Service Solicited - 2025 - Darktrace - Darktrace Network Services (Platform Products, Deplayment Usage, Standard Services) •
Product Order Form
Customer Name: City of Eagle Quote Ref: Q-188825
Shipping Address: 660 E Civic Lane Eagle, Date Prepared: 31/10/2025
83616 United States
660 E Civic Lane Eagle,
Invoice Address: Idaho 83616 United Expiry Date: 28/11/2025
States
Email: dgoodman@cityofeagle. Master Contract Number:
org
Email for Invoice finance@cityofeagle.org
Submission:
Attn: Devonte Goodman
Tax ID/Business NA
Registration/VAT No:
Darktrace Offering
Product/Services SKU Term Start End Extended Customer
Description Code Quantity (Months) Date Date Price(USD)
Platform Products
DT-PL-
Darktrace/NETWORK PD-NE
401-450 12 01/11/2025 31/10/2026
Darktrace/IDENTITY DT-PL-
176-200 12 01/11/2025 31/10/2026
PD-ID
Darktrace/EMAIL DT-PL- 126-150
PD-EM- Active 12 01/11/2025 31/10/2026
EX Users
Deployment Usage
Darktrace On-Prem DT-DP- 1 12 01/11/2025 31/10/2026
Appliance(Small) PH-SM
Darktrace On-Prem DT-DP- 1 12 01/11/2025 31/10/2026
Appliance(Medium) PH-ME
Standard Services
Darktrace Standard DT-SIS 1 12 01/11/2025 31/10/2026
Support Services
Darktrace/Installation DT-IS 1 12 01/11/2025 31/10/2026
Services
Total(USD) 43,609
US+1 415 229 9100 LATAM:+52 55 7006 0966 UK:+44(0)1223 294 100 APAC:+65 6804 5010 mfo@derktracecom
Darktrace Moldings Limited Company number: 08662035
Maurice Wilkes Building St John•s Innovation Park, Cowley Road, Cambridge, United Kingdom, C84 00S VAT number: OB411 3031 68
Product Order Form
Terms& Conditions
1 The Usage Metrics set out in the above Offering Table are in the aggregate not in addition to any prior orders.In the event of conflict
with any prior order the Usage Metrics set out above are determinative.
2 By signing this Product Order Form issuing a purchase order referencing this Product Order Form or otherwise accessing or using the
Offering the Customer's use of the Offering shall be subject to the Darktrace Master Services Agreement included in the Appliance
which can also be found at:https://www.darktrace.com/resources/legal-online-terms.pdf(Agreement).
3 Darktrace/NETWORK features core ActiveAl Security Platform capabilities to secure network environments:Real Time Detection,
Autonomous Response,Cyber Al Analyst and Technical Support.Use of Darktrace/NETWORK is limited to within the IP Count band
specified above(Usage Metrics,).For such purposes IP Count,is calculated by taking the peak unique IP address values(with VLAN5
differentiated)in any 24-hour period in the last 28 days.Should Usage Metrics be exceeded additional Fees shall be payable.
4 Darktrace/IDENTITY features core ActiveAl Security Platform capabilities to secure users across business:Real Time Detection,
Autonomous Response,Cyber Al Analyst and Technical Support.Darktrace/IDENTITY supports the following applications:Microsoft
365,Google Workspace,Salesforce,Box,Dropbox,Slack,Zoom,Duo,Okta,Egnyte,Jump Cloud,Asana,Cloudflare,Hubspot,
NetSuite.Use of Darktrace/IDENTITY is limited to within the band of Active Users specified above(Usage Metrics).For the purposes
of Darktrace/IDENTITY an Active User,consists of any object which can perform actions that are then reported by the API/logging of
the 3rd-party product including but not limited to 3rd-party user accounts 3rd-party apps and other 3rd party identities.The number
of Active Users is calculated by taking the peak number of Active Users over all configured and applicable modules within Darktrace
/IDENTITY seen over a 28-day period.Should Usage Metrics be exceeded additional Fees shall be payable.
5 Darktrace/EMAIL features core ActiveAl Security Platform capabilities to secure emails:Real Time Detection,Autonomous
Response,Cyber Al Analyst and Technical Support.Use of Darktrace/EMAIL is limited to within the band of Active Users specified
above(Usage Metrics).For the purposes of Darktrace/EMAIL an Active User,consists of a mailbox reported by the relevant provider
that has been seen to send or receive email in the last 28 days.Use of Darktrace/EMAIL may not exceed 3000 Mail Volume as
determined by the volume of inbound and outbound email in a 24-hour period(Mail Volume).Should the number of Active Users or
Mail Volume usage exceed the figures set out above additional Fees shall be payable.
6 Customer is in possession of the Appliance(s)listed above and shall not receive additional such Appliance(s)pursuant to this Product
Order Form.
7 The Offering is made available on the basis of the relevant Product Specification Service Definition or other technical documentation
(as applicable).Product Specifications and Service Definitions are found at:https://darktrace.com/legal/product-specifications-and-
service-definitions whilst other technical documentation can be found via the Customer Portal.
8 If Customer requires a purchase order it must be sent at the time of acceptance of this Product Order Form and be for the full
contract value.If it is not received Darktrace shall be entitled to invoice without it.
9 Fees are exclusive of any applicable sales tax goods and services tax withholding tax or VAT.Fees will be invoiced annually in
advance.Payment terms Net 30.
10 Acceptance of this Product Order Form is expressly limited to the terms of Darktrace's offer.Once accepted the terms and
conditions of this Product Order Form and the Agreement will be the complete and exclusive statement of the agreement between
the parties.Any modifications proposed by Customer are expressly rejected by Darktrace and shall not become part of the
Agreement in the absence of Darktrace's written acceptance.
11 This Product Order Form may be executed in any number of counterparts and by different parties in separate counterparts.Each
counterpart when so executed shall be deemed to be an original and all of which together shall constitute one and the same
agreement.Transmission of the executed counterpart of this Product Order Form by email(in PDF JPEG or other agreed format)shall
take effect as delivery of an executed counterpart.
12 Any Darktrace platform line pricing is conditional on all of the subscriptions being purchased and is offered on a combined basis,and
as such,will be invoiced as a single subscription line on relevant invoice(s).
13 Statutory Certifications. Darktrace Holdings Limited hereby certifies that it is not owned or operated by the Government of China,as defined in Idaho
Code Section 67-2359,and that during the Term of this Agreement it will not be owned or operated by the Government of China. Darktrace Holdings
Limited hereby certifies that it is not currently engaged in,and during the Term of this Agreement will not engage in,a boycott of goods and services
from Israel or territories under its control as defined in Idaho Code Section 67-2346. Company certifies that it is not,and will not for during the Term of
the Agreement,become an abortion provider or an affiliate of an abortion provider,as those terms are defined in Idaho Code§§18-8701 et seq.
14 Notwithstanding anything to the contrary in the Agreement:Clause 15"Governing Law and Dispute Resolution"shall be amended such that the
Governing Law is the State of Idaho and the Governing Courts shall be the state or federal courts located in Boise,Idaho.
For Customer. For Darktrace:
Signature: Signature:
Name: DevunteGuudrnan 4���i� Name:
Job Title: 11,1(1`(l'.-Y' y Job Title:
Signature Date: I ft OZlfs-1,�
Signature Date:
("Effective Date")
us:•1 415 229 9100 LATAKt+52 66 7005 0966 UK.+44(0)1223 294 100 APAC:+85 8804 5010 Infotkdarktrace.corn
0erktrace Holdings Limited Company number: 08562035
Maurice Wilkes Building St John's Innovation Perk, Cowley Road, Cembridgm, CB4 00S VAT number: GB411 3031 68
Docusign Envelope ID:D1427819-C67E-400B-A16E-2CE686C0A2D1
Terms& Conditions
1 The usage Metrics set out in the
Offering Table are in the %IOt1fl idf tllon tD lviy prior orders.In the event of conflict
with any prior order the Usage Metrics set out above are determinative.
2 By signing this Product Order f orm issuing a purchase order reterencing this Product Order Form or otherwise accessing or using the
Offering the Customer's use of the Offering shall be subject to the Darktrace Master Services Agreement included In the Ap tiience
which can also be found at:https.//wow darktrace.corieresources/fegal-online terrns.pdf(Agreement).
