End-User Licence Terms

Status and incorporation

These End-User Licence Terms (the "EULT", or "these terms") are Axtraction AI's standard terms for licensing the Approved Products to an End-User. They are not negotiated per customer, so this published version carries no party names; the particulars of each licence are recorded in the applicable Order.

These terms are entered into under the agreement between Axtraction AI and the Supplying Party, and the End-User accepts them before any Approved Product is deployed. The order of precedence in Section 11.2A runs the terms of that agreement, then these terms, then the applicable Order, and the Data Processing Addendum prevails on any data-protection matter. Where the End-User procures directly from Axtraction AI there is no such agreement, and these terms and the applicable Order govern. Sections 6.2 and 6.3 prevail in every case.

Versioning

The version each End-User accepts is the Current Version published on the Legal Documents Portal at the time of acceptance, amended only in accordance with Section 11.6. Publishing a new Current Version changes what an End-User accepts going forward; for an existing End-User a change takes effect only through Section 11.6.

The parties to each licence

These are the standard terms on which Axtraction AI Sdn Bhd (Company No. 202301042335 (1536252-X)) licenses each End-User. For any particular licence, the End-User, the Supplying Party, the Approved Products, the Deployment Model and the licence term are identified in the applicable Order or acceptance record.

Acceptance is by authorised signature, click-through, or order acceptance, before deployment. Where the End-User is a Public Sector End-User as defined in Section 11.6(d), acceptance is governed by Section 11.6(e), and click-through and order acceptance do not apply to that End-User.

Definitions

In these terms:

• "Affiliate" means, in relation to a party, any entity that controls, is controlled by, or is under common control with that party, where control means the direct or indirect holding of more than fifty per cent of the voting rights, or the power to direct its management.
• "Approved Products" means the Axtraction AI products licensed to the End-User under the applicable Order, together with the releases, updates, and modules of them that Axtraction AI makes available under that Order. An "Approved Product" is any one of them.
• "Base Codex" means the prompts, templates and system instructions, the orchestration and model-selection logic, the agent and tool definitions, the guardrails and safety filters, the evaluation and benchmark datasets, the model weights, adapters and fine-tunes, and the embeddings and vector indices authored or supplied by Axtraction AI for the Approved Products, together with Axtraction AI's reusable modules, orchestration methodology, rules engine, prompt architecture, scoring and ranking methodology, thresholds, taxonomies and know-how, and Axtraction AI's platform intellectual property in any of them. The Base Codex does not include the End-User-specific business logic and configurations the End-User owns under Section 3.2(b), save to the extent those would disclose or reproduce generally-applicable Base Codex material. "Base Codex material" means any part of it.
• "Client Data", "Controller", "Data Protection Laws", "End-User Personal Data", "Personal Data", "Personal Data Breach", "Processing", "Processor" and "Sub-processor" have the meanings given in the Data Processing Addendum.
• "Component Supplier" means a party other than Axtraction AI, which may be the Supplying Party, that supplies, procures, installs, provisions, configures, hosts, operates, administers, maintains or supports a Non-Axtraction Component for the End-User.
• "Current Version" means, for a document, the version of it published on the Legal Documents Portal at the relevant time.
• "Data Processing Addendum" means Axtraction AI's standard Data Processing Addendum, the Current Version of which is published at https://axtraction.ai/dpa. It is incorporated into these terms by reference.
• "Deployment Model" means the model in which an Approved Product is delivered, Fully Managed or Self-Hosted, as stated in the applicable Order. Under a "Fully Managed" deployment Axtraction AI hosts and operates the Approved Product in a cloud environment it controls, and supplies the operating environment itself. Under a "Self-Hosted" deployment the Approved Product runs in an operating environment controlled by the End-User or by a Component Supplier it engages; what that party controls is the operating environment, not the Axtraction Solution, which Axtraction AI alone delivers, configures, orchestrates and supports in either model. The operating environment is the Infrastructure Layer defined in Clause 1.11 of the Data Processing Addendum.
• "End-User" means the customer that accepts these terms and is licensed to use the Approved Products under the applicable Order.
• "Escrow Materials" means any source code, model weights, or other Axtraction AI material deposited or released under an escrow or exit schedule of the kind referred to in Section 10.4.
• "Legal Documents Portal" means the legal documents pages Axtraction AI publishes at axtraction.ai, where it publishes the Current Version of these terms and of the Data Processing Addendum. Superseded versions are held in an archive and supplied to any End-User on request.
• "Order" means the order form, statement of work, schedule, or equivalent written ordering record executed or accepted by the End-User under which the Approved Products are licensed, recording the Approved Products supplied, the Deployment Model, the licence term, the fees, and any acceptance criteria. It is subject to these terms and does not vary them.
• "Professional Services" means Forward Deployed Engineering customisation and implementation work performed by Axtraction AI under a statement of work referred to in the Order. Professional Services are work on the Axtraction Components.
• "Regulated Sector" means any government or statutory body, government-linked company, listed company, financial institution, insurer, healthcare provider, education institution, legal-sector user, or defence or critical-infrastructure operator; any deployment involving employment, credit, insurance, healthcare, or public-sector eligibility decisioning; or any other sector or use case requiring enhanced data-protection, security, or governance review.
• "Supplying Party" means the party through which the End-User procures the Approved Products and to which it pays the fees under the Order. Where the End-User procures directly from Axtraction AI, Axtraction AI is the Supplying Party.

The remaining defined terms are given their meaning where they first appear: Axtraction Components, Axtraction Solution and Non-Axtraction Components in Section 1A.1, Non-Exposing Control Failure in Section 5.4G, Fee Measure in Section 8.2, Super-Cap in Section 8.4, and Public Sector End-User in Section 11.6(d). Throughout these terms, a reference to a Section is a reference to a section of these terms, and a reference to a Clause or an Annex of the Data Processing Addendum is so identified. Where these terms and the Data Processing Addendum each describe what the Order records, each describes the particulars it requires, and neither limits the other.

1. Licence grant

1.1 Subject to these terms and to payment of the applicable fees under the Order, Axtraction AI grants the End-User a limited, non-exclusive, non-transferable, non-sublicensable licence to access and use the Approved Products specified in the Order, solely for the End-User's own internal business purposes during the licence term.

1.2 The licence is provided under the Deployment Model specified in the Order.

1.3 The licence confers no right to source code, the Base Codex, or the underlying platform intellectual property beyond the right of use expressly granted.

1.4 Implementation environments: The End-User shall not input any real, personal, confidential, or regulated data into any demo, sandbox, trial, or non-production environment, and shall obtain go-live approval from Axtraction AI or the Supplying Party before using the Approved Products in production. Go-live approval is conditional on completion of Annex 1 to the Data Processing Addendum for the End-User, or of an Order or equivalent record that supplies the Annex 1 particulars, production Processing of Personal Data not commencing until that is done (Clause 2.10 of the Data Processing Addendum).

1A. The Axtraction Solution and Non-Axtraction Components

1A.1 The two layers

A deployment has two layers, and these terms allocate responsibility between them:

• (a) The Axtraction Components are the Approved Products and the Base Codex and, in relation to an Approved Product, its AI configuration, the mapping of data pipelines into it, the configuration, tuning, deployment orchestration and core system maintenance of it, and the technical support of it. Taken together they are the Axtraction Solution.
• (b) The Non-Axtraction Components are everything else supplied, installed or operated for the deployment, including computing, storage and network hardware, data-centre and facility services, connectivity and telecommunications, public-cloud and other infrastructure subscriptions, accounts and tenancies, operating systems, virtualisation, container and database platforms, identity, backup, security and monitoring tooling that does not form part of an Approved Product, end-user devices, and the procurement, installation, provisioning, operation, maintenance and support of any of them. A Non-Axtraction Component does not become an Axtraction Component merely because an Approved Product runs on, in, through or against it.

1A.2 What Axtraction AI supplies

Axtraction AI supplies the Axtraction Solution, and delivers it exclusively and directly through its own Forward Deployed Engineering team. Axtraction AI's obligations and liabilities to the End-User in respect of the Axtraction Solution are those set out in these terms, the Order, and the Data Processing Addendum. Axtraction AI does not supply, and is not responsible for supplying, any Non-Axtraction Component unless the Order expressly states that it does.

