Service Terms and Conditions

RECITALS

WHEREAS, Ambient provides the Ambient Service (defined below) for sale to customers to augment and integrate with their existing physical security system;

WHEREAS, Customer desires to license from Ambient the Ambient Service under the terms and conditions of this Agreement;

NOW, THEREFORE, in consideration of the mutual premises and of the performance of the mutual covenants herein, the parties agree as follows:

1. DEFINITIONS

1.1 “Additional Products and Services” means certain services and products made available by Ambient to Customer and described in the Order Form, including but not limited to: training and consulting services, video equipment, and computer services.

1.2. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with, another entity.

1.3. “Ambient Service” means the computer vision intelligence platform for augmenting and integrating with existing physical security systems, associated software, Additional Products and Services, and hardware provided by Ambient to Customer in the Order Form and this Agreement.

1.4. “Confidential Information” means any information or data disclosed by either party that is marked or otherwise designated as confidential or proprietary or that should otherwise be reasonably understood to be confidential in light of the nature of the information and the circumstances surrounding disclosure.  However, “Confidential Information” will not include any information which (a) is publicly available through no fault of receiving party; (b) was properly known to receiving party, without restriction, prior to disclosure by the disclosing party; (c) was properly disclosed to receiving party, without restriction, by another person with the legal authority to do so; or (d) is independently developed by the receiving party without use of or reference to the disclosing party’s Confidential Information. Customer Data is Customer’s Confidential Information. All software, hardware, Documentation and other information provided by Ambient as part of the Ambient Service is Ambient’s Confidential Information.

1.5. “Customer Data” means (a) all Customer-provided data and/or information provided to Ambient by or on behalf of Customer, including snippets of video footage collected by Customer’s video surveillance system; and (b) input into or generated by the use of the Ambient Service.

1.6. “Data Protection Laws” means the meaning given to it in the DPA.

1.7. “Documentation” means electronic or hardcopy manuals, designs, drawings, specifications, datasheets, slide decks or documents received from Ambient in connection with the Ambient Service under this Agreement. 

1.8. “DPA” means the Data Processing Agreement between Ambient and Customer, hereby incorporated by reference and attached as **Exhibit A**. 

1.9. “Feedback” means any suggestions, comments or other feedback provided by Customer to Ambient, and relating to the Ambient Service.

1.10. “Order Form” means an order form executed by Customer and Ambient for the purchase of the Ambient Service and Additional Products and Services, as applicable.

1.11. “Performance Data” means data generated and/or collected in connection with Customer’s use of the Ambient Service, such as logs, session data, support data, usage data, statistics, aggregated data, and derivatives thereof. 

1.12. “Personal Data” means the meaning given to it in the DPA.

2. LICENSE; RESTRICTIONS; DATA PROCESSING

2.1. License.

Subject to Customer’s compliance with the terms of this Agreement and payment of all applicable fees, Ambient grants to Customer a non-exclusive, non-transferable, non-sublicensable, license to (a) access and internally use the Ambient Service within the scope described in the Order Form; (b) to install and internally use any software included as part of the Ambient Service, in accordance with the Documentation; and (c) to make a reasonable number of copies of the Documentation solely in connection with using the Ambient Service. Affiliates of Customer who wish to access the Ambient Service will submit a separate Order Form and will be bound by the terms of this Agreement. Where relevant, references to Customer will include Affiliates, as applicable.

2.2. Restrictions.

Customer agrees not to, and will not allow any third party to: 

2.2.1. Remove or otherwise alter any proprietary notices or labels from the Ambient Service or any portion thereof;

2.2.2. reverse engineer, decompile, disassemble, or otherwise attempt to discover the underlying structure, ideas, or algorithms of the Ambient Service, and any software or hardware used to provide or make the Ambient Service available; 

2.2.3. rent, resell or otherwise allow any third-party access to or use of the Ambient Service, except for allowing service providers and Affiliates of Customer to access the Ambient Service; 

2.2.4. use, inspect, analyze, or otherwise exploit the Ambient Service outside the scope of the express license granted in Section 2.1; 

2.2.5. use the Ambient Service in a manner that adversely affects the availability of the Ambient Service to other Ambient customers; or

2.2.6. use the Ambient Service in violation of the Documentation. 

2.3. Data Processing.

‍Any Personal Data will be processed in accordance with Data Protection Laws and as described in the DPA.

2.4. Service Availability.

Subject to Customer’s payment of the corresponding fees, Ambient will make the Ambient Service available to Customer in accordance with the service level specified in the applicable Order Form. 

2.5. Suspension due to Adverse Impacts.
Ambient may suspend Customer’s access to or use of the Ambient Service immediately, with written notice (email sufficient) if Ambient reasonably believes Customer’s use of the Ambient Service may pose a security risk to or may adversely impact the Ambient Service.

2.6. Additional Products and Services.
Any Additional Products and Services purchased by Customer will be subject to terms and conditions set forth in the Order Form.