3 Darktrace/NETWORK features core ActiveAl Security Platform capabilibes to secure network environments Real Time Detection.
Autonomous Response.Cyber Al Analyst and Technical Support.Use of Darktrace/NETWORK is limited to within the IP Count band
specified above(Usage Metrics.) For such purposes IP Courtt,is calculated by taking the peak unique IP address values(with VLANS
differentiated)in any 24-hour period in the last 28 days.Should Usage Metrics be exceeded additional Fees shall be payable
4 Darktrace/IDENTITY features core ActiveAI Security Platform capabilities to secure users across business.Real Time Detection.
Autonomous Response.Cyber Al Analyst and Technical Support.Darktrace/IDENTITY supports the following applications:Microsoft
365,Google Workspace.5aiesforce,Box.Dropbox.Slack,loom.Duo,Okta,Egnyte,Jump Cloud,Asana.Cloudflare,HubSpot,
NetSuite Use of Derktrace/IDENTTTY is limited to within the band of Active Users specified above(Usage Metrics) For the purposes
of Darktrace/IDENTITY an Active user,consists of any object which can perform actions that are then reported by the APt/logging of
the 3rd-party product including but not limited to 3rd-party user accounts 3rd-party apes and other 3rd party identities The number
of Active UserS is cakutated by taking the peak number of Active Users over all cordigured and applicable nodules within Darktrace
/IDENTITY seen over a 28 day period.Should Usage Metrics be exceeded additional Fees shall be payable.
5 Darktrace/EMAIL features core ActiveAl Security Platform capabilities to secure emails.Real Time Detection,Autonomous
Response,Cyber At Analyst and Technical Support Use of Darktrace/EMAIL is limited to within the band of Active Users specified
above(Usage Metrks) For the purposes of Darktrace/EMAIL an Active User,consists of a mailbox reported by the relevant provider
that has been seen to send or receive email in the last 28 days.Use of Darktrace/EMAIL may not exceed 3000 Mad Volume as
determined by the volume of inbound and outbound email in a 24-hour period(Mail Volume).Should the number of Active Users or
Mail Volume usage exceed the figures set out above additional Fees shall be payable
6 Customer is in possession of the Appliance(s)listed above and shall not receive additional such Appliance(s)pursuant to this Proouct
Order Form
The Offering is made available on the basis of the relevant Product Specification Service Definition or other technical documentation
(as applicable) Product Specifications and Service Definitions are found at https•/ldarktrace.corregairproduct specifications-an-
servkedefinitions whilst other technical documentation can be found via the Customer Portal.
8 if Customer requires a purchase order it must be sent at the time of acceptance of this Product Order Form and be for the full
contract value If it is not received Darktrace shall be entitled to invoice without It.
9 Fees are exclusive of any applicable sales tax goods and Services tax withholding tax or VAT Fees wi'I be invoiced annually in
advance. Payment terms Net 30.
10 Acceptance ofthtis Product Order Form is expressly limited to the terms of Darktrace's offer.Once accepted the terms and T
conditions of this Product Order Form and the Agreement will be the complete and exclusive statement of the agreement between
the parties.Any modthcattons proposed by Customer are expressly rejected by Danctrace and shall not become part of the
Agreement in the absence of Darktrace's written acceptance.
11 This Product Order Form may be executed In any number of counterparts and by different parties in separate counterparts Face
counterpart when so executed shall be deemed to be an original and all of which together shall constitute one and the same
• agreement Transrrussan of the executed counterpart of this Product Order Form by email(in PDF jPEG or other agreed format)shall
take effect as delivery of an executed counterpart.
17 Any Darktrace platform line pricing is conditional on all of the subscriptions being purchased and is offered on a combined basis,and
as such.will be invoiced as a single subscription line on relevant invoice(s).
13 Statutory CeiScakons. Dartttace Iiolrbngs l united riereby certifies that et is not owned or operated by Ste Government of China as defined in Idaho
Code Section 67-2359,and alai during the-term or pins Agreement It we not be owned or operated by the Government of Cana. Darthace Hearings
Limited hereby certifies that it is not oareney engaged n.and&rand the Tenn of Etas Agreement we not engage in.a boycott et goods and services
horn Israel or territories under Its control as defined in Idaho Code Section 67.2346. Company oertRies trial A is not and will not tar Owing tie Term or
rhea Agreement become an abortion provider or:in affiliate d an abortion provider.as those leave are deaned n Idaho Code§;t 8-8701 el sag.
14 Notwitnstandng anything to the contrary in Lie Ain_JV11.n1 Clause IS`Coveting Law and Dispute Resdulioo"shall be amended such mar the
Governing Law is Ste State or Idaho and the Governing Courts shall De the stag or federal courts located in Boise.Idaho.
For Customer , foragarktrace:
Signature: Signature
Mantle: >' n I
Name:
-000C11oa4aoli49A-
t(cLaura Walton-Wood
V�`r :oil Title: Accounts Receivable Manager
Job Trill: •_ ..._.:. _... .�.�
Signature Dot*: I e
Signature Date.12/02/2025
("Effective Date")
,u., ,,.1 ;
+?r tl;l it �'t�i1,1,1r•1,1 i1r�
DARKTRACE
DARKTRACE MASTER SERVICES AGREEMENT
THIS MASTER SERVICES AGREEMENT (TOGETHER WITH ALL APPLICABLE PRODUCT ORDER
FORM(S), THE "AGREEMENT") GOVERNS THE ACCESS TO, AND USE OF, THE OFFERING (AS
DEFINED BELOW) OR ANY PORTION THEREOF BY THE CUSTOMER. BY SELECTING THE
"ACCEPT" OPTION, DOWNLOADING, INSTALLING, OR OTHERWISE ACCESSING OR USING THE
OFFERING, OR ENTERING INTO A PRODUCT ORDER FORM THAT REFERENCES THIS
AGREEMENT, THE PERSON DOING SO ON BEHALF OF CUSTOMER REPRESENTS AND
WARRANTS THAT THEY HAVE FULL AUTHORITY TO BIND THE CUSTOMER TO THIS
AGREEMENT, WHICH CONSTITUTES A BINDING CONTRACT BETWEEN CUSTOMER AND
DARKTRACE HOLDINGS LIMITED ("DARKTRACE"). IF CUSTOMER DOES NOT AGREE TO THE
TERMS AND CONDITIONS OF THIS AGREEMENT, OR IF SUCH PERSON DOES NOT HAVE
AUTHORITY TO BIND THE CUSTOMER, THEN CUSTOMER WILL NOT BE AUTHORIZED TO
DOWNLOAD, ACCESS OR USE THE OFFERING OR ANY PORTION THEREOF. THE AGREEMENT
BECOMES BINDING ON CUSTOMER ON THE EARLIEST OF THE FOLLOWING DATES: THE DATE
THE CUSTOMER ACCEPTS THE TERMS AND CONDITIONS HEREIN, THE DATE SPECIFIED ON
A PRODUCT ORDER FORM OR THE DATE ON WHICH CUSTOMER DOWNLOADS, INSTALLS,
ACTIVATES OR OTHERWISE ACCESSES OR USES THE OFFERING. THIS AGREEMENT SHALL
REMAIN IN EFFECT SO LONG AS THE CUSTOMER HAS AUTHORIZED ACCESS TO THE
OFFERING.
1. Definitions.
Certain capitalized terms used in this Agreement have the meanings attributed to them in
Section 17.
2. Order Process.
Customer may procure the Offering directly from Darktrace or through a Partner pursuant to
a Partner Arrangement. Any Offering procured through a Partner is subject to, and Darktrace's
obligations and liabilities to Customer are governed by, this Agreement. Only the terms in a
Product Order Form (and for the avoidance of doubt, specifically excluding any pre-printed
terms on a Customer or Partner purchase order) that has been duly signed by Darktrace and
Customer, or by Darktrace and a Partner on behalf of the Customer, will have any force or
effect. Product Order Forms are non-cancellable.
