Terms of Service

1 Preamble

OUWBA provides Services, as described in Appendix 1 "Description of Services", supporting the Client in the implementation of the ISO 27001, SOC 2, HDS and NIS 2 compliance processes through automated workflows. These services cover (i) the deployment of OUWBA's automation tools, (ii) the generation of required documentation, (iii) the mapping and monitoring of the Client's information assets and IT tools, (iv) the identification of compliance gaps and recommended remediation actions, (v) the guidance on the implementation of required organizational and technical controls, and upon the Client's request (vi) ongoing expert support throughout the certification readiness and external audit phases.

The Services are provided through a SaaS platform made available to the Client on a subscription basis, granting access to OUWBA's automated compliance features, dashboards, tools, and support resources for the duration of the subscription.

The Client acknowledges and declares that such Services are relevant and appropriate to its needs.

2 Definitions

The following words or expressions, provided that the first letter is written with a capital letter, shall have the meaning assigned respectively hereto. Any reference in the singular also includes the plural and vice versa. Any reference to one gender includes the other gender.

Account: The interface dedicated to the Client and its Users accessible on the Platform and enabling the use of the Services.
Affiliate: In relation to a Party, any person that, at any time, directly or indirectly (a) controls such Party, or (b) is controlled by the person referred to in (a). For the purposes of this definition, "Control" has the meaning set forth in Article L.233-3 et seq. of the French Commercial Code.
Applicable Data Protection Regulations: (i) Regulation (EU) 2016/679 ("GDPR"), (ii) Directive 2002/58/EC ("e-Privacy Directive"), and any legislation replacing them, and (iii) any national law on Personal Data protection applicable to a Party.
Applicable Laws: All statutes, regulations, directives, codes, decrees, decisions and other legal provisions applicable to this Contract.
Asset Inventory: The list of information assets, systems, applications, tools and infrastructure components identified by the Client or automatically detected by the Platform for the purpose of ISO 27001, SOC 2, HDS and NIS 2 compliance.
Audit Readiness Support: The advisory assistance provided by OUWBA, upon the Client's request, to prepare for internal audits, external audits or certification assessments, including document review, control validation and auditor briefing.
Client's Content: Any information, documents, records, files, configurations, security-related information and/or other content submitted, uploaded, imported, posted or displayed by the Client or its Users or generated for the Client on the Platform, including information relating to the Client's organization, information systems and technical data, assets and processes; IT tools; security policies and operational procedures; risk management and compliance documentation; incident, continuity and compliance records; supplier and third-party information; physical and environmental security information; and any content required to meet the Compliance Plan.
Client's Data: Any data, information, file, record, configuration, or dataset submitted, uploaded, imported, posted, transmitted, or displayed by the Client or its Users on the Platform, including business data, operational data, technical information, commercial, financial or security information, as well as Personal Data whenever applicable, or any element necessary to meet the Compliance Plan.
Compliance Plan: The set of requirements, tasks, controls, milestones, and supporting documentation necessary for the Client to implement, maintain, and demonstrate compliance with ISO 27001, SOC 2, HDS and NIS 2, as organized and made available within the Platform, including any timelines, action items, responsibilities, control objectives, evidence requirements, and progress indicators associated with these frameworks.
Confidential Information: All financial, technical or business information disclosed by the Client to OUWBA that is designated as confidential or should reasonably be understood as confidential given its nature or circumstances.
Consultancy Services: The optional advisory support provided by OUWBA, for an additional fee, to assist the Client with its compliance activities, including remediation guidance, documentation support, audit readiness support, and audit preparation.
Contract: These TOS, its appendices, and the Subscription Form signed by the Client.
Dashboard: The dedicated workspace within the Platform through which the Client and its Users enter data, manage documents, track compliance activities, and access the Services, and which displays progress indicators, control status, pending actions, risk metrics, and other compliance information.
Documentation: The collection of model policies, procedures, registers, and other mandatory or recommended documents automatically generated by OUWBA, as templates intended to support the Client in meeting ISO 27001, SOC 2, HDS and NIS 2 certification requirements.
Intellectual Property Rights: All present and future rights in and to trademarks, service marks, logos, technology, know-how, inventions, patents and patent applications, copyrights, trade secrets, database rights, design rights, and all other proprietary or industrial property rights, whether registered or unregistered, including any applications, continuations, renewals, extensions, or restorations thereof.
Parties: Individually OUWBA or the Client and collectively OUWBA and the Client.
Personal Data: Any information relating to an identified or identifiable natural person as defined under the GDPR. In the context of the Services, Personal Data may include information relating to the Client's employees, contractors appearing in documentation, asset inventories, policies, audit trails or other materials processed through the Platform or Users accessing the Platform, contributing to the compliance process.
Platform: The cloud-based platform developed and operated by OUWBA which provides to the Client and its Users access to the Services, including all features, modules, interfaces, dashboards and functionalities supporting ISO 27001, SOC 2, HDS and NIS 2 automation and management.
Risk Management Analysis Tool: The tool provided by OUWBA to help identify discrepancies between the Client's existing information security practices and the requirements of ISO 27001, SOC 2, HDS and NIS 2.
Services: The functionalities, tools, and support provided by OUWBA through the Platform to assist the Client in managing and automating its Compliance Plan, including access to compliance workflows, dashboards, gap analyses, documentation templates, risk management modules, control tracking, evidence management, audit-readiness assistance, and any other features or services described in Appendix 1.
Site: OUWBA's website, which presents the Platform and Services.
Subscription Form: The document agreed between OUWBA and the Client setting the price of the Services and any other specific conditions applying to the Client.
Support: Any assistance provided by OUWBA to ensure the proper functioning, maintenance and resolution of issues related to the Platform, as outlined in Appendix 2.
Users: The users of the Client using the Platform and the Services.
Version: A completely new version of the Platform.

