METTISSA SUBSCRIPTION GENERAL TERMS

Art. 1. Subject matter and scope

(1) These general terms (“the General Terms”) govern the provision of the Mettissa service by Taylored EOOD, UIC 208485493, with registered office and address of management at: Sofia, Lozenets district, 17 Sveta Gora Street, floor 2, apt. 4 (“the PROVIDER”), to merchants and other legal entities (“the CLIENT”) that have concluded a subscription order with the PROVIDER (“the Order”). The PROVIDER and the CLIENT are together referred to as “the Parties”.

(2) The agreement between the Parties (“the Agreement”) consists of the signed Order, these General Terms and Annex No. 1 – Personal Data Processing Agreement. In the event of conflict, the Order prevails over the General Terms, and Annex No. 1 prevails over the remainder of the General Terms on matters of personal data protection.

(3) The CLIENT accepts the General Terms in writing by signing the Order. The General Terms are published at mettissa.com/terms and are sent to the CLIENT by email.

(4) The PROVIDER may amend the General Terms by notifying the CLIENT by email at least 30 (thirty) days before the amendments enter into force. If the CLIENT does not agree with them, it may terminate the Agreement by written notice (including by email) before that date, without owing a penalty; otherwise the amendments are deemed accepted. Amendments to the General Terms do not change the price agreed in the Order.

(5) The General Terms do not apply in respect of consumers.

Art. 2. The Service and its purpose

(1) The PROVIDER provides services for the analysis of production processes on the production premises used by the CLIENT, through the software product developed by the PROVIDER under the trade name Mettissa (“the Service”), against a monthly subscription price in accordance with the Order. For this purpose the CLIENT provides the PROVIDER with video streams from cameras located on the production premises, and the analysis is carried out only on data without facial or biometric features, after Automatic Privacy Processing.

(2) The purpose of the Service is the analysis and improvement of the production processes, procedures, rules, technologies, policies and work organisation introduced by the CLIENT.

(3) The Service may not serve and may not be used for:

a) assessment, ranking, monitoring of labour discipline, determination of remuneration, sanctions and/or norms of an individual worker/employee;

b) determination of productivity indicators for an individual worker/employee, or notifications (alerts) relating to an individual worker/employee;

c) video surveillance for security purposes;

d) other purposes prohibited by applicable law.

(4) The cameras whose video streams are analysed (“the In-Scope Cameras”) and the corresponding work areas are specified in the Order and/or agreed in writing between the Parties (including by email) before they are connected. By the same procedure the Parties may add or remove cameras during the term of the Agreement, and the change is reflected in the subscription price in accordance with the Order, as from the next subscription period.

(5) Unless otherwise agreed in the Order, the Service includes: access to the Mettissa platform; a report after the end of each working day; a weekly report on trends and a weekly review of the results lasting up to 30 minutes; support with a response within 24 hours on working days. New functionalities requested by the CLIENT are quoted separately.

Art. 3. Definitions

(1) For the purposes of the Agreement:

1. “Automatic Privacy Processing” means the automatic blurring of faces in the frame, carried out before the analysis and before any human review;

2. “Process-Level Metrics” means aggregated data on time by workstation, operation and product (e.g. work, support activities, waiting, downtime), without data on an individual person;

3. “Temporary Object Numbers” means random numbers that the system assigns to moving objects within a single video segment in order to calculate time by station; they are not stored and are not linked between segments;

4. “Processed Clips” means short video segments with blurred faces, used for tuning the Service and verifying accuracy;

5. “Anonymised Data” means data obtained in the provision of the Service from which no natural person can be identified and the CLIENT, its products or trade secrets cannot be recognised – for example derived data (coordinates, contours, activity labels, operation times) and video segments processed so as not to permit such identification;

6. “Start Date” has the meaning given in Art. 5(1).

Art. 4. Term

(1) The Agreement enters into force upon the signing of the Order by both Parties and is concluded for an indefinite term, unless a fixed term is agreed in the Order.

(2) Either Party may terminate the Agreement by notice in accordance with Art. 13(1)(2).

Art. 5. Start and special conditions

(1) The PROVIDER starts the Service within 10 (ten) working days of the signing of the Order, unless another period is agreed therein, provided that the CLIENT has provided the access and the data under Art. 8(1). If the Service does not start within that period for reasons attributable to the PROVIDER, the CLIENT may terminate the Agreement by written notice (including by email) without owing payment, and the amounts paid are refunded to it. The start of the Service is confirmed in writing (including by email) by the PROVIDER (“the Start Date”).

(2) In the Order the Parties may agree special commercial conditions – for example discounts, a free period, a right of termination with a refund of amounts paid, or a fixed term. They apply as described in the Order and only to it.