3. Fees; Payment Terms; Taxes.
3.1. Fees and Payment. Customer will pay, as applicable: (i) the fees set forth in the applicable
Product Order Form entered into by Customer and Darktrace to Darktrace; or (ii) the fees
agreed upon by Customer and the applicable Partner in accordance with the applicable
Partner Arrangement to such Partner(as applicable, the"Fees"). Where Customer is required
to pay Fees to Darktrace, then unless otherwise expressly set forth on the Product Order
Form: (a) Fees will be invoiced on an annual basis, at the beginning of each year of the
applicable Subscription Period (where a "year" commences on the Commencement Date and
each anniversary thereof), Darktrace reserves the right to invoice from is local Affiliate; (b)
Customer will pay the Fees within 30 days after receipt of the applicable invoice by email; and
(c) Darktrace reserves the right to increase the Fees payable by the Customer: (i) on 30 days'
prior written notice in the sole event that the Cloud Provider increases the charges or fees
payable by Darktrace to such Cloud Provider for services necessary for or related to the
applicable Offering, provided that any such increase shall be proportionate to the increase
charged by the Cloud Provider; (ii) once per year on not less than 60 days' prior written notice,
with any such adjustment taking affect from the next anniversary of the Commencement Date;
DARKTRACE - 1 -
DARKTRACE
or (iii) if there is any change to the Customer's network or infrastructure after the Product
Order Form is executed, and such change results in a cost to Darktrace, in which case
Darktrace shall be entitled to charge such cost to the Customer. Except as otherwise expressly
provided in this Agreement, as between Darktrace and Customer, all Fees are non-refundable
and non-cancellable.
3.2. Taxes; Late Payment. As between Darktrace and Customer: (i) Fees are exclusive of any
applicable taxes, however designated; (ii) Customer will pay all such taxes levied or imposed
by reason of Customer's purchase of the Offering and the transactions hereunder; and (iii)
Darktrace may impose late charges on overdue payments at a rate equal to 1.5% per month
or, if lower, the highest rate permitted by applicable law.
3.3. Withholding Taxes. Should Customer be required under any Applicable Law to withhold or
deduct any portion of the payments due to Darktrace, then Customer will increase the sum
payable to Darktrace by the amount necessary to yield to Darktrace an amount equal to the
sum Darktrace would have received had no withholdings or deductions been made.
4. Offering.
4.1. Evaluation Offering. Darktrace may allow Customer to use the Offering or any part thereof
(including parts or features offered for preview or beta testing purposes), on a free-of-charge
basis ("Evaluation Offering"). This Agreement also applies to access and use of the
Evaluation Offering, except as follows: (i) the duration of the evaluation is 4 weeks unless
otherwise specified by Darktrace in writing ("Evaluation Period") at the end of which period
the Customer's right to access and use the Evaluation Offering will automatically terminate;
(ii) the Evaluation Offering is provided "AS-IS" without warranty of any kind, and Darktrace
disclaims all warranties, support obligations, and other liabilities and obligations for the
Evaluation Offering; and (iii) Customer may use the Evaluation Offering only for evaluation
purposes and will not use the Evaluation Offering in a product testing environment.
4.2. Access and Use. Subject to the terms and conditions of this Agreement (including Darktrace's
receipt of applicable Fees), Darktrace grants Customer a non-exclusive, non-transferable
(except as expressly provided in Section 16.2), non-sublicensable license to access and use
the Offering for Customer's and Customer Affiliates' internal business purposes in accordance
with this Agreement and the applicable Product Specification (which is hereby incorporated
into and forms part of this Agreement) during the applicable Subscription Period. Customer's
access and use of the Offering is limited to the Usage Metrics set forth in the applicable
Product Order Form, and Customer will be subject to the payment of additional fees if the
applicable Usage Metrics are exceeded.
4.3. Product Specification; Customer Dependency. The Product Specification for the Offering
includes additional terms and conditions applicable to Customer's access and use of the
Offering. Customer will comply with all such terms and conditions, including the obligations
and tasks attributed to Customer therein (each, a "Customer Dependency"). To the extent
that Customer's delay or failure to comply with a Customer Dependency causes Darktrace to
breach an obligation, Darktrace will be entitled to an extension of time equivalent to the delay
caused by the delay or failure to comply with such Customer Dependency.
4.4. Appliances. Where the Offering includes the Appliance(s), then unless otherwise agreed to in
writing between the parties, title to all Appliances (and all components thereof) provided by
Darktrace to Customer under this Agreement will always remain with Darktrace. Customer
acknowledges and agrees that the Appliances are provided solely as the medium for delivery
and operation of the Software and must not be used for any other purpose. Upon termination
of the Subscription Period, Customer will promptly return all Appliances to Darktrace (or to
DARKTRACE -2-
DARK i R/arc
the applicable Partner) in accordance with Darktrace's (or applicable Partner's) instructions.
Customer's use of any Appliance is subject to the applicable Product Specification.
4.5. Services. Darktrace will provide to Customer the Services set forth in the Product Order Form.
Support Services will be provided in accordance with the Support Terms, which are hereby
incorporated into and form part of this Agreement.
4.6. Restrictions. Customer will not, with respect to the Offering (or any portion thereof): (i) use
the Offering in any manner beyond the scope of rights expressly granted in this Agreement;
(ii) modify or create derivative works of the Offering, in whole or in part; (iii) reverse engineer,
disassemble, decompile, decode or otherwise attempt to derive or gain improper access to
any software component of the Offering, in whole or in part; (iv) frame, mirror, sell, resell, rent
or lease use of the Offering to any third party, or otherwise allow any third party to use the
Offering for any purpose (except for Customer Affiliates or Outsource Providers as expressly
permitted herein); (v) use the Offering in any manner or for any purpose that infringes,
misappropriates, or otherwise violates any Intellectual Property Right or other right of any third
party, or that violates any Applicable Laws; (vi) interfere with, or disrupt the integrity or
performance of, the Offering; (vii) access or search any software component of the Offering
(or download any data or content contained therein or transmitted thereby) through the use of
any engine, software, tool, agent, device or mechanism (including spiders, robots, crawlers
or any other similar data mining tools) other than software or Offering features provided by
Darktrace for use expressly for such purposes; (viii) use the Offering for benchmarking or
competitive analysis with respect to competitive or related products or services, or to develop,
commercialize, license or sell any product, service or technology that could, directly or
indirectly, compete with the Offering or any part thereof; (ix) employ or authorize a Darktrace
competitor to use or view the Offering, or to provide management, hosting, or support for the
Offering; (x) disclose the contents of Alerts, reports or other output of the Offering to third-
parties other than Customer Affiliates or Outsource Providers without Darktrace's prior written
consent; (xi) use the Offering to circumvent the security of a third party's network/information,
develop malware, unauthorized surreptitious surveillance, data modification, data exfiltration,
data ransom or data destruction; or (xii) cause, encourage or assist any third party to do any
of the foregoing.
4.7. Customer Affiliates. Customer will ensure that any Affiliate of Customer("Customer Affiliate")
using or accessing the Offering, or benefitting from Customer's use of the Offering, complies
with this Agreement. Customer is responsible for Customer Affiliates' acts and omissions in
connection with their access to, or use of, the Offering.
4.8. Open Source Software. Darktrace uses certain open source software in its products. Copies
of, or references to, open source software licenses may be set out in a text file, installation
file or folder accompanying the open source software.
4.9. Ownership. All Software is provided on a subscription access basis, not sold. Subject to the
limited rights expressly granted hereunder, Darktrace reserves and, as between the parties
will solely own, the Offering and all right, title and interest (including all Intellectual Property
Rights) in and to the Offering. No rights are granted to Customer hereunder (whether by
implication, estoppel, exhaustion or otherwise) other than as expressly set forth in this
Agreement.
4.10. Feedback. Darktrace may freely use any feedback, suggestions, comments or the like that
Customer provides to Darktrace with regard to the Offering.
DARKTRACE -3-
DARK i RAC€
5. Outsource Providers and Third-Party Services.
5.1. Outsource Providers. If Customer contracts with an Outsource Provider, Customer may permit
such Outsource Provider to exercise all or any portion of the rights granted to Customer in
Section 4.2 solely on Customer's or the Customer Affiliates' behalf. If Customer permits an
Outsource Provider to use or access the Offering on Customer's or a Customer Affiliate's
behalf, Customer will make sure all Outsource Providers comply with the terms of this
Agreement and Customer will be liable for any breach of this Agreement by an Outsource
Provider.