3 Contractual priority

The contract (the "Contract") means the following documents, which are ranked in descending order of legal force:

the Subscription Form;
these TOS;
the Appendices: Appendix 1 (Description of the Services), Appendix 2 (Support), Appendix 3 (Data Processing Agreement).

In case of conflict between the provisions of one or more of the documents mentioned above, the document having the greatest legal force will prevail. In case of conflict between the provisions of different versions of the same document, the provisions of the latest version will prevail, as the latest version is the one in force.

4 Financial terms

4.1. Subscription

The Client subscribes to the Platform and the Services for a fixed price (the "Subscription Price"), as specified in the Subscription Form, which covers the provision of the Services and Support for the period also specified in the Subscription Form (the "Subscription"). The Client may also subscribe to additional Consultancy Services for an extra fee, as set out in the Subscription Form. Additional fees may apply for any unjustified extension of the Compliance Plan caused by the Client.

4.2. Payment terms

The Subscription Price is exclusive of taxes. The Subscription Price is firm and final and cannot be modified during the contractual period, except in the event of an unjustified extension of the Compliance Plan caused by the Client. OUWBA may revise its prices for subsequent contractual periods, provided advance written notice is given, but such changes will not affect the current term.

4.3. Payment schedule and default

The Client will pay two-thirds of the Subscription Price upon signing the Subscription Form and the remaining one-third within three months of the Contract signature, except as otherwise agreed by the Parties. Consultancy Services will be invoiced separately and payable monthly. Late payments are subject to a service charge equal to 10% of the amount due, or the maximum amount permitted by law, whichever is lower. If payment is more than thirty (30) days late, OUWBA reserves the right, at its sole discretion, to suspend access to the Platform and Services, with no entitlement for the Client to claim damages. Failure by the Client to pay any sum by its due date, unresolved for thirty (30) days after receipt of written notice from OUWBA, will be considered a material breach of this Contract and may trigger the provisions of Article 13 "Term and Termination" below.

5 Access to the Platform and the Services

5.1. Account

To access its Dashboard and the Services provided through the Platform, the Client will create an Account, using as a login its email address and a personal and confidential password. Access to the Client's Account conditions access to its Dashboard and to the Services.

5.2. Access Codes

The Client is solely responsible for the preservation, security and integrity of its Access Codes. It shall take necessary measures to keep them confidential and to protect them from any risk of loss, theft, disclosure or unauthorized or illegal use. The Client acknowledges and accepts that any access to or use of its Account, Dashboard, or the Services made using its Access Codes shall be deemed to have been carried out by the Client, under its sole responsibility, including for any resulting consequences. The Client undertakes to immediately notify OUWBA of any loss, theft, or suspected unauthorized use of the Access Codes, by any appropriate means, provided that such notification shall be confirmed by registered letter with acknowledgment of receipt.

6 Services

6.1. Description of the Services

The Services are detailed in Appendix 1 of the TOS, with a complete and up-to-date description also available on the Site.

6.2. Use of the Services

The Client and its Users will use the Services and the Platform in strict compliance with Applicable Laws and solely for the Client's business purposes. The Client will not use the Platform and the Services, directly or indirectly, for any purpose or in any manner other than those expressly authorized under these TOS; in violation of Applicable Laws, or in a manner contrary to public order or decency; in a way that harms or compromises the security, integrity, or availability of the Platform and the Services, including by introducing viruses or malicious software; or in a manner that infringes or may infringe the rights and interests, including intellectual property rights, of OUWBA or any third party.

6.3. Additional Services

The Client may, at its discretion, request additional assistance or services from OUWBA to address specific needs, including but not limited to Consultancy Services. Any such request will be formalized and confirmed in the initial Subscription Form or any other subsequent order form.

