CLOUDFLOW ENTERPRISE SOFTWARE-AS-A-SERVICE AGREEMENT

This Enterprise Software-as-a-Service Agreement (this "Agreement") is entered into as of 1 September 2026 (the "Effective Date") by and between:

(1) CLOUDFLOW TECHNOLOGIES PTE. LTD., a company incorporated under the laws of the Republic of Singapore (UEN 201812345K), having its registered office at 80 Robinson Road, #08-01, Singapore 068898 ("CloudFlow" or the "Vendor"); and

(2) MERIDIAN RETAIL SOLUTIONS PRIVATE LIMITED, a company incorporated under the Companies Act, 2013 of India (CIN U74999KA2016PTC098765), having its registered office at Tower B, Level 9, Prestige Corniche, Sarjapur Road, Bengaluru, Karnataka 560103, India ("Meridian" or the "Customer").

CloudFlow and Meridian are each referred to herein as a "Party" and collectively as the "Parties".

BACKGROUND

(A) CloudFlow operates a proprietary cloud-based workflow, document-management, analytics, and AI-assisted business automation platform made available on a subscription basis.

(B) The Customer wishes to subscribe to the platform, together with related implementation and support services, on the terms of this Agreement, and the Parties accordingly agree as follows.

1. DEFINITIONS AND INTERPRETATION

1.1 In this Agreement, unless the context otherwise requires:

"Acceptable Use Policy" or "AUP" means CloudFlow's acceptable use policy applicable to the Services, as published at https://www.cloudflow.io/legal/aup and updated by CloudFlow from time to time.

"Affiliate" means, in relation to a Party, any entity that directly or indirectly Controls, is Controlled by, or is under common Control with that Party, where "Control" means ownership of more than fifty percent (50%) of the voting securities of an entity or the power to direct its management.

"Agreement" means this agreement, its Schedules, the Order Form, and any documents expressly incorporated by reference, including the Documentation and CloudFlow Policies.

"AI Features" means those features of the Platform that employ machine learning, large language models, or other artificial-intelligence technologies, including document classification, extraction, summarisation, predictive analytics, and the CloudFlow Assist conversational interface.

"Authorised User" means an employee, officer, or individual contractor of the Customer or its Affiliates who is authorised by the Customer to use the Services and to whom the Customer has issued unique login credentials, up to the number of subscriptions stated in the Order Form.

"Business Day" means a day other than a Saturday, Sunday, or public holiday in Singapore.

"CloudFlow Policies" means the AUP, the Documentation, CloudFlow's security overview, subprocessor list, support policy, and other operational policies referenced in this Agreement or published by CloudFlow at https://www.cloudflow.io/legal, in each case as updated by CloudFlow from time to time.

"Confidential Information" has the meaning given in Clause 10.1.

"Customer Data" means electronic data, content, and materials submitted by or on behalf of the Customer or Authorised Users to the Platform, including documents, records, transaction data, and personal data contained therein, but excluding Usage Data and De-identified Data.

"De-identified Data" means data derived from Customer Data or Usage Data from which identifiers reasonably associated with the Customer or identifiable individuals have been removed or obscured in accordance with CloudFlow's internal data-handling standards.

"Documentation" means the user guides, technical descriptions, and help materials for the Platform made available by CloudFlow, as updated from time to time.

"Fees" means the Subscription Fees, Implementation Fees, and any other fees payable under this Agreement or an Order Form.

"Go-Live Date" means the date on which the Platform is first made available for productive use by the Customer following completion of the Implementation Services, targeted to occur no later than ninety (90) days after the Effective Date.

"Implementation Services" means the implementation, configuration, migration, and training services described in Schedule 2.

"Initial Term" has the meaning given in Clause 19.1.

"Order Form" means Schedule 1 or any subsequent ordering document executed by the Parties referencing this Agreement.

"Personal Data" means information relating to an identified or identifiable natural person contained within Customer Data, and includes "personal data" as defined under the Personal Data Protection Act 2012 of Singapore and the Digital Personal Data Protection Act, 2023 of India, in each case to the extent applicable.

"Platform" means CloudFlow's proprietary cloud-based workflow, document-management, analytics, and AI-assisted automation software platform, including the AI Features, as modified from time to time.

"Renewal Term" has the meaning given in Clause 19.2.

"Services" means the provision of access to the Platform, the Support Services, and, where applicable, the Implementation Services and Exit Assistance.

"Service Levels" means the service availability and support commitments set out in Clause 7 and Schedule 3.

"Subprocessor" means a third party engaged by CloudFlow or its Affiliates to process Customer Data in connection with the Services.

"Subscription Fees" means the recurring fees for the Services stated in the Order Form.

"Support Services" means the technical support services described in Schedule 3.

"Usage Data" means technical logs, telemetry, metadata, performance data, and other data generated by or collected through the operation of the Platform, including data concerning access patterns, feature utilisation, queries, configurations, and system events.

1.2 Headings are for convenience only; references to Clauses and Schedules are to this Agreement; "including" is illustrative and not exhaustive; references to statutes include amendments and re-enactments; "in writing" includes email except for formal notices under Clause 27.2; and the singular includes the plural and vice versa.

1.3 Subject to Clause 28.9 (Order of Precedence), the Schedules form part of this Agreement.

2. SUBSCRIPTION RIGHTS AND RESTRICTIONS

2.1 Subject to the Customer's payment of the Fees and compliance with this Agreement, CloudFlow grants the Customer a non-exclusive, non-transferable, non-sublicensable right during the Term for Authorised Users to access and use the Platform and Documentation solely for the Customer's internal business operations.

2.2 The Customer shall ensure that the number of Authorised Users does not exceed the number of user subscriptions purchased under the Order Form (initially one thousand two hundred (1,200)). Login credentials are personal to the individual Authorised User and shall not be shared. The Customer may reassign a subscription from a departing Authorised User to a replacement individual.

2.3 If the Customer's actual usage exceeds the purchased subscription quantities or usage parameters stated in the Order Form, CloudFlow may invoice the Customer for the excess usage at the per-unit rates in the Order Form or, where no rate is stated, at CloudFlow's then-current list rates, with effect from the first date of the excess usage.

2.4 The Customer shall not, and shall ensure that Authorised Users do not: (a) copy, modify, translate, or create derivative works of the Platform; (b) reverse engineer, decompile, or disassemble the Platform except to the extent such restriction is prohibited by applicable law; (c) rent, lease, resell, distribute, or otherwise make the Platform available to any third party, or operate the Platform on a service-bureau or outsourcing basis; (d) access the Platform to build a competing product or for benchmarking against a competing product; (e) circumvent or attempt to circumvent usage limits, security controls, or access restrictions; (f) upload or transmit malicious code; (g) use the Platform in violation of the AUP or applicable law; or (h) use the AI Features to generate content that is unlawful, infringing, or deceptive.

