Cloudmark Spam Reporting Service – Service Use Agreement

This Cloudmark Service Use Agreement (the "Agreement") is a legal agreement between you, a mobile network operator ("You" or "Customer"), and Cloudmark, Inc. ("Cloudmark"). You have previously entered into a Master Subscription Agreement ("MSA") with GSMA, Ltd. ("GSMA") or with Cloudmark, pursuant to which You ordered and have or will pay for the GSMA Spam Reporting Service ("SRS") and either basic support or premium support. Terms used in initial capitals but not defined herein, have the meanings given in the MSA. This Agreement governs your access to and use of the GSMA SRS. The GSMA SRS includes the Cloudmark software and accompanying documentation (the "Software") that Cloudmark provides for You to access and use the GSMA SRS.

Upon launching the GSMA SRS, you are deemed to have accepted the terms of this Agreement, including the terms of Cloudmark's Privacy Policy located on the Internet at https://www.proofpoint.com/us/legal/privacy-policy ("Privacy Policy") which is incorporated by reference herein, before downloading, copying, or otherwise using the Software or accessing or using the GSMA SRS. By using the Software or GSMA SRS, You are indicating that You have read and understood, and that You assent to be bound by, the terms and conditions of this Agreement. If You do not agree to the terms and conditions of this Agreement, You are not granted any rights whatsoever in the Software and have no right to access or use the GSMA SRS. In addition, by signing the MSA to which a copy of this Service Use Agreement is attached, You acknowledged and agreed that You will be bound by the terms of this Agreement.

Access to GSMA SRS

Customer may access and use the GSMA SRS solely for its own benefit and in accordance with the terms and conditions of this Agreement and the end user technical documentation provided with the GSMA SRS ("Documentation") and any scope of use restrictions. Use of and access to the GSMA SRS is permitted only by employees of Customer ("Permitted Users"). If Customer is given passwords to access the GSMA SRS, Customer shall require that all Permitted Users keep user ID and password information strictly confidential and not share such information with any unauthorized person. Customer shall be responsible for any and all actions taken using Customer's accounts and passwords. Customer may permit its independent contractors and consultants ("Contractors") to serve as Permitted Users, provided Customer remains responsible for compliance by each such Contractor with all of the terms and conditions of this Agreement and any such use of the GSMA SRS by such Contractor is for the sole benefit of Customer.

General Restrictions

Customer shall not:

1. rent, lease, copy, provide access to or sublicense the GSMA SRS to a third party or use the GSMA SRS to provide a service to a third-party,
2. alter, reverse engineer, decompile, disassemble, or otherwise modify the GSMA SRS, except to the extent expressly permitted by applicable law (and then only upon advance notice to GSMA),
3. modify the GSMA SRS, or create any derivative product from any of the foregoing,
4. remove or obscure any product identification, proprietary, copyright or other notices contained in the GSMA SRS (including any reports or data printed from the GSMA SRS),
5. incorporate the GSMA SRS into any other offering (whether software as a service or otherwise),
6. use the GSMA SRS for the rendering of services to third parties (for example, by offering consulting services to third parties),
7. publicly disseminate information or analysis regarding the performance of the GSMA SRS, or
8. provide access to the GSMA SRS to an Affiliate. "Affiliate" means any entity controlling, under common control with, or controlled by Customer where "control" means ownership of or the right to control greater than 50% of the voting securities of such entity.

In addition, Customer shall not:

1. seek to obtain the source code or APIs to the Software, or
2. modify the Documentation.

Service Reports

Definition —"Service Reports" means the variety of reports generated by the GSMA SRS and viewable by Customer via a web-based portal.

License to Service Reports – Subject to the terms and conditions of this Agreement, Cloudmark hereby grants Customer a limited, royalty-free, non-exclusive, non-transferable (except as provided in Section titled Assignment), non-sublicensable license during the Subscription Term to access and use the Service Reports solely for the purpose of managing its mobile network.