6.4. New Versions

OUWBA will inform the Client of any new releases, updates, or enhancements of the Platform and the Services. All new Versions and updates are made available directly on the Platform and become accessible to the Client automatically, without any download, installation, or specific deployment required.

7 Warranties

7.1. OUWBA provides the Platform and the Services strictly on an "as is" and "as available" basis, disclaiming all express or implied warranties, representations, or endorsements of any kind. This exclusion includes, but is not limited to, any warranties relating to title, non-infringement, merchantability, fitness for a particular purpose, or assurances that the Platform and the Services will be error-free, uninterrupted, or continuously available. OUWBA's only warranty, to the extent permitted by law, is that the Platform and the Services are designed to perform in accordance with their intended functionality, quality standards, and described purpose.

7.2. The Client has access to a Dashboard on the Platform which facilitates the centralization of the tasks and the saving of the Client's documentation; however, OUWBA shall not be liable for any omission, oversight, or failure by the Client to upload, complete, or submit the necessary documentation or to perform the required tasks. It remains the Client's sole responsibility to ensure that all elements and actions required for ISO 27001, SOC 2, HDS and NIS 2 certification are complete and not missing.

7.3. OUWBA provides Documentation, explanatory notes and guidelines for each standard-required item and related actions. These resources reflect OUWBA's expertise and interpretation of ISO 27001, SOC 2, HDS and NIS 2 requirements and are intended for general advisory purposes only. While they are prepared with care and regularly updated, OUWBA cannot guarantee their exhaustiveness or accuracy, that they are fully up to date with the latest version of the applicable standards, or the obtention of the certification. The Client is responsible for adapting, completing, and validating these documents.

7.4. OUWBA provides a Risk Management Analysis Tool designed to help Clients identify gaps between their current information security practices and the requirements of ISO 27001, SOC 2, HDS and NIS 2. This tool is provided for informational purposes only. It is intended to support rather than replace the Client's internal compliance assessments, professional judgment, and expertise. The Risk Management Analysis does not constitute legal, consulting, or professional advice and does not guarantee compliance, certification, or future performance. The Client remains exclusively responsible for interpreting the results of the Risk Management Analysis and for making all related decisions. OUWBA provides the risk management framework and guidance but does not validate, review, or approve the Client's risk inputs, assessments, or treatment decisions. The final determination, documentation, and resolution of risks remain the exclusive responsibility of the Client.

8 Data

8.1. Client's Data

OUWBA hosts and accesses Client's Data for the purpose of providing the Services. OUWBA maintains strict confidentiality and does not disclose Client's Data to any third party except as required for the performance of the Services or as mandated by law. OUWBA implements appropriate security measures to protect Client's Data; however, it will not be liable for any inaccuracies, loss, or corruption of Client's Data provided these measures are respected. The Client remains responsible for the accuracy, quality, completeness, legality, and relevance of the Client's Data, and for obtaining any necessary consents for its use on the Platform. OUWBA does not verify, validate, or warrant the accuracy, quality, completeness, legality, and relevance of any Client's Data and disclaims any liability for any discrepancies, errors, or consequences arising from the use of such Data in connection with the Compliance Plan. The Client shall maintain adequate backup for the Client's Data. The Platform does not archive it on behalf of the Client, even though it may be stored on the Platform.

8.2. Personal Data

OUWBA may collect, access, and process Personal Data of Users when they connect to, and interact with, the Platform and Services. OUWBA may also collect, access, or process Personal Data relating to the contractors (e.g. clients, partners, providers) of the Client, as included in any Content or documents shared by the Client on the Platform. For these processing activities, OUWBA acts solely as a data processor on behalf of the Client in accordance with the Data Processing Agreement annexed hereto and all applicable Data Protection Laws.

9 Intellectual property

9.1. OUWBA's Intellectual Property

OUWBA retains exclusively all the Intellectual Property Rights relating to the Platform and the Services, including but not limited to OUWBA's Documentation. The Client shall not copy, reproduce, adapt, decompile, reverse engineer, or otherwise attempt to derive the source code of the Platform. Any infringement shall be promptly reported to OUWBA. In case of infringement, the Client agrees to fully indemnify OUWBA for all resulting damages, losses, and costs.

OUWBA will defend the Client against any claim brought by a third party against the Client by reason of the Client's use of the Platform and the Services alleging that such use infringes or misappropriates a third party's Intellectual Property Rights ("IP Claim"). OUWBA will also pay any damages ordered to be paid by the Client by a final court decision, provided that (a) the Client promptly notifies OUWBA of the threat or notice of any such IP Claim; and (b) OUWBA has sole and exclusive control and authority to select its attorneys and to defend and/or settle any such IP Claim.