2.5 The Customer is responsible for all acts and omissions of Authorised Users and of any person accessing the Platform using credentials issued to the Customer, as if they were the acts and omissions of the Customer.

3. IMPLEMENTATION AND ACCEPTANCE

3.1 CloudFlow shall provide the Implementation Services described in Schedule 2 in accordance with the project plan agreed between the Parties' project managers. The Parties shall cooperate in good faith to achieve the Go-Live Date, which the Parties acknowledge is a target date and not a fixed obligation.

3.2 Upon completion of each implementation milestone identified in Schedule 2 as subject to acceptance, CloudFlow shall notify the Customer that the relevant deliverable is ready for acceptance testing. The Customer shall have five (5) Business Days from such notification (the "Acceptance Period") to test the deliverable against the acceptance criteria stated in Schedule 2.

3.3 If the Customer reasonably determines that a deliverable fails to conform in a material respect to the applicable acceptance criteria, the Customer may reject the deliverable by written notice within the Acceptance Period, which notice must describe each alleged non-conformity in substantial detail, including reproduction steps, affected modules, and the specific acceptance criterion said not to be met. A rejection notice that does not contain such detail shall not constitute a valid rejection.

3.4 If the Customer does not deliver a valid rejection notice within the Acceptance Period, or if the Customer or any Authorised User uses the deliverable (or the Platform configuration to which it relates) in a productive or live environment, the deliverable shall be deemed accepted.

3.5 Following a valid rejection, CloudFlow shall use commercially reasonable efforts to remedy the material non-conformities and shall resubmit the deliverable for acceptance, whereupon the process in Clauses 3.2 to 3.4 shall reapply. This process may be repeated as necessary. The remedy and resubmission process described in this Clause 3.5 is the Customer's sole and exclusive remedy for any non-conformity of an implementation deliverable.

3.6 Acceptance or deemed acceptance of a deliverable shall be conclusive for the purposes of milestone invoicing under Schedule 1.

4. CUSTOMER RESPONSIBILITIES

4.1 The Customer shall: (a) provide CloudFlow with timely access to personnel, information, systems, and decisions reasonably required for the Implementation Services and Support Services; (b) maintain the minimum technical environment specified in the Documentation, including supported browsers and network configurations; (c) be responsible for procuring and maintaining its own network connections and telecommunications links; (d) ensure that Customer Data and its use of the Services comply with applicable law and the AUP; (e) maintain the confidentiality and security of Authorised User credentials and promptly disable credentials of departing personnel; and (f) promptly notify CloudFlow of any unauthorised use of the Services of which it becomes aware.

4.2 The Customer acknowledges that CloudFlow's performance is dependent on the Customer's timely performance of its responsibilities, and that CloudFlow shall not be liable for any failure or delay to the extent attributable to the Customer's acts, omissions, systems, or data.

4.3 The Customer is solely responsible for the accuracy, quality, legality, and provenance of Customer Data and for having obtained all rights, consents, and lawful bases necessary for CloudFlow and its Subprocessors to process Customer Data as contemplated by this Agreement, including for the purposes described in Clauses 8.2 and 12.

5. FEES, INVOICING, TAXES, AND PRICE CHANGES

5.1 The Customer shall pay the Fees stated in Schedule 1. The Annual Subscription Fee for each year of the Term is payable annually in advance. The Implementation Fee is payable in the instalments stated in Schedule 1.

5.2 CloudFlow shall invoice the first Annual Subscription Fee and the first Implementation Fee instalment on the Effective Date. Subsequent Annual Subscription Fees shall be invoiced not earlier than sixty (60) days before the start of the relevant contract year. All invoices are payable within thirty (30) days of the invoice date, without set-off, counterclaim, or deduction.

5.3 All Fees are stated exclusive of taxes. The Customer shall be responsible for all goods and services tax, value-added tax, and similar transaction taxes arising from the Services, other than taxes on CloudFlow's net income. If the Customer is required by law to withhold or deduct any amount from a payment, the Customer shall gross up the payment so that CloudFlow receives the amount it would have received absent the withholding, and shall provide official withholding certificates to CloudFlow on request.

5.4 Amounts unpaid when due shall bear interest at one and one-half percent (1.5%) per month or the maximum rate permitted by law, whichever is lower, from the due date until paid. The Customer shall reimburse CloudFlow's reasonable costs of collection, including legal fees.

5.5 CloudFlow may adjust the Subscription Fees with effect from the start of each Renewal Term by written notice given before the start of that Renewal Term.

5.6 In addition, CloudFlow may adjust the Fees during the Initial Term or any Renewal Term, on not less than thirty (30) days' written notice, to the extent reasonably necessary to reflect: (a) documented increases in hosting, infrastructure, or third-party licence costs incurred by CloudFlow in providing the Services; (b) material movements in exchange rates between the United States dollar and the currencies in which CloudFlow incurs its principal delivery costs; (c) increases in a recognised consumer or producer price index applicable to Singapore; (d) changes in law or regulatory requirements that increase CloudFlow's cost of providing the Services; or (e) the Customer's usage of the Services materially exceeding the usage profile on which the Fees were based. An adjustment under this Clause 5.6 shall take effect on the date stated in CloudFlow's notice and shall not, of itself, entitle the Customer to terminate this Agreement, save that where a single adjustment under Clause 5.6(c) exceeds fifteen percent (15%) of the then-current Annual Subscription Fee, the Customer may terminate the affected Order Form on sixty (60) days' written notice given within thirty (30) days of the adjustment notice.

5.7 Fees paid or payable are non-refundable except as expressly stated in this Agreement.

6. SERVICE LEVELS AND SUPPORT

6.1 CloudFlow shall use commercially reasonable efforts to make the Platform available with a Monthly Uptime Percentage of at least 99.9%, measured and calculated as described in Schedule 3, and shall provide the Support Services in accordance with Schedule 3.

6.2 The availability commitment in Clause 6.1 does not apply to, and Monthly Uptime Percentage calculations shall exclude, unavailability attributable to: (a) scheduled maintenance notified in accordance with Schedule 3, and emergency maintenance; (b) third-party services, software, or infrastructure not provided by CloudFlow, including hosting-provider failures affecting multiple tenants; (c) internet or telecommunications failures outside CloudFlow's network boundary; (d) force majeure events; (e) the Customer's or Authorised Users' systems, networks, data, configurations, acts, or omissions; (f) suspension or restriction of the Services in accordance with this Agreement; (g) security-related mitigations that CloudFlow reasonably determines are necessary to protect the Platform or its customers; (h) beta, preview, trial, or evaluation features, including AI Features designated as preview features; and (i) any other circumstances beyond CloudFlow's reasonable control.