3. OWNERSHIP

3.1. Proprietary Rights.
As between the parties, Ambient or its licensors exclusively owns all right, title, and interest in and to the Ambient Service and Documentation, and any software or other intellectual property created, used, provided or made available by Ambient under or in connection with the Ambient Service, and Customer exclusively owns all right, title and interest in and to the Customer Data and Performance Data. Ambient shall acquire no ownership rights in or to the Customer Data or Performance Data, subject to license rights to Ambient set forth in Section 3.2.

3.2. License to Ambient.

3.2.1. Performance Data.
Customer grants Ambient a limited license to aggregate, collect, analyze, and store Performance Data (a) to provide, maintain, and improve the Ambient Service, and (b) in aggregated, de-identified form for product improvement and Ambient’s marketing purposes. For clarity, any Performance Data used for marketing purposes will not identify Customer.

3.2.2. Customer Data.
Customer understands and acknowledges that Ambient’s proprietary technology includes probabilistic predictive models and algorithms used in threat detection, and that training such models and algorithms on Customer Data will improve Customer’s experience with the Ambient Service, for example, where feasible, developing custom threat signatures, and signals intelligence. As such, Customer grants Ambient a limited license to collect, store, and use Customer Data (i) to provide, maintain, and improve the Ambient Service for Customer’s benefit, and (ii) to train and improve Ambient’s underlying proprietary technology, including without limitation, Ambient’s probabilistic predictive models and algorithms used in threat detection.

3.2.3. Feedback.
Customer has no obligation to disclose to Ambient any Feedback. However, if Customer discloses Feedback to Ambient, Customer shall grant, and hereby does grant, to Ambient a non-exclusive, worldwide, non-terminable, royalty-free, transferable, sublicensable license to use, reproduce, prepare derivative works of, make, have made, import, offer for sale, sell, lease, distribute, publicly display, publicly perform, and otherwise exploit such intellectual property rights in or to any such Feedback in or with any Ambient products or technology.

4. FEES, PAYMENT

4.1. Fees.

Customer shall pay those amounts due and not disputed in good faith within thirty (30) days of the date of receipt of the applicable invoice, unless a specific date for payment is set forth in such Order Form, in which case payment will be due on the date specified.  Except as otherwise specified herein or in any applicable Order Form, (a) fees are quoted and payable in United States dollars and (b) payment obligations are non-cancelable and non-pro-ratable for partial months, and fees paid are non-refundable.

4.2. Late Payment.

Ambient may suspend access to the Ambient Service immediately upon notice if Customer fails to pay any amounts hereunder at least five (5) days past the applicable due date.  If Ambient has not received payment within five (5) days after the applicable due date, interest will accrue on past due amounts at the rate of one percent (1%) per month, but in no event greater than the highest rate of interest allowed by law, calculated from the date such amount was due until the date that payment is received by Ambient.

4.3. Taxes.

All amounts payable hereunder are exclusive of any sales, use and other taxes or duties, however designated.  Customer will be solely responsible for payment of all applicable taxes or duties, except for those taxes based on the income of Ambient.  Customer will not withhold any Taxes from any amounts due to Ambient.

5. TERM, TERMINATION

5.1. Term and Renewal.

The term of this Agreement begins on the Effective Date and will remain in effect for the term described in the Order Form (the “Initial Term”), unless sooner terminated. After the Initial Term, this Agreement shall automatically renew for successive one (1) year periods (each, a “Renewal Term”) unless Customer provides Ambient with written notice of its election to terminate this Agreement at least thirty (30) days prior to the expiration of the Initial Term or the then-current Renewal Term, as applicable. The Initial Term together with all Renewal Terms, if any, shall be collectively referred to as the “Term”. Notwithstanding anything to the contrary in the foregoing, this Agreement will remain in full force and effect and govern any Order Form that has not expired prior to expiration of the Term.

5.2. Termination.

Each party may terminate this Agreement or the applicable Order Form upon written notice in the event (a) the other party commits any material breach of this Agreement or the applicable Order Form and fails to remedy such breach within thirty (30) days after written notice of such breach or (b) subject to applicable law, upon the other party’s liquidation, commencement of dissolution proceedings or assignment of substantially all its assets for the benefit of creditors, or if the other party become the subject of bankruptcy or similar proceeding that is not dismissed within sixty (60) days. 

5.3. Post-Termination Obligations.

Following any termination of the Agreement, each party will, within thirty (30) days of such termination, (a) immediately cease use of any Confidential Information of the other communicated for the purposes of this Agreement, and (b) return or destroy (and certify destruction of) all copies of any Confidential Information of the other party disclosed under the Agreement within thirty (30) days of such termination, subject to each party’s customary backup and archival processes. Customer shall cease using the Ambient Service and de-install all related software installed on Customer’s property or property under Customer’s control. Any ongoing Additional Products and Services will cease as of the termination date. Following termination of the Agreement, Customer may export all Customer Data using the export functionality available on the Ambient Service. Customer understands and acknowledges that Customer Data may be irretrievably deleted thirty (30) days after termination of the Agreement.

5.4. Survival.

Sections 1, 3, 4, (solely as to any outstanding fees), 5.3, 5.4, 6, 9, 10, and 11 will survive termination or expiration of the Agreement.