1A.3 What a Component Supplier supplies

Where a Component Supplier supplies, procures, installs, provisions, configures, hosts, operates, administers, maintains or supports a Non-Axtraction Component for the End-User, it does so in its own right and under its own contract with the End-User. That Component Supplier is responsible to the End-User for that component, including its specification, procurement, fitness, capacity, availability, security, patching, lawful operation, installation, operation, maintenance and support, and for any subscription, licence or service it procures from a third party for the deployment. Where it supplies or operates the operating environment on or in which an Approved Product runs, it acts in its own right as a processor to the End-User in respect of that layer and is not a Sub-processor of Axtraction AI (Clause 2.11(b) of the Data Processing Addendum), and the End-User shall procure that any such party complies with the minimum control floor in Section 5.4B and with the other deployment conditions in Section 5 for as long as it supplies or operates that layer.

1A.4 Neither layer warrants the other

Axtraction AI gives no warranty, condition or undertaking in respect of any Non-Axtraction Component, and no failure, unavailability, insecurity, misconfiguration or unsuitability of a Non-Axtraction Component is a failure of the Axtraction Solution or a breach by Axtraction AI. No Component Supplier is authorised to give any warranty, service level or other commitment in respect of an Axtraction Component, and no such commitment binds Axtraction AI (Section 11.3). A defect in an Axtraction Component is not a Component Supplier's responsibility.

1A.5 Where the End-User's remedy lies

The End-User's remedies in respect of the Axtraction Solution run against Axtraction AI under these terms and the Order. Its remedies in respect of a Non-Axtraction Component run against the Component Supplier that supplied it, under the End-User's own contract with that party. Axtraction AI requires every Component Supplier to contract directly with the End-User for the component it supplies, on written terms that make it responsible to the End-User for that component and give the End-User a direct contractual remedy against it, so that the split in this Section 1A leaves the End-User with a remedy against someone for each layer and no gap between them. Nothing in this Section 1A reduces Axtraction AI's obligations in respect of the Axtraction Solution, and nothing in it makes the End-User's rights against Axtraction AI conditional on first pursuing a Component Supplier.

2. Use restrictions

2.1 The End-User shall not, and shall not permit any third party to: (a) copy, modify, decompile, disassemble, reverse engineer, extract prompts, scrape, reconstruct, white-label, rebrand, create derivative works from, or attempt to recreate or derive the source code, system architecture, prompts, or workflow logic of the Approved Products, and shall not use any output, response, log, or telemetry of the Approved Products to train, fine-tune, distil, or develop any model, system, or product, whether or not competing; (b) sublicense, resell, rent, lease, or make the Approved Products available to any third party; (c) remove or obscure proprietary notices; (d) use the Approved Products outside the licensed scope or in breach of applicable law; (e) systematically transcribe, screen-capture, screen-record, session-record, photograph, or otherwise systematically capture or reproduce any prompt-visible interface, intermediate reasoning step, prompt-derived phrasing, or orchestration output of the Approved Products, whether manually or by any automated or assistive means; or (f) perform model extraction, model inversion, membership-inference, training-data-extraction, prompt-injection, jailbreak, or adversarial-probing attacks against an Approved Product, or query an Approved Product at a volume, rate, or in a pattern designed or likely to enable reconstruction of its behaviour, parameters, or instructions. Any breach of Section 2.1(a) or Section 2.1(f) is a material breach entitling Axtraction AI to terminate with immediate effect under Section 10.2. Section 2.1(f) applies in addition to, and is not limited by, Sections 2.1(a) and 2.1(e).

2.1A Permitted evaluation: Nothing in Section 2.1(a) or Section 2.1(e) prevents the End-User from testing, evaluating, benchmarking, or monitoring an Approved Product, or from using its output, response, logs, and telemetry for that purpose, where it does so for its own internal assessment, acceptance, assurance, model-governance, data-protection impact assessment, audit, renewal, or procurement purposes, or where required by law or by a regulator. The End-User shall not publish the results of any such benchmarking, or disclose them to a competitor of Axtraction AI or to any supplier of a competing product or service, without Axtraction AI's prior written consent, which shall not be unreasonably withheld, save where the disclosure is required by law or by a regulator. Axtraction AI shall on request provide reasonable assistance and system documentation to support an assessment within this Section 2.1A, consistent with Clause 3.6 of the Data Processing Addendum.

2.1B Section 2.1(e) does not restrict incidental capture in the ordinary course of the End-User's own operations, including a single screenshot taken to raise a support ticket or to evidence a decision in the End-User's own case file. Capture undertaken for the purpose of, or having the effect of, deriving or reconstructing anything described in Section 2.1(a) is a breach of Section 2.1(a).

2.2 The End-User shall not use the Approved Products to develop or train a competing product or service, and shall not give any competitor or competing vendor access to the Approved Products.

2.3 No third-party or consultant access inconsistent with confidentiality: The End-User shall not give any third-party consultant, system integrator, or other person access to the Approved Products in a manner inconsistent with these terms or the confidentiality obligations in Section 9.

2.4 User management (Fully Managed): For Fully Managed deployments, the End-User is responsible for identifying and authorising its users, promptly removing leavers, maintaining credential hygiene and multi-factor authentication discipline, and reporting any suspected credential compromise to Axtraction AI or the Supplying Party.

2.5 Persons bound: Sections 2.1 to 2.4 and Section 2.6 bind the End-User, its personnel, contractors, sub-contractors, consultants, system integrators, and any other person to whom the End-User gives access to an Approved Product. The End-User shall procure that each such person is bound in writing before access is given, and is liable for each such person's acts and omissions as if they were its own.

2.6 Sanctions and export control: The End-User shall not, and shall procure that no person within Section 2.5 does, directly or indirectly, export, re-export, supply, transfer, or make any Approved Product or other Axtraction Component available to any person, entity, or jurisdiction targeted by applicable sanctions or export restrictions, or use or permit the use of any Approved Product for any purpose those laws prohibit. The End-User shall promptly notify Axtraction AI of any actual or potential breach of this Section 2.6. This Section 2.6 is in addition to Section 2.1(d). A breach of this Section 2.6 is a material breach of these terms.

2A. End-User responsibilities and dependencies

2A.1 The End-User shall provide accurate data, timely access and credentials, appoint responsible owners, make timely decisions, and ensure its Client Data is lawfully collected and may be Processed for the intended purpose. Client Data excludes any Base Codex material, which remains Axtraction AI's property (Sections 3.1 and 3.1A).

2A.2 Axtraction AI is not responsible for any delay, cost, or deficiency in the Approved Products to the extent caused by the End-User's failure to meet a dependency in Section 2A.1.

3. Intellectual property and data ownership

3.1 Platform IP: The Base Codex, the Approved Products, and all improvements, enhancements, and generally-applicable developments remain the sole and exclusive property of Axtraction AI.

3.1A No implied IP transfer: No right, title, or interest in the Base Codex, the Approved Products, or any custom configuration is transferred or assigned to the End-User except by an express written assignment signed by Axtraction AI. Custom configurations built for the End-User do not carry any implied assignment of Axtraction AI platform IP.

3.2 End-User data and configurations: As between the End-User and Axtraction AI, the End-User owns (a) its data and (b) the End-User-specific business logic and configurations built on the Approved Products for it, subject to Axtraction AI's underlying platform rights and the licence-back in Section 3.3.

3.2A What Section 3.2 does not carry: Neither the End-User's data under Section 3.2(a) nor its configurations under Section 3.2(b) include any Base Codex material. That material remains Axtraction AI's property under Sections 3.1 and 3.1A, and does not become the End-User's property by reason of being Processed, stored, cached, logged, reproduced in an audit trail, or otherwise present within the End-User's deployment or records.