6.3 Service credits calculated in accordance with Schedule 3 are the Customer's sole and exclusive remedy, and CloudFlow's sole and exclusive liability, for any failure to meet the availability commitment or the Support Services response times. Service credits have no cash value, are not refundable, and may be applied only against future Subscription Fees.

6.4 To receive a service credit the Customer must submit a claim in accordance with Schedule 3 within fifteen (15) days after the end of the calendar month in which the relevant failure occurred, failing which the claim is waived.

7. DATA OWNERSHIP AND PERMITTED USE

7.1 As between the Parties, the Customer owns all right, title, and interest in and to Customer Data. Except for the rights expressly granted in this Agreement, CloudFlow acquires no ownership interest in Customer Data.

7.2 The Customer grants CloudFlow and its Affiliates a worldwide, irrevocable, non-exclusive, royalty-free licence, exercisable through Subprocessors, to host, store, copy, transmit, display, analyse, modify, create derivative works from, and otherwise use and process Customer Data: (a) to provide, maintain, secure, and support the Services; (b) to develop, test, train, improve, and enhance the Platform, the AI Features, and CloudFlow's other products, services, models, and algorithms; (c) to produce analytics, benchmarking, and statistical reports; (d) to create and use De-identified Data and aggregated datasets; and (e) for CloudFlow's other reasonable internal business purposes consistent with this Agreement.

7.3 CloudFlow owns all right, title, and interest in and to Usage Data and De-identified Data, and may retain, use, and disclose Usage Data and De-identified Data for any lawful purpose during and after the Term, including after termination or expiry of this Agreement.

7.4 The Customer shall not submit to the Platform: (a) payment card primary account numbers except within the invoice-reference fields designed for truncated card data; (b) government-issued identifier databases; or (c) special categories of personal data not reasonably necessary for the Customer's use of the Services, in each case except as expressly agreed in an Order Form.

8. PRIVACY AND DATA PROCESSING

8.1 Each Party shall comply with the data-protection laws applicable to it in the performance of this Agreement. To the extent CloudFlow processes Personal Data on behalf of the Customer, CloudFlow shall do so in accordance with Schedule 4 and this Clause 8.

8.2 The Customer instructs CloudFlow to process Personal Data as necessary to provide the Services and as otherwise contemplated by this Agreement, including the purposes described in Clause 7.2. The Customer warrants that these instructions are lawful and that it has provided all notices and obtained all consents and lawful bases required for such processing.

8.3 CloudFlow may engage Subprocessors to process Customer Data. CloudFlow maintains a list of its current Subprocessors at https://www.cloudflow.io/legal/subprocessors, which CloudFlow may update from time to time. CloudFlow will indicate additions on that list, and the Customer is responsible for checking the list periodically. If the Customer reasonably objects on data-protection grounds to a new Subprocessor within ten (10) days of the list being updated, the Parties shall discuss the objection in good faith; if CloudFlow, in its discretion, cannot reasonably accommodate the objection, CloudFlow may either proceed with the appointment or terminate the affected portion of the Services on notice to the Customer, without liability other than a pro-rata refund of prepaid Subscription Fees for the terminated portion. CloudFlow shall enter into written terms with each Subprocessor that are, in substance, no less protective in material respects than those in Schedule 4, and shall remain responsible for the performance of its Subprocessors' data-processing obligations to the extent CloudFlow would have been liable under this Agreement had it performed the relevant processing itself, subject in all cases to Clause 15.

8.4 CloudFlow and its Affiliates and Subprocessors may process and store Customer Data in Singapore, India, and any other country in which CloudFlow, its Affiliates, or its Subprocessors maintain operations or facilities. Where cross-border transfer restrictions apply to Personal Data, CloudFlow shall rely on lawful transfer mechanisms recognised under applicable law, which may include contractual safeguards, adequacy or whitelisting determinations, permissions, or other mechanisms available from time to time.

8.5 CloudFlow shall provide reasonable assistance, at the Customer's cost where the assistance is material, in responding to data-subject requests and data-protection inquiries relating to Personal Data processed under this Agreement, taking into account the nature of the processing and the information available to CloudFlow.

9. INFORMATION SECURITY

9.1 CloudFlow shall implement and maintain commercially reasonable administrative, technical, and physical safeguards designed to protect Customer Data against unauthorised access, disclosure, alteration, and destruction, having regard to industry practice for comparable cloud services. A summary of CloudFlow's security programme is set out in Schedule 4; further operational detail is contained in CloudFlow's internal security policies and standards.

9.2 CloudFlow may modify its security measures from time to time, provided that such modifications do not materially reduce the overall level of security of the Platform during the Term.

9.3 Upon the Customer's written request, no more than once in any twelve-month period, CloudFlow shall make available a summary description of its then-current security controls and, where available, an executive summary or attestation letter relating to third-party security assessments, subject to confidentiality obligations and to CloudFlow's policies concerning the distribution of security materials. CloudFlow is not obliged to disclose penetration-test reports, vulnerability data, internal audit reports, or other materials that CloudFlow considers commercially sensitive or a security risk to disclose.

9.4 If CloudFlow confirms a security incident resulting in unauthorised access to or disclosure of unencrypted Customer Data (a "Security Incident"), CloudFlow shall notify the Customer without undue delay and in any event within ten (10) Business Days after CloudFlow confirms the incident. CloudFlow shall determine, acting reasonably, whether and when an incident is confirmed. The notification obligation in this Clause 9.4 does not apply to unsuccessful attempts or attacks that do not result in unauthorised access to Customer Data (such as blocked intrusion attempts, port scans, and denial-of-service events), to suspected but unconfirmed incidents, or to incidents affecting only Usage Data, De-identified Data, or CloudFlow's own operational data.

9.5 CloudFlow shall take reasonable steps to investigate and mitigate the effects of a Security Incident and shall provide the Customer with information reasonably available to CloudFlow about the nature and consequences of the incident. CloudFlow's notification of or response to a Security Incident shall not be construed as an admission of fault or liability.

10. CONFIDENTIALITY

10.1 "Confidential Information" means non-public information disclosed by one Party (the "Disclosing Party") to the other (the "Receiving Party") in connection with this Agreement that is designated as confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure. CloudFlow's Confidential Information includes the Platform, Documentation, pricing, security information, and product roadmaps. The Customer's Confidential Information includes Customer Data and the Customer's business information.

10.2 The Receiving Party shall: (a) use the Disclosing Party's Confidential Information only to exercise its rights and perform its obligations under this Agreement; (b) protect it using at least the degree of care it uses for its own similar information, and no less than reasonable care; and (c) not disclose it to any third party except as permitted by this Clause 10.