6. CONFIDENTIALITY

6.1. Confidentiality Obligations.

Each party agrees that it will use the Confidential Information of the other party solely in accordance with the provisions of this Agreement and it will not disclose the same directly or indirectly, to any third party without the other party’s prior written consent, except as otherwise permitted hereunder.  However, either party may disclose Confidential Information (a) to its employees, officers, directors, attorneys, auditors, financial advisors and other representatives who have a need to know and are legally bound to keep such information confidential by confidentiality obligations consistent with those of this Agreement; and (b) as required by law (in which case the receiving party will provide the disclosing party with prior written notification thereof, will provide the disclosing party with the opportunity to contest such disclosure, and will use its reasonable efforts to minimize such disclosure to the extent permitted by applicable law.  Neither party will disclose the terms of this Agreement to any third party, except that either party may confidentially disclose such terms to actual or potential lenders, investors or acquirers.  Each party agrees to exercise due care in protecting the Confidential Information from unauthorized use and disclosure.  In the event of actual or threatened breach of the provisions of this Section 6, the non-breaching party will be entitled to seek immediate injunctive and other equitable relief, without waiving any other rights or remedies available to it.  Each party will promptly notify the other in writing if it becomes aware of any violations of the confidentiality obligations set forth in this Agreement.

7. INSURANCE

7.1. Coverage Generally.

Ambient will obtain and maintain in full force and effect, with financially sound and reputable insurers, insurance to cover its obligations under this Agreement.  Upon execution of this Agreement and before the commencement of the Ambient Service, Ambient can, upon request, provide to Customer a certificate of insurance evidencing the following coverages and minimum amounts covered below.

7.2. Workers’ Compensation.

Workers’ compensation sufficient to meet statutory requirements in the state wherein the work is to be performed and employer’s liability insurance minimum limits of at least $1,000,000. 

7.3. Commercial General Liability.

Commercial General Liability in the following minimum amounts: Bodily Injury & Property Damage Each Occurrence: $1,000,000, Personal and Advertising Injury: $1,000,000, Products/Completed Operations Aggregate: $2,000,000 General Aggregate: $2,000,000.

7.4. Professional Liability (Errors and Omissions).

Professional Liability including Cyber and Privacy Security Liability coverage appropriate to the services being provided under the Agreement with a minimum combined single limit of $5,000,000 per claim.

7.5. Crime.

Crime Liability coverage with a minimum combined single limit of $2,000,000 per claim.

8. WARRANTIES

8.1. Mutual Warranties.

Each party represents and warrants to the other that: (a) this Agreement has been duly executed and delivered and constitutes a valid and binding agreement enforceable against such party in accordance with its terms; and (b) no authorization or approval from any third party is required in connection with such party’s execution, delivery, or performance of this Agreement. 

8.2. Customer Warranties.

Customer represents and warrants to Ambient that it has all rights or consents necessary to provide Customer Data to Ambient under this Agreement.

8.3. Ambient Warranties.

Ambient represents and warrants to Customer that the Ambient Service, when used by Customer in accordance with the permitted uses in this Agreement and the Documentation, will function as described in the Documentation and the DPA, during the Term.

8.4. Exclusive Remedy.

Customer shall report to Ambient, pursuant to the notice provision of this Agreement, any breach of the warranties set forth in this Section 8. In the event of a breach of warranty by Ambient under this Agreement, Customer’s sole and exclusive remedy, and Ambient’s entire liability, shall be prompt correction of any material non-conformance in order to minimize any material adverse effect on Customer’s business.

8.5. Disclaimer.

EXCEPT FOR THE EXPRESS REPRESENTATIONS AND WARRANTIES STATED IN THIS SECTION 8, AMBIENT MAKES NO ADDITIONAL REPRESENTATION OR WARRANTY OF ANY KIND WHETHER EXPRESS, IMPLIED (EITHER IN FACT OR BY OPERATION OF LAW), OR STATUTORY, AS TO ANY MATTER WHATSOEVER. AMBIENT EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUALITY, ACCURACY, TITLE, AND NON-INFRINGEMENT. AMBIENT DOES NOT WARRANT AGAINST INTERFERENCE WITH THE ENJOYMENT OF THE AMBIENT SERVICE. AMBIENT DOES NOT WARRANT THAT THE AMBIENT SERVICE IS ERROR-FREE OR THAT OPERATION OF THE AMBIENT SERVICE WILL BE SECURE OR UNINTERRUPTED. AMBIENT DOES NOT WARRANT THAT ANY INFORMATION PROVIDED THROUGH THE AMBIENT SERVICE IS ACCURATE OR COMPLETE, OR THAT ANY INFORMATION PROVIDED THROUGH THE AMBIENT SERVICE WILL ALWAYS BE AVAILABLE. AMBIENT EXERCISES NO CONTROL OVER AND EXPRESSLY DISCLAIMS ANY LIABILITY ARISING OUT OF OR BASED UPON THE RESULTS OF CUSTOMER’S USE OF THE AMBIENT SERVICE.