3.2B Configurations: no competitor disclosure, no reproduction of Axtraction AI material: The End-User's ownership under Section 3.2(b) does not entitle it to (a) disclose its configurations, or permit their disclosure, to any competitor of Axtraction AI or to any supplier of a product or service competing with an Approved Product; or (b) use them, or permit their use, in a way that discloses or reproduces the Base Codex, or Axtraction AI's prompt architecture, orchestration logic, rules engine, scoring or ranking methodology, thresholds, taxonomies, or reusable modules, in specifying, scoping, procuring, building, or evaluating a replacement for or an alternative to an Approved Product. Nothing in this Section 3.2B prevents the End-User from procuring a replacement for an Approved Product, or from describing its own operational requirements, in any tender, request for proposal, technical annex, requirements document, or evaluation matrix. The configurations are Axtraction AI's confidential information under Section 9 for so long as, and to the extent that, they would reveal the Base Codex, or Axtraction AI's prompt architecture, orchestration logic, rules engine, scoring or ranking methodology, thresholds, taxonomies, or reusable modules. This Section 3.2B does not restrict the End-User's internal use of its configurations for its own operations, nor any disclosure required by law or by a regulator, provided that where lawful the End-User gives Axtraction AI prompt written notice and seeks confidential treatment.

3.3 Licence-back: The End-User grants Axtraction AI a non-exclusive licence to host, process, and use the End-User's data and configurations only to deliver, operate, configure, support, secure, troubleshoot, bill for, audit, and maintain the Approved Products and the agreed services, to comply with applicable law, and for any other purpose the End-User expressly authorises in writing. Clause 3.10 of the Data Processing Addendum governs that use and prevails over this Section 3.3. The licence granted by this Section 3.3 does not extend to using the End-User's data or configurations to train, fine-tune, or embed any artificial-intelligence or machine-learning model, that use being governed exclusively by Clause 3.11 of the Data Processing Addendum; and the use of aggregated, anonymised, and de-identified learnings is permitted only on the conditions in Clause 3.12 of that Addendum.

3.4 Feedback: The End-User grants Axtraction AI a perpetual, irrevocable, worldwide, royalty-free, transferable, and sublicensable licence to use, reproduce, modify, adapt, and otherwise exploit for any purpose any feedback, suggestion, or input the End-User provides in relation to the Approved Products, without any obligation, ownership, royalty, commission, or compensation to the End-User. The End-User shall ensure that any feedback it submits is free of, and does not contain, embed, or reveal, (a) any confidential information of any third party and (b) any Personal Data. The End-User warrants that it holds, and has obtained, all rights, consents, and authorisations necessary to submit each item of feedback and to grant the licence in this Section 3.4 free of any third-party right. Feedback shall not, merely by virtue of being provided as feedback, be treated as the End-User's confidential information under Section 9 so as to limit or reduce Axtraction AI's rights under the first sentence of this Section 3.4.

3.5 Third-party and open-source components: Third-party components provided with the Approved Products remain subject to their own licence terms. The End-User shall not, and shall procure that no person within Section 2.5 does, introduce, combine, link, incorporate, or distribute any open-source or other software with any Approved Product, any Escrow Materials, or any other Axtraction AI material on terms that would, or could, require the disclosure, licensing, availability, or transfer of Axtraction AI's source code, model weights, prompts, or other proprietary materials, or that would restrict Axtraction AI's ability to charge for or licence any of them.

4. AI governance and responsible use

The End-User acknowledges and agrees that, for any Approved Product that scores, ranks, profiles, or flags natural persons:

• (a) Human-in-the-loop: a qualified human must review, validate, and take responsibility for any material decision informed by system output. No adverse action affecting a natural person, including any arrest, detention, denial of service, or other adverse legal or administrative action, shall be taken solely on the basis of an automated output.
• (b) Non-determinative use: system outputs are decision-support signals and shall not be represented or used as conclusive findings of fact, guilt, or wrongdoing.
• (c) Non-discrimination: the End-User shall not use the Approved Products in a manner that unlawfully discriminates against individuals or groups.
• (d) Audit logging: the End-User shall maintain audit logs of material decisions informed by system outputs, sufficient to support review and regulatory scrutiny.
• (e) Regulatory responsibility: the End-User remains responsible for its own regulatory compliance, including any heightened obligations attaching to profiling or risk-scoring of natural persons.
• (f) No social scoring: the End-User shall not use the Approved Products for social scoring of natural persons by or for a public authority in a manner prohibited by law. This paragraph (f) applies whether or not the End-User is itself a public authority, and is in addition to Section 4A.1.

4A. Prohibited and restricted use

4A.1 Prohibited use: The End-User shall not use the Approved Products for unlawful surveillance, discriminatory profiling, or any purpose prohibited by applicable law.

4A.2 Restricted use (human review required): The End-User shall not use the Approved Products to make final decisions on employment, credit, insurance, healthcare, legal outcomes, or the biometric identification of natural persons without qualified human review; and, consistent with Section 4(a), no adverse action (including any arrest, detention, or denial of service) shall be taken solely on the basis of an automated output.

4A.3 Right to refuse or suspend: Axtraction AI may refuse any deployment or use case that in its reasonable assessment is unlawful, high-risk, or inconsistent with Section 4 or this Section 4A. Axtraction AI may suspend a live deployment under this Section 4A.3 only where the use is unlawful or is in breach of Section 4 or this Section 4A, and then only in accordance with Section 6.2. No suspension, deactivation, degradation or interruption may be effected under this Section 4A.3, and no payment-related notice may be injected, against an End-User that is current on its own payment and other obligations and is not in breach of Section 4 or this Section 4A, including where Axtraction AI reassesses a previously accepted use case as high-risk. In that case Axtraction AI's remedies are to require remediation of the use case within thirty (30) days, to impose additional Section 4 governance conditions, and, failing remediation, to decline to renew on expiry of the then-current licence term. This Section 4A.3 is subject to Sections 6.2 and 6.3, which prevail.

4A.4 Allocation of AI-governance responsibility: As between Axtraction AI and the End-User, Axtraction AI is responsible for the design, documentation, and technical guardrails of the Approved Products, and for supplying on request the system documentation the End-User reasonably needs for its own model-governance review or data-protection impact assessment (Section 2.1A and Clause 3.6 of the Data Processing Addendum). The End-User is responsible for the use case, for the human review, non-discrimination, and audit-logging obligations in Section 4, for the lawfulness of the decisions it takes on system output, and for its own regulatory compliance. Any further allocation for a particular deployment is recorded in the Order. No document outside these terms, the Order, and the Data Processing Addendum allocates AI-governance responsibility between the parties.

5. Data protection

5.1 The End-User is the data controller (or equivalent) for Personal Data processed within its deployment; Axtraction AI acts as processor (or equivalent) and processes such Personal Data only on the End-User's documented instructions set out in or given under these terms.

5.2 Each party shall comply with the Data Protection Laws applicable to it.

5.3 The data-processing details, being security measures, Sub-processors, breach notification, cross-border transfer safeguards, and return or deletion on termination, are set out in the Data Processing Addendum, the Current Version of which is published on the Legal Documents Portal and amended only in accordance with Clause 9 of that Addendum. It is incorporated into these terms by reference, and the End-User accepts it as Controller, with Axtraction AI as Processor. The version current when specific Processing was carried out continues to govern that Processing. Where a change to the Data Processing Addendum has a significant adverse effect on the End-User, the End-User's objection and exit rights are those in Clause 9.5 of that Addendum, and Clause 9.11 of it applies to a material change to the content Article 28(3) of the GDPR requires. Axtraction AI shall implement appropriate technical and organisational measures to protect Personal Data.

5.4 In Self-Hosted deployments the End-User controls the operating environment and is responsible for its own security configuration.

5.4A Self-Hosted conditions (anti-extraction and telemetry): As a condition of any Self-Hosted deployment, the End-User shall (a) implement and maintain the technical anti-extraction, obfuscation, key-management, and tamper-evidence controls specified by Axtraction AI, and (b) generate, retain for the retention period specified by Axtraction AI (and, absent a specified period, for not less than twelve (12) months), and make available to Axtraction AI on request the telemetry and audit logs of extraction, export, and access attempts. Components that do not conform to these controls are available on a Fully Managed basis only. This Section 5.4A is subject to the protection of paid-up, compliant End-Users in Section 6.3. Nothing in this Section permits any suspension, deactivation, degradation or interruption of a deployment contrary to Section 6.3, which prevails.