Generally

"Customer Data" means any business information or other data of any type which is provided by Customer to Cloudmark in connection with providing the GSMA SRS, including without limitation information which Customer inputs, or provides to Cloudmark for inputting, into the GSMA SRS, such as SMS Abuse Reports (defined below). Customer shall ensure that Customer's use of the GSMA SRS and all Customer Data is at all times compliant with Customer's privacy policies and subscriber agreements, and all applicable local, state, federal, national, regional (e.g., EU), and international laws, regulations and conventions, including, without limitation, those related to data privacy, international communications, and the exportation of technical or personal data. Customer is solely responsible for the accuracy, content and legality of all Customer Data.

"SMS Abuse Reports" means reports of SMS abuse provided to Customer by its end users via any mechanism currently existing or developed in the future by Customer.

"Reporting Statistics Data" means the resultant statistics data created by Cloudmark, to the extent based on Customer Data provided to Cloudmark under this Agreement for the purpose of providing reports to customers during the Subscription Term. The Reporting Statistics Data shall not include Customer Data.

Customer Data

Customer represents and warrants to Cloudmark that

1. Customer has sufficient rights in the Customer Data to authorize Cloudmark to process, distribute and display the Customer Data and provide the Reporting Statistics Data as contemplated by this Agreement and the functionality of the GSMA SRS,
2. the Customer Data, and use as contemplated under this Agreement, does not infringe the rights of any third party,
3. any disclosure of personally identifiable information included in Customer Data provided by Customer to Cloudmark is made with all required consents of, and disclosures and notices to, the data subject and is otherwise lawful, and
4. at all times during the transmitting of Customer Data to Cloudmark, Customer will have in place appropriate security, technical and organizational measures to protect the Customer Data against unauthorized or unlawful forms of processing and unauthorized access to, or unauthorized alteration, disclosure or destruction of the Customer Data.

Ownership of Customer Data

As between the parties, Customer shall retain all right, title and interest (including any and all intellectual property rights) in and to the Customer Data as provided to Cloudmark. During the Subscription Term, Customer hereby grants to Cloudmark a non-exclusive, non-transferable (except as provided in Section titled Assignment), worldwide, royalty-free right to

1. use, copy store, transmit, modify, create derivative works of and display the Customer Data solely to the extent necessary to provide the GSMA SRS,
2. publish information from Customer's SMS Abuse Reports via a secure web portal, and
3. copy, use and analyze the SMS Abuse Reports solely for the purposes of providing the GSMA SRS, analyzing SMS abuse transmissions, methods and mechanisms for developing and sending SMS abuse attacks and designing and developing methods for defending against or blocking mobile SMS abuse attacks.

The foregoing right includes the right to collect Customer Data and to aggregate Customer Data with other data so that it is non-personally identifiable with respect to Customer's subscribers ("Aggregated Anonymous Data") and use such data to provide Reporting Statistics Data as part of the GSMA SRS. Customer acknowledges and agrees that the collection by Cloudmark of Aggregated Anonymous Data is critical to maintaining the functionality of the GSMA SRS and that Cloudmark is free to use Aggregated Anonymous Data in any manner in order to improve the GSMA SRS during the Subscription Term, including, but not limited to, the delivery of reports containing Aggregated Anonymous Data to Customer and other GSMA SRS customers.

Uploads of Customer Data

Customer shall be responsible for providing all Customer Data to Cloudmark and shall provide such Customer Data in a format consistent with the technical compatibility requirements set forth in the applicable Service Description (or as otherwise specified by Cloudmark) ("Technical Requirements"). Errors in loading Customer Data onto Cloudmark systems due to defective media, erroneous data or failure to meet Technical Requirements may be rejected by the GSMA SRS or may be referred back to Customer for resolution and Cloudmark shall have no responsibility for any related impact on the applicable service.

Indemnification by Customer

Customer shall indemnify, defend and hold harmless Cloudmark from and against any and all claims, costs, damages, losses, liabilities and expenses (including reasonable attorneys' fees and costs) arising out of or in connection with any claim arising from or relating to

1. any action taken (or not taken) by Customer based upon use of the GSMA SRS,
2. any Customer Data,
3. any service or product offered by Customer in connection with or related to the GSMA SRS, or
4. any breach by Customer of any representation and warranty in the MSA.