8.6. Resulting Uses.

CUSTOMER IS SOLELY RESPONSIBLE FOR ANY USE OF THE RESULTS OR OUTPUT OF THE AMBIENT SERVICE AND ALL ACTIONS OR OMISSIONS RESULTING THEREFROM (THE “RESULTING USES”). CUSTOMER ASSUMES ALL RISK AND LIABILITY WITH RESPECT TO RESULTING USES, AND CUSTOMER ACKNOWLEDGES AND AGREES THAT THE AMBIENT SERVICE IS NOT DESIGNED OR INTENDED FOR USE IN APPLICATIONS OR IN A MANNER WHICH FAILURE OF SUCH SERVICE OR USE COULD REASONABLY BE EXPECTED TO RESULT IN PERSONAL INJURY, LOSS OF LIFE, OR CATASTROPHIC PROPERTY DAMAGE.

9. INDEMNITY

9.1. Indemnity by Ambient.

Ambient will defend Customer against any claim, demand, suit, or proceeding (“Claim”) made or brought against Customer by a third party alleging that the use of the Ambient Service as permitted hereunder infringes or misappropriates a patent, copyright or trade secret and will indemnify Customer for any damages finally awarded against Customer (or any settlement approved by Ambient) in connection with any such Claim.  If the use of the Ambient Service by Customer has become, or in Ambient’s opinion is likely to become, the subject of any claim of infringement, Ambient may at its option and expense (i) procure for Customer the right to continue using and receiving the Ambient Service as set forth hereunder; (ii) replace or modify the Ambient Service to make it non-infringing (with comparable functionality); or (iii) if the options in clauses (i) or (ii) are not reasonably practicable, terminate this Agreement and provide a pro rata refund of any prepaid subscription fees corresponding to the terminated portion of the applicable term.  

9.1.1. Excluded Claims.

Ambient will have no liability or obligation with respect to any Claim for intellectual property infringement or misappropriation if such Claim is caused in whole or in part by (a) compliance with designs, guidelines, plans or specifications provided by Customer; (b) use of the Ambient Service by Customer not in accordance with this Agreement; (c) modification of the Ambient Service by or on behalf of Customer; (d) Customer Confidential Information, or (e) the combination, operation or use of the Ambient Service with other products or services where the Ambient Service would not by itself be infringing (clauses (a) through (e), “Excluded Claims”).  This Section states Ambient’s sole and exclusive liability and obligation, and Customer’s exclusive remedy, for any claim of any nature related to infringement or misappropriation of intellectual property.

9.2. Indemnification by Customer.

Customer will defend Ambient against any Claim made or brought against Ambient by a third party arising out of (a) the Excluded Claims; (b) Ambient’s use of Customer Data as permitted hereunder; and (c) any Resulting Uses, and Customer will indemnify Ambient for any damages finally awarded against Ambient (or any settlement approved by Customer) in connection with any such Claim.

9.3. Notice and Procedure.

In the event of a Claim for which a party seeks indemnity under this Section 9 (each an “Indemnified Party”), (a) the Indemnified Party shall promptly notify the other party (“Indemnifying Party”) of such Claim, (b) the Indemnifying Party will have the sole and exclusive authority to defend and/or settle any such Claim (provided that the Indemnifying Party may not settle any Claim without the Indemnified Party’s prior written consent, which will not be unreasonably withheld, unless it unconditionally releases the Indemnified Party of all related liability) and (c) the Indemnified Party reasonably cooperates with the Indemnifying Party in connection therewith.

10. LIMITATION OF LIABILITY 

EXCEPT FOR A PARTY’S INDEMNIFICATION OBLIGATIONS AND FOR BREACH OF SECTION 6 (COLLECTIVELY, “SPECIAL CLAIMS”), UNDER NO LEGAL THEORY, WHETHER IN TORT, CONTRACT, OR OTHERWISE, WILL EITHER PARTY BE LIABLE TO THE OTHER UNDER THIS AGREEMENT FOR (A) ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES OF ANY CHARACTER, INCLUDING DAMAGES FOR LOSS OF GOODWILL, LOST PROFITS, LOST SALES OR BUSINESS, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, LOST CONTENT OR DATA, EVEN IF A REPRESENTATIVE OF SUCH PARTY HAS BEEN ADVISED, KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES, OR (B) EXCLUDING CUSTOMER’S PAYMENT OBLIGATIONS AND SPECIAL CLAIMS, ANY AGGREGATE DAMAGES, COSTS, OR LIABILITIES IN EXCESS OF THE AMOUNTS PAID BY CUSTOMER TO AMBIENT UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTHS PRECEDING THE CLAIM. EACH PARTY’S AGGREGATE LIABILITY FOR SPECIAL CLAIMS UNDER THIS AGREEMENT WILL NOT EXCEED  ONE MILLION US DOLLARS ($1,000,000). THIS LIMITATION OF LIABILITY WILL NOT APPLY TO CLAIMS AGAINST EITHER PARTY FOR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, WHICH WILL BE SUBJECT TO UNLIMITED LIABILITY.