10.3 CloudFlow may disclose the Customer's Confidential Information to its Affiliates, and to its and their directors, officers, employees, professional advisers, insurers, auditors, contractors, Subprocessors, actual or prospective financing sources and investors, and actual or prospective counterparties (and their advisers) in connection with a merger, acquisition, financing, reorganisation, or sale of assets, in each case on a need-to-know basis and subject to obligations of confidence consistent with this Clause 10. The Customer may disclose CloudFlow's Confidential Information to its employees, professional advisers, and auditors on a need-to-know basis and subject to obligations of confidence consistent with this Clause 10.

10.4 Confidential Information does not include information that: (a) is or becomes publicly available other than through breach of this Agreement; (b) was known to the Receiving Party without restriction before disclosure; (c) is independently developed without use of the Disclosing Party's Confidential Information; or (d) is rightfully received from a third party without restriction.

10.5 A Receiving Party may disclose Confidential Information to the extent required by law, regulation, or a competent authority, provided that (where lawful and practicable) it gives the Disclosing Party prompt notice and reasonable cooperation, at the Disclosing Party's cost, to seek protective treatment.

10.6 The Customer acknowledges that unauthorised use or disclosure of CloudFlow's Confidential Information, including any breach of Clause 2.4, may cause CloudFlow irreparable harm for which damages would be an inadequate remedy, and that CloudFlow shall be entitled to seek injunctive and other equitable relief in any court of competent jurisdiction in respect of any such breach, in addition to its other remedies.

10.7 The obligations in this Clause 10 continue for three (3) years after termination or expiry of this Agreement, except that: (a) obligations in respect of CloudFlow's trade secrets, source code, and security information continue for so long as such information remains a trade secret or confidential; and (b) obligations in respect of Personal Data continue as required by applicable law.

11. INTELLECTUAL PROPERTY

11.1 CloudFlow and its licensors own all right, title, and interest in and to the Platform, the Documentation, the AI Features, the underlying models, software, and technology, Usage Data, De-identified Data, and all modifications, enhancements, and derivative works of the foregoing, together with all intellectual-property rights therein. No rights are granted to the Customer other than as expressly stated in this Agreement.

11.2 If the Customer or an Authorised User provides suggestions, feedback, or ideas regarding the Services ("Feedback"), CloudFlow may use and exploit the Feedback without restriction or obligation, and the Customer assigns to CloudFlow all intellectual-property rights in the Feedback.

11.3 Any improvements, refinements, or learnings to or of the Platform, the AI Features, or CloudFlow's models, algorithms, or datasets arising from or derived from the Customer's use of the Services, Customer Data, prompts, or outputs (excluding the Customer Data itself) shall be owned exclusively by CloudFlow.

12. AI-ASSISTED FEATURES

12.1 The AI Features are made available as part of the Platform. The Customer may enable or disable certain AI Features at workspace level in accordance with the Documentation.

12.2 The Customer acknowledges and agrees that: (a) outputs generated by the AI Features ("Outputs") are generated by probabilistic systems and may be inaccurate, incomplete, or unsuitable for the Customer's purposes; (b) Outputs are not professional advice; (c) the Customer is solely responsible for reviewing and validating Outputs before relying on or using them, and uses Outputs at its own risk; (d) similar or identical outputs may be generated for other customers, and CloudFlow makes no representation that Outputs are unique; and (e) CloudFlow does not warrant that Outputs will not infringe third-party rights.

12.3 CloudFlow may collect and use prompts, inputs, uploaded content, interactions with the AI Features, Feedback, and Outputs to operate, evaluate, test, train, fine-tune, and improve the AI Features and CloudFlow's models, systems, and services, in accordance with Clauses 7.2 and 11.3. CloudFlow may use third-party technology providers in the delivery of the AI Features.

12.4 As between the Parties and subject to Clauses 11 and 12.3, the Customer may use Outputs for its internal business purposes. CloudFlow retains all rights in the AI Features, models, and any improvements described in Clause 11.3.

12.5 AI Features identified in the Documentation as beta, preview, or experimental are provided "as is", may be modified or withdrawn at any time, and are excluded from the Service Levels and from CloudFlow's warranties.

13. WARRANTIES

13.1 Each Party warrants that it has full power and authority to enter into and perform this Agreement, and that this Agreement constitutes its legal, valid, and binding obligation.

13.2 CloudFlow warrants that: (a) during the Term, the Platform will perform materially in accordance with the Documentation; and (b) the Implementation Services will be performed with reasonable skill and care by suitably qualified personnel.

13.3 The Customer's sole and exclusive remedy, and CloudFlow's sole and exclusive liability, for breach of the warranty in Clause 13.2(a) is that CloudFlow shall use commercially reasonable efforts to correct the non-conformity or provide a workaround; and for breach of Clause 13.2(b), that CloudFlow shall re-perform the deficient services, provided in each case that the Customer notifies CloudFlow in writing of the breach within thirty (30) days of the date on which it first arose, describing the breach in reasonable detail. If CloudFlow determines that correction, workaround, or re-performance is not commercially practicable, CloudFlow may terminate the affected Services and refund the portion of prepaid Subscription Fees attributable to the unexpired remainder of the then-current contract year for the affected Services, which shall fully discharge CloudFlow's liability for the relevant breach.

13.4 The Customer warrants that: (a) it owns or has all rights necessary in the Customer Data to grant the rights in Clause 7.2; (b) the Customer Data and its use as contemplated by this Agreement do not and will not infringe third-party rights or violate applicable law; and (c) it will use the Services in compliance with the AUP and applicable law.

13.5 EXCEPT AS EXPRESSLY STATED IN THIS CLAUSE 13, THE SERVICES, THE PLATFORM, THE AI FEATURES, AND ALL OUTPUTS ARE PROVIDED "AS IS" AND "AS AVAILABLE", AND CLOUDFLOW DISCLAIMS ALL OTHER WARRANTIES, CONDITIONS, AND REPRESENTATIONS, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WITHOUT LIMITATION, CLOUDFLOW DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE FROM ALL THREATS; THAT THE SERVICES WILL MEET THE CUSTOMER'S REQUIREMENTS OR ACHIEVE ANY PARTICULAR RESULTS; THAT THE CUSTOMER'S USE OF THE SERVICES WILL COMPLY WITH LAWS APPLICABLE TO THE CUSTOMER; THAT THE AI FEATURES OR OUTPUTS WILL BE ACCURATE, RELIABLE, OR FIT FOR ANY PURPOSE; OR THAT THE SERVICES WILL BE COMPATIBLE WITH ANY THIRD-PARTY SYSTEM, SOFTWARE, OR SERVICE.

14. INDEMNITIES

14.1 CloudFlow shall defend the Customer against any claim brought against the Customer by an unaffiliated third party alleging that the Customer's use of the Platform, as delivered by CloudFlow and used in accordance with this Agreement and the Documentation, infringes a copyright or registered trademark, or a patent granted in Singapore or India, and shall pay damages finally awarded against the Customer by a court of competent jurisdiction or agreed by CloudFlow in settlement of such claim.