Art. 6. Price and payment

(1) The subscription price, the number of In-Scope Cameras included in it and the price for each additional camera are set out in the Order. Prices are in euro and exclude VAT.

(2) The subscription price is paid in advance for each subscription period of 1 (one) month. The first subscription period begins on the Start Date, unless otherwise agreed in the Order. Each subsequent subscription period begins on the same date of the following month.

(3) The PROVIDER issues an invoice at the beginning of each subscription period. The CLIENT pays it by bank transfer within 7 (seven) days of receiving it, unless another period is agreed in the Order, to the bank account indicated on the invoice. The fees of the CLIENT’s bank and of any intermediary banks are for its account.

(4) The CLIENT agrees that invoices be sent to it electronically, to the email address indicated in the Order.

(5) VAT is charged in accordance with applicable law, including under the reverse charge procedure where the CLIENT is established outside the Republic of Bulgaria.

(6) The PROVIDER may change the subscription price under a concluded Agreement only upon notice by email at least 30 (thirty) days before the change enters into force. Within that period the CLIENT may terminate the Agreement by written notice (including by email) without owing a penalty. A change in the PROVIDER’s published prices does not affect Orders already concluded.

Art. 7. Obligations of the PROVIDER

(1) The PROVIDER undertakes:

1. to provide the Service with due care and in accordance with the Agreement;

2. to provide the CLIENT with access to the Mettissa software platform, through which it provides periodic reports on the analysis of the production processes from the In-Scope Cameras;

3. to produce only Process-Level Metrics and not to produce reports, rankings or comparisons at the level of an individual, nor notifications about a specific individual;

4. not to display metrics aggregated for fewer than 2 (two) people or for a station with a single permanent operator; for such stations only metrics for the product or the material are reported;

5. not to use facial recognition or other biometric methods, not to link Temporary Object Numbers and not to draw inferences about emotions or fatigue;

6. to use the access to the CLIENT’s systems only for the purposes of the Service, through a separate user account with “view only” rights to the video streams and recordings from the In-Scope Cameras necessary for tuning, for providing the Service and for verifying accuracy, without access to other cameras and without the ability to change the cameras’ settings;

7. not to allow access to the Processed Clips by persons not authorised by the CLIENT;

8. to remedy within a reasonable time technical problems in the operation of the Service of which it has been notified by the CLIENT.

(2) Should the CLIENT assign other tasks outside the Service, it owes the PROVIDER additional remuneration agreed in writing (including by email).

Art. 8. Obligations of the CLIENT

(1) The CLIENT undertakes:

1. to provide the PROVIDER with the necessary data (e.g. production data, working hours, standard operating procedures, real-time video stream) and a contact person; the data is provided within 5 (five) working days of a written request (including by email);

2. to provide the PROVIDER with the assistance necessary to achieve the purposes of the Agreement, including a stable internet connection and uninterrupted access to the video streams from the In-Scope Cameras;

3. to use the results only to improve the production processes and not to attempt to identify or assess individuals from the video material and the reports;

4. as controller of the personal data – to have a legal basis for the video surveillance and for providing the video data to the PROVIDER and, before the Start Date, to inform the employees and other persons within the cameras’ scope in writing about the processing (the PROVIDER provides a template notice and information signs);

5. to pay the PROVIDER the subscription price within the agreed periods.

(2) In the event of delayed performance of the CLIENT’s obligations under paragraph 1, the PROVIDER’s performance deadlines are extended by the period of the delay, without this being considered non-performance on its part.

Art. 9. Personal data protection

(1) In providing the Service the PROVIDER processes video data from the In-Scope Cameras as a processor of personal data on behalf of the CLIENT, who is the controller of that data, under the conditions of Annex No. 1.

(2) The CLIENT notifies the PROVIDER immediately (no later than 2 working days) if it establishes that the processing goes beyond the scope of the Agreement, or that an objection or complaint has been received from a data subject, or a communication from and/or an act of the competent supervisory authority.

Art. 10. Confidentiality

(1) “Confidential Information” means any information disclosed by one Party to the other in connection with the Agreement, in whatever form – including production, commercial, technical and financial data, video material, reports, pricing terms, as well as the software, the models and the methods.

(2) Each Party undertakes not to disclose the Confidential Information to third parties and to use it only for the purposes of the Agreement. Access to it is given only to workers/employees, partners, consultants and subcontractors who need it and who are bound by the same obligation. The PROVIDER will not share information about the CLIENT’s processes, or results of the analyses of those processes, with third parties, including competitors of the CLIENT.