11. MISCELLANEOUS

11.1. Governing Law and Venue.

This Agreement will be governed by and interpreted in accordance with the laws of the State of California, without regard to conflicts of laws principles. In the event of any controversy or claim arising out of or relating to this Agreement, or its breach or interpretation, the parties will submit to the exclusive jurisdiction of and venue in San Mateo County, California. Each party waives all defenses of lack of personal jurisdiction and inconvenient forum. 

11.2. Publicity; References.

Customer agrees that Ambient may use Customer’s name and trademarks in referring to Customer as a customer of Ambient, in Ambient’s marketing materials and website, and subject to Customer’s trademark guidelines provided from time to time.

11.3. Equitable Relief.

Customer and Ambient acknowledge that damages will be an inadequate remedy if the other party violates the terms of this Agreement pertaining to the protection of a party’s intellectual property rights and Confidential Information. Accordingly, each of them will have the right, in addition to any other rights each of them may have, to seek in any court of competent jurisdiction, temporary, preliminary, and permanent injunctive relief to restrain any breach, threatened breach, or otherwise to specifically enforce any of the obligations in this Agreement.

11.4. Force Majeure.

Neither Party will be deemed in breach hereunder for any cessation, interruption or delay in the performance of its obligations due to causes beyond its reasonable control (“Force Majeure Event”), including earthquake, flood, or other natural disaster, act of God, labor controversy, civil disturbance, terrorism, war (whether or not officially declared), cyber attacks (e.g., denial of service attacks), or the inability to obtain sufficient supplies, transportation, or other essential commodity or service required in the conduct of its business, or any change in or the adoption of any law, regulation, judgment or decree.

11.5. Severability; Invalidity.

If any provision of this Agreement is held to be invalid, such invalidity will not render invalid the remainder of this Agreement or the remainder of which such invalid provision is a part. If any provision of this Agreement is so broad as to be held unenforceable, such provision will be interpreted to be only so broad as is enforceable.

11.6. Waiver.

No waiver of or with respect to any provision of this Agreement, nor consent by a party to the breach of or departure from any provision of this Agreement, will in any event be binding on or effective against such party unless it be in writing and signed by such party, and then such waiver will be effective only in the specific instance and for the purpose for which given. 

11.7. Third Party Beneficiaries.

Except as expressly set forth in this Agreement, no provisions of this Agreement are intended nor will be interpreted to provide or create any third party beneficiary rights or any other rights of any kind in any other party. 

11.8. Assignment.

Neither party may assign any of its rights or obligations under this Agreement without the prior written consent of the other, which will not be unreasonably withheld, provided, however, either party may assign this Agreement as a whole to any entity into or with which it is merged, or that acquires all or substantially all of its assets, upon notice to the other party, but without requiring consent. Subject to the foregoing restriction on assignment, this Agreement will be binding upon, inure to the benefit of, and be enforceable by the parties and their respective successors and assigns. 

11.9. Notices.

Any notice or communication under this Agreement must be in writing. Customer must send any notices under this Agreement (including breach notices and warranty and indemnity claims) to Ambient, in English to legal@ambient.ai. Ambient may send notices to the email addresses on Customer’s account or, at Ambient’s option, to Customer’s last-known postal address. Ambient may also provide operational notices regarding the Ambient Service or other business-related notices through conspicuous posting of the notice on Ambient’s website or the Ambient Service. Each party consents to receiving electronic notices. Ambient is not responsible for any automatic filtering Customer or its network provider may apply to email notifications.

11.10. Subcontractors.

Ambient may use subcontractors and permit them to exercise the rights granted to Ambient in order to provide the Ambient Service and related services under this Agreement. These subcontractors may include, for example, Ambient’s hosting providers. However, subject to all terms and conditions of this Agreement, Ambient will remain responsible for: (i) compliance of its subcontractors with the terms of this Agreement; and (ii) the overall performance of the Ambient Service if and as required under this Agreement. 

11.11. Entire Agreement; Amendments.

This Agreement and all attached exhibits and orders hereto constitute the entire agreement and understanding between the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous written, electronic, or oral communications, representations, agreements, or understandings between the parties with respect thereto. This Agreement may not be modified or amended except by a written instrument executed by both parties. Any additional, supplementary, or conflicting terms supplied by either party, including those contained on or within any invoice, purchase order, or standard terms of purchase, or any click through license agreement or terms of use, are specifically and expressly rejected by each party.  In the event of any conflict between the provisions of this Agreement and any Order Form, the provisions of this Agreement will prevail. 

11.12. Counterparts.

Order Forms and any amendments to this Agreement may be executed in one or more counterparts, which taken together will constitute a single agreement between the parties.

Exhibit A

DATA PROCESSING ADDENDUM

This Data Processing Addendum including all of its Annexes (this **“Addendum”**) supplements and forms part of the Service Terms and Conditions accepted by Customer on or about the date hereof (the **“Agreement”**) by and between Ambient AI, Inc. (**“Ambient”**) and the Customer identified therein (**“Customer”**, and together with Ambient, the **“Parties”**).

