Master Services Agreement (MSA)

Version 2.4 — Publication date: 01/07/2026

This Master Services Agreement (the “MSA”) sets out the general terms and conditions governing the provision of technology services, licensing, development, infrastructure administration, APIs, integrations, support and subscription models. The MSA is entered into between:

(i) BCL Group S.A.S., a company incorporated under the laws of the Republic of Colombia, with tax identification number (NIT) 901.371.032, domiciled in Bogotá D.C., operating under the trade name Greyfield Strata (the “SERVICE PROVIDER”); and

(ii) the legal entity identified in and signing the respective Service Order (the “SERVICE RECIPIENT”).

The SERVICE PROVIDER and the SERVICE RECIPIENT may be referred to jointly as the “Parties” and individually as a “Party”. The MSA takes effect between the Parties from the date of the last signature of the first Service Order.

1. DEFINITIONS

The terms below, when capitalized, in the singular or plural, have the meaning assigned to them here. Other terms defined in the body of the Contract have the meaning given there.

Affiliate: with respect to a Party, any entity that directly or indirectly controls it, is controlled by it or is under common control with it. “Control” means the power to direct the management or policies of an entity, whether through ownership of voting shares, by contract or otherwise.

Third-Party Charges: costs of third-party products or services incorporated into the Services and identified as such in the Service Order, such as consumption of Artificial Intelligence models, cloud infrastructure or components licensed by third parties.

Contract: for each Service Order, the set formed by the Service Order, the applicable Service-Specific Terms, the DPA (where applicable) and this MSA.

Recipient Data: all information, source code, repositories, context, databases and content that the SERVICE RECIPIENT or its Users provide, upload or pass through the Services.

Personal Data: any information linked or that may be associated with one or more identified or identifiable natural persons, under Law 1581 of 2012.

Custom Developments: the deliverables created specifically for the SERVICE RECIPIENT in performance of a Service Order that expressly designates them as such.

Business day: any day other than a Saturday, Sunday or public holiday in the Republic of Colombia, whether or not capitalized. Periods expressed in hours are computed according to Colombian legal time, unless the Service Order indicates another time zone for support.

DPA: the SERVICE PROVIDER’s Data Processing Addendum (Personal Data Transmission and Processing Annex).

Provider Tools: the scripts, connectors, templates, standard configurations, methodologies, software, MCP servers and clients, APIs, documentation and other assets of the SERVICE PROVIDER, pre-existing or independently developed, as well as their improvements and derivative works.

Service Order: the document entitled Accession & Service Order, its amendments and annexes, signed by the Parties.

Third-Party Platforms: third-party services, software or infrastructure not under the SERVICE PROVIDER’s control with which the Services interact, including Git platforms, Artificial Intelligence model providers and cloud providers.

Initial Term and Renewal Period: the periods defined in clauses 17.3 and 17.4.

Services: the services and products described in a Service Order.

Service-Specific Terms: the modular, standardized terms applicable to each service line, such as the Managed Git Organizations Service Terms, the MCP, API & CLI Subscription Service Terms and the Software Development & Delivery Service Terms.

User: each natural person employed or engaged as a contractor by the SERVICE RECIPIENT or its authorized Affiliates, or each application, to which credentials to access the Services are assigned.

2. PURPOSE AND ACCESSION MECHANISM

2.1. Purpose. The purpose of this MSA is to establish the permanent legal, operational and commercial framework applicable to any technology solution that the SERVICE RECIPIENT contracts with the SERVICE PROVIDER, without being limited to a specific technology or platform.

2.2. Accession mechanism. The SERVICE RECIPIENT becomes bound by this MSA by accepting a Service Order issued by the SERVICE PROVIDER, in accordance with clause 5.2. Acceptance entails accession to the version of the document package identified in that Order, which comprises the MSA, the Service-Specific Terms and the DPA.

2.3. Independent contracts and Affiliates. Each Service Order, together with the documents that make it up, constitutes an independent Contract. The SERVICE RECIPIENT’s Affiliates may sign Service Orders acceding to this MSA, in which case the signing Affiliate will be the SERVICE RECIPIENT with respect to that Order. When the SERVICE RECIPIENT gives an Affiliate access to the Services, it will be liable for that Affiliate’s compliance with the Contract as if they were its own acts.

2.4. Trials and pilots. Every trial, pilot or proof of concept of the Services, whether free or paid, is governed by this MSA. Unless the Service Order provides otherwise, trials are provided as is, without service levels, and the SERVICE PROVIDER may end them at any time. Free trials will not give rise to liability for the SERVICE PROVIDER, except in the case of willful misconduct or gross negligence.

2.5. Scope of application. This MSA applies to the contracts that the SERVICE RECIPIENT enters into by accepting a Service Order, in the course of a business or professional activity, regardless of the country of its domicile. It does not apply to those who acquire the Services as consumers under Law 1480 of 2011. Contracts entered into through the SERVICE PROVIDER’s online purchasing platform are governed by the Online Subscription Terms and Conditions published at [URL].