14.2 CloudFlow's obligations under Clause 14.1 do not apply to any claim to the extent arising from: (a) Customer Data or materials provided by or on behalf of the Customer; (b) combination of the Platform with software, hardware, data, or services not provided by CloudFlow, where the claim would not have arisen but for the combination; (c) modification of the Platform other than by CloudFlow; (d) use of the Platform other than in accordance with this Agreement and the Documentation, or after CloudFlow has notified the Customer to cease the allegedly infringing use; (e) any AI Feature Output, or the Customer's use of any Output; (f) beta, preview, or evaluation features; (g) use of a superseded release of the Platform where the claim would have been avoided by use of the current release made available to the Customer; or (h) the Customer's failure to implement updates or workarounds provided by CloudFlow.

14.3 CloudFlow's obligations under Clause 14.1 are conditional on the Customer: (a) notifying CloudFlow in writing of the claim promptly and in any event within ten (10) Business Days of becoming aware of it; (b) granting CloudFlow sole control of the defence and settlement of the claim; (c) providing CloudFlow with all reasonable assistance, at CloudFlow's reasonable cost; and (d) not making any admission, settlement, or compromise without CloudFlow's prior written consent. The Customer may participate in the defence at its own expense with counsel of its choice. Failure to comply with this Clause 14.3 relieves CloudFlow of its obligations under Clause 14.1 to the extent CloudFlow is prejudiced by the failure, and entirely in the case of failure to satisfy Clause 14.3(b).

14.4 If the Platform becomes, or in CloudFlow's opinion is likely to become, the subject of an infringement claim, CloudFlow may at its option and expense: (a) procure the right for the Customer to continue using the Platform; (b) modify or replace the Platform so that it becomes non-infringing without materially reducing its functionality; or (c) if CloudFlow determines that neither (a) nor (b) is commercially reasonable, terminate the affected Services on notice and refund the portion of prepaid Subscription Fees attributable to the unexpired remainder of the then-current contract year for the affected Services. This Clause 14 states CloudFlow's entire liability, and the Customer's sole and exclusive remedy, in respect of infringement of third-party intellectual-property rights.

14.5 The Customer shall defend, indemnify, and hold harmless CloudFlow, its Affiliates, and their respective directors, officers, employees, and agents (the "CloudFlow Indemnitees") from and against all claims, demands, actions, proceedings, investigations, losses, damages, fines, penalties, regulatory sanctions, costs, and expenses (including reasonable legal fees) suffered or incurred by any CloudFlow Indemnitee arising out of or in connection with: (a) Customer Data, including any allegation that Customer Data or its processing as contemplated by this Agreement infringes third-party rights or violates applicable law; (b) the Customer's or any Authorised User's use of the Services, including use of Outputs; (c) breach of Clause 2.4, the AUP, or Clause 13.4; (d) any act or omission of an Authorised User or of any person using credentials issued to the Customer; and (e) any claim, complaint, investigation, or enforcement action by a data subject, regulator, or other authority to the extent arising from the matters in (a) to (d).

14.6 CloudFlow shall notify the Customer of a claim for which it seeks indemnity under Clause 14.5 and shall be entitled to control the defence and settlement of such claim with counsel of its choosing, at the Customer's cost, provided that CloudFlow shall not settle a claim in a manner imposing non-monetary obligations on the Customer without the Customer's consent, not to be unreasonably withheld.

15. LIMITATION OF LIABILITY

15.1 Nothing in this Agreement excludes or limits either Party's liability for: (a) death or personal injury caused by its negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot be excluded or limited under applicable law.

15.2 Subject to Clause 15.1, neither Party shall be liable for any loss of profits, loss of revenue, loss of anticipated savings, loss of business or goodwill, loss or corruption of data (except to the extent of CloudFlow's restoration obligation under Schedule 3), or any indirect, incidental, special, consequential, punitive, or exemplary loss or damage, whether arising in contract, tort (including negligence), breach of statutory duty, or otherwise, and whether or not foreseeable or advised of the possibility of such loss.

15.3 Subject to Clauses 15.1, 15.2, and 15.4, the aggregate liability of CloudFlow and its Affiliates arising out of or in connection with this Agreement, howsoever arising, whether in contract, tort (including negligence), breach of statutory duty, indemnity, or otherwise, including any liability arising from or relating to loss of or damage to Customer Data, Security Incidents, breach of Clause 8, Clause 9, or Clause 10, or CloudFlow's obligations under Clause 14, shall not exceed the total Fees paid by the Customer to CloudFlow under this Agreement during the three (3) months immediately preceding the first event giving rise to the claim.

15.4 The limitations in Clauses 15.2 and 15.3 shall not apply to: (a) the Customer's obligation to pay Fees and interest due under this Agreement; (b) the Customer's liability arising from breach of Clause 2 (Subscription Rights and Restrictions) or the AUP; (c) the Customer's liability for breach of Clause 10 (Confidentiality) in respect of CloudFlow's Confidential Information; or (d) the Customer's indemnity obligations under Clause 14.5.

15.5 The Parties acknowledge that the Fees reflect the allocation of risk in this Clause 15 and that CloudFlow would not enter into this Agreement on these commercial terms without these limitations. Each provision of this Clause 15 is severable and shall survive termination or expiry of this Agreement.

16. INSURANCE

16.1 CloudFlow shall maintain during the Term, with reputable insurers, commercial general liability insurance and technology errors-and-omissions insurance (including cyber-liability coverage) at levels consistent with prudent industry practice for comparable providers. Upon the Customer's written request, no more than once per year, CloudFlow shall provide a certificate evidencing such insurance. CloudFlow's insurance is not a limit on, or expansion of, its liability under this Agreement.

17. AUDIT AND REGULATORY COOPERATION

17.1 CloudFlow shall maintain reasonable records of its processing of Customer Data. Not more than once in any twelve-month period, and on not less than forty-five (45) days' written notice, the Customer may submit written questions to CloudFlow concerning CloudFlow's compliance with Schedule 4, which CloudFlow shall answer in reasonable detail within a reasonable period.

17.2 Where the Customer demonstrates that written responses and available attestations are insufficient to meet a mandatory requirement of applicable law or a binding demand of a regulator with jurisdiction over the Customer, CloudFlow shall permit a remote review of relevant documentation by the Customer or an independent auditor (not a competitor of CloudFlow) bound by confidentiality obligations acceptable to CloudFlow, during business hours, in a manner that does not disrupt CloudFlow's operations and does not provide access to other customers' data, CloudFlow's premises, systems, source code, penetration-test reports, or internal audit reports. The Customer shall bear its own costs and shall reimburse CloudFlow's reasonable costs and professional-services fees, at CloudFlow's then-current rates, of facilitating any review or providing regulatory cooperation under this Clause 17.