5.4B Minimum control floor

• (a) Encryption and access control. Absent, or in addition to, any specification given under Section 5.4A(a), the End-User shall ensure, and shall procure that each person to whom it gives access to an Approved Product and each person supplying, operating or administering the operating environment for it ensures, that every prompt, template, orchestration sequence, agent or tool definition, guardrail, evaluation dataset, and model weight supplied as part of an Approved Product is (i) held encrypted at rest wherever it is stored, including in volumes, snapshots, machine or disk images, replicas, caches, log stores, and backup or business-continuity media; (ii) accessible only to named individuals on a least-privilege basis, whose access is logged; and (iii) not copied, moved, or transmitted outside the operating environment except as these terms expressly permit.
• (b) Covenants. The End-User shall not, and shall procure that no person to whom it gives access to an Approved Product and no person supplying, operating or administering the operating environment for it does, read, dump, extract, copy, export, decrypt, decompile, disassemble, reverse engineer, index, mine, or otherwise reconstruct the content of any material within paragraph (a) from process memory, a container image, a volume, a snapshot, a machine or disk image, a replica, a cache, a log, or a backup, or mount, unpack, or inspect any such artefact for that purpose. Operating the environment in the ordinary course, including running, patching, monitoring, replicating, snapshotting, and backing up the environment as a whole, is not a breach of this paragraph (b) even where it necessarily captures such material, provided the resulting media are held in accordance with paragraph (a), are not opened, unpacked, decrypted, mounted for inspection, analysed, or disclosed, and are deleted in accordance with the applicable retention cycle.
• (c) Enhanced controls where specified. Where Axtraction AI specifies in writing, for a particular component, technical controls additional to or in place of paragraph (a), such as a hardware-backed key store or a sealed or attested runtime, the End-User shall implement and maintain those controls for that component as a condition of its Self-Hosted deployment. Absent such a specification, paragraphs (a) and (b) are the applicable control floor and the component may be deployed Self-Hosted on that footing.
• (d) Prompt-visible components. Where Axtraction AI expressly approves in writing a component that renders a prompt or system instruction visible to a human user, paragraphs (a) to (c) apply to that component save to the extent of that approval and on the conditions stated in it, and Section 2.1 continues to apply to everything so rendered.
• (e) Saving. Nothing in this Section 5.4B permits any suspension, deactivation, degradation or interruption of a deployment contrary to Section 6.3, which prevails.

5.4C Fully Managed logging: In any Fully Managed deployment, Axtraction AI may generate, collect, and retain logs of export, bulk-retrieval, screen-capture, and prompt-disclosure events on the End-User's tenant, including events attributable to any person within Section 2.5 and to the administrative, provisioning, configuration, or support access of the Supplying Party or a Component Supplier to that tenant, and may use them solely to detect and investigate a suspected breach of Section 2.1, Section 2.2, Section 2.3, Section 2.6 or Section 3.5. The End-User shall not disable, evade, degrade, or circumvent that logging, and shall inform each person within Section 2.5 holding such access that it is carried out. In respect of any Personal Data contained in a log generated under this Section 5.4C, Axtraction AI acts as a controller and not as a processor, because it determines the purpose of that Processing for its own account. Axtraction AI relies on its legitimate interests in protecting its intellectual property and the integrity of the Approved Products; it shall Process that Personal Data only for the purpose stated in this Section 5.4C, shall retain it for no longer than twelve (12) months unless it is required for an investigation that is under way or for the establishment, exercise, or defence of a legal claim, and shall protect it in accordance with Annex 2 to the Data Processing Addendum. That Processing is separate from, and does not vary, Axtraction AI's obligations as Processor under the Data Processing Addendum, which continues to govern all End-User Personal Data Processed within the Approved Products. Nothing in this Section 5.4C permits any suspension, deactivation, degradation or interruption of a deployment, or the injection of any payment-related notice, contrary to Section 6.3, which prevails.

5.4D Extraction event report, legal hold and preservation: The End-User shall notify Axtraction AI within seventy-two (72) hours of becoming aware of any detected or tamper-evident extraction, export, decompilation, or unauthorised-access event affecting an Approved Product, and shall preserve all related logs, images, and artefacts pending Axtraction AI's investigation. Within five (5) business days of that notification the End-User shall deliver to Axtraction AI a written report identifying the roles, accounts, devices, and environments involved, the material affected, and the steps taken, naming an individual only where that is necessary to identify the material affected and lawful for the End-User to do; shall suspend any automatic deletion, rotation, or overwriting policy affecting the related logs, images, artefacts, devices, and accounts and preserve them for ninety (90) days from that notification or until Axtraction AI confirms in writing that preservation may end, whichever is the earlier, that period being extendable by written agreement; and shall deliver up or irretrievably destroy, and certify in writing by a director or equivalent officer, every copy of Axtraction AI material held otherwise than as these terms permit. Where forensic examination of an affected environment is required, it shall be carried out by the End-User or by an independent forensic examiner it appoints, and the End-User shall provide Axtraction AI with the findings and supporting artefacts so far as they concern Axtraction AI material; Axtraction AI shall provide reasonable assistance on request. This Section 5.4D applies whatever the Deployment Model. Nothing in this Section 5.4D requires the disclosure of the End-User's own Client Data except so far as it is necessary to identify the material affected, permits any suspension, deactivation, degradation or interruption of a deployment contrary to Section 6.3, which prevails, or varies the Data Processing Addendum.

5.4E Transport integrity; no interception or inspection

Where a Self-Hosted deployment is configured so that material within Section 5.4B(a) is served from, or otherwise passes to or from, an environment Axtraction AI controls, the protection of that material in transit is a condition of that deployment on the same footing as Sections 5.4A and 5.4B. This Section 5.4E applies only to such a deployment, and does not apply to a deployment that operates without any such connection. Where any such material, or any inference request or response carrying or capable of revealing it, or any decryption key or credential for it, passes between an environment Axtraction AI controls and any component of the deployment, the End-User shall ensure, and shall procure that each person supplying, operating or administering the operating environment and every other person deploying or operating an Approved Product for it ensures, that:

• (i) both endpoints authenticate each other by mutual cryptographic authentication to the standard specified by Axtraction AI in writing and, absent a specified standard, by mutually authenticated TLS 1.3 or better, the client credentials and private keys for that authentication being held under the encryption and access controls required by Section 5.4B(a) and not being made available to any person who does not require them for the operation of the deployment;
• (ii) the traffic is encrypted in transit end to end between those two endpoints, so that neither its content nor any material within Section 5.4B(a) that it carries is available in clear text at any intermediate point, and so that its confidentiality and integrity do not depend on any control operated by a person other than Axtraction AI; and
• (iii) the traffic passes between those endpoints without interception. The End-User shall configure its network security controls so that traffic to and from the endpoints Axtraction AI identifies in writing is excluded from TLS termination and inspection, by a pass-through or bypass rule or equivalent exclusion, and shall procure that no person supplying, operating or administering the operating environment, and no person acting for or engaged by such a person, otherwise intercepts, terminates, proxies, mirrors, bridges, decrypts, inspects, modifies, logs, records or retains that traffic or its content, whether by a TLS-terminating or TLS-inspecting proxy, gateway, firewall or load balancer, a network tap, span port or packet capture, a service mesh, sidecar or in-cluster interception, an endpoint, agent-based or data-loss-prevention inspection, the installation or use of any certificate authority, trust anchor, root certificate or key on any endpoint for that purpose, or any other means. Where the End-User's security policy or its regulatory obligations do not permit such an exclusion, it shall notify Axtraction AI, and the affected component shall instead be provided under the Fully Managed Deployment Model in accordance with Section 5.4G; the absence of an exclusion is not of itself a breach of this Section 5.4E where the End-User has so notified Axtraction AI. Any content of that traffic that a network security control nevertheless renders visible is Axtraction AI's confidential information, and Section 5.4B(b) and Section 9 apply to it.