3. CONTRACTUAL ARCHITECTURE AND PRECEDENCE

3.1. Documents. Each Contract is made up of the following documents, which form a single agreement: (a) the Service Order; (b) the Service-Specific Terms applicable to the selected Services; (c) the DPA, when applicable under clause 8; and (d) this MSA.

3.2. Precedence. In the event of conflict between the documents, the order in which they are listed in clause 3.1 will prevail, with two exceptions: (i) with respect to the processing of Personal Data, the DPA will prevail; and (ii) clauses 10 (Confidentiality) and 12 (Limitation of Liability) of this MSA may be modified only by a provision of the Service Order that expressly refers to the clause it modifies.

3.3. Versions and amendments. The MSA, the Service-Specific Terms and the DPA are published as a document package identified by a common version number, at a web address specific to each version, under https://greyfieldstrata.com/es/legal/. The SERVICE PROVIDER will keep earlier versions published. The Service Order indicates the applicable version of the document package. The SERVICE PROVIDER may publish new versions, which will apply to new Service Orders and, with respect to current Orders, from the next Renewal Period. However, a new version will apply to current Orders with thirty (30) calendar days’ prior notice when (a) the change is required by law, by an authority or by a third party under clause 15.5; or (b) the change does not adversely and materially affect the SERVICE RECIPIENT’s rights. If a change under (a) materially affects the SERVICE RECIPIENT, it may terminate the affected Service by notice within thirty (30) calendar days of the notice, without penalty.

3.4. Technical documentation. The technical documentation published by the SERVICE PROVIDER forms part of the Contract with respect to functional specifications, technical requirements and usage limits of the Services.

4. SERVICES AND MODELS

4.1. Portfolio. The SERVICE PROVIDER offers a multi-product portfolio that includes, among others, the administration of organizations on Git platforms, access to APIs, services based on the Model Context Protocol (MCP), command-line tools (CLI), software development and maintenance with continuous integration and delivery, and on-demand or subscription platforms.

4.2. Scope by service line. The technical scope, service levels, acceptable use policies and limitations of each Service are defined in the respective Service-Specific Terms, which are incorporated by reference upon signing the Service Order.

4.3. Service Order variables. Service Orders specify the individual variables of each transaction: identification of the SERVICE RECIPIENT, Services contracted, User volumes, consumption limits, technical parameters, terms, commercial conditions and prices.

4.4. Additions, removals and changes. The addition, removal or modification of Services or quantities will be documented through a new Service Order or an amendment Order signed by the Parties. Unless otherwise agreed, (a) additional Services or quantities will be aligned with the current period of the Order to which they are added and will expire with it; and (b) reductions of Services or quantities will take effect only at the start of the next Renewal Period.

4.5. Change requests. Activities that exceed the scope of a Service Order or of the Service-Specific Terms will be quoted and carried out only upon the SERVICE RECIPIENT’s written acceptance, at the SERVICE PROVIDER’s current rates or at those agreed.

4.6. Third-Party Platform restrictions. The Services depend on Third-Party Platforms whose owners may impose or modify usage restrictions. The SERVICE RECIPIENT will comply with those restrictions, which will be binding on it. The SERVICE PROVIDER will use commercially reasonable efforts to notify the SERVICE RECIPIENT of new or modified restrictions affecting the Services thirty (30) calendar days in advance, or within the shorter period the third party grants it.

5. FINANCIAL TERMS AND INVOICING

5.1. Consideration. The SERVICE RECIPIENT will pay the SERVICE PROVIDER the fees and charges set out in each Service Order.

5.2. Offer and formation. Each Service Order constitutes a commercial offer by the SERVICE PROVIDER, valid for thirty (30) calendar days from its issue and subject to the verification provided for in clause 7.6. The Contract is formed upon the SERVICE RECIPIENT’s acceptance, expressed by signing the Service Order without modifications and sending it to the SERVICE PROVIDER, without the latter’s signature being required. Any modification introduced by the SERVICE RECIPIENT will constitute a new proposal, which will bind the SERVICE PROVIDER only if it accepts it in writing. Once the offer period has expired without acceptance, the SERVICE PROVIDER may revise the prices.

5.3. Accrual and invoicing. Recurring fees will accrue from the Term Start Date until the last day of the month in which the Service ends and will be invoiced in advance on a quarterly basis, unless the Service Order states otherwise. The initial setup fee will be invoiced upon signing the Service Order. Overage consumption will be invoiced monthly in arrears, based on the SERVICE PROVIDER’s metering records, which will be conclusive absent manifest error. The SERVICE PROVIDER will issue electronic sales invoices in accordance with DIAN regulations. Amounts the SERVICE PROVIDER pays on behalf of the SERVICE RECIPIENT are governed by clause 5.13.

5.4. Currency. Fees will be expressed in the pricing currency stated in the Service Order. When the SERVICE RECIPIENT is resident in Colombia and the fee is expressed in United States dollars, payment will be made in Colombian pesos at the Representative Market Rate (TRM) certified by the Financial Superintendence of Colombia in effect on the invoice date. In that case, the peso amount stated in the Service Order is indicative and will vary in each billing period according to the applicable TRM.