(3) The obligation does not apply to information which: is publicly available through no fault of the receiving Party; was lawfully known to the receiving Party before the disclosure; was lawfully obtained from a third party without an obligation of confidentiality; or must be disclosed by law or at the request of a competent authority (of which the other Party is notified in good time, to the extent permissible).

(4) The confidentiality obligation applies for the term of the Agreement and for 3 (three) years after its termination.

(5) Upon termination of the Agreement each Party returns or destroys the Confidential Information received, unless the law requires its retention.

(6) The use of Anonymised Data in accordance with Art. 11(4) does not constitute disclosure of Confidential Information.

(7) The PROVIDER may name the CLIENT as its client, including to potential investors and partners bound by an obligation of confidentiality. Publication of a case study, results, photographs or the CLIENT’s logo is permitted only with its prior written consent (including by email).

Art. 11. Intellectual property and data

(1) The CLIENT receives the right to use the reports and results provided, without limitation in time, for its own internal needs, subject to Art. 2(3).

(2) The PROVIDER retains all rights in its software, models, algorithms, methods and know-how, including the improvements to them created in the performance of the Agreement.

(3) The PROVIDER may use, for purposes of its own choosing, aggregated statistical data on the operation of the system (e.g. model accuracy rates) which contain no personal data and from which neither the CLIENT nor any natural person can be identified.

(4) The CLIENT instructs the PROVIDER to anonymise the data obtained in the provision of the Service and agrees that the PROVIDER may use the Anonymised Data, including after termination of the Agreement, for training, testing and improving its models and services, including for its other clients, provided that the PROVIDER: a) does not disclose the Anonymised Data to third parties in a form that allows the CLIENT or a natural person to be recognised; b) does not attempt to re-identify individuals or the CLIENT; c) does not use the Anonymised Data in order to provide third parties with comparisons or information about the CLIENT.

(5) The CLIENT may at any time request in writing (including by email) that the data obtained from it after the request not be used under paragraph 4.

(6) The reports and results produced for the CLIENT are not provided to other clients of the PROVIDER.

Art. 12. Liability

(1) The PROVIDER is not liable for damages arising from use of the results in breach of Art. 2(3) or Art. 8(1)(3), or from non-performance of the CLIENT’s obligations as employer and as controller of personal data under applicable law, including under Art. 8(1)(4) and Art. 9(2), and the CLIENT indemnifies it for claims brought by third parties in that connection.

(2) The PROVIDER is not liable for interruptions of the Service caused by the internet connection, the cameras or other systems of the CLIENT or of third parties beyond the PROVIDER’s control.

(3) Except in cases of intent or gross negligence, the PROVIDER’s total liability under the Agreement is limited to the amount of the subscription price paid by the CLIENT for the last 12 (twelve) months before the event giving rise to the damage, and the PROVIDER is not liable for lost profits.

Art. 13. Termination and suspension of the Agreement

(1) The Agreement is terminated:

1. by mutual written consent of the Parties;

2. upon 14 (fourteen) days’ written notice (including by email) from either Party to the other Party, whereby the Agreement terminates at the end of the subscription period in which the notice expires;

3. by written notice from the non-defaulting Party, if the other Party fails to perform a material obligation under the Agreement and does not remedy the non-performance within 14 (fourteen) days of receiving a written request;

4. upon the opening of insolvency proceedings or a declaration of liquidation in respect of either Party;

5. in the cases under Art. 1(4), Art. 5(1), Art. 6(6) and paragraph 4 of this Article, as well as in the cases agreed in the Order.

(2) Upon termination of the Agreement the subscription price paid for the current subscription period is not refunded, except in the cases under Art. 5(1), where otherwise agreed in the Order, and upon termination due to non-performance by the PROVIDER.

(3) Either Party may immediately, at its own discretion, suspend the processing and/or the provision of the Service if the competent authorities order or recommend this, or upon an objection or complaint received from a data subject – until the matter is resolved. The periods under the Agreement are extended by the period of the suspension.

(4) In the event of a breach of Art. 8(1)(3) the PROVIDER may suspend the Service by written notice. If the breach is not remedied within 14 (fourteen) days, the PROVIDER may terminate the Agreement by written notice.

(5) In the event of a payment delay of more than 14 (fourteen) days the PROVIDER may suspend the Service by written notice until the amounts due are paid.

(6) After termination of the Agreement the personal data is deleted or returned in accordance with Annex No. 1.

Art. 14. Changes in the status of the Parties

(1) Upon a change in the name, the legal form (including conversion from EOOD to OOD) or the ownership of the capital of the PROVIDER or of the CLIENT, the Agreement remains in force. Each Party notifies the other in writing within 7 (seven) days of the registration of the change.

Art. 15. Final provisions

(1) Amendments to the Order are made in writing, with the signatures of a representative of each Party, with the exception of the changes under Art. 2(4) and of the contact persons, which may be agreed by email.