Nothing in this Section 5.4E prevents the collection of connection-level metadata that does not reveal the content of the traffic, or the telemetry and audit logging required by Section 5.4A(b) and Section 5.4C. Section 5.4F applies to this Section 5.4E, so that satisfaction of it is a condition precedent to release and is covered by the certification and the no-waiver-by-release provision in that Section, and Section 5.4G applies to a failure to satisfy it. Nothing in this Section 5.4E permits any suspension, deactivation, degradation or interruption of a deployment contrary to Section 6.3, which prevails.

5.4F Condition precedent, certification, and no waiver by release

Satisfaction of Sections 5.4A, 5.4B, 5.4E and this Section 5.4F is a condition precedent to release of the affected component for Self-Hosted deployment, and is a continuing condition of its continued deployment. Before release, the End-User shall deliver to Axtraction AI a written certification signed by a director or equivalent officer confirming that Sections 5.4A, 5.4B and 5.4E are satisfied for that deployment, and shall re-certify annually and on any material change to the operating environment. A certification later shown to have been materially inaccurate when given is deemed never to have been delivered. Release, deployment, activation, go-live, or acceptance of payment by Axtraction AI is not, and shall not be relied on as, evidence of satisfaction of those Sections, an approval under them, or a waiver, variation, or release of them, whether by conduct, election, course of dealing, estoppel, or otherwise; and no such waiver is effective unless in a written instrument signed by an authorised signatory of Axtraction AI, expressly identifying the Section, the component, and the deployment, and limited to them. Where the End-User will not or cannot satisfy Section 5.4B or Section 5.4E for a component, that component is available on a Fully Managed basis only (Section 5.4A), and any transition of an already-deployed component to the Fully Managed Deployment Model shall be effected so as to preserve continuity of that End-User's access and shall not suspend, deactivate, degrade, or interrupt its deployment. Nothing in this Section 5.4F permits any suspension, deactivation, degradation or interruption of a deployment contrary to Section 6.3, which prevails.

5.4G Failure after release; Non-Exposing Control Failure; remediation

Where Section 5.4B, Section 5.4E or Section 5.4F ceases to be satisfied for a deployed component, Axtraction AI may, on written notice, require the End-User to remediate the failure within ten (10) business days and, failing remediation, may withdraw that component and require the affected functionality to be provided only under the Fully Managed Deployment Model, in each case subject to Section 6.3, and any such transition shall be effected so as to preserve continuity of that End-User's access and shall not suspend, deactivate, degrade, or interrupt its deployment (Section 5.4F).

A "Non-Exposing Control Failure" means a failure to satisfy Section 5.4B, Section 5.4E or Section 5.4F for a deployed component that (i) is a technical failure of a control and is neither wilful nor the result of a deliberate act or omission of the End-User or of any person within Section 2.5; (ii) has not caused or permitted any Base Codex material to be read, reconstructed, exported, disclosed, or otherwise made accessible to any person not authorised under these terms to receive it; and (iii) is being addressed by the End-User in good faith. The operation of a network security control that the End-User, or a person supplying, operating or administering the operating environment for it, had in place before the deployment, or that the End-User's security policy or its regulatory obligations require, is not of itself a wilful failure or a deliberate act or omission for the purposes of limb (i).

The opportunity to remediate under this Section 5.4G is available for a Non-Exposing Control Failure alone; Axtraction AI's rights to withdraw the affected component and to require the affected functionality to be provided only under the Fully Managed Deployment Model are available on any failure to satisfy Section 5.4B, Section 5.4E or Section 5.4F, and on a failure that is not a Non-Exposing Control Failure are exercisable immediately and without any remediation period. A Non-Exposing Control Failure that is remediated within the ten (10) business day period is not an irremediable material breach for the purposes of the paragraph headed "Consequences of breach of Sections 5.4B, 5.4E and 5.4F" below or of Section 10.2. A Non-Exposing Control Failure that is not remediated within that period, and any failure to satisfy Section 5.4B, Section 5.4E or Section 5.4F that is not a Non-Exposing Control Failure, carries the consequences stated in that paragraph. The ten (10) business day period runs only from Axtraction AI's written notice under this Section 5.4G, and Axtraction AI is not obliged to give that notice. Nothing in this Section 5.4G permits any suspension, deactivation, degradation or interruption of a deployment, or the injection of any payment-related notice, contrary to Section 6.3, which prevails.

Consequences of breach of Sections 5.4B, 5.4E and 5.4F

A breach of Section 5.4B, Section 5.4E or Section 5.4F is a material breach of these terms; and where the breach is wilful, or has caused or permitted any Base Codex material to be read, reconstructed, exported, disclosed, or otherwise made accessible to any person not authorised under these terms to receive it, it is an irremediable material breach entitling Axtraction AI to terminate these terms with immediate effect under Section 10.2(b), without notice to remedy and without any cure period. This paragraph is subject to Section 5.4G: a Non-Exposing Control Failure that is remediated within the ten (10) business day period allowed by that Section is not an irremediable material breach for the purposes of this paragraph or of Section 10.2. Nothing in this paragraph permits any step against an End-User contrary to Section 6.3, which prevails, and no suspension, deactivation, degradation or interruption of a deployment, and no injection of any payment-related notice, may be effected under this paragraph against an End-User that is current on its own payment and other obligations otherwise than on the ground of that End-User's own default under Section 6.2.

5.5 Security and data residency:

• (a) The stated position binds. The data-residency position that binds Axtraction AI is the position stated in the Data Processing Addendum, in particular Annex 3 to it (Sub-processors, including their processing locations) and Annex 4 to it (cross-border transfers and data residency), read with the Order. That recorded position, including every qualification stated in it, is the commitment: the End-User is entitled to rely on it, and Axtraction AI shall comply with it. Applying it:
  • (i) Hosting. In a Fully Managed deployment, End-User Personal Data is hosted in the hosting region recorded in Annex 1 to the Data Processing Addendum, on the terms of Annex 4 to it. In a Self-Hosted deployment the operating environment, and therefore the location at which End-User Personal Data is held in it, is determined by the End-User and by the party that supplies and operates that environment (Sections 1A.3 and 5.4), and Axtraction AI's residency commitment applies to the Processing carried out in the systems and services Axtraction AI itself operates for the deployment.
  • (ii) Inference. AI or model inference runs in the AI-inference region recorded in Annex 1 to the Data Processing Addendum, which is the hosting region wherever the applicable AI service supports it there, as Annexes 3 and 4 to that Addendum record. Where an AI service is not available in that region, Personal Data goes only to the nearest approved region under a lawful transfer mechanism recorded in Annex 4 to that Addendum for that destination, and the End-User is informed first.
  • (iii) Sub-processor locations. Where Annex 3 to the Data Processing Addendum records a Sub-processor's processing location for a service by reference to in-region availability, or records it subject to any other qualification, that qualification forms part of the position that binds under this paragraph (a) and is not overridden by it.
  • (iv) Support and Forward Deployed Engineering access. Remote access to End-User Personal Data from Malaysia for support, troubleshooting, configuration, or Forward Deployed Engineering is a transfer, and is carried out only under the transfer safeguards recorded in the Data Processing Addendum (Clause 5 of it, Annex 4 to it and, for GDPR restricted transfers, Annex 4A to it).
  • (v) No unilateral move. Axtraction AI shall not host, store, or Process End-User Personal Data outside the position recorded in Annexes 1 and 4 to the Data Processing Addendum and in the Order without prior written notice to the End-User and the lawful transfer basis and transfer safeguards that Addendum requires for that destination. Any change to the recorded position itself is governed by paragraph (b).
• (b) Changes to the stated position. Any change to the residency position recorded in the Data Processing Addendum takes effect only through Clause 9 of that Addendum, read with Section 5.3, and any change to a residency position recorded in the Order requires the End-User's written agreement. Section 11.6(d) applies to a Public Sector End-User.
• (c) No reliance outside those documents. The End-User shall not rely on, and shall have no remedy in respect of, any security, certification, or data-residency claim that is not stated in the Data Processing Addendum, in the Order, or in a document expressly incorporated in either. No statement of that kind made outside those documents, by the Supplying Party, a Component Supplier, or any other person, is a representation, warranty, or commitment of Axtraction AI. This paragraph (c) excludes reliance only on claims outside those documents; it does not qualify paragraph (a).
• (d) Security controls. For enterprise or Regulated Sector deployments, the applicable security controls are those set out in Annex 2 to the Data Processing Addendum.