17.3 CloudFlow may decline, in whole or in part, any audit, review, or cooperation request that CloudFlow reasonably considers unduly burdensome, inconsistent with its confidentiality obligations or internal security policies, or a risk to the Platform or other customers, in which case the Parties shall discuss alternative means of assurance in good faith.

18. SUSPENSION RIGHTS

18.1 CloudFlow may suspend or restrict access to all or part of the Services, in whole or in part, immediately and without prior notice where CloudFlow considers prior notice impracticable, if: (a) CloudFlow reasonably suspects a security risk, vulnerability, or attack affecting or emanating from the Customer's use of the Services; (b) CloudFlow reasonably believes that the Customer's or an Authorised User's use of the Services may violate applicable law, the AUP, or Clause 2.4; (c) any undisputed Fees remain unpaid fifteen (15) days after written notice of non-payment; (d) the Customer's usage materially degrades the Platform or the experience of other customers; (e) continued provision of the Services may, in CloudFlow's reasonable opinion, expose CloudFlow to legal liability or reputational harm; or (f) required by law or a competent authority.

18.2 CloudFlow shall, where practicable, give the Customer notice of a suspension and its general grounds, and shall restore the affected Services when the grounds for suspension have been resolved to CloudFlow's reasonable satisfaction. Suspension does not relieve the Customer of its obligation to pay Fees, and Fees continue to accrue during any suspension other than a suspension that CloudFlow determines was implemented without proper grounds. Suspension is without prejudice to CloudFlow's other rights and remedies.

19. TERM AND RENEWAL

19.1 This Agreement commences on the Effective Date and, unless terminated earlier in accordance with its terms, continues for an initial term of three (3) years from the Effective Date (the "Initial Term").

19.2 Following the Initial Term, this Agreement shall automatically renew for successive further terms of twelve (12) months each (each a "Renewal Term" and, together with the Initial Term, the "Term") unless either Party gives the other written notice of non-renewal not less than one hundred and twenty (120) days and not more than one hundred and fifty (150) days before the end of the Initial Term or the then-current Renewal Term, as applicable. A notice of non-renewal given outside this window shall be of no effect for the immediately following Renewal Term.

20. TERMINATION

20.1 CloudFlow may terminate this Agreement or any Order Form, in whole or in part, with immediate effect by written notice if: (a) the Customer fails to pay any undisputed Fees within fifteen (15) days after written notice of non-payment; (b) the Customer breaches Clause 2.4, Clause 10, or the AUP; (c) CloudFlow reasonably believes that the Customer's use of the Services violates applicable law or exposes CloudFlow to material legal liability or reputational harm; (d) the Customer undergoes an insolvency event, ceases to carry on business, or suffers analogous circumstances in any jurisdiction; or (e) a change in law, regulation, or third-party licensing terms makes CloudFlow's continued provision of the Services unlawful or commercially impractical, in which case CloudFlow shall give as much notice as is reasonably practicable.

20.2 The Customer may terminate this Agreement by written notice if CloudFlow commits a material breach of its obligations under Clause 6.1 or Clause 9.1 and fails to cure that breach within forty-five (45) days after receiving written notice describing the breach in reasonable detail and expressly invoking this Clause 20.2.

20.3 Either Party may terminate this Agreement by written notice if the other Party undergoes an insolvency event and the relevant proceedings are not dismissed within sixty (60) days.

20.4 Except as expressly stated in Clause 5.6, this Agreement does not confer on the Customer any right to terminate for convenience.

21. CONSEQUENCES OF TERMINATION

21.1 On termination or expiry of this Agreement for any reason: (a) all subscription rights granted to the Customer cease immediately; (b) all Fees invoiced or accrued up to the effective date of termination become immediately due and payable; and (c) each Party shall return or destroy the other Party's Confidential Information in accordance with Clause 10, subject to Clauses 21.4 and 21.5.

21.2 Where CloudFlow terminates under Clause 20.1(a), (b), (c), or (d), the Customer shall not be entitled to any refund of prepaid Fees, and the Subscription Fees for the remainder of the then-current contract year shall become immediately due and payable as a debt. Where CloudFlow terminates under Clause 20.1(e), CloudFlow shall refund a pro-rata portion of prepaid Subscription Fees for the unexpired remainder of the then-current contract year, which shall be CloudFlow's sole liability arising from such termination. Where the Customer validly terminates under Clause 20.2, CloudFlow shall refund a pro-rata portion of prepaid Subscription Fees for the unexpired remainder of the then-current contract year.

21.3 For a period of fifteen (15) days following the effective date of termination or expiry (the "Export Period"), CloudFlow shall make Customer Data available for export by the Customer through the Platform's standard export utilities in CloudFlow's then-standard formats. Additional exit assistance, including data conversion, custom export formats, migration support, and extended availability, is available as chargeable professional services in accordance with Schedule 5 at CloudFlow's then-current rates. CloudFlow does not warrant that exported Customer Data will be complete, free of errors, or usable in any third-party system.

21.4 Following the Export Period, CloudFlow may delete or de-identify Customer Data in the production environment and shall have no further obligation to retain or make available Customer Data, save that CloudFlow may retain Customer Data: (a) in routine backups, archives, logs, and disaster-recovery systems until deleted in the ordinary course under CloudFlow's data-retention policies; (b) in analytics and model-training environments to the extent processed under Clauses 7.2, 7.3, and 12.3; (c) in legal-hold repositories where required for actual or reasonably anticipated legal proceedings; and (d) as De-identified Data, which CloudFlow may retain and use indefinitely.

21.5 Clauses 1, 2.4, 5, 7.2 to 7.4, 10, 11, 12.2 to 12.4, 13.5, 14, 15, 17.2, 21, 26, and 27, together with any provision that by its nature is intended to survive, shall survive termination or expiry of this Agreement.

22. BUSINESS CONTINUITY AND DISASTER RECOVERY

22.1 CloudFlow shall maintain business-continuity and disaster-recovery plans for the Platform consistent with good industry practice, shall test such plans periodically, and shall target the recovery objectives described in Schedule 4. CloudFlow's disaster-recovery obligations are subject to the exclusions in Clause 6.2 and to force majeure.

23. PUBLICITY

23.1 Neither Party shall issue a press release concerning this Agreement without the other Party's prior written consent, except as required by law or stock-exchange rules.

24. ASSIGNMENT AND SUBCONTRACTING

24.1 The Customer shall not assign, novate, transfer, or otherwise deal with this Agreement or any of its rights or obligations under it, in whole or in part, including in connection with any internal reorganisation or change of Control, without CloudFlow's prior written consent.

24.2 CloudFlow may assign, novate, or transfer this Agreement, in whole or in part, without the Customer's consent: (a) to an Affiliate; or (b) in connection with a merger, acquisition, corporate reorganisation, financing, securitisation, or sale of all or substantially all of the assets or business to which this Agreement relates, provided that CloudFlow gives notice to the Customer within a reasonable period after the assignment takes effect.