If the use of the Platform and the Services by the Client has become the subject of any such IP Claim, OUWBA may, at its discretion and expense, (i) provide the Client with the right to continue to use the Platform and the Services; (ii) replace or modify all or part of the Platform and the Services so that it ceases to infringe the Intellectual Property Rights of the third party; or (iii) if options (i) or (ii) are not commercially reasonable or practicable in OUWBA's opinion, terminate the Contract and refund prorata temporis the Subscription Price.

OUWBA grants the Client a non-exclusive, non-transferable, non-assignable, royalty-free, and worldwide license to access and use the Platform and the Services for the Initial Term of the Contract and any other Renewal Term. This licence does not convey to the Client title to or ownership of the Platform and the Services.

9.2. Client's Intellectual Property

The Client retains all intellectual property rights in the Client's Content provided or generated on the Platform. The Client warrants that such materials do not infringe any third-party intellectual property rights. The Client shall not upload, share, or incorporate content it does not have the necessary rights or licenses for, and will promptly notify OUWBA of any claim, suspicion, or allegation of infringement. In case of infringement, the Client agrees to fully indemnify and hold OUWBA harmless against all resulting claims, damages, losses, costs, and expenses. The Client grants OUWBA a non-exclusive, non-transferable, worldwide license to use, reproduce, and process the Client's materials solely as required for providing the Platform and Services, for the Initial Term of the Contract and any Renewal Term. This license does not convey title or ownership in Client materials to OUWBA; all rights not expressly granted remain with the Client.

10 Confidentiality

10.1. Each Party will not disclose, duplicate, publish, transfer or otherwise make available Confidential Information of the other Party to any third party except as required to perform the Services or with the other Party's prior written consent.

10.2. Notwithstanding the foregoing, OUWBA may disclose Confidential Information (a) to its Affiliates, professional advisors, subcontractors, and employees on a need-to-know basis provided they are subject to confidentiality obligations at least as protective as those herein; and (b) to the extent required by applicable law, regulation, or valid legal process. In such last case, OUWBA will, unless prohibited by law, provide prior notice to the Client to allow a reasonable opportunity to seek protective or other appropriate relief. OUWBA's liability for disclosure required by law is expressly disclaimed and, to the extent legally permissible, OUWBA will have sole discretion over the scope and manner of such disclosures.

10.3. Confidential Information excludes any information that: (i) becomes publicly available other than by one Party's breach of this Agreement; (ii) is independently developed by one Party without reference to the other Party's Confidential Information; (iii) is received lawfully from a third party without any breach of confidentiality; or (iv) consists of technical, operational, or usage data derived from the provision or operation of the Services, which OUWBA may anonymize and aggregate for analytics, compliance, or service improvement purposes.

11 Liability

11.1. Force Majeure

Neither Party will be held liable if the execution of the Contract is delayed or prevented due to force majeure, as described by the French courts. In particular, any war, pandemic, partial or total strike, fire, flood, earthquake, volcanic eruption, severe weather, or partial or total disruption of electronic or electric communications networks will be treated as a particular case of force majeure under this Contract.

11.2. Liability

OUWBA shall be solely liable for direct damages resulting from its proven faults, errors, or omissions in the performance of its Services, including faults, errors, or omissions of its personnel or authorized subcontractors. OUWBA shall not be liable for any indirect, consequential, or special damages whatsoever, including without limitation loss of profits, business interruption, data loss or corruption, loss of business information, or any other financial losses incurred by the Client arising from or connected to the execution or non-performance of this Contract. The Client hereby waives any right to claim such indirect, consequential, or special damages against OUWBA.

11.3. Limitation of liability

Subject to the Applicable Laws and the other provisions of the Contract, OUWBA's aggregate liability to the Client, the Client's Affiliate(s), or any third party is strictly limited to the annual Price paid by the Client prior to the first event or occurrence giving rise to such liability. The limitation of liability provided for herein will apply in aggregate to the Client and its Affiliates and shall not be cumulative.

12 Third party links and contents

12.1. The Client may have access to third-party links and third-party contents while using the Platform and the Services. These may redirect to third-party content or services. OUWBA does not endorse or make any representations about these third-party links, content, any information or other products or materials found there, or any results that may be obtained from using them. OUWBA is not responsible for the accuracy, legality, or content of these links, applications, or resources.

12.2. If the Client wishes to connect third-party services to the Services, to connect with OUWBA while using a third-party authentication service, or otherwise grants OUWBA access to information from a third-party service, the Client is fully responsible for any further use of information, including Personal Data, from those third parties for the purpose of and in accordance with the Contract.

13 Term and termination

13.1. Term

The Contract shall take effect on the date of signature of the Subscription Form (the "Effective Date") and shall remain in force for a fixed term of three (3) years (the "Initial Term"). Upon expiration of the Initial Term, the Contract shall automatically renew for successive periods of one (1) year (each a "Renewal Term"), unless terminated in accordance with this Article.