6. Fees, payment, and suspension

6.1 The End-User pays licence and service fees to the Supplying Party under the Order. Where the Supplying Party is not Axtraction AI, Axtraction AI's payment relationship is with that party and not with the End-User. If Axtraction AI gives the End-User written notice that it is taking over invoicing for the affected Approved Products, the End-User's invoicing and payment counterparty for them becomes Axtraction AI directly, on otherwise unchanged terms; that does not affect the protection of paid-up, compliant End-Users in Section 6.3.

6.2 Suspension for the End-User's own default

Axtraction AI may suspend or deactivate the End-User's deployment, on ten (10) business days' written notice and a reasonable opportunity to cure, if the End-User is in material breach of these terms or fails to pay undisputed fees due under the Order when due, until the breach is cured. Where the Supplying Party is not Axtraction AI, it may request a suspension for non-payment of undisputed fees, evidencing the notice and the opportunity to cure that it has given; Axtraction AI may act on that request only after satisfying itself that those steps were taken, and may decline a request or lift a suspension at any time. Suspension for material breach of these terms is exercisable by Axtraction AI alone. This is the only suspension right at End-User level, it is exercisable only in respect of the End-User's own default, and only Axtraction AI may exercise it.

6.3 Protection of paid-up, compliant End-Users

A licence held by an End-User that is current on its own payment and other obligations shall not be suspended, deactivated, degraded, or subjected to injected payment-related notices by reason of any non-payment, act, omission, default or insolvency anywhere else in the chain of supply for the Approved Products, nor by reason of any reassessment by Axtraction AI of a previously accepted deployment or use case, nor under any other provision of these terms, of the Order, or of any incorporated document, nor under any provision of any agreement between Axtraction AI and any other person, whether or not the End-User knows of that agreement or of its terms. The only ground on which such a licence may be suspended is the End-User's own default under Section 6.2. This Section 6.3 prevails over every other provision of these terms, including Sections 4A.3, 5.4A, 5.4B, 5.4C, 5.4D, 5.4E, 5.4F, 5.4G and 11.2 and the Status and incorporation statement, and over every document incorporated into these terms; nothing in these terms may be read to permit what it prohibits; and no provision of any other agreement, and no act, omission, default or insolvency of any person other than the End-User itself, may be relied on to do what it prohibits.

6.4 Self-Hosted limitation

In Self-Hosted deployments the parties acknowledge that any suspension or release mechanism is a contractual right rather than a guaranteed technical capability.

7. Warranties and disclaimer

7.1 The Approved Products are provided on an "as-is" and "as-available" basis. Except as expressly stated in Section 7.5, in Section 8B, or in the Order, Axtraction AI disclaims all other warranties, whether express, implied, statutory, or otherwise, including implied warranties of merchantability and fitness for a particular purpose. Section 8B states Axtraction AI's obligations in respect of third-party intellectual-property claims. Any service levels or acceptance criteria are only those expressly agreed in the Order. Subject to Section 7.1A, where the Order does not specify acceptance criteria, the Approved Product is deemed accepted on the earlier of first production use and ten (10) business days after delivery or activation.

7.1A Acceptance where criteria are stated, and for Public Sector End-Users: The deemed acceptance in the last sentence of Section 7.1 does not apply, and no lapse of time operates as acceptance, where (a) the Order states acceptance criteria, or (b) the End-User is a Public Sector End-User as defined in Section 11.6(d). In either case the Approved Product, and each milestone or deliverable of any Professional Services, is accepted only when the End-User accepts it in writing, or when the End-User puts it into production use otherwise than for the purpose of acceptance testing. Where the Order states acceptance criteria, the End-User shall, within the review period stated in the Order or, absent a stated period, within twenty (20) business days of Axtraction AI's written notice of completion, either accept in writing or give written notice of material non-conformity with those criteria, specifying the non-conformity in reasonable detail; Axtraction AI shall remedy the non-conformity and re-submit within a reasonable period, and this Section 7.1A applies again to the re-submission. Acceptance may be withheld only on the ground of a material non-conformity with the acceptance criteria stated in the Order, and shall not be unreasonably withheld, conditioned, or delayed. This Section 7.1A states the acceptance mechanic as between Axtraction AI and the End-User, including for a milestone or deliverable of Professional Services. It does not apply to any Non-Axtraction Component (Section 1A), acceptance of which is a matter between the End-User and the Component Supplier that supplied it.

7.2 Support and service-level boundary: Unless expressly stated in the Order, Axtraction AI provides no uptime, response-time, resolution-time, or service-credit commitment. Excluded from any support are issues caused by the End-User's environment, third-party components, misuse, unauthorised modification, or use outside the licensed scope.

7.3 No professional advice: The Approved Products do not provide legal, financial, HR, tax, compliance, medical, or cyber-certification advice. Any advisory output must be reviewed by the End-User's own qualified professionals, who remain responsible for the resulting decision.

7.4 AI-output responsibility: The End-User is responsible for outputs to the extent caused by defective or unlawful input data, misconfiguration by the End-User, or use of the Approved Products outside an approved use case.

7.5 Professional services warranty and sole remedy: Axtraction AI warrants directly to the End-User that the Professional Services will be performed with reasonable skill and care, using suitably qualified personnel, and substantially in accordance with the applicable statement of work. Where the End-User notifies Axtraction AI in writing within thirty (30) days of performance that the Professional Services were not so performed, specifying the non-conformity in reasonable detail, Axtraction AI shall re-perform the affected Professional Services at its own cost. Re-performance is the End-User's sole and exclusive remedy for breach of this warranty. This Section 7.5 is the operative professional-services warranty and remedy as between Axtraction AI and the End-User, and it takes effect under these terms, to which the End-User is a party. The supply, procurement, installation, provisioning, configuration, operation, maintenance and support of a Non-Axtraction Component is not a Professional Service, is not warranted by Axtraction AI under this Section 7.5, and is governed by Section 1A. Except as stated in this Section 7.5, Sections 7.1 to 7.4 apply to the Professional Services, and no service level, uptime commitment, or delivery date is warranted unless expressly stated in the Order. Liability under this Section 7.5 is subject to Section 8.

8. Limitation of liability

8.1 To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for loss of profits, revenue, business, goodwill, or anticipated savings.

8.2 Subject to Section 8.3, Axtraction AI's total aggregate liability to the End-User under these terms shall not exceed the Fee Measure, being the total fees paid by the End-User under the Order for the affected Approved Products in the twelve (12) months immediately preceding the event (or the first in a series of related events) giving rise to the liability. The Fee Measure is the single measure by which every cap in this Section 8 is calculated. No cap in these terms is measured by reference to any amount Axtraction AI receives from any other party, and the End-User is not required to know or to prove any such amount. This cap is an aggregate ceiling on liability, not a fixed or agreed sum payable. Every cap in this Section 8 applies separately in respect of each End-User, is calculated only by reference to that End-User's own Order, and is verifiable by that End-User from its own payment records.

8.3 Sections 8.1 and 8.2 do not apply to: (a) either party's breach of confidentiality (subject, for a party's direct liability, to the super-cap in Section 8.4); (b) the End-User's infringement or misappropriation of Axtraction AI intellectual property; (c) death or personal injury caused by negligence; (d) fraud, wilful misconduct, or gross negligence; (e) any liability that cannot be excluded or limited under applicable law; (f) the End-User's unlawful or unauthorised data use; (g) the End-User's indemnity obligations under Section 8A; and (h) Axtraction AI's indemnity obligations under Section 8B.