All capitalized terms used but not otherwise defined herein have the respective meanings ascribed to them in the Agreement.

Customer has purchased a subscription to the Software pursuant to the Agreement that involves the Processing of Personal Data subject to Data Protection Laws (the **“Service”**).

In the provision of the Software by Ambient to Customer pursuant to the Agreement, Customer acts as Controller and Ambient acts as Processor or Service Provider with respect to the Personal Data, or, as the case may be, Customer acts as a Processor for its end-user customers (including such end-user customers’ affiliated companies as ultimate Controllers) and Ambient will act as a sub-Processor acting on the instruction of the Customer vis-à-vis its end-user customers. 

The Parties agree as follows:

1. Definitions

Unless otherwise defined in the Agreement, all capitalized terms used in this Addendum will have the meanings given to them herein or in applicable Data Protection Laws.

“Controller” means the entity or Business which solely or jointly with other entities determines the purposes and means of the Processing of Personal Data, and for the purposes of this Addendum means Customer, including when acting on behalf of its own end-user customer.

“Data Breach” has the meaning given to it in the Data Protection Laws and for the purpose of this Addendum relates to the Personal Data Processed by Ambient on behalf of Customer.

“Data Protection Laws” means, to the extent applicable to Customer’s use of the Software, all applicable data protection and privacy laws, their implementing regulations, regulatory guidance, and secondary legislation, each as updated or replaced from time to time, including, as they may apply: (i) the General Data Protection Regulation ((EU) 2016/679) (“GDPR”) and any applicable national implementing laws; (ii) the UK General Data Protection Regulation (“UK GDPR”) and the UK Data Protection Act 2018; (iii) U.S. legislation (e.g., the California Consumer Privacy Act and the California Privacy Rights Act); and (iv) any other laws that may be applicable.

“Data Subject” means the identified or identifiable person to whom the Personal Data relates, as defined in applicable Data Protection Laws.

“EEA” means the European Economic Area.

“EU Standard Contractual Clauses” (or “EU SCCs” or “Clauses”) means the standard data protection clauses for the transfer of Personal Data to processors established in third countries, as described in Article 46 of the GDPR pursuant to the European Commission’s decision (C(2010)593) of 5 February 2010 on Standard Contractual Clauses, as approved by the European Commission in Implementing Decision 2021/914/EU of 4 June 2021, as each may be amended, updated, or replaced from time to time.

“Personal Data” has the meaning given to it in the Data Protection Laws and, for the purpose of this Addendum, relates to the Personal Data Processed by Ambient on behalf of Customer as described in Section 3.

“Processing” has the meaning given to it in the Data Protection Laws and “process”, “processes” and “processed” will be construed accordingly.

“Processor” means the entity or Service Provider which Processes Personal Data on behalf of the Controller, as defined in applicable Data Protection Laws, and for the purposes of this Addendum means Ambient.

2. Compliance with Laws

Each Party will comply with the Data Protection Laws as applicable to it. In particular, Customer will comply with its obligations as Controller (or on behalf of Controller), and Ambient will comply with its obligations as Processor.

3. Data Processing

a. Roles of the Parties.

The Parties acknowledge and agree that, with regard to the Processing of Personal Data where such terms are used by applicable Data Protection Laws, (i) Customer is the Controller; Ambient is the Processor or Service Provider; and the Processor may engage sub-Processors or other Service Providers pursuant to Section 10 of this Addendum.

b. Customer Obligations.

i. Customer (as Controller or on behalf of the ultimate Controller) undertakes that all instructions for the Processing of Personal Data under the Agreement, this Addendum, or as otherwise agreed will comply with the Data Protection Laws, and such instructions will not in any way cause Ambient to be in breach of any Data Protection Laws.

ii. The Customer will have sole responsibility for the means by which the Customer acquired the Personal Data.

c. Ambient’s Processing of Personal Data

i. Ambient will Process Personal Data only in accordance with Customer’s (i) instructions as outlined in the Agreement and this Addendum or (ii) as otherwise documented by Customer, in either event only as permitted by applicable Data Protection Laws and for the purpose of providing the Products to Customer in accordance with the terms of the Agreement.

ii. Unless prohibited by applicable law, Ambient will notify Customer if, in its opinion, an instruction infringes any Data Protection Law to which it is subject, in which case Ambient will be entitled to suspend performance of such instruction without any liability to Customer until Customer confirms in writing that such instruction is valid under such Data Protection Law. Any additional instructions regarding the manner in which Ambient Processes the Personal Data will require prior written agreement between Ambient and Customer.

iii. Ambient will not be liable in the event of any claim brought by a third party, including, without limitation, a Data Subject, arising from any act or omission of the Processor to the extent that such act or omission is a result of the Customer’s instructions. 

iv. Ambient will not disclose Personal Data to any government, except as necessary to comply with applicable law or a valid and binding order of a law-enforcement agency (such as a subpoena or court order). If Ambient receives such an order, Ambient will notify Customer of the request it has received so long as Ambient is not legally prohibited from doing so. 