5.2. Third-Party Services. Darktrace does not support or guarantee integration with third party
technologies or services ("Third-Party Services") unless otherwise expressly set out in a
Product Order Form or otherwise agreed to by Darktrace in writing. Darktrace: (i) does not
provide any aspect of the Third-Party Services; and (ii) is not responsible for any compatibility
issues or errors in the Offering or Third-Party Services caused in whole or in part by the Third-
Party Services.
6. Customer Obligations and Customer Data.
6.1. Customer Security Obligation. As between the parties, Customer will be solely responsible for
establishing, monitoring and implementing security practices to control the physical access to
and use of the Offering and all Customer Data therein. Darktrace will not be liable, and
Customer will be solely responsible for any unauthorized access, damage or loss that may
occur through the use or misuse of Customer's credentials, equipment, systems or premises.
Customer acknowledges that Darktrace does not provide or undertake backup or maintenance
services for Customer Data and Customer will be solely responsible for backup of all Customer
Data.
6.2. Customer Data. As between Customer and Darktrace, Customer will own all right, title and
interest in and to the Customer Data. Customer grants to Darktrace a limited, non-exclusive,
worldwide, royalty-free license to host, access and use the Customer Data only: (i) for the
purpose of operating and providing the Offering and (ii) as required by Applicable Laws.
6.3. Alerts. Darktrace may utilize the metadata associated with Alerts on a deidentified basis to
develop and improve the Darktrace Offering.
6.4. Representation and Warranties. Customer represents and warrants that: (i) it has obtained
and will obtain and continue to have, during the applicable Subscription Period, all necessary
rights, authority, consents and licenses for the access to and use of Customer Data, including
any Personal Data included therein, as contemplated by this Agreement; and (ii) Darktrace's
use of Customer Data in accordance with this Agreement will not violate any Applicable Laws
or cause a breach of any agreement or obligations between Customer and any third party.
7. Data Protection.
7.1. Data Protection Addendum. The parties will comply with their respective obligations set out in
the Data Processing Addendum, which is hereby incorporated into and forms part of this
Agreement.
7.2. Business Associate Agreement. In order to comply with the parties' obligations under the
Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), to the extent applicable
to Customer, Customer and Darktrace agree such protected health information will be
processed in accordance with the Business Associate Agreement, which is hereby
incorporated into and forms part of this Agreement. For the purposes of this Section, Customer
DARKTRACE -4-
DARK i R/arc
is a "covered entity" as defined pursuant to HIPAA regulations and transmits to Darktrace
protected health information which is regulated pursuant to HIPAA during the course of its use
of the Offering.
8. Confidentiality.
8.1. General Obligation. A recipient of Confidential Information will protect that Confidential
Information using the same standard of care it uses to protect its own confidential information
of a similar nature, but no less than a reasonable standard of care. This Section 8 will not
apply to information which: (i) is known by the recipient without confidentiality obligations; (ii)
is or has become public knowledge through no fault of the recipient; or (iii) is independently
developed by, or for, the recipient.
8.2. Permitted Recipient. A recipient of Confidential Information will not: (i) use Confidential
Information of the other party, except as needed to fulfill its obligations or exercise its rights
under this Agreement; or (ii) disclose Confidential Information of the other party to any third
party, except to its or its Affiliates' employees, agents and contractors who need to know. The
recipient is liable for a breach of this Section 8 by its permitted recipients and will ensure each
of those permitted recipients have written confidentiality obligations at least as restrictive as
the recipient's obligations under this Agreement.
8.3. Required Disclosures. The recipient may reveal Confidential Information of the other party if
required by law (including under a court order) but only after it notifies the discloser in writing
(if legally permissible). A recipient will reasonably cooperate with a discloser's reasonably
requested protective actions, at the discloser's expense.
8.4. Return or Destruction. The recipient will return, delete or destroy all Confidential Information
of the other party and confirm in writing it has done so within 30 days of the discloser's written
request unless retention is required by law or Confidential Information has been stored in a
backup system in the ordinary course of business, provided, however, that any such retained
information will remain subject to this Agreement.
9. Warranties.
9.1. Software Warranty. Darktrace warrants to Customer during the applicable Subscription Period
that: (i) the Software will perform materially in accordance with the applicable Product
Specification(s); and (ii) Darktrace adopts customary industry standard practices to prevent
the Software, upon download by or delivery to the Customer, from injecting malicious or
disabling code that is intended to damage or destroy the Customer's system or network where
the Software is installed (the "Software Warranty"). Darktrace will use commercially
reasonable efforts to provide a work-around or correct any reported non-conformity with the
Software Warranty, and, if Darktrace determines that it is unable to do so in its discretion,
Darktrace may terminate Customer's license to access and use the applicable non-conforming
Software and refund to Customer the prepaid Fees prorated for the unused period of the
applicable Subscription Period. Customer will promptly report any non-conformity with the
Software Warranty to Darktrace in writing. The rights and remedies set forth in this Section
will be the Customer's sole and exclusive remedy and Darktrace's sole and exclusive liability
for any breach of the Software Warranty. The Software Warranty does not apply to Evaluation
Offerings.
9.2. Service Warranty. Darktrace warrants to Customer that it will perform all Services in a
professional and workmanlike manner consistent with applicable industry standards. This
warranty will be in effect for a period of 30 days from the completion of the Services, and
Customer will promptly report any non-conformity with such warranty to Darktrace in writing.
DARKTRACE -5-
DARK i RACE
Darktrace will, at its option and expense: (i) use commercially reasonable efforts to re-perform
the non-conforming Services; or (ii) refund to Customer the portion of the Fees paid
attributable to the non-conforming Services. The rights and remedies set forth in this Section
will be the Customer's sole and exclusive remedy and Darktrace's sole and exclusive liability
for any breach of the warranty set forth in this Section.
9.3. Exclusions. The warranties in Sections 9.1 and 9.2 do not apply if: (i) the Offering has been
modified, except by Darktrace; (ii) the Offering has not been installed, used, or maintained in
accordance with this Agreement or Product Specification; (iii) the non-conformity occurs due
to a failure by the Customer to allow Darktrace or its agents to implement any updates,
corrections or modifications to the Software made available to Customer by Darktrace; or (iv)
Customer has combined the Offering with other software, services, or products that are not
provided by Darktrace or not otherwise specified in the applicable Product Specification, and
but for such combination, the breach of warranty would have been avoided.
9.4. No Guarantee. CUSTOMER AGREES THAT: (I) DARKTRACE DOES NOT GUARANTEE OR
WARRANT THAT IT WILL FIND, LOCATE, REPORT OR DISCOVER ALL OF CUSTOMER'S
OR CUSTOMER AFFILIATES' SYSTEM THREATS, VULNERABILITIES, MALWARE, AND
MALICIOUS SOFTWARE, AND CUSTOMER AND CUSTOMER AFFILIATES WILL NOT
HOLD DARKTRACE RESPONSIBLE THEREFOR; AND (II)THE OFFERING AND SERVICES
DO NOT CONSTITUTE ANY FORM OF REPRESENTATION, WARRANTY OR GUARANTEE
THAT CUSTOMER'S SYSTEMS ARE SECURE FROM EVERY ATTACK, EVEN IF FULLY
IMPLEMENTED.
9.5. Disclaimers. EXCEPT AS EXPRESSLY SET FORTH HEREIN, THE OFFERING IS
PROVIDED ON AN "AS IS" BASIS, AND DARKTRACE MAKES NO WARRANTIES OR
REPRESENTATIONS TO CUSTOMER OR TO ANY OTHER PARTY REGARDING THE
OFFERING OR ANY OTHER SERVICES OR MATERIALS PROVIDED HEREUNDER. TO
THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, DARKTRACE HEREBY
DISCLAIMS ALL WARRANTIES AND REPRESENTATIONS, WHETHER EXPRESS OR
IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT,
AND ANY WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE.