This indemnification obligation is subject to Customer receiving

1. prompt written notice of such claim (but in any event notice in sufficient time for Customer to respond without prejudice);
2. the exclusive right to control and direct the investigation, defense, or settlement of such claim; and
3. all reasonable necessary cooperation of Cloudmark at Customer's expense.

This is an Agreement for use of the GSMA SRS and not an agreement for the sale of Software, Documentation, or otherwise. Customer acknowledges that it is obtaining only a limited right to the GSMA SRS and that irrespective of any use of the words "purchase", "sale" or like terms hereunder no ownership rights are being conveyed to Customer under this Agreement or otherwise and Customer agrees that Cloudmark and its suppliers retain all right, title and interest (including all patent, copyright, trade secret and other intellectual property rights) in and to the GSMA SRS, Service Reports, Service Descriptions, Documentation, Software and any and all related and underlying software (including interfaces), databases (including data models, structures, and non-Customer specific data), technology, reports and documentation (collectively, "Cloudmark Technology"). Further, Customer acknowledges that the GSMA SRS is offered as an on-line, hosted solution, and that Customer has no right to obtain a copy of the Cloudmark Technology itself, other than as necessary to access and use the GSMA SRS.

Term

This Agreement is effective as of the Effective Date of the MSA and expires on the date of expiration or termination of all Subscription Terms. This Agreement will be coterminous with the MSA.

Termination for Cause

Either party may terminate this Agreement upon termination of the MSA or if the other party

1. fails to cure any material breach of this Agreement within thirty (30) days after written notice;
2. ceases operation without a successor; or
3. seeks protection under any bankruptcy, receivership, trust deed, creditors' arrangement, composition, or comparable proceeding, or if any such proceeding is instituted against that party (and not dismissed within sixty (60) days thereafter).

Effect of Termination

Upon any termination of this Agreement, the effects of termination set forth in the MSA will apply. Termination of this Agreement is not an exclusive remedy and the exercise of either party of any remedy under this Agreement will be without prejudice to any other remedies it may have under this Agreement, by law, or otherwise.

The following Sections shall survive any expiration or termination of this Agreement: General Restrictions, Indemnification by Customer, Ownership, Effects of Termination, Survival, Warranty Disclaimer, Limitation of Remedies and Damages, Indemnification, Confidential Information, and General Terms.

Limited Warranty

Cloudmark warrants, for Customer's benefit only, that the GSMA SRS will operate in substantial conformity with the applicable Documentation and Cloudmark will perform the GSMA SRSs in a professional and workmanlike manner. Cloudmark does not warrant that Customer's use of the GSMA SRS will be uninterrupted or error-free, nor does Cloudmark warrant that it will review the Customer Data for accuracy or that it will preserve or maintain the Customer Data without loss. Cloudmark's sole liability (and Customer's sole and exclusive remedy) for any breach of the foregoing warranty shall be for Cloudmark to reperform the applicable GSMA SRS, at no charge to Customer. The limited warranty set forth in this Section shall not apply:

1. unless Customer makes a claim within thirty (30) days of the date on which the condition giving rise to the claim first appeared, or
2. if the error was caused by misuse, unauthorized modifications or third-party hardware, software or services.

Warranty Disclaimer

EXCEPT FOR THE LIMITED WARRANTY IN THE SECTION ABOVE, THE GSMA SRS SERVICE AND ALL RELATED PRODUCTS AND SERVICES ARE PROVIDED "AS IS". NEITHER CLOUDMARK NOR ITS SUPPLIERS MAKES ANY OTHER WARRANTIES, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. CUSTOMER MAY HAVE OTHER STATUTORY RIGHTS. HOWEVER, TO THE FULLEST EXTENT PERMITTED BY LAW, THE DURATION OF STATUTORILY REQUIRED WARRANTIES, IF ANY, SHALL BE LIMITED TO THE LIMITED WARRANTY PERIOD. CLOUDMARK SHALL NOT BE LIABLE FOR DELAYS, INTERRUPTIONS, SERVICE FAILURES AND OTHER PROBLEMS INHERENT IN USE OF THE INTERNET AND ELECTRONIC COMMUNICATIONS OR OTHER SYSTEMS OUTSIDE THE REASONABLE CONTROL OF CLOUDMARK.