24.3 CloudFlow may subcontract the performance of its obligations, including through Affiliates and Subprocessors, provided that CloudFlow remains responsible for the acts and omissions of its subcontractors in the performance of this Agreement to the extent provided in Clause 8.3 and subject to Clause 15.

25. COMPLIANCE WITH LAWS

25.1 Each Party shall comply with applicable anti-bribery, anti-corruption, anti-money-laundering, sanctions, and export-control laws in connection with this Agreement. The Customer shall not use, and shall ensure that Authorised Users do not use, the Services in or for the benefit of any sanctioned country or person, or export or re-export any component of the Platform in violation of applicable export-control laws.

26. DISPUTE RESOLUTION AND GOVERNING LAW

26.1 This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of Singapore, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

26.2 The Parties shall first attempt to resolve any dispute by escalation to senior executives of each Party, who shall meet (in person or remotely) within twenty (20) Business Days of a written escalation notice.

26.3 Any dispute not resolved under Clause 26.2 within forty (40) Business Days of the escalation notice shall be referred to and finally resolved by arbitration administered by the Singapore International Arbitration Centre in accordance with the Arbitration Rules of the Singapore International Arbitration Centre for the time being in force, which rules are deemed incorporated by reference in this clause. The seat of the arbitration shall be Singapore. The tribunal shall consist of one arbitrator. The language of the arbitration shall be English. The arbitration and all related materials shall be confidential. The party commencing the arbitration shall pay the filing fees and shall fund the tribunal's fees and administrative deposits as they fall due, subject to the tribunal's power to allocate costs in the final award.

26.4 Nothing in this Clause 26 prevents CloudFlow from seeking injunctive or other equitable relief under Clause 10.6, or from bringing proceedings for the recovery of unpaid Fees as a debt, in any court of competent jurisdiction.

27. GENERAL PROVISIONS

27.1 Force Majeure. Neither Party shall be liable for failure or delay in performing its obligations (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, epidemics, war, terrorism, civil disturbance, labour disputes, governmental action, utility or telecommunications failures, and failures of third-party hosting providers, provided the affected Party notifies the other and uses reasonable efforts to mitigate.

27.2 Notices. Formal notices, including notices of breach, non-renewal, suspension, or termination, must be in writing in English and delivered by hand, courier, or registered post to the recipient's registered office stated above (for CloudFlow, attention: Legal Department; for the Customer, attention: General Counsel), with an advance copy by email (legal@cloudflow.io; legal@meridianretail.in). A notice is deemed received on delivery or five (5) Business Days after posting.

27.3 Entire Agreement. This Agreement constitutes the entire agreement between the Parties in relation to its subject matter and supersedes all prior agreements, understandings, and representations, whether written or oral. Each Party acknowledges that it has not relied on any statement not set out in this Agreement. Nothing in this Clause limits liability for fraud.

27.4 Variation and Waiver. Except as otherwise provided in this Agreement (including CloudFlow's rights to update the CloudFlow Policies, the Documentation, the Subprocessor list, and its security measures as described herein), no variation of this Agreement is effective unless in writing and signed by authorised representatives of both Parties. No failure or delay in exercising a right is a waiver of it.

27.5 Marketing Reference. Notwithstanding Clause 23.1, CloudFlow may identify the Customer as a customer of CloudFlow and use the Customer's name and logo in customer lists, presentations, proposals, press and marketing materials, and case studies describing the deployment in general terms, in accordance with any brand guidelines the Customer provides, unless and until the Customer opts out by written notice delivered in accordance with Clause 27.2 specifying the materials to which the opt-out applies, in which case CloudFlow shall cease new uses within thirty (30) days and may continue distribution of materials already produced.

27.6 Severability. If any provision of this Agreement is held invalid or unenforceable, the remainder shall continue in full force, and the Parties shall negotiate in good faith a valid provision reflecting the original intent.

27.7 Relationship. The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship.

27.8 Third-Party Rights. Save that CloudFlow Indemnitees may enforce Clause 14.5 and CloudFlow's Affiliates may enforce the provisions expressed to benefit them, a person who is not a Party has no right under the Contracts (Rights of Third Parties) Act 2001 of Singapore to enforce any term of this Agreement.

27.9 Order of Precedence. In the event of conflict or inconsistency, the following order of precedence applies: (a) the Order Form, including any special terms stated in it; (b) Schedule 4; (c) the main body of this Agreement; (d) the remaining Schedules; and (e) the Documentation and the other CloudFlow Policies; provided that (i) with respect to acceptable use, security operations, and support procedures, the applicable CloudFlow Policies shall prevail over the main body of this Agreement to the extent they address operational matters not expressly addressed in the main body, and (ii) CloudFlow may update the CloudFlow Policies from time to time with effect from publication, provided that updates do not materially diminish the overall Services during a paid subscription period.

27.10 Counterparts. This Agreement may be executed in counterparts, including by electronic signature, each of which is an original and which together constitute one instrument.

28. SIGNATURE

IN WITNESS WHEREOF the Parties have executed this Agreement by their duly authorised representatives as of the Effective Date.

SIGNED for and on behalf of
CLOUDFLOW TECHNOLOGIES PTE. LTD.

Signature: /s/ Elena Tan
Name: Elena Tan
Title: Chief Operating Officer
Date: 1 September 2026

SIGNED for and on behalf of
MERIDIAN RETAIL SOLUTIONS PRIVATE LIMITED

Signature: /s/ Arjun Mehta
Name: Arjun Mehta
Title: General Counsel
Date: 1 September 2026

SCHEDULE 1 — ORDER FORM AND PRICING

1. Services ordered: CloudFlow Enterprise Platform subscription (Enterprise Edition), including workflow, document management, analytics, and AI Features (excluding features designated beta or preview); Support Services (Enterprise tier); Implementation Services per Schedule 2.

2. Authorised User subscriptions: 1,200. Included storage: 25 TB. Included AI Feature usage: 500,000 assisted actions per contract year. Excess users, storage, and AI usage are chargeable at CloudFlow's then-current list rates unless otherwise agreed.

3. Fees. Annual Subscription Fee: USD 420,000 per contract year, invoiced annually in advance. Implementation Fee: USD 90,000, invoiced 50% on the Effective Date, 25% on completion of Milestone 3 (Schedule 2), and 25% on the Go-Live Date or deemed acceptance of the final implementation deliverable, whichever is earlier.

4. Renewal pricing. Unless otherwise agreed in writing, the Subscription Fees for each Renewal Term shall be CloudFlow's then-current list price for the subscribed Services as at the start of that Renewal Term, as notified in the renewal invoice.