WITHOUT LIMITING THE FOREGOING, DARKTRACE HEREBY DISCLAIMS ANY
WARRANTY THAT USE OF THE OFFERING WILL BE ERROR-FREE, BUG-FREE OR
UNINTERRUPTED, OR WILL FULFILL ANY OF CUSTOMER'S PARTICULAR PURPOSES
OR NEEDS. THE OFFERING IS NOT DESIGNED OR INTENDED FOR USE IN ANY
APPLICATION OR HAZARDOUS ENVIRONMENT THAT REQUIRES FAIL-SAFE
PERFORMANCE, WHERE THE FAILURE OF THE OFFERING MIGHT RESULT IN OR
CAUSE DEATH, PERSONAL INJURY OR ENVIRONMENTAL DAMAGE. DARKTRACE
DOES NOT WARRANT ANY THIRD-PARTY PRODUCTS, INTEGRATIONS OR SERVICES.
10. Intellectual Property Rights Infringement Indemnity.
10.1. Darktrace's Indemnity. Darktrace will defend any third-party claim against the Customer
asserting that Customer's use of the Software in accordance with this Agreement infringes a
third party's patent, copyright or registered trademark (the "IP Claim"). Darktrace will
indemnify Customer against any damages awarded in any final judgment entered by a court
of competent jurisdiction or any settlements arising out of an IP Claim, if the Customer: (i)
notifies Darktrace in writing of the IP Claim promptly, and in any event, within 20 days of
receiving notice of such IP Claim; (ii) fully cooperates with Darktrace in the defense of the IP
Claim; and (iii) grants Darktrace the right to exclusively control the defense and settlement of
the IP Claim and any appeal (provided that any settlement by Darktrace must include, as an
unconditional term, the claimant's or plaintiff's release of Customer from all liability with
respect to the IP Claim). Customer may, at Customer's own expense, participate in the
DARKTRACE -6-
DARKTRACE
defense of any IP Claim but Customer will not enter into any settlement or compromise of any
such claim without Darktrace's prior written consent.
10.2. Remedies. If Darktrace reasonably believes the Software could infringe any third party's
patent, copyright or registered trademark, Darktrace may, at its sole option and expense use
commercially reasonable efforts to: (i) modify or replace the Software, or any component or
part thereof, to make it non-infringing; or (ii) procure the right for Customer to continue to use
the Software. If Darktrace determines that neither alternative is commercially practicable,
Darktrace may terminate this Agreement, in its entirety or with respect to the affected
component, by providing written notice to Customer and refunding a prorated portion of the
pre-paid, unused Fees paid by Customer corresponding to the unused period of the applicable
Subscription Period.
10.3. Exclusions. Darktrace will have no obligations under this Section 10 if the IP Claim is based
upon or arises out of: (i) any modification to the Software not made by Darktrace; (ii) any
combination or use of the Software with or in any third party software, hardware, process,
firmware, or data, to the extent that such claim is based on such combination or use; (iii)
Customer's continued use of the allegedly infringing Software after being notified of the
infringement claim or after being provided a modified version of the Software by Darktrace at
no additional cost that is intended to address such alleged infringement; or (iv) Customer's
failure to use the Software in accordance with the terms of this Agreement, including the
applicable Product Specification.
10.4. Exclusive Remedy. THE RIGHTS AND REMEDIES SET FORTH IN THIS SECTION 10 WILL
CONSTITUTE CUSTOMER'S SOLE AND EXCLUSIVE REMEDY,AND DARKTRACE'S SOLE
AND EXCLUSIVE LIABILITY, FOR ANY INFRINGEMENT OR MISAPPROPRIATION OF
INTELLECTUAL PROPERTY RIGHTS IN CONNECTION WITH THE OFFERING.
11. Limitation of Liability.
11.1. Excluded Damages TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY
WILL BE LIABLE FOR ANY LOST PROFITS, REVENUE, OR SAVINGS, LOST BUSINESS
OPPORTUNITIES, LOST DATA, COST OF SUBSTITUTE SERVICES, OR SPECIAL,
INCIDENTAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES ARISING OUT
OF OR IN CONNECTION WITH THIS AGREEMENT OR THE PROVISION OF THE
OFFERING, REGARDLESS OF THE LEGAL OR EQUITABLE THEORY ON WHICH THE
APPLICABLE CLAIM OR LIABILITY IS BASED, EVEN IF SUCH PARTY HAS BEEN ADVISED
OF THE POSSIBILITY OF SUCH DAMAGES OR LOSSES OR SUCH DAMAGES OR
LOSSES WERE REASONABLY FORESEEABLE.
11.2. Limitation of Liability. TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT
WILL A PARTY'S CUMULATIVE LIABILITY TO THE OTHER PARTY ARISING UNDER OR
RELATED TO THIS AGREEMENT OR THE PROVISION OF THE OFFERING, EXCEED THE
FEES ACTUALLY PAID TO DARKTRACE FOR THE OFFERING GIVING RISE TO THE
LIABILITY IN THE 12 MONTH PERIOD IMMEDIATELY PRECEDING THE FIRST EVENT
GIVING RISE TO THE LIABILITY. MULTIPLE CLAIMS SHALL NOT EXPAND THE
LIMITATIONS SPECIFIED IN THIS SECTION 11.
11.3. Exclusions. THE FOREGOING EXCLUSIONS AND LIMITS IN THIS SECTION 11 DO NOT
APPLY TO: (I) DARKTRACE'S INDEMNIFICATION OBLIGATIONS UNDER SECTION 10.1;
(II) BREACH OF SECTION 4.6 (RESTRICTIONS); (Ill) CUSTOMER'S PAYMENT
OBLIGATIONS; AND/OR (IV) ANY INFRINGEMENT OR MISAPPROPRIATION BY ONE
PARTY OF THE OTHER PARTY'S INTELLECTUAL PROPERTY RIGHTS.
DARKTRACE -7-
DARKTRACE
11.4. Basis of the Bargain. THE PARTIES HEREBY ACKNOWLEDGE AND AGREE THAT THE
LIMITATIONS OF LIABILITY IN THIS SECTION 11 ARE AN ESSENTIAL PART OF THE
BASIS OF THE BARGAIN BETWEEN DARKTRACE AND CUSTOMER, AND WILL APPLY
EVEN IF THE REMEDIES AVAILABLE HEREUNDER ARE FOUND TO FAIL THEIR
ESSENTIAL PURPOSE.
12. Term; Suspension and Termination.
12.1. Term. This Agreement will remain in effect until all active Subscription Periods have expired
or until earlier terminated pursuant to the terms of this Agreement or as otherwise specified
herein.
12.2. Suspension. Darktrace may immediately suspend Customer's access to, or use of, the
Offering if: (i) Darktrace believes that there is a significant threat to the security, integrity,
functionality, or availability of the Offering or any content, data, or applications in the Offering;
(ii) Customer is in breach of Section 4.6 (Restrictions); (iii) Customer (or the applicable
Partner) fails to pay Darktrace when fees are due; or(iv) if required by law (including under a
court order); provided, however, Darktrace will use commercially reasonable efforts under the
circumstances to provide Customer with notice and, if applicable, an opportunity to remedy
such violation prior to any such suspension.
12.3. Termination. Either party may terminate this Agreement, effective on written notice to the other
party, if the other party materially breaches this Agreement, and such breach remains uncured
30 days after the non-breaching party provides the breaching party with written notice of such
breach.
12.4 Effect of Termination. Upon termination of this Agreement for any reason: (i) all Customer's
rights to access and use the Offering will terminate; (ii) Customer will promptly cease all use
of the Offering and de-install all Software installed on Customer's systems or networks; (iii)
where applicable, Customer will ensure all Customer Data is removed from the Appliance and
return the Appliance to Darktrace (or the applicable Partner) in accordance with Darktrace's
(or the applicable Partner's) instructions. Darktrace will not be responsible for maintaining or
protecting any configuration settings or data found on the returned Appliance; (iv) for a period
of 30 days following the termination, Darktrace will maintain Customer Data stored in
Darktrace's cloud services and grant Customer access to the cloud services, solely to
download and delete any such Customer Data. Thereafter, Darktrace will delete or destroy all
copies of Customer Data without liability or additional notice, unless legally prohibited from
doing so. Customer Data cannot be received once deleted or destroyed; and (v) all undisputed
Fees owing to Darktrace at the date on which termination or expiry takes effect will become
immediately due and payable.
12.5 Survival. Sections 1, 3, 4.9, 4.10, 6.3, 8, 9.5, 10, 11, 12.4, 12.5, and 13 to 17 will survive
expiration or termination of this Agreement for any reason.