v. Where Ambient acts as Customer’s Service Provider, Ambient shall not: (i) sell Personal Data; (ii) collect, retain, use, or disclose Personal Data (a) for any purpose other than providing the Products specified in the Agreement and this Addendum, or (b) outside of the direct business relationship between Ambient and Customer; or (iii) combine this Personal Data with Personal Data that Processor obtains from other sources except as permitted by applicable Data Protection Laws. Ambient certifies that it understands the prohibitions outlined in this Section 3(c)(v) and will comply with them. 

vi. Ambient will take reasonable steps to ensure that individuals with access to or involved in the Processing of Personal Data are subject to appropriate confidentiality obligations and/or are bound by related obligations under Data Protection Laws or other applicable laws.

d. The duration of the Processing, the nature and specific purposes of the Processing, the types of Personal Data Processed, and categories of Data Subjects under this Addendum are further specified in the Annexes to this Addendum and, on a more general level, in the Agreement.

4. International Transfers.

At all times during the term of the Agreement, Customer (as data exporter) and Ambient (as data importer) shall comply with the Standard Contractual Clauses with respect to Personal Data relating to European Economic Area (EEA), Swiss, and/or United Kingdom (UK) Data Subjects Transfers of Personal Data Outside the EEA.

5. Technical and Organizational Measures

Ambient will implement appropriate technical and organizational measures to ensure a level of security of Personal Data appropriate to the risk, as further described in Annex II. In assessing the appropriate level of security, Ambient will take into account the risks presented by Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise Processed.

6. Data Subject Rights

Ambient will assist Customer in responding to Data Subjects’ requests to exercise their rights under Data Protection Laws. To that effect, Ambient will (i) to the extent permitted by applicable law, promptly notify Customer of any request received directly from Data Subjects to access, correct or delete its Personal Data without responding to that request, and (ii) upon written request from Customer, provide Customer with information that Ambient has available to reasonably assist Customer in fulfilling its obligations to respond to Data Subjects exercising their rights under the Data Protection Laws.

7. Data Protection Impact Assessments

If Customer is required under Data Protection Laws to conduct a Data Protection Impact Assessment, Ambient will, upon written request, use commercially reasonable efforts to assist, to the extent Customer does not otherwise have access to the relevant information, including reasonable assistance with any cooperation or prior consultation with supervisory authorities.

8. Audit of Technical and Organizational Measures.

Upon written request (no more than once annually) and at Customer’s sole cost, Customer may verify Ambient’s compliance with its data protection obligations as specified in this Addendum by: (i) submitting a security-assessment questionnaire; and (ii) if Customer is not satisfied with the responses to the questionnaire, conducting an audit meeting with Ambient’s information security experts on a mutually agreeable time. Such interviews will be conducted with a minimum of disruption to Ambient’s normal business operations and subject always to Ambient’s agreement on scope and timings. Such audit will be performed during normal business hours, in such a manner as not to unreasonably disrupt normal business operations, and in no event will take place over the course of more than two business days. The Customer may perform the verification described above by itself or through a mutually agreed upon third party auditor, so long as Customer or its authorized auditor executes a mutually agreed upon non-disclosure agreement. Customer will be responsible for any actions taken by its authorized auditor. All information disclosed by Ambient under this Section 8 will be deemed Ambient’s Confidential Information, and Customer will not disclose any audit report to any third party except as obligated by law, court order or administrative order by a government agency. Ambient will remediate any mutually agreed, material deficiencies in its technical and organizational measures identified by the audit procedures described in this Section 8 within a mutually agreeable timeframe.

9. Breach Notification

If Ambient becomes aware of a Data Breach, Ambient will notify Customer without undue delay, and in any case, within seventy-two (72) hours, cooperate, and take commercially reasonable steps to investigate, mitigate, and remediate. Ambient will provide all support necessary to enable Customer to comply with its legal obligations.

10. Sub-Processing

a. General Authorization.

Customer authorizes Ambient to engage Ambient affiliates or third-party providers as Sub-processors. Ambient will impose contractual obligations on Sub-processors no less protective than this Addendum.

b. Sub-processor List & Objection Right.

Ambient maintains an updated list of Sub-processors (available upon written request) and may amend the list at any time with thirty (30) days advance written notice, including details of the Processing to be undertaken by the proposed Sub-processors. Customer may object in writing; Ambient will work in good faith to resolve objections. Ambient may choose to: (i) not use the Sub-processor to Process Personal Data for Customer or (ii) take corrective steps requested by Customer in its objection and use the Sub-processor once Customer deems such corrective steps were taken. If neither of these options are reasonably possible and Customer continues to object, Customer may terminate the affected portion of the Service with notice.

11. Return or Deletion of Personal Data

Ambient will delete or return Personal Data (at Customer’s option) within a reasonable period following termination or expiration of the Agreement, unless otherwise required by law.

12. Termination

This Addendum shall automatically terminate upon the termination or expiration of the Agreement. Sections 1, 3(b), 3(c)(iii), 11, 13, and 14 of this Addendum shall survive the termination or expiration of this Addendum for any reason. This Addendum cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this Addendum shall automatically terminate.