13.2. Termination for convenience

Either Party can terminate the Contract by providing a written Notice to the other Party of termination, forty-five (45) days prior to the end of the Initial Term or any Renewal Term.

13.3. Termination for cause

Either Party can terminate the Contract for cause immediately after notice in writing from the other Party of a material breach of any of its obligations under this Contract that is unresolved within thirty (30) days following the receipt of such notice. Non-payment of the Price will be considered de facto a material breach of the Contract. OUWBA reserves the right to suspend access to the Services during any period of breach or non-payment by the Client.

13.4. Termination for other cause

Either Party can also terminate the Contract if the other Party becomes the subject of a petition in bankruptcy, to the extent permitted by Applicable Laws.

13.5. Effects of Termination

Upon termination of the Contract, the Client will have no more access to the Platform and the Services. It is its own responsibility to export and secure, prior to the effective date of termination, all Client's Data and Content from the Platform. After termination, OUWBA will delete the Client's Data and Content within 30 days, except for any data that OUWBA is required to retain to comply with its own accounting, tax, employment or other legal obligations. OUWBA has no obligation to retain, recover, or provide the Client's Data or Content. In the event of termination for the Client's material breach, the Price paid or payable by the Client shall be non-refundable, and OUWBA is entitled to claim all outstanding amounts due for the remaining contract period. If OUWBA is found to be in material breach and the Contract is terminated as a result, the Client may be eligible to receive a pro rata refund of the Price for the unused portion of the Platform and the Services. Any expiration or termination of this Contract, for any reason, will not affect any provisions or rights of either Party that are expressly or by their nature intended to survive, including without limitation those relating to payment, confidentiality, intellectual property, data protection, and limitation of liability.

14 Miscellaneous

14.1. Assignment

OUWBA may, without the consent of the Client, assign this Contract to any Affiliate or in connection with any merger, change of control, or the sale of all or substantially all of its assets. It will provide the Client prior notice of such assignment and ensure that any such successor agrees to fulfill its obligations pursuant to this Contract.

14.2. Insurance

OUWBA represents that it subscribes to, and undertakes to maintain in force for the entire duration of the Contract, a general and/or professional liability insurance policy with a well-established and solvent insurance company.

14.3. Subcontractors

OUWBA may engage third-party providers for all or any part of the provision of the Services. OUWBA warrants that its subcontractors will comply with all obligations applicable to OUWBA under this Contract, and OUWBA shall remain fully liable to the Client for the acts and omissions of its subcontractors.

14.4. Severability

If any provision of the Contract is found to be void or unenforceable, it shall be deemed to have never existed but shall not make any other provision of the Contract void or unenforceable. The Parties agree to use their best efforts to replace any void or unenforceable provision with a new provision that reflects as closely as possible the original intention of the Parties.

14.5. Relationship of the Parties

OUWBA and the Client act as independent contractors, on their own behalf and for their own account. Nothing in this Contract shall be construed as constituting a partnership, franchise, joint venture, agency, fiduciary, or employment relationship between the Parties.

14.6. Notices

Any notices provided by OUWBA to the Client under this Contract shall be addressed in writing by postal mail with acknowledgment of receipt to the contact mailing address provided by the Client on the Subscription Form, or by email to the contact email address also provided on the Subscription Form. Any notices provided by the Client to OUWBA shall be addressed in writing either by email to admin@ouwba.com, or by postal mail with acknowledgement of receipt to the following address: OUWBA, 14 avenue du Général de Gaulle, 94160 Saint-Mandé. All notices shall be deemed to have been given immediately upon delivery by electronic mail, or on the day indicated on the acknowledgement of receipt when the notice is sent by postal mail.

14.7. Commercial Reference

OUWBA may use the Client's name, logo, and trademarks solely to identify it as a user of the Services on OUWBA's Site and other marketing materials.

14.8. Amendments

OUWBA may amend these TOS and its appendices from time to time, in which case the new TOS will supersede prior versions. In the event that OUWBA amends the TOS and Appendices, each modification will automatically become part of the Contract upon posting the new version of the TOS on the Platform. If the Client does not accept the changes in the TOS, the Client may terminate the Contract for convenience.

14.9. Non-Waiver

The fact that one Party does not claim a breach by the other Party of any provision of the Contract shall not be construed in the future as a waiver of such provision or any other provision of the Contract.

14.10. Entire Agreement

The rights and obligations of both Parties shall be as set forth in the Contract, which constitutes the entire agreement between the Parties and replaces all prior agreements, oral or written, and all other discussions and communications between the Parties relating to the subject matter of this Contract.