13. Compliance with Laws.
Each party agrees to comply with Applicable Laws, including but not limited to, applicable
export and import, anti-corruption and employment laws. Customer affirms that Customer is
not named on, owned by, or acting on behalf of any United Kingdom, U.S. or other applicable
government denied-party list, and Customer agrees to comply fully with all relevant export
control and sanctions laws and regulations of the United Kingdom, the United States and other
applicable jurisdictions ("Export Laws") to ensure that neither the Offering, Software, any of
Customer Data, nor any technical data related thereto is: (i) used, exported or re-exported
directly or indirectly in violation of Export Laws; or (ii) used for any purposes prohibited by the
DARKTRACE -8-
DARKTRACE
Export Laws, including, but not limited to, nuclear, chemical, or biological weapons
proliferation, missile systems or technology, or restricted unmanned aerial vehicle
applications. Customer shall complete all undertakings required by Export Laws, including
obtaining any necessary export license or other governmental approval.
14. U.S. Government End Users.
The Offering (including the Software) was developed solely at private expense and is a
"commercial product", "commercial item", or"commercial computer software" as defined in the
Federal Acquisition Regulation 2.101 and other relevant government procurement regulations
including agency supplements. Any use, duplication, or disclosure of the Offering (including
the Software) by or on behalf of the U.S. government is subject to restrictions as set forth in
this Agreement as consistent with U.S. federal law and regulations. If these terms are
inconsistent in any respect with U.S. federal law, Customer will immediately discontinue its
use of the Offering (including the Software).
15. Governing Law and Dispute Resolution.
Any dispute or claim relating in any way to this Agreement will be governed by the Governing
Law defined in the table below and adjudicated: (i) in the Governing Courts defined in the
table below, in which case each party consents to the exclusive jurisdiction and venue thereof;
or (ii) by final and binding arbitration; in each case, as set forth in the table below.
Notwithstanding the foregoing: (a) each party may enforce its or its Affiliates' Intellectual
Property Rights in any court of competent jurisdiction, including to seek injunction, specific
performance and any other relief that may be available from any such court; and (b) Darktrace
or its Affiliates may bring suit for payment in the country where the Customer is located. Where
arbitration applies, it will be conducted in English, under the Rules of Arbitration of the
International Chamber of Commerce (the "ICC") by three arbitrators in accordance with said
Rules. The award shall be final and binding on the parties. Except to the extent entry of
judgment and any subsequent enforcement may require disclosure, all matters relating to the
arbitration, including the award,will be held in confidence. Customer and Darktrace agree that
the United Nations Convention on Contracts for the International Sale of Goods shall not
apply.
Customer location (as Governing Law Governing Courts /
stated in the Product Arbitration
Order Form)
United Kingdom The laws of England &Wales The courts of England &
Wales
United States of America The laws of the state of The state or federal courts
California, without giving in Santa Clara County,
effect to any principles of California
conflict of laws that would
lead to the application of the
laws of another jurisdiction
None of the above The laws of England &Wales Arbitration at the ICC in
London
16. General Provisions.
16.1. Entire Agreement; Amendments. This Agreement is the complete and exclusive agreement
between the parties with respect to its subject matter and supersedes any and all prior or
contemporaneous agreements, communications and understandings, both written and oral,
with respect to its subject matter. This Agreement may be amended or modified only by a
DARKTRACE _g_
DARKTRACE
written document executed by duly authorized representatives of the parties, except that
Darktrace may unilaterally modify the Product Specification and Support Terms so long as it
does not reduce or materially modify the functionality of the Offering. Unless otherwise
specifically agreed to in writing signed by the parties, in the event of any conflict or
inconsistency between this Agreement, any Product Order Form or any document
incorporated by reference into this Agreement, the order of precedence of the documents from
highest to lowest is: (i) the Product Order Form; (ii) this main body of the Agreement; and (iii)
the documents incorporated herein by reference solely with respect to the subject matter of
such documents, and provided, further, that the Data Processing Addendum will prevail over
the Product Order Form, this main body of the Agreement and all other documents solely with
respect to its subject matter.
16.2. Assignment. Neither party may assign or transfer this Agreement, by operation of law or
otherwise, without the other party's prior written consent. Any attempt to assign or transfer
this Agreement without such consent will be void. Notwithstanding the foregoing, either party
may assign or transfer this Agreement to: (i) an Affiliate in connection with a corporate
reorganization; or (ii) a third party that succeeds to all or substantially all of the assigning
party's business and assets relating to the subject matter of this Agreement, whether by sale,
merger, operation of law or otherwise. Subject to the foregoing, this Agreement is binding
upon and will inure to the benefit of each of the parties and their respective successors and
permitted assigns.
16.3. Compliance. Customer agrees to permit Darktrace, or an independent representative
appointed by Darktrace, to verify that Customer's use of the Offering complies with this
Agreement. Darktrace will not exercise this right more than once in any 12-month period. If
Customer procured the Offering through a Partner, Customer also agrees that Darktrace may
request Customer to provide confirmation of the order(s) placed by Customer with the Partner,
including copies of agreement(s) between Customer and Partner, provided that all pricing
information will be removed from the copies provided to Darktrace.
16.4. Equitable Relief. Each party agrees that a breach or threatened breach by such party of any
of its obligations under Section 8 (Confidentiality) or, in the case of Customer, Section 4.6
(Restrictions), would cause the other party irreparable harm and significant damages for which
there may be no adequate remedy under law and that, in the event of such breach or
threatened breach, the other party will have the right to seek immediate equitable relief,
including a restraining order, an injunction, specific performance and any other relief that may
be available from any court. Such remedies are not exclusive and are in addition to all other
remedies that may be available at law, in equity or otherwise.
16.5. Independent Contractors. The relationship between the parties is that of independent
contractors. Nothing in this Agreement will be construed to establish any partnership, joint
venture or agency relationship between the parties. Neither party will have the power or
authority to bind the other or incur any obligations on the other's behalf without the other
party's prior written consent.
16.6. No Third-Party Beneficiaries. No provision of this Agreement is intended to confer any rights,
benefits, remedies, obligations, or liabilities hereunder upon any person or entity other than
the parties and their respective successors and assigns.
16.7. Waiver; Severability. Either party's failure to enforce any provision of this Agreement will not
constitute a waiver of future enforcement of that or any other provision. No waiver of any
provision of this Agreement will be effective unless it is in writing and signed by the party
granting the waiver. If any provision of this Agreement is held invalid, illegal or unenforceable,
that provision will be enforced to the maximum extent permitted by law, given the fundamental
DARKTRACE - 10 -
DARKTRACE
intentions of the parties, and the remaining provisions of this Agreement will remain in full
force and effect.
16.8. Force Maieure. Other than in respect of Customer's payment obligations, neither party will be
responsible for any failure or delay in the performance of its obligations under this Agreement
due to causes beyond its reasonable control, which may include, without limitation, labor
disputes, strikes, lockouts, shortages of or inability to obtain energy, raw materials or supplies,
denial of service or other malicious attacks, telecommunications failure or degradation,
pandemics, epidemics, public health emergencies, governmental orders and acts (including
government-imposed travel restrictions and quarantines), material changes in law, war,
terrorism, riot, or acts of God. The party experiencing a force majeure event will use
commercially reasonable efforts to provide notice of such to the other party. During the
continuation of a force majeure event, the non-performing party will use commercially
reasonable efforts to overcome the force majeure event and, to the extent it is able, continue
to perform its obligations under this Agreement.
16.9. Notices. Any notice will be delivered by hand, recorded delivery, registered post or email with
satisfactory proof of such delivery to be retained by sender. Notices will only become effective
on the actual date that the notice is received. Any notices required to be given in writing to
Darktrace will be addressed to: Attn: Legal Department, Darktrace Holdings Limited, Maurice
Wilkes Building, Cowley Road, Cambridge CB4 ODS, United Kingdom. Email notices to
notices a(�darktrace.com.
17. Definitions.
When used in this Agreement, terms defined in this Section 17 will have the meanings given
below. Defined terms may be used in the singular or plural depending on the context.
"Affiliate" means any corporation or other business entity that directly or indirectly controls, is
controlled by or is under common control with a party. Control means direct or indirect
ownership of or other beneficial interest in fifty percent (50%) or more of the voting stock,
other vesting interest, or income of a corporation or other business entity.
