless expressly permitted, Employees of SCALEFLEX companies and their next of kin must not HOLD SHARES in companies that have or seek to develop business relationships with a SCALEFLEX company if holding such shares may have an impact on the work done within SCALEFLEX. * In the event of potential or actual conflicts of interest, the Employees must immediately INFORM THEIR LINE MANAGER. 6. **WHISTLEBLOWING PROCEDURE** SCALEFLEX puts in place an ethical alert system to strengthen the ability of all Employees to express themselves so they can report any conduct or situations that conflict with this Anti-Corruption Code of Conduct. Any Employee may send his/her report using the specific form, available on a dedicated website whose address is as follows: The rules relating to the operation of the whistleblowing system and the guarantees offered to Employees in the context of its use are detailed in a specific document entitled “SCALEFLEX ethical whistleblowing system”. It is available on the intranet site of SCALEFLEX and is available to the human resources department. No disciplinary or discriminatory action will be taken against Employees raising an alert, even if the reported facts prove to be unfounded, provided that the Employees have acted in good faith. Any direct or indirect retaliation against a SCALEFLEX Employee who has raised an alert cannot be tolerated and may result in disciplinary action which may go as far as the employment contract being terminated, in accordance with applicable law. 7. **DISCIPLINARY SANCTIONS FOR NON-COMPLIANCE WITH THE CODE OF CONDUCT** Any breach of the duties set out in this Code of Anti-Corruption Conduct lays the perpetrator open to the disciplinary sanctions provided for in the internal regulations of the relevant French company of SCALEFLEX, without prejudice to the administrative measures and criminal sanctions provided by the applicable national laws and regulations. 8. **INTERNAL CONTROL AND ASSESSMENT** In order to ensure the adequacy and effectiveness of the anti-corruption prevention and detection measures implemented based on its risk mapping, SCALEFLEX has developed an internal control and assessment system. This system meets four (4) objectives: * monitor the implementation of anti-corruption prevention and detection measures and test their effectiveness; * identify and understand failures in the implementation of procedures; * define appropriate recommendations or other corrective measures, if necessary, with a view to improving the effectiveness of the anti-corruption compliance programme; * detect, where applicable, acts of corruption. 9. **DISTRIBUTION** This Anti-Corruption Code of Conduct is appended to the internal regulations of the relevant French companies of SCALEFLEX; it is also available on the intranet site of each relevant SCALEFLEX company, as well as the human resources department of each such company. It may need to be adapted according to regulatory changes. 10. **INTERPRETATION AND COMPLIANCE WITH THE ANTI-CORRUPTION CODE OF CONDUCT** Each SCALEFLEX Employee must read, understand and comply with this Anti-Corruption Code of Conduct. Each SCALEFLEX Anti-Corruption Representative ensures it is disseminated and complied with by Employees. For any question relating to this Anti-Corruption Code of Conduct or in case of interpretation difficulties regarding its application to a given situation, Employees are invited to contact their line manager or their Anti-Corruption Representative, the contact details of which are provided below: **Anti-Corruption Representatives:** {% columns %} {% column %} **Scaleflex SAS** Emil Novakov CEO {% endcolumn %} {% column %} **Scaleflex Inc.** Jean-François Lecas Managing Director, North America {% endcolumn %} {% endcolumns %} # Modern Slavery Statement \[ESG\_3] Created on: 12.12.2023 - Last modified / reviewed: 15.09.2025 **Introduction & Business Organization & Supply Chain** \ This Modern Slavery Statement (“Statement”) is made on behalf of Scaleflex SAS pursuant to Section 54(1) of the UK Modern Slavery Act 2015 and Section 14 of the Australian Modern Slavery Act 2018. Scaleflex SAS is the parent company of 6 direct subsidiaries including Scaleflex Ltd and Scaleflex Inc. (hereinafter collectively referred as “Scaleflex”). Scaleflex is a global SaaS provider of a Visual Experience platform that offers organizations a smart way to create, find and share creative files and branding materials. As a SaaS company Scaleflex key suppliers consist of (a) data centers that host its platform, (b) other SaaS providers; and (c) suppliers who enable Scaleflex to operate its facilities such as reception and security. **Policies & Training** \ It is essential for us to highlight the importance of compliance with human rights laws at the very start of the Scaleflex journey of our employees and suppliers. Therefore, as part of our onboarding package, every Scaleflex employee is required to complete a mandatory ethics training highlighting the importance of compliance with human rights laws. Similarly, we expect our key suppliers (i) to have sufficient anti-slavery and human trafficking policies and procedures in place; and (ii) commit to the core values of United Nations Global Compact. In our employee handbooks and supplier