14.11. Authority

Each Party represents that it has validly entered this Contract and has the legal power to do so. The Client undertakes that it is a legally incorporated company, in good standing under Applicable Laws, and that its legal representative, or its management company, has full power and authority to sign and execute the Contract; that the signature of the Contract has been validly authorized, if required, by the competent bodies; and that the signature and performance of the Contract does not and will not result in any breach, termination or modification of any contract or act to which it is a party, and that the Contract does not conflict with any provision of such contract or act.

15 Governing law, jurisdiction and disputes

15.1. The Contract is governed by the laws of France. The Parties will seek an amicable solution to any difficulties that may arise regarding the application or interpretation of the Contract. Any disputes arising from the existence, validity, conclusion, execution, interpretation or termination of the Contract are under the exclusive jurisdiction of the Court of Appeal of Paris, even in the event of third parties, proceedings involving several defendants, or summary proceedings.

15.2. Before the Parties resort to litigation to solve any dispute, the Parties will enter good-faith negotiations in order to resolve the dispute.

Appendix 1

Description of the Services

Service	Description and functionalities
Dashboard	A categorized overview of all pending tasks, organized by task type and priority to facilitate efficient compliance management. The Dashboard also provides customizable Key Performance Indicators (KPIs) enabling the Client to monitor progress towards ISO 27001, SOC 2, HDS or NIS 2 certification.
Tasks	A centralized task management module designed to support the Client in planning, organizing, and tracking all activities required for compliance. The Tasks module enables the Client to: view all actions to be completed, categorized by topic, chapter, priority, or status; create, assign, and schedule tasks related to documentation, risk treatment, audits, controls, or operational security measures; monitor task progress through real-time status updates (e.g., to do, in progress, blocked, completed); attach evidence, notes, or links directly to each task, enabling traceability and audit-ready documentation; view dependencies between tasks and identify prerequisites to ensure logical sequencing.
Documents	OUWBA provides a document repository that stores, organizes, and manages all Client documentation in a centralized, searchable online location; a documentation library offering templates aligned with the applicable standards; document status tracking (e.g., draft, in review, approved); and a Statement of Applicability (SoA) module allowing the Client to generate, customize, and maintain its SoA in accordance with ISO 27001 requirements. OUWBA also provides download and export functionalities allowing the Client to retrieve documents in standard formats.
Variables	A dynamic Variables System designed to streamline the creation, customization, and maintenance of all documentation and workflows. It enables the Client to define and manage organization-specific variables, automatically inject variable values into documentation templates and wizards, update variables centrally with changes instantly reflected across all linked documents, and leverage variable-based logic within wizards for dynamic question paths and automated content generation.
Assets	The Client's asset database that stores, organizes (by category, owner and criticality), and manages all Client assets in a centralized, searchable location; plus a common asset database built by OUWBA offering a list of commonly used asset types with predefined descriptions, ownership fields, classification options, status indicators, and lifecycle information.
Vendor Management	The Client's vendor database that maintains a centralized, searchable list of all vendors, suppliers, and third-party service providers relevant to the Compliance Plan; plus a common vendor database built by OUWBA offering a list of commonly used vendors by category with predefined description and criticality type.
Risk Management	The Client's risk register, which centrally records, categorizes, and manages all information-security risks; a common risk database built by OUWBA; and a risk-assessment matrix supporting the evaluation of likelihood and impact. OUWBA also provides an AI-powered risk-suggestion engine that analyzes the Client's documentation, assets, and vendors to recommend the most relevant and commonly observed risks for the Client's specific activities.
Users	A centralized User Management module that consolidates all users with access to the Platform. It enables the Client to view and manage the complete list of users (roles, permissions, authentication status), connect third-party tools to synchronize user lists, verify key security attributes such as whether Multi-Factor Authentication (MFA) is enabled, and identify dormant, inconsistent, or unauthorized accounts to support regular access reviews.
Audit	An Audit Mode designed to support the Client during internal audits, external audits, and certification assessments. It enables the Client to view the complete list of requirements and chapters from the relevant standards, access and review all evidence corresponding to each chapter or requirement, and quickly identify missing, outdated, or insufficient evidence.
Indicators	An Indicators module designed to help the Client measure, monitor, and improve the performance of its Information Security Management System (ISMS). It enables the Client to track KPIs related to the effectiveness of security processes, create custom indicators tailored to the Client's context, visualize trends over time through dynamic charts, and identify deviations or declining performance levels for timely corrective action.

Appendix 2

Support

OUWBA provides initial, corrective and standard support in accordance with these terms and under a means obligation (the "Support Services").

Support Services will not be applicable in the following cases: (a) if the issue cannot be replicated or otherwise identified; (b) if the Platform and Services have been altered, damaged, misused or modified by the Client or a third party without OUWBA's consent; (c) for problems caused by (i) the Client's and/or its Users' negligence, hardware malfunction or breach of the Contract; (ii) issues outside of OUWBA's control; (iii) external technical components integrated with the Platform; or (iv) use of the Platform and Services in combination with any equipment or software not provided by OUWBA. The Client must make the necessary backups of all the Content shared on the Platform before any intervention by OUWBA.