8.4 Confidentiality and data-incident super-cap: Notwithstanding Section 8.3(a), each party's total aggregate liability to the other for breach of the confidentiality obligations in Section 9, including any claim founded on the same facts as a Personal Data Breach (as defined in the Data Processing Addendum), taken together and across all claims, shall not exceed the greater of (a) one (1) times the Fee Measure defined in Section 8.2 and (b) the amount stated as the Super-Cap in the applicable Order (the "Super-Cap"). The measure to which that multiple is applied under these terms is, in every case and for every cap in this Section 8, the Fee Measure defined in Section 8.2. Where the applicable Order states no such amount, the Super-Cap is one (1) times the Fee Measure, and this Section 8.4 then affords no cover beyond the cap in Section 8.2. This Super-Cap sits above, and is separate from, the cap in Section 8.2, and applies in place of that cap to a party's direct liability for breach of Section 9. Single shared aggregate: the cap in Section 8.2 and the Super-Cap in this Section 8.4 are not cumulative; the maximum recoverable under both taken together, across all claims and all heads to which either applies, is one amount equal to the Super-Cap, and any amount paid or payable under Section 8.2 reduces the amount available under this Section 8.4. That single aggregate does not apply to, and does not cap, any liability listed in paragraphs (i) to (v) below or in Section 8.3(b) to (h). The Super-Cap does not apply to, and liability remains uncapped for: (i) a wilful breach of Section 9; (ii) fraud, wilful misconduct, or gross negligence; (iii) the End-User's infringement or misappropriation of Axtraction AI intellectual property, or misuse of Axtraction AI trade secrets (Sections 8.3(b) and 9.1); (iv) any liability that cannot be excluded or limited under applicable law; and (v) Axtraction AI's indemnity obligations under Section 8B (Section 8.3(h)). Nothing in this Section 8.4 limits the End-User's indemnity under Section 8A.

8A. End-User indemnity

8A.1 The End-User shall indemnify, defend, and hold harmless Axtraction AI from and against losses arising out of the End-User's Client Data, the End-User's unlawful or unauthorised use of the Approved Products, its misuse of outputs, or its use of the Approved Products outside the licensed scope or an approved use case. This indemnity is not subject to Sections 8.1 and 8.2 (Section 8.3(g)). Axtraction AI's corresponding indemnity to the End-User is in Section 8B.

8B. Axtraction AI IP indemnity

8B.1 Indemnity. Axtraction AI shall defend the End-User against any claim by a third party that an Approved Product, or output generated by an Approved Product, infringes or misappropriates that third party's patent, copyright, trade mark, trade secret, or other intellectual-property right, and shall indemnify the End-User against the damages, costs, and expenses finally awarded against it in respect of such a claim, or payable under a settlement Axtraction AI has approved.

8B.2 Conditions. The indemnity in Section 8B.1 is conditional on the End-User (a) notifying Axtraction AI in writing promptly after becoming aware of the claim; (b) giving Axtraction AI sole control of the defence and settlement, save that Axtraction AI shall not settle on terms imposing a non-indemnified liability, or an admission of fault, on the End-User without its consent, which shall not be unreasonably withheld; and (c) giving reasonable cooperation and information, at Axtraction AI's cost. A delay in notification relieves Axtraction AI only to the extent it is prejudiced by that delay.

8B.3 Exclusions. Section 8B.1 does not apply to a claim to the extent it arises from (a) the End-User's Client Data, prompts, instructions, or configuration, or from output attributable to any of them; (b) combination or use of an Approved Product with any product, service, data, or system not supplied by Axtraction AI, where the claim would not have arisen but for that combination; (c) modification of an Approved Product otherwise than by or for Axtraction AI; (d) use of an Approved Product outside the licensed scope, an approved use case, or these terms; (e) the End-User's continued use of an Approved Product after Axtraction AI has notified it to stop and has made a non-infringing alternative available; or (f) any Non-Axtraction Component (Section 1A).

8B.4 Remedies. Where an Approved Product is, or in Axtraction AI's reasonable opinion is likely to become, the subject of a claim within Section 8B.1, Axtraction AI may at its own cost and option (a) procure for the End-User the right to continue using it; (b) modify or replace it so that it is non-infringing while remaining materially equivalent in function; or, only where neither (a) nor (b) is reasonably available, (c) terminate the licence for the affected Approved Product on written notice and refund the fees paid for it in respect of the unexpired part of the then-current term. Termination under paragraph (c) applies only to the affected Approved Product, shall be effected with a reasonable transition period, and, being a withdrawal required to avoid continuing infringement and accompanied by that refund, is not a suspension, deactivation, or degradation by reason of any matter within Section 6.3, which continues to apply to every other deployment of that End-User.

8B.5 Uncapped. Liability under this Section 8B is not subject to the exclusions and limits in Sections 8.1, 8.2, and 8.4, and is uncapped (Section 8.3(h)).

8B.6 Sole remedy. Sections 8B.1 to 8B.5 state the End-User's sole and exclusive remedy, and Axtraction AI's entire liability, for any claim that an Approved Product or its output infringes or misappropriates a third party's intellectual-property right.

9. Confidentiality

9.1 Each party shall protect the other's confidential information with no less than a reasonable standard of care and use it only to exercise its rights and perform its obligations under these terms. The Base Codex and Axtraction AI's technical materials are Axtraction AI's confidential information and trade secrets.

9.1A No residuals: The End-User shall not, and shall procure that no person within Section 2.5 does, use or disclose any of Axtraction AI's confidential information retained in unaided memory. There is no residuals right and no provision of these terms confers one. This Section 9.1A does not restrict any individual's use of general skills, knowledge and experience of a kind ordinarily acquired in the course of professional work and not amounting to, and not revealing, a trade secret of Axtraction AI or any part of the Base Codex; and to the extent this Section 9.1A would otherwise be unenforceable, it applies to the Base Codex and to Axtraction AI's trade secrets alone and remains fully effective as so applied. This Section 9.1A is subject to Section 9.2.

9.2 The obligations in Section 9.1 do not apply to information that is or becomes public through no fault of the receiving party, was lawfully known to it without restriction before disclosure, is independently developed without use of the confidential information, or is required to be disclosed by law or by a regulator. Where disclosure is so required, the receiving party shall, where lawful, give prompt written notice and seek confidential treatment.

9.3 Section 9 survives for five (5) years after expiry or termination, and indefinitely in respect of the Base Codex and any trade secrets.

10. Term and termination

10.1 These terms apply for the licence term specified in the Order and any renewal.

10.2 Termination for cause

Either party may terminate these terms with immediate effect by written notice if the other commits a material breach that is incapable of remedy or is not remedied within thirty (30) days of written notice, or immediately on the other party's insolvency. In addition, Axtraction AI may terminate these terms with immediate effect by written notice:

• (a) for a breach of Section 2.1(a) or Section 2.1(f); and
• (b) for any breach that the paragraph headed "Consequences of breach of Sections 5.4B, 5.4E and 5.4F" in Section 5 makes an irremediable material breach, in which case no notice to remedy applies, no cure period applies, and the thirty (30) day period in the first sentence of this Section 10.2 does not apply.

A breach within paragraph (a) or paragraph (b) is a breach by the End-User of its own obligations under these terms, so an End-User committing it is not current on its own payment and other obligations and Section 6.3 is not engaged by the exercise of this Section 10.2 against it. In every other case Section 6.3 prevails, and nothing in this Section 10.2 permits any suspension, deactivation, degradation or interruption of the deployment of, or the injection of any payment-related notice into the deployment of, an End-User that is current on its own payment and other obligations.

10.3 On expiry or termination, the End-User shall cease all use of the Approved Products. Axtraction AI shall, for thirty (30) days after expiry or termination, make the End-User's data available for export. That window is a self-service export facility only. The return or deletion of Personal Data, and the periods for it, are governed exclusively by Clause 3.7 of the Data Processing Addendum, which prevails over this Section 10.3; nothing in this Section permits deletion before those periods have run. Sections 1A, 2 (including Section 2.6), 3 (including Section 3.5), 5 (including Sections 5.4B, 5.4C in respect of logs already generated and any investigation of a suspected breach committed during the licence term, 5.4D, 5.4E, 5.4F and 5.4G), 8, 8A, 8B, 9 (including the no-residuals obligation in Section 9.1A), 11.3, and this Section 10.3 survive.