"Alerts" means alerts of suspected malicious activity on a Customer's environment generated
by the Offering.
"Appliance(s)" means hardware device(s) (including embedded firmware) shipped by
Darktrace to Customer and as more fully described on the Product Order Form.
"Applicable Laws" means all international, domestic and local laws, ordinances, regulations
and orders applicable to a party's performance under this Agreement.
"Business Associate Agreement" means the document titled Darktrace Business Associate
Agreement available at https://darktrace.com/legal/business-associate-agreement.
"Cloud Provider" means Microsoft Azure, Amazon Web Services, Google Cloud Platform, as
specified on the Product Order Form.
"Commencement Date" means the date specified in a Product Order Form on which Darktrace
shall commence providing the Offering to Customer.
"Confidential Information" means any information, however conveyed or presented, that
relates to the business, affairs, operations, customers, suppliers, processes, budgets, pricing
DARKTRACE - 11 -
DARKTRACE
policies, product information, strategies, developments, trade secrets, intellectual property,
materials, designs, improvements, formulae, discoveries, inventions, networks, concepts,
ideas, technical information and know-how of a party, and any other information clearly
designated by a party as being confidential to it (whether or not it is marked "confidential"),
and information that ought reasonably be considered to be confidential given its nature or
circumstance of disclosure, but in all circumstances excludes any Personal Data.
"Customer" means the party using or accessing the Offering, or any portion thereof, in each
case, pursuant to the terms of this Agreement.
"Customer Data" means: (i)all data and information submitted into, or stored in, the Appliance
or Software by Customer, or otherwise provided by Customer to, or accessible by, Darktrace
in connection with this Agreement (which may include information about network traffic on
Customer's network (metrics), log/metadata collection, as well as the raw packet capture data
from Customer's network); and (ii) the contents of all Alerts; but, in case of (i) and (ii),
excluding any information or data owned or controlled by Darktrace and made available
through or in connection with the Offering.
"Data Processing Addendum" means the document titled Data Processing Addendum
available at https://darktrace.com/legal/data-processing-addendum.
"Installation Service" means installation and test procedures performed by Darktrace to
confirm completion of the installation of the Appliance on the applicable site.
"Intellectual Property Rights" means patent rights, copyrights, trademark rights, design rights,
trade secrets, know-how, data and database rights, mask work rights, domain name rights,
and any other intellectual property rights and similar or equivalent rights or forms of protection
recognized in any part of the world.
"Offering" means, collectively, the Appliance(s), Software and Services (or any combination
thereof).
"Outsource Provider" means any third-party service provider(s) such as an outsourcer,
hosting, managed service, or collocation service provider or other information technology
service provider for the performance of information technology functions appointed or
engaged by or on behalf of Customer.
"Partner" means an authorized reseller of Darktrace.
"Partner Arrangement" means a separate agreement between Customer and a Partner.
"Personal Data" has the meaning given to it in the Data Processing Addendum.
"Product Order Form" means any order form, purchase order or other ordering document
agreed to or accepted by Darktrace, or Darktrace and a Partner where applicable, that
identifies the Offering purchased by Customer, or an Evaluation Offering, the Offering
quantity based on Darktrace's applicable usage metrics, price, and Subscription Period.
"Product Specification" means the technical and user manuals and guides for the Offering
available at available at https://darktrace.com/legal/product-specific-term:: and at
nttps:;'darktrace.com/legal/product-specifications-and-service-definitions, as updated by
Darktrace from time to time.
DARKTRACE _ 12_
DARKTRACE
"Services" means the Installation Service and the Support Services.
"Support Services" means support services for the Offering performed by Darktrace in
accordance with the Support Terms.
"Support Terms" means Darktrace's support services terms and conditions available at
https://darktrace.com/legal/darktrace-support-services, as may be updated by Darktrace from
time to time.
"Software" means the Darktrace's software (in object code form) delivered to Customer on a
standalone basis or as installed in the Appliance (including pursuant to an applicable Product
Order Form), as more fully described on the applicable Product Specification, together with
all enhancements, error corrections, and/or updates which are generally made available by
Darktrace.
"Subscription Period" means the period during which Darktrace shall make available the
Offering to Customer as set forth in the applicable Product Order Form.
"Usage Metrics" means the limits, metrics or other measurements or conditions of permitted
usage of the Offering, as set out in the applicable Product Order Form.
DARKTRACE - 13 -
DA;K i RACE
BUSINESS ASSOCIATE AGREEMENT
1. PREAMBLE AND DEFINITIONS
1.1. Pursuant to the Health Insurance Portability and Accountability Act of 1996, as amended
("HIPAA"), the applicable healthcare provider that has agreed to the Darktrace Master
Services Agreement ("Covered Entity") and Darktrace Holdings Limited, a private limited
company registered in England and Wales (together with any of its corporate affiliates,
"Business Associate"), enter into this Business Associate Agreement ("BAA"), which is
incorporated by reference into, and entered into as of the date of, the Darktrace Master
Services Agreement, to address the HIPAA requirements with respect to "business
associates," as defined under the privacy, security, breach notification, and enforcement rules
at 45 C.F.R. Part 160 and Part 164 ("HIPAA Rules"), including as amended by the Health
Information Technology for Economic and Clinical Health Act of 2009 (the "HITECH Act") and by
the American Recovery and Reinvestment Act of 2009 ("ARRA"). A reference in this BAA to a
section in the HIPAA Rules means the section as currently in effect or as amended.
1.2. This BAA is intended to ensure that Business Associate has, or will, establish and implement
appropriate safeguards for the Protected Health Information ("PHI") (as defined under the HIPAA
Rules) that Business Associate may receive, maintain, use, or disclose in connection with the
functions, activities, and services that Business Associate performs for Covered Entity. The
functions, activities, and services that Business Associate performs for Covered Entity are defined
in the Darktrace Master Services Agreement or any other written agreement between the parties
for the provision of services by Business Associate to Covered Entity (the "Underlying
Agreement").
1.3. Unless the context clearly indicates otherwise, the following terms in this BAA shall have the same
meaning as those terms in the HIPAA Rules: Designated Record Set, disclosure, Electronic
Protected Health Information (ePHI), individual, Minimum Necessary, Notice of Privacy Practices,
Required By Law, Secretary, Subcontractor, Unsecured PHI, and use.Additional definitions are as
follows:
(a) "Breach"shall mean a"breach"as defined in 45 C.F.R.§ 164.402 with respect to Unsecured PHI
save that for the purposes of this Agreement, a Breach shall exclude log-on attempts,denials of service
or any combination of the above, so long as no such incidents result in actual unauthorized access, use
or disclosure of Covered Entity's Unsecured PHI.
(b) "Discovery" shall mean, with respect to a Breach or Security Incident, the first day on which such
Breach or Security Incident is known to Business Associate (including any person, other than the
individual committing the breach, that is an employee, officer, or other agent of Business
Associate).
(c) "Security Incident" shall have the meaning given such term in 45 C.F.R. § 164.304, save that for the
purposes of this Agreement,a Security Incident shall exclude log-on attempts, denials of service or any
combination of the above, so long as no such incidents result in actual unauthorized access, use or
disclosure of Covered Entity's unsecured PHI.
(d) "Privacy Rule" shall mean the Privacy Rule, in conformity with the regulations at 45 C.F.R.
Parts 160-164, as interpreted under applicable regulations and guidance of general
OARKTRACE
D/ARK i RACE
application published by the HHS, including all amendments thereto for which compliance is
required,as amended by the HITECH Act,ARRA,and the HIPAA Rules.
(e) "Security Rule"shall mean the Standards for Security of Electronic Protected Health Information at
45 C.F.R. § 160 and§ 164, subparts A and C.
2. GENERAL OBLIGATIONS OF BUSINESS ASSOCIATE
2.1. Business Associate agrees not to use or disclose PHI,other than as permitted or required by this BAA or
as required by Law,or if such use or disclosure does not otherwise cause a Breach of Unsecured PHI.
2.2. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of PHI other than
as provided for by the BAA.
2.3. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to
Business Associate as a result of a use or disclosure of PHI by Business Associate in violation of this
BAA's requirements or that cause a Breach of Unsecured PHI.