Article 1: Initial Support

OUWBA responds to requests for assistance from the Client concerning the use of the Platform and the Services ("Initial Support"). Initial Support is available 8 hours per day, 5 days per week, during Business Hours (9:00 a.m. to 5:00 p.m., Paris time), for an unlimited number of incidents. Upon notification of an incident, the Client shall open a support ticket by emailing support@ouwba.com. OUWBA's support team will remotely access the Client's Dashboard to diagnose the issue; for this purpose, the Client must provide OUWBA with the necessary access credentials. OUWBA will respond to the Client within 2 to 4 hours, depending on the nature and severity of the incident. If the initial diagnostic shows a malfunction, OUWBA will proceed to provide Corrective Maintenance as described in Article 2.

Article 2: Corrective Maintenance

If an incident is determined to be a Malfunction (a "Malfunction"), defined as any demonstrable and reproducible deviation in the Platform's behavior from its specifications or its minimum contractual functionality, OUWBA will proceed under Corrective Maintenance. Functionality introduced by updates, upgrades, or new versions shall not be classified as Malfunctions. Malfunctions have four priority levels:

Priority	Definition	Target response
P1 (Urgent)	System interruption or severe restrictions preventing the Client from using the Platform and the Services.	2 hours
P2 (High)	Severe loss of functionality, significant system restrictions including production and critical non-production environments.	4 hours
P3 (Normal)	A specific function does not work correctly; no significant impact on production and users but not consistent with the agreed functionality.	24 hours
P4 (Low)	A usage problem that does not block the Platform and Services.	48 hours

Response times commence once a support ticket is logged; time required for access to Client Systems is excluded. OUWBA provides no absolute warranty of resolution within any timeframe and will resolve Malfunctions by commercially reasonable means, including workarounds or patches, as appropriate.

Article 3: Standard Maintenance

OUWBA may, at its discretion, make generic modifications and improvements to the Platform and Services over time. Such modifications may result in updates or New Versions, which will be automatically applied to the Client's environment. Wherever reasonably practicable, OUWBA will provide advance notice of any updates that may impact the Client's systems. Standard Maintenance covers automatic deployment of updates, patches, and upgrades; scheduled maintenance windows (with advance notification when possible); and bug fixes, minor corrections, and enhancements that do not fundamentally alter the overall operation of the Platform. Standard Maintenance expressly excludes training in the use of New Versions (unless otherwise agreed); support for issues caused by the Client's failure to update its systems; and any customization, specific developments, or functionalities not included in the standard version of the Platform.

Appendix 3

Data Processing Agreement

OUWBA acts as processor and the Client acts as controller under this DPA for the processing of the Client's Data, which may include Personal Data relating to the Client's own clients found in the Client's Content shared on the Platform, and Users' Data.

Article 1: Definitions

1.1. For the purposes of this DPA, the terms "Personal Data", "Data Subject", "Personal Data Breach", "Processing", "Transfer", "Supervisory Authority", "Controller" and "Processor" shall have the definitions set forth by Article 4 of the GDPR.

1.2. Any capitalized terms in this DPA that are not defined in this Article 1 shall have the meaning set forth in the TOS.

Article 2: OUWBA's obligations

2.1. OUWBA will process Personal Data solely on behalf of and under the documented, lawful instructions of the Client, for the purposes described in the Contract.

2.2. The performance of the Contract and the use of the Services by the Client, including provision of the Client's Content containing end-client data, constitute documented instructions from the Client.

2.3. Any additional instructions from the Client must be submitted in writing, specifying the relevant purpose and processing operation; OUWBA may, at its discretion, require acceptance of a corresponding estimate or amendment for implementation.

2.4. OUWBA shall notify the Client without undue delay if, in its opinion, an instruction is in breach of any Applicable Data Protection Regulation.

2.5. If OUWBA receives a request or inquiry directly from a data subject whose Personal Data is processed under the Contract, OUWBA shall promptly inform the Client without responding to the data subject directly. OUWBA shall assist the Client, at the Client's cost, in fulfilling data subject rights such as access, rectification, restriction, erasure, objection, or portability.

2.6. OUWBA shall cooperate with the Client by providing reasonable assistance and documentation, at the Client's cost, for compliance with Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultations with Supervisory Authorities.

2.7. OUWBA shall timely notify the Client of any third-party request for access or disclosure of Personal Data based on regulatory or legal authority.

Article 3: Sub-processors

3.1. The Client authorizes OUWBA to engage sub-processors strictly for the necessary performance of the Contract, including processing of end-client data contained in Client Content.