(2) Notices under the Agreement are sent by email to the addresses of the contact persons indicated in the Order and are deemed received on the day they are sent. Contact person for the PROVIDER: Alexander Stoilov, contact@mettissa.com, +359 888 990 026, unless otherwise indicated in the Order.

(3) If any provision of the Agreement proves invalid, this does not affect the validity of the remaining provisions.

(4) Matters not settled by the Agreement are governed by Bulgarian law. Disputes between the Parties in connection with the Agreement are resolved by mutual consent and, failing such, by the competent court in the city of Sofia.

(5) The Order may be signed on paper, with a qualified electronic signature, or by a scanned copy sent by email.

(6) The General Terms are published in Bulgarian and in English. In the event of a discrepancy between the texts, the Bulgarian text prevails.

ANNEX No. 1

Personal Data Processing Agreement (Art. 28 of Regulation (EU) 2016/679)

(1) Subject matter and roles. The CLIENT is the controller and the PROVIDER is the processor of the personal data contained in the video data from the In-Scope Cameras. The PROVIDER processes the personal data only for the provision of the Service and only on documented instructions from the CLIENT; the Agreement and the Order constitute such instructions.

(2) Nature and purpose of the processing. Receipt and temporary storage of video data, Automatic Privacy Processing, automated analysis to produce Process-Level Metrics, and anonymisation in accordance with Art. 11(4) of the General Terms.

(3) Categories of data subjects and data. Employees, workers, subcontractors and visitors of the CLIENT falling within the cameras’ scope; data: video images. No audio, special categories of data or biometric data for identification purposes are processed.

(4) Duration. The processing continues for the term of the Agreement. Unprocessed video data is deleted automatically within 3 (three) days of its receipt, and the Processed Clips upon termination of the Agreement, unless they have been converted into Anonymised Data.

(5) Confidentiality. The PROVIDER ensures that the persons processing the personal data on its behalf have undertaken an obligation of confidentiality.

(6) Security. The PROVIDER applies appropriate technical and organisational measures, including encryption in transit and at rest, restriction of access to authorised persons, separate accounts and access logging.

(7) Subprocessors. The CLIENT gives general authorisation for the use of subprocessors. As at the date of this version they are:

a) Amazon Web Services EMEA SARL – cloud infrastructure: receipt, temporary storage and automated processing of video data, storage of results and reports; region: EU – Frankfurt, Germany;

b) Supabase, Inc. – database and authentication for the Mettissa platform (processed results, reports and user accounts, without video); region: EU – Frankfurt, Germany;

c) Vercel Inc. – hosting of the Mettissa web platform (app.mettissa.com); video recordings are loaded directly from AWS via temporary links and are not stored at Vercel; region: EU – Frankfurt, Germany;

d) Google Cloud EMEA Ltd. (Gemini API) – automated analysis of video recordings from the workplaces and text processing of the results in order to produce reports and improvement suggestions; region: Google’s global infrastructure; transfer outside the EU on the basis of the EU standard contractual clauses and/or the EU–US Data Privacy Framework;

e) Google Cloud EMEA Ltd. (Google Workspace) – email correspondence with the contact persons.

The current list is maintained in this Annex, published at mettissa.com/terms. The PROVIDER notifies the CLIENT by email at least 14 days before adding or replacing a subprocessor; the CLIENT may object and, if the matter is not resolved, terminate the Agreement without a penalty. The PROVIDER imposes the same data protection obligations on the subprocessors.

(8) Location. The personal data is stored in the European Union. Processing outside the European Economic Area, including by a subprocessor under paragraph 7, is permitted only subject to appropriate safeguards under Chapter V of Regulation (EU) 2016/679.

(9) Assistance. The PROVIDER assists the CLIENT in responding to requests from data subjects, in impact assessments and in prior consultation with a supervisory authority, to the extent this is related to the Service.

(10) Security breaches. The PROVIDER notifies the CLIENT without undue delay, and no later than 48 hours after becoming aware, of a personal data breach, and provides it with the available information.

(11) Deletion. Upon termination of the Agreement the PROVIDER deletes the personal data within 30 days, unless the law requires its retention. Anonymised Data is not personal data and is not subject to deletion under this paragraph.

(12) Audits. The PROVIDER provides the CLIENT with the information necessary to demonstrate compliance with this Annex, and permits audits no more than once a year, with 30 days’ notice, at the CLIENT’s expense.

(13) Controller’s obligations. The CLIENT is responsible for the legal basis for the video surveillance and for providing the data to the PROVIDER, for informing the data subjects, and for complying with the requirements for video surveillance in the workplace.