The GSMA SRS includes basic support services ("Basic Support").

NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, RELIANCE OR CONSEQUENTIAL DAMAGES OF ANY KIND (INCLUDING LOST PROFITS) OR ANY LOSS OF USE, OR INACCURACY OR LOSS OF DATA, INTERRUPTION OF BUSINESS, OR COSTS OF DELAY, REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, EVEN IF INFORMED OF THE POSSIBILITY OF SUCH DAMAGES IN ADVANCE.

NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, CLOUDMARK'S AND ITS SUPPLIERS' ENTIRE, CUMULATIVE, AGGREGATE LIABILITY TO CUSTOMER FOR ANY AND ALL CLAIMS SHALL NOT EXCEED THE AMOUNT ACTUALLY PAID BY CUSTOMER UNDER THE MSA DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE APPLICABLE CLAIM OF LIABILITY.

THIS SECTION SHALL NOT APPLY TO CUSTOMER WITH RESPECT TO ANY CLAIM ARISING UNDER THE SECTIONS TITLED "GENERAL RESTRICTIONS," "DATA" OR "CONFIDENTIAL INFORMATION".

The parties agree that the limitations specified in this Section will survive and apply even if any limited remedy specified in this Agreement is found to have failed of its essential purpose.

Cloudmark shall indemnify and hold harmless Customer from and against any claim of infringement of a U.S. patent, copyright, or trade secret asserted against Customer by a third party based upon Customer's use of the GSMA SRS in accordance with the terms of this Agreement, provided that Cloudmark shall have received from Customer:

1. prompt written notice of such claim (but in any event notice in sufficient time for Cloudmark to respond without prejudice);
2. the exclusive right to control and direct the investigation, defense, or settlement (if applicable) of such claim; and
3. all reasonable necessary cooperation of Customer.

If Customer's use of the GSMA SRS, or in Cloudmark's opinion is likely to be, enjoined due to the type of infringement specified above, or if required by settlement, Cloudmark may, in its sole discretion:

1. substitute substantially functionally similar services;
2. procure for Customer the right to continue using GSMA SRS;

or if (a) and (b) are commercially impracticable,

1. terminate this Agreement

The foregoing indemnification obligation of Cloudmark shall not apply:

1. if the GSMA SRS is modified by any party other than Cloudmark, but solely to the extent the alleged infringement is caused by such modification;
2. the GSMA SRS is combined with other non-Cloudmark products or processes not authorized by Cloudmark, but solely to the extent the alleged infringement is caused by such combination;
3. to any unauthorized use of the GSMA SRS; or
4. any action arising as a result of Customer Data or any third-party deliverables or components contained within the GSMA SRS.

THIS SECTION SETS FORTH CLOUDMARK'S SOLE LIABILITY AND CUSTOMER'S SOLE AND EXCLUSIVE REMEDY WITH RESPECT TO ANY CLAIM OF INTELLECTUAL PROPERTY INFRINGEMENT.

Each party agrees that all code, inventions, know-how, business, technical and financial information it obtains ("Receiving Party") from the disclosing party ("Disclosing Party") constitute the confidential property of the Disclosing Party ("Confidential Information"), provided that it is identified as confidential at the time of disclosure or should be reasonably known by the Receiving Party to be Confidential Information due to the nature of the information disclosed and the circumstances surrounding the disclosure. Any Cloudmark Technology, intellectual property and performance information relating to the GSMA SRS shall be deemed Confidential Information of Cloudmark without any marking or further designation. The terms and conditions of this Agreement shall be deemed Confidential Information of Cloudmark without any marking or further designation. Customer Data will be deemed Confidential Information of Customer without any marking or further designation. Except as expressly authorized herein, the Receiving Party will hold in confidence and not use or disclose any Confidential Information. The Receiving Party shall not disclose the Confidential Information to any third party other than to its Board of Directors, officers, employees, consultants and subcontractors (excluding consultants and subcontractors that are competitors of the Disclosing Party) with a "need to know" necessary for that party to perform its obligations or exercise its rights under this Agreement and who have entered into confidentiality agreements sufficient to prohibit further unauthorized use or disclosure of the Confidential Information. The Receiving Party's nondisclosure obligation shall not apply to information to the extent which the Receiving Party can document:

1. was rightfully in its possession or known to it prior to receipt of the Confidential Information;
2. is or has become public knowledge through no fault of the Receiving Party;
3. is rightfully obtained by the Receiving Party from a third party without breach of any confidentiality obligation;
4. is independently developed by employees of the Receiving Party who had no access to such information; or
5. is required to be disclosed pursuant to a regulation, law or court order (but only to the minimum extent required to comply with such regulation or order and with advance notice to the Disclosing Party).