5. Currency and payment: United States dollars, by wire transfer to the account stated on CloudFlow's invoice. Payment terms: net thirty (30) days.

6. Special terms: None.

SCHEDULE 2 — IMPLEMENTATION SERVICES

1. Scope. CloudFlow shall provide: (a) project initiation and solution design workshops; (b) tenant provisioning and configuration of up to twelve (12) workflow templates and eight (8) document libraries; (c) single sign-on integration with the Customer's identity provider; (d) migration of up to 4 TB of legacy documents from up to two (2) source systems using CloudFlow's standard migration tooling; (e) two (2) train-the-trainer sessions for up to twenty-five (25) participants each; and (f) go-live support for ten (10) Business Days following the Go-Live Date.

2. Milestones. Milestone 1: project kick-off and approved solution design. Milestone 2: configured non-production environment available. Milestone 3: completion of data migration into the non-production environment. Milestone 4: production cutover readiness (final implementation deliverable). Milestones 2, 3, and 4 are subject to acceptance under Clause 3 of the Agreement.

3. Acceptance criteria. A deliverable conforms if it materially performs the functions described in the approved solution-design document, as verified using the test scripts agreed by the Parties' project managers before the start of the relevant Acceptance Period.

4. Assumptions. The Implementation Services are priced on the basis of the Customer providing timely access, decisions, test resources, and source-system extracts in the agreed formats. Additional work arising from changed requirements, source-data quality issues, or Customer delay shall be chargeable at CloudFlow's then-current professional-services rates under the change-control procedure agreed by the project managers.

SCHEDULE 3 — SERVICE LEVELS AND SUPPORT

1. Availability. CloudFlow shall use commercially reasonable efforts to achieve a Monthly Uptime Percentage of at least 99.5% for the production Platform. "Monthly Uptime Percentage" means 100% minus the percentage of minutes in the calendar month during which the production Platform was unavailable, excluding the exclusions listed in Clause 6.2 of the Agreement and scheduled maintenance windows notified at least forty-eight (48) hours in advance.

2. Maintenance. Standard maintenance windows are Sundays 14:00–18:00 Singapore time. CloudFlow may perform emergency maintenance at any time and shall use reasonable efforts to give advance notice.

3. Service credits. If the Monthly Uptime Percentage in a calendar month falls below 99.5%, the Customer shall be entitled, on a valid claim, to a service credit equal to: (a) 2% of the monthly-equivalent Subscription Fee (being one-twelfth of the Annual Subscription Fee) where Monthly Uptime Percentage is below 99.5% but at least 99.0%; (b) 5% where below 99.0% but at least 98.0%; and (c) 10% where below 98.0%. Service credits in any calendar month shall not exceed 10% of the monthly-equivalent Subscription Fee, and are subject to Clauses 6.3 and 6.4 of the Agreement. Claims must be submitted through the support portal within fifteen (15) days after the end of the relevant month and must include the dates, times, and duration of claimed unavailability and supporting logs where available.

4. Support. CloudFlow shall provide English-language support via the support portal and email, 24x7 for Priority 1 incidents and 09:00–18:00 Singapore time on Business Days for other priorities. Target initial response times: Priority 1 (production down, no workaround): one (1) hour; Priority 2 (major function impaired, workaround available): four (4) business hours; Priority 3 (minor impairment): one (1) Business Day; Priority 4 (questions and requests): two (2) Business Days. Response-time targets are objectives and not guarantees; resolution times are not committed.

5. Data restoration. In the event of loss or corruption of Customer Data caused by the Platform, CloudFlow's sole obligation is to use commercially reasonable efforts to restore the affected Customer Data from the most recent available backup.

SCHEDULE 4 — DATA PROCESSING AND SECURITY TERMS

1. Roles and scope. For Personal Data in Customer Data, the Customer is the data fiduciary or controller and CloudFlow is the data processor, processing on the Customer's documented instructions as set out in the Agreement. Categories of data subjects: Customer employees and contractors, customers, suppliers, and other individuals whose data the Customer submits. Categories of Personal Data: contact details, employment information, transactional records, documents and their contents, and limited payment-related references. Duration: the Term plus the retention periods described in Clause 21.4.

2. Processor obligations. CloudFlow shall: (a) process Personal Data only as described in the Agreement or as required by law (in which case CloudFlow shall inform the Customer unless prohibited); (b) ensure persons authorised to process Personal Data are bound by confidentiality; (c) implement the technical and organisational measures summarised in paragraph 4; (d) impose data-protection terms on Subprocessors as described in Clause 8.3; (e) assist the Customer as described in Clauses 8.5 and 17; and (f) on termination, delete or return Personal Data as described in Clause 21.

3. Incident notification. CloudFlow shall notify the Customer of a personal-data breach affecting Personal Data processed under the Agreement without undue delay after becoming aware of the breach, and in any event within seventy-two (72) hours where the breach is likely to result in a risk to the rights of data subjects, providing the information reasonably required for the Customer to meet its own notification obligations, insofar as available to CloudFlow.

4. Security measures. CloudFlow maintains: encryption of Customer Data in transit (TLS 1.2 or higher) and at rest (AES-256); logical tenant separation; role-based access controls and multi-factor authentication for administrative access; vulnerability management and periodic penetration testing by qualified third parties; security logging and monitoring; personnel background screening where lawful; secure development practices; and business-continuity arrangements with a disaster-recovery recovery time objective of twenty-four (24) hours and recovery point objective of four (4) hours for the production Platform. Further detail is set out in CloudFlow's internal security policies and standards, which CloudFlow may update from time to time in accordance with Clause 9.2.

5. Transfers. Customer Data may be processed in the locations described in Clause 8.4. CloudFlow shall ensure that transfers of Personal Data are made under lawful transfer mechanisms available under applicable law.

SCHEDULE 5 — EXIT ASSISTANCE

1. Standard export. During the thirty (30) days following termination or expiry of the Agreement, CloudFlow shall make the Platform's self-service export utilities available to the Customer to export Customer Data in CloudFlow's then-standard formats (currently CSV for structured data and native file format for stored documents, with metadata manifests in JSON).

2. Assisted exit services. On the Customer's written request received before or during the export period, CloudFlow shall provide reasonable additional exit assistance — including bulk extraction, custom formatting, data mapping, migration consulting, and extension of the export period — as chargeable professional services at CloudFlow's then-current rates, subject to a mutually agreed statement of work and to payment in advance where the Customer is in arrears.

3. Deletion. Following the export period and completion of any agreed assisted exit services, CloudFlow shall disable the Customer's tenant and thereafter delete Customer Data from the production environment in the ordinary course, subject to Clause 21.4 of the Agreement.

4. No warranty. CloudFlow does not warrant the completeness of exports initiated by the Customer or the compatibility of exported data with any successor system. The Customer is responsible for verifying its exports before the end of the export period.