3.2. OUWBA maintains an up-to-date list of sub-processors, available upon written request by the Client.

3.3. OUWBA will inform the Client of any intended changes regarding the addition or replacement of sub-processors as soon as reasonably practicable. The Client may object in writing within ten (10) business days, otherwise consent will be deemed given.

3.4. OUWBA requires each sub-processor to implement appropriate safeguards and to flow down substantially similar contractual and statutory data protection obligations to those of this DPA.

Article 4: Confidentiality and security

4.1. OUWBA will keep Client Data strictly confidential and will not disclose it to third parties except for the provision of the Services, as required by law or with the Client's prior explicit permission. OUWBA ensures confidentiality commitments for all authorized personnel and sub-processors.

4.2. OUWBA will implement and maintain appropriate technical and organizational measures to safeguard Client Data against unauthorized or unlawful processing, or accidental loss, destruction, alteration, or disclosure, at a minimum as required by Article 32 of the GDPR.

Article 5: Data breaches

5.1. OUWBA will inform the Client in writing without undue delay upon becoming aware of any Personal Data Breach affecting Client Data, including data of the Client's own clients/end users.

5.2. OUWBA shall provide reasonable cooperation and assistance, at the Client's cost, to investigate, mitigate, and notify Supervisory Authorities and Data Subjects as required.

Article 6: Data transfers

6.1. OUWBA does not transfer any Client Data (including data of end-clients) outside the European Union or European Economic Area under the scope of this Agreement. All processing of Client Data is performed exclusively within the EU/EEA.

6.2. Should an exceptional or future need for such transfer arise, OUWBA will ensure that no transfer shall occur without the Client's prior written consent and only subject to the implementation of adequate safeguards required by Applicable Data Protection Regulations, such as an adequacy decision for the destination country, the use of Standard Contractual Clauses, or other legally approved mechanisms.

Article 7: Data retention

7.1. Upon termination of the Contract for any reason whatsoever, OUWBA (including its employees, directors, affiliates, suppliers and sub-processors) shall cease all processing of the Client Data carried out for performance of the Contract within 30 days, except for processing necessary for compliance with its own accounting, tax and employment legal obligations.

7.2. Upon termination of the Contract for any reason whatsoever, OUWBA undertakes to destroy, automatically or manually and within a reasonable period of time, all Client Data provided by or duly collected on behalf of the Client, in its capacity as Processor, except for processing necessary for compliance with its own accounting, tax and employment legal obligations and for the fulfillment of the Parties' contractual obligations remaining at the end of the Contract.

Article 8: Security audit

8.1. At the Client's written request, the Client can conduct a security audit of OUWBA's facilities, systems, policies, controls and practices, at the Client's expense.

8.2. A Client Audit shall (i) occur at a mutually agreeable time and in any case with 30 days' notification to OUWBA, not more than once a calendar year (starting at the Effective Date) and once following each Data Breach; and (ii) not unreasonably interfere with OUWBA's operations. Any third party performing such Client Audit shall execute a standard nondisclosure agreement with OUWBA, and access to OUWBA's facilities shall be subject to OUWBA's reasonable access requirements and security policies. Such requirements shall in no way materially impede the Client, or a third-party auditor selected by the Client, from conducting a Client Audit.

8.3. The audit report shall be provided to OUWBA by the auditors before it is finalised, so that OUWBA can make any comments it may have, and the final report should take account of and respond to these comments. The audit report will then be sent to OUWBA and discussed in a meeting between the Parties.

8.4. In the event that the final audit report identifies breaches by OUWBA of the commitments made in the performance of this DPA, OUWBA shall propose a corrective action plan.

Article 9: Miscellaneous

9.1. Liability. The Parties shall be liable for the fulfillment of their obligations under this DPA in accordance with the Applicable Data Protection Regulations. The liability rules agreed between the Parties in the TOS shall also apply to this DPA.

9.2. Term and Termination. The DPA shall enter into force on the Contract Effective Date and remain in force for the term of it.

9.3. Prevalence. The DPA prevails over any previous agreement relating to the processing of Client Data that may have been signed in the past between the Parties or that would result from clauses relating to the protection of personal data under the TOS.

9.4. Governing law and jurisdiction. The processing of Personal Data under this Agreement is governed by the law of the TOS. Any disputes relating to the processing of Client Data under this DPA will be subject to the exclusive jurisdiction of the courts set forth in the TOS.

Exhibit A: Description of Processing

Subject-matter of the Processing: please refer to Appendix 1 "Description of the Services".
Nature of the Processing: collection, organization, structuring, storage, consultation, use, disclosure by transmission, alignment or combination, restriction, erasure or destruction.
Purpose of the Processing: performance of the Contract.
Duration of the Processing: duration of the Contract.
Type of Personal Data: identification data, contact data, professional data.
Categories of Data Subjects: Client's prospects and clients, and Users acting as the Client's account owner.