The Receiving Party acknowledges that disclosure of Confidential Information would cause substantial harm for which damages alone would not be a sufficient remedy, and therefore that upon any such disclosure by the Receiving Party the Disclosing Party shall be entitled to appropriate equitable relief in addition to whatever other remedies it might have at law.

Assignment

This Agreement will bind and inure to the benefit of each party's permitted successors and assigns. Neither party may assign this Agreement except upon the advance written consent of the other party, except that either party may assign this Agreement in connection with a merger, reorganization, acquisition or other transfer of all or substantially all of such party's assets or voting securities. Any attempt to transfer or assign this Agreement except as expressly authorized under this Section will be null and void.

Severability

If any provision of this Agreement shall be adjudged by any court of competent jurisdiction to be unenforceable or invalid, that provision shall be limited to the minimum extent necessary so that this Agreement shall otherwise remain in effect.

Governing Law; Jurisdiction and Venue

This Agreement shall be governed by the laws of the State of New York and the United States without regard to conflicts of laws provisions thereof, and without regard to the United Nations Convention on the International Sale of Goods. The jurisdiction and venue for actions related to the subject matter hereof shall be the state and United States federal courts located in New York, New York and both parties hereby submit to the personal jurisdiction of such courts.

Attorneys' Fees and Costs

The prevailing party in any action to enforce this Agreement will be entitled to recover its attorneys' fees and costs in connection with such action.

Notice

Any notice or communication required or permitted under this Agreement shall be in writing to the parties at the address set forth on the Order Form for Customer, or at the address set forth below for Cloudmark, or at such other address as may be given in writing by the applicable party to the other in accordance with this Section and shall be deemed to have been received by the addressee

1. if given by hand, immediately upon receipt;
2. if given by overnight courier service, the first business day following dispatch or
3. if given by registered or certified mail, postage prepaid and return receipt requested, the second business day after such notice is deposited in the mail.

Address notice for Cloudmark:

Cloudmark, Inc.
Attn: General Counsel
128 King Street
2nd Floor
San Francisco, CA 94107
USA

Amendments; Waivers

No supplement, modification, or amendment of this Agreement shall be binding, unless executed in writing by a duly authorized representative of each party to this Agreement. No waiver will be implied from conduct or failure to enforce or exercise rights under this Agreement, nor will any waiver be effective unless in a writing signed by a duly authorized representative on behalf of the party claimed to have waived. No provision of any purchase order or other business form employed by Customer will supersede the terms and conditions of this Agreement, and any such document relating to this Agreement shall be for administrative purposes only and shall have no legal effect.

Entire Agreement

This Agreement is the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements and communications between the parties relating to the subject matter of this Agreement.

Force Majeure

Neither party shall be liable to the other for any delay or failure to perform any obligation under this Agreement if the delay or failure is due to unforeseen events which occur after the Effective Date and which are beyond the reasonable control of such party, such as a strike, blockade, war, act of terrorism, riot, natural disaster, failure or diminishment of power or telecommunications or data networks or services, or refusal of a license by a government agency.

Subcontractors

Cloudmark may use the services of subcontractors for performance of services under this Agreement, provided that Cloudmark remains responsible for

1. compliance of any such subcontractor with the terms of this Agreement and
2. for the overall performance of the GSMA SRS as required under this Agreement.

Independent Contractors

The parties to this Agreement are independent contractors. There is no relationship of partnership, joint venture, employment, franchise or agency created hereby between the parties. Neither party will have the power to bind the other or incur obligations on the other party's behalf without the other party's prior written consent.