2.4. Business Associate agrees to report to Covered Entity any Breach of Unsecured PHI not provided for
by the BAA of which it becomes aware, or any Security Incident of which it becomes aware, within
seven(7)calendar days of the Discovery of such Breach or Security Incident. Business Associate
shall provide, as much as may be reasonably practicable, such additional information reasonably
requested by Covered Entity for purposes of investigating the Breach or Security Incident and any
other available information that Covered Entity is required to include to the individual under 45
C.F.R. § 164.404(c) at the time of notification or promptly thereafter as information becomes
available.
2.5. To the extent it may be applicable, Business Associate agrees, in accordance with 45 C.F.R. §§
164.502(e)(1)(ii)and 164.308(b)(2), to require that any Subcontractors that create, receive, maintain,
or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and
requirements that apply to the Business Associate with respect to such information.
2.6. Business Associate does not maintain a Designated Record Set(as defined in 45 C.F.R.§164.501), nor
does Business Associate maintain any unique PHI to which Covered Entity does not have access.
Covered Entity retains all obligations related to Designated Record Sets, including maintenance,
individual access,amendments to the Designated Record Set, and responding to individuals' requests
for access.
2.7. To the extent applicable and practicable given that Business Associate does not maintain a
Designated Record Set, Business Associate agrees to maintain and make available the information
required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered
Entity's obligations under 45 C.F.R. §164.528.
2.8. Business Associate agrees to make its internal practices, books, and records, including policies
and procedures regarding PHI, relating to the use and disclosure of PHI and Breach of any
Unsecured PHI received from Covered Entity,or created or received by the Business Associate on
behalf of Covered Entity, available to the Secretary for the purpose of the Secretary determining
compliance with the Privacy Rule.
2.9. Business Associate shall not sell any PHI without the express prior written consent of Covered Entity.
DARKTRACE
DARKTRACE
3. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
3.1. General Uses and Disclosures. Business Associate agrees to receive, create, use, or disclose PHI only
in a manner that is consistent with this BAA,the Privacy Rule,or Security Rule, and only in connection
with providing services to Covered Entity.
3.2. Business Associate may use or disclose PHI as Required By Law,and may use PHI to report violations of
law to appropriate federal and state authorities,consistent with 45 C.F.R.§164.502(j)(1).
3.3. Business Associate agrees to make uses and disclosures and requests for PHI consistent with
Covered Entity's Minimum Necessary policies and procedures.
3.4. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R.
Part 164 if done by the Covered Entity.
3.5. Except as otherwise provided in this BAA, Business Associate may use PHI for its proper management
and administration or to carry out its legal responsibilities as permitted under applicable law.
3.6. Business Associate may de-identify any and all PHI, provided that the de-identification conforms to the
requirements of 45 C.F.R. § 164.514(b), and further provided that the Covered Entity maintains the
documentation required by 45 C.F.R. § 164.514(b)which may be in the form of a written assurance from the
Business Associate.To the extent described in 45 C.F.R. §164.502(d)(2),de-identified information does not
constitute PHI and is not subject to the terms of this BAA.
4. OBLIGATIONS OF COVERED ENTITY
4.1. Covered Entity shall:
(a) Provide Business Associate with the Notice of Privacy Practices that Covered Entity produces in
accordance with the Privacy Rule, and any changes or limitations to such notice under 45 C.F.R.§
164.520, to the extent that such changes or limitations may affect Business Associate's use or
disclosure of PHI.
(b) Notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has
agreed to or is required to abide by under 45 C.F.R. § 164.522,to the extent that such restriction
may affect Business Associate's use or disclosure of PHI under this BAA.
(c) Notify Business Associate of any changes in or revocation of permission by an individual to use or
disclose PHI, if such change or revocation may affect Business Associate's permitted or required
uses and disclosures of PHI under this BAA.
(d) Use appropriate safeguards to maintain and ensure the confidentiality,privacy and security of PHI
transmitted to Business Associate in accordance with the standards and requirements of the HIPAA
Rules.
4.2 Covered Entity shall not request Business Associate to use or disclose PHI in any manner that
would not be permissible under the Privacy and Security Rule if done by Covered Entity,except for
the specific uses and disclosures provided under Section 3 of this BAA.
5. TERM AND TERMINATION
5.1. This BAA shall be in effect as of the date of the Underlying Agreement and shall terminate on the earlier
of the date that:
(a) Either party terminates for cause as authorized under Section 5.2 of this BAA.
DARKTRACE
DARKTRACE
(b) All of the PHI received from Covered Entity, or created or received by Business Associate on
behalf of Covered Entity, is destroyed or returned to Covered Entity. If it is not feasible to return
or destroy PHI, protections are extended in accordance with Section 5.3 of this BAA.
5.2. Upon either party's knowledge of material breach by the other party, the non-breaching party
shall provide an opportunity for the breaching party to cure the breach or end the violation; or
terminate the BAA. If the breaching party does not cure the breach or end the violation within a
reasonable timeframe not to exceed thirty (30) days from the notification of the breach, or if a
material term of the BAA has been breached and a cure is not possible, the non-breaching party
may terminate this BAA, upon written notice to the other party.
5.3. Upon termination of this BAA for any reason, Business Associate, with respect to PHI received from
Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered
Entity, shall:
(a) Retain only that PHI that is necessary for Business Associate to continue its proper management and
administration or to carry out its legal responsibilities;
(b) Return to Covered Entity or destroy the remaining PHI that the Business Associate still maintains in any
form;
(c) Continue to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with
respect to ePHI to prevent use or disclosure of the PHI,other than as provided for in]this Section 5,
for as long as Business Associate retains the PHI;
(d) Not use or disclose the PHI retained by Business Associate other than for the purposes for which
such PHI was retained and subject to the same conditions set out in Sections 2 and 3 above
which applied prior to termination; and
(e) Return to Covered Entity or destroy the PHI retained by Business Associate when it is no longer
needed by Business Associate for its proper management and administration or to carry out its
legal responsibilities.
5.4. The obligations of Business Associate under this Section 5 shall survive the termination of this BAA.
6. MISCELLANEOUS
6.1. Limitation of Liability. Except to the extent may be precluded by HIPAA or other applicable laws, the
parties' maximum liability to each other will be limited to the total amount paid or payable to Business
Associate during the term of this BAA, and in no event will either party be liable to the other party for
any indirect, moral, incidental, special, economic, exemplary, punitive or consequential damages.
6.2. The parties agree to take such action as is necessary to amend this BAA to comply with the
requirements of the Privacy Rule,the Security Rule,HIPAA,ARRA,the HITECH Act,the HIPAA Rules,
and any other applicable law.
6.3. The respective rights and obligations of Business Associate under Section 5 of this BAA shall survive the
termination of this BAA.
6.4. This BAA shall be interpreted in the following manner:
(a) Any ambiguity shall be resolved in favor of a meaning that permits Covered Entity to comply with the
HIPAA Rules.
DARKTRACE
D/ARK i RACE
(b) Any inconsistency between the BAA's provisions and the HIPAA Rules, including all amendments,
as interpreted by the HHS,a court, or another regulatory agency with authority over the Parties,
shall be interpreted according to the interpretation of the HHS, the court, or the regulatory
agency.
(c) Any provision of this BAA that differs from those required by the HIPAA Rules, but is nonetheless
permitted by the HIPAA Rules, shall be adhered to as stated in this BAA.
6.5. This BAA constitutes the entire agreement between the parties related to the subject matter of this BAA,
except to the extent that the Underlying Agreement may impose more stringent requirements related
to the use and protection of PHI upon Business Associate. This BAA supersedes all prior
negotiations,discussions, representations, or proposals,whether oral or written.This BAA may not
be modified unless done so in writing and signed by a duly authorized representative of both parties.
If any provision of this BAA, or part thereof, is found to be invalid, the remaining provisions shall
remain in effect.
6.6. Except to the extent preempted by federal law, this BAA shall be governed by and construed in
accordance with the laws of the State of California, and any disputes arising under or relating to
this BAA shall be brought before the state and federal courts located in the City of San Francisco,
California to whose exclusive jurisdiction the parties irrevocably consent.
6.7. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer,
upon any person other than the parties and the respective successors or assigns of the parties, any
rights, remedies,obligations, or liabilities whatsoever.
DARKTRACE