policies, we communicate our values to our employees and suppliers and emphasize that we do not tolerate violations of human rights laws. On a regular basis we review our policies to ensure that they stay up-to-date and compliant with the current legislation and practices. **Due Diligence and Risk Assessment** \ Staying vigilant against any possible violations of human rights within our organization and supply chain is essential for us. Therefore, every person within our organization has the responsibility to prevent, detect and report suspected violations of this Statement, human rights principles or other laws and regulations taking place in any part of our organization or supply chain. Any suspected violation can be reported to Scaleflex Legal Team directly at . **Next Steps** \ We are committed to respecting human rights as set out in the UN Guiding Principles on Business and Human Rights, UN Universal Declaration of Human Rights, Core Conventions of the ILO and ILO Declaration on Fundamental Principles and Rights at Work. This Statement shall be reviewed before the end of each financial year and amended as required by any significant changes in the legislation. **Emil Novakov** \ **Chief Executive Officer** # Environmental and Sustainability Policy \[ESG\_1] Created on: 12.12.2023 - Last modified / reviewed: 15.09.2025 This **Environmental and Sustainability Policy Statement** (“Statement”) is made on behalf of Scaleflex SAS and its subsidiaries (collectively referred to as “Scaleflex” or “we”). Scaleflex’ management and all who work at Scaleflex are committed to the care of the environment and the prevention of pollution by taking actions aimed at sustainability. By taking climate focused actions, we ensure our suppliers and business operations reduce environmental footprint. Scaleflex seeks to minimize waste, promote recycling, reduce energy consumption and emissions and, where possible, work with suppliers, contractors and those working on behalf of the organization who have sound environmental policies. We see ourselves as a responsible and ethical organization and as such place significant emphasis on managing and improving our environmental performance and this document sets out our environmental policy. Our policies and guidelines take cognizance of United Nations Sustainable Development Goals (SDGs). We ensure that our actions are in line with Goal 7 (Usage of affordable and sustainable energy), Goal 12 (Ensure sustainable consumption and production pattern) and Goal 13 (Take actions to combat climate change and its impact). **We are committed to:** * Complying fully with all relevant national, regional and federal laws, codes of practice, and regulations * Assessing the environmental impacts of our operations, continuously seeking to reduce these impacts and improving our resource efficiency through reduction of energy, water use, and waste * Promoting environmental and energy awareness in our employees * Working with our customers to make more environmentally-sensitive choices * Monitoring our progress to ensure ongoing improvements in our environmental performance * Communicate this policy to stakeholders and the public and work with all our stakeholders to reduce the impact of our operations **Remote Working** * Hybrid working policy that will reduce our carbon footprint * We opt for remote meetings over onsite visits as much as possible to reduce our carbon footprint **Energy** * Optimizing energy efficiency and conservation in all operations by using energy efficient equipment * Controlling and managing energy efficiency in our business and promoting energy efficiency * Reducing the impact of transportation in our business activities by encouraging usage of public transport **Waste** * Actively promote reducing, reusing, and recycling waste in all of our offices globally * Minimizing waste generation by applying reuse and recycle options where possible * Proscribe the use of plastic in our offices by utilizing reusable crockery * Operating a paperless business process to minimizing waste generation **Continuous Improvement** * Setting specific improvement targets, monitoring progress, and communicating results internally * Developing specific objectives to continually improve our environmental performance by ensuring sustainability in all our actions * Setting objectives and targets for continuous improvement. * Measuring and reviewing our performance internally regularly **Procurement** * Choosing suppliers and contractors that adopt best environmental and sustainability practices and make this the procurement policy of our company * Purchasing products and services that have the least environmental impact, where this is feasible * Encouraging suppliers and contractors to implement sustainable environmental systems * Procuring from local suppliers and using locally made sustainable products **Awareness/Training** * Encouraging environmental awareness among our employees through appropriate communication and training programmes * Promoting environmental awareness throughout our business * Ensuring all employees understand our environmental policy and conform to its standards * Informing and motivating all of our staff and encouraging them to play an active role in committing to our environmental policy