13. Governing Law & Jurisdiction

This Addendum shall be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by applicable Data Protection Laws. The Parties agree that Module Two shall apply. For the purposes of Clause 13 of the GDPR, the Supervisory Authority shall be the data exporter’s applicable Supervisory Authority. Data exporter shall notify data importer of the applicable Supervisory Authority by email at legal@ambient.ai and shall provide any necessary updates without undue delay. For the purposes of Clauses 17 and 18 of the EU SCCs, where applicable, to the extent that the governing law and jurisdiction provisions in the Agreement do not meet the requirements of the EU SCCs, the parties select Option 2 of Clause 17, and agree that the EU SCCs shall be governed by the law of the EU Member State in which the data exporter is established; where such law does not allow for third-party beneficiary rights, the EU SCCs shall be governed by the laws of the country of Ireland. Pursuant to Clause 18, any dispute between the Parties arising from the EU SCCs shall be resolved by the courts of Ireland, and the Parties submit themselves to such jurisdiction. 

14. Entire Agreement; Conflict

Except as amended by this Addendum, the Agreement remains in full force and effect. In case of conflict on the subject matter herein, the terms of this Addendum shall control.

ANNEX I

A. List of Parties

1. Data exporter(s): 

Name: The Customer named in the Agreement

Address: The address of the Customer’s corporate headquarters

Contact person’s name, position and contact details: The primary administrative contact listed in the Hosted Software

Activities relevant to the data transferred under these Clauses: Purchase of subscription and use of Software under the Agreement 

Role (controller/processor): Controller 

2. Data importer(s): 

Name: Ambient AI, Inc.

Address: 555 Twin Dolphin Drive, Suite 610, Redwood City, CA 94065

Contact details: Vikesh Khanna, CTO, support@ambient.ai

Activities relevant to the data transferred under these Clauses: Processing of personal data to provide Products as set forth in the Agreement 

Role (controller/processor): Processor

B. Description of Transfer 

Categories of data subjects whose personal data is transferred

Customer’s physical security team members, any individuals whose faces are incidentally captured by Customer’s video cameras.

Categories of personal data transferred

- First name, last name, email address, and optionally, phone numbers of Customer’s physical security team members who are onboarded onto the Ambient platform, and any individuals whose faces are incidentally captured by Customer’s video cameras.  

- If Customer has enabled badge integration with the Ambient Service, all badge system information provided by Customer containing Personal Data will be transferred. This may include employee/contractor name, timestamp, employee/contractor photo, access events, and other Personal Data Customer elects to share with the Ambient Service.

- Any other Customer Data containing Personal Data provided to Ambient for Processing via the Ambient Service, by or at the direction of Customer or Customer’s users.

Special categories or sensitive Personal Data transferred

None

The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis)

Ambient pulls in live video from security cameras and access events from access control systems on a continuous basis.

Nature of the processing

Ambient pulls in live video from security cameras to assist physical security teams in identifying security events of interest proactively. Ambient applies state of the art computer vision and AI to identify security of events and once identified these events are surfaced to physical security team members.

Purpose(s) of the data transfer and further processing

Ambient is used by physical security teams and assists physical security teams in identifying security events of interest proactively.

The period for which the personal data will be retained, or, if that is not possible, the criteria

During the Term of the Agreement and as provided therein.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing:

Processing during the Term solely for providing the services/Products.

C. Competent Supervisory Authority

The Supervisory Authority applicable to the Data Exporter as notified to the Data Importer in accordance with Section 13 of the Addendum.

ANNEX II

Technical and Organizational Measures

1. In assessing the appropriate level of security, Data Importer will take account in particular of the risks that are presented by Processing, in particular from a Personal Data Breach.

2. Data Importer will do the following:

a.  implement physical access controls designed to secure relevant facilities, infrastructure, data centers, hard copy files, servers, backup systems, and equipment (including mobile devices) used to access Personal Data, including controls to prevent, detect, and respond to attacks, intrusions, or other system failures;

b. implement user authentication and access controls within operating systems, applications, equipment, and media;

c. implement personnel security policies and practices restricting access to Personal Data, including background checks consistent with Applicable Law on all personnel who maintain, implement, or administer its information security program and safeguards;

d. perform continuous monitoring of networks, systems, and devices (including services) to ensure the privacy, confidentiality, security, integrity, and availability of the Personal Data; and

e. maintain a reasonable security monitoring and incident response program to both detect and effectively respond to security events across all systems affecting Personal Data.

Access Controls

3. To control access to Personal Data, Processor will: 

a. maintain reasonable controls to ensure that only individuals who have a legitimate need to access Personal Data under the Agreement will have such access; 

b. promptly terminate an individual’s access to Personal Data when such access is no longer required for performance under the Agreement;

c. log the appropriate details of access to Personal Data on Third Party’s systems and equipment, and retain such records for no less than 90 days; and 

d. be responsible for any unauthorized access to Personal Data under its custody or control or its Sub-processors custody or control.

For an archived version of our previous terms of service, please visit our archive