10.4 No step-in, source access, or escrow by default: Except under a separate escrow or exit schedule expressly signed by Axtraction AI, the End-User has no right of step-in, source-code access, or operational takeover of the Approved Products, and the Base Codex is at all times retained by Axtraction AI. Where such a schedule is signed, any step-in, source access, or release of Escrow Materials in respect of that End-User is confined to, and governed by, the bounded terms of that schedule.

10.5 On expiry or termination of a Self-Hosted deployment the End-User shall, within thirty (30) days, cease all use of, and delete or destroy, every copy, image, container, artefact, and backup of the Approved Products in its possession or control, and certify that deletion in writing on request. The restrictions in Section 2 continue to apply to any copy retained under a legal retention requirement, which may not be accessed, restored, or used for any purpose beyond the purpose that justifies its retention.

11. General

11.1 Governing law and forum

These terms are governed by the laws of Malaysia, and disputes are subject to the exclusive jurisdiction of the High Court of Malaya (Kuala Lumpur). Either party may apply to any court of competent jurisdiction for interim, injunctive, or conservatory relief to protect intellectual property or confidential information, including the Base Codex.

11.2 Relationship to other agreements

These terms are entered into under, and are subordinate to, the agreement between Axtraction AI and the Supplying Party, where there is one. Conflicts are resolved by the order of precedence in Section 11.2A, and the Data Processing Addendum prevails on any data-protection matter. Where a conflict is not resolved by that order, the more specific provision prevails over the more general. Sections 6.2 and 6.3 prevail in every case. Any summary or description of these terms given to another party in the chain of supply is a summary only: it confers no right on the End-User, it does not vary these terms, and it never prevails over them. On any divergence between such a summary and these terms, these terms govern.

11.2A Order of precedence

As between the documents that govern the licence, the order of precedence is: the terms of the agreement between Axtraction AI and the Supplying Party, then these terms, then the applicable Order. Where the End-User procures directly from Axtraction AI, the order runs these terms, then the applicable Order. The Data Processing Addendum prevails on any data-protection matter. Where Professional Services are supplied, the statement of work referred to in the Order governs their scope, milestones and acceptance, and does not vary these terms.

11.3 No third-party rights; entire agreement; non-reliance

No person who is not a party has any right to enforce these terms. These terms, the Order, and the Data Processing Addendum constitute the entire agreement between Axtraction AI and the End-User for the licensing of the Approved Products, and supersede any prior statement, representation, or understanding about it. The End-User has not relied on, and shall have no remedy in respect of, any statement made before acceptance that is not expressly incorporated in an executed document. Nothing in this Section 11.3 excludes or limits liability for fraudulent misrepresentation.

11.4 Publicity

Neither party shall use the other's name, logo, case study, or procurement result for marketing or publicity without the other's prior written consent.

11.5 Notices

• (a) To the End-User. The End-User's notice contact is the email address and in-product account it provides on acceptance of these terms. Any notice to the End-User under these terms, including a material-change notice under Section 11.6, may be given by email to that address, by in-product notification, or through the Supplying Party, with posting on the Legal Documents Portal as a backstop. The End-User shall keep its notice contact current.
• (b) To Axtraction AI. Any notice to Axtraction AI must be in writing, sent to Axtraction AI Sdn Bhd, Level 27 Penthouse, Centrepoint North, Lingkaran Syed Putra, Mid Valley City, 59200 Kuala Lumpur, Malaysia, marked for the attention of the Legal Department, with a copy by email to info@axtraction.ai and, where the Supplying Party is not Axtraction AI, a copy to that party.
• (c) Deemed receipt. A notice is deemed given on delivery if sent by hand or courier, and on transmission if sent by email during business hours in Kuala Lumpur where no automated non-delivery message is received within four (4) hours. An email sent outside business hours is deemed given at 9.00 a.m. on the next business day. A recipient's failure to acknowledge a notice does not affect its validity or timing.

11.6 Change control and updates

• (a) On acceptance, the End-User agrees that these terms, as amended from time to time in accordance with this Section 11.6, apply, and that the Current Version published on the Legal Documents Portal governs at any time.
• (b) Axtraction AI shall give the End-User at least thirty (30) days' prior notice (by the route in Section 11.5) of any change that materially and adversely affects the End-User before it takes effect. A change applies prospectively only and does not affect accrued rights, the paid-up-user protection in Section 6.3, or Processing already carried out.
• (c) If a change has a significant adverse effect on the End-User, the End-User may object within the notice period; pending resolution the prior version continues to apply, and if the matter is unresolved within thirty (30) days the End-User may cease using the affected Approved Product and terminate these terms in respect of the affected deployment, without penalty and without prejudice to accrued rights.
• (d) Public Sector End-Users: no adverse change without written acceptance. A "Public Sector End-User" is an End-User that is a government or statutory body, ministry, department, agency or authority, a government-linked company, a Berhad or other public listed company, or a listed issuer, or a body controlled by or acting for any of them. Each is within the Regulated Sector. Where the End-User is a Public Sector End-User, a change to these terms that is materially adverse to it takes effect in respect of that End-User only on its written acceptance. Until it accepts in writing, the version in force immediately before the change continues to apply to it in full, and publication of a new Current Version on the Legal Documents Portal is not, and does not operate as, that acceptance. Where the parties do not agree a materially adverse change, the prior version continues to apply for the remainder of the then-current licence term; Axtraction AI may decline to renew on expiry of that term, but may not suspend, deactivate, degrade, or interrupt the deployment, or inject any payment-related notice into it, by reason of the End-User not accepting the change (Section 6.3, which prevails). Paragraphs (b) and (c) continue to apply to a Public Sector End-User. Nothing in this paragraph (d) prevents a change that is not materially adverse to that End-User, which takes effect on notice under paragraph (b), or a change required by applicable law or by a regulator, which takes effect on notice and to the minimum extent required. Section 5.5(b) applies to any change to the residency position, and Section 7.1A applies to acceptance.
• (e) Public Sector End-Users: form and execution of acceptance. Where the End-User is a Public Sector End-User, acceptance of these terms, and acceptance of any change to them under paragraph (d), is by written instrument only, and click-through and order acceptance do not apply to that End-User. Where that End-User is the Federal Government or a State, or a ministry or department of either, or any other person contracting in the name of either, that written instrument must be made in the name of the Government of Malaysia or of the relevant State and signed by a Minister, by the State Authority, or by a public officer duly authorised in writing by a Minister for the purpose (Government Contracts Act 1949, section 2, or the applicable State enactment). Where the End-User is a statutory body or other person having separate legal personality, the instrument shall instead be executed in that End-User's own name, as its constituting statute and its internal authority require. The End-User warrants that the person accepting these terms, or any change to them, on its behalf is duly authorised to do so and that the instrument is executed in the form its constituting law requires. Axtraction AI may rely on the instrument without further inquiry, and a defect in its execution does not entitle the End-User to deny that these terms applied to a deployment it has received or to any benefit it has taken under them. This paragraph (e) states a formality of execution only; it does not permit any suspension, deactivation, degradation or interruption of a deployment, or the injection of any payment-related notice, contrary to Section 6.3, which prevails.

11.7 Assignment

The End-User shall not assign or transfer these terms or any licence granted under them without Axtraction AI's prior written consent. Axtraction AI may assign to an Affiliate or on a merger, acquisition, or sale of all or substantially all of its assets, on written notice.

11.8 Severance and waiver

If a provision is held invalid or unenforceable, the remainder continues in full force. No failure or delay in exercising a right is a waiver of it.

Acceptance by the End-User

Nothing on this page is signed. Each End-User accepts these terms before deployment, in the manner described under "The parties to each licence" above and, where it is a Public Sector End-User, in the form Section 11.6(e) requires. Acceptance is recorded on the applicable Order or acceptance record for that End-User, together with the notice contact under Section 11.5(a), rather than here. The version accepted is the Current Version published on this page at the time of acceptance.

Data protection is governed by the Data Processing Addendum, published and version-controlled on the Legal Documents Portal at https://axtraction.ai/dpa, incorporated into these terms by reference and accepted by the End-User as Controller.