5.5. Taxes. Fees do not include taxes, levies or contributions, which will be added where applicable.

5.5.1. Recipients resident in Colombia. The SERVICE RECIPIENT may make the withholdings required by Colombian law and will deliver the corresponding certificates.

5.5.2. Non-resident Recipients. When the SERVICE RECIPIENT is neither resident nor has a permanent establishment in Colombia, it declares that it will use the Services exclusively abroad and undertakes to provide the information and supporting documents the SERVICE PROVIDER requires to apply the tax treatment for exported services. If the SERVICE RECIPIENT is required by the law of its country to make withholdings, the Parties will cooperate to apply any applicable double taxation treaties; to that end, the SERVICE PROVIDER will deliver its tax residence certificate and the SERVICE RECIPIENT the receipts for the withholdings made. To the extent the withholding exceeds the rate of the applicable treaty, or there is no treaty, the SERVICE RECIPIENT will increase the payment by the amount necessary for the SERVICE PROVIDER to receive the net invoiced amount. Indirect taxes arising in the SERVICE RECIPIENT’s country from the import of the Services, including those payable through self-assessment or reverse-charge mechanisms, will be borne by it.

5.6. Payment term and method. Invoices will be paid within thirty (30) calendar days of issue, by transfer to the account indicated by the SERVICE PROVIDER, without set-off, counterclaim or deduction other than legal withholdings. The SERVICE RECIPIENT’s internal procedures, such as purchase orders or supplier registration, will not suspend or extend that term. Bank and transfer costs will be borne by whoever incurs them.

5.7. Invoice disputes. Disputes over the content of an electronic invoice will be raised within the term provided in article 773 of the Colombian Commercial Code. When the SERVICE RECIPIENT is not resident in Colombia, disputes will be raised within fifteen (15) calendar days of receipt of the invoice. If the SERVICE RECIPIENT disputes in good faith part of the amount invoiced, it will pay the undisputed part on time, and the Parties will seek to resolve the difference within fifteen (15) calendar days.

5.8. Late payment. Amounts not paid on time will accrue default interest at the maximum rate permitted by Colombian law, without prejudice to the recovery of reasonable collection costs. For obligations denominated in foreign currency owed by non-resident Recipients, default interest will be calculated at the lower of: one percent (1%) per month, or the maximum rate permitted by applicable law. The costs of intermediary banks in international transfers will be borne by the SERVICE RECIPIENT.

5.9. Annual adjustment. The SERVICE PROVIDER may adjust the fees once per calendar year, by written notice at least ninety (90) calendar days in advance. If the adjustment exceeds the greater of seven percent (7%) and the annual change in the consumer price index for all OECD countries (all items), published by the Organisation for Economic Co-operation and Development for the latest twelve (12) month period available on the date of the notice, the SERVICE RECIPIENT may terminate the affected Service without penalty, by notice within thirty (30) calendar days of the notice of adjustment. Termination will take effect on the date the adjustment would have entered into force. When the pricing currency of the Service Order is the Colombian peso, the reference index will be the annual change in the Consumer Price Index certified by DANE.

5.10. Third-Party Charges. The SERVICE PROVIDER may adjust Third-Party Charges in the same proportion in which the relevant third party increases its prices, giving notice as far in advance as reasonably possible. These adjustments are not subject to the threshold in clause 5.9.

5.11. Overage use. If the SERVICE RECIPIENT exceeds the limits of the Service Order (Users or seats, calls, volume, connectors or others), the SERVICE PROVIDER will invoice the excess at the overage rate stated in the Service Order or, failing that, at the current list rate. When the excess is recurring, the recurring fees will be adjusted for the remainder of the current period.

5.12. Refunds. Amounts paid are non-refundable, except where the Contract expressly provides for a pro rata refund of amounts prepaid and unused, which will occur in the cases of clauses 3.3, 5.9, 11.2, 13.2, 14.3, 15.4, 15.5 and upon termination for breach by the SERVICE PROVIDER.

5.13. Payments on behalf of the SERVICE RECIPIENT. When the Service-Specific Terms or the Service Order provide for the SERVICE PROVIDER to purchase or pay for third-party products or services in the name and on behalf of the SERVICE RECIPIENT, the SERVICE PROVIDER will act as agent. The corresponding amounts (a) will be reimbursed without margin, together with the associated taxes, withholdings and transaction costs; (b) do not constitute consideration for the Services; (c) will be documented and invoiced in accordance with the rules applicable to payments on behalf of third parties; and (d) may be required in advance. The SERVICE PROVIDER will not be obliged to make payments on behalf of the SERVICE RECIPIENT until the latter has provided the corresponding funds.

6. SUSPENSION

6.1. Suspension for late payment. If any undisputed amount remains unpaid for more than fifteen (15) calendar days after its due date, the SERVICE PROVIDER may suspend the Services in whole or in part, after ten (10) calendar days’ written notice. Recurring fees will continue to accrue during the suspension. The Services will be restored within two (2) business days after full payment of the amount owed.

6.2. Other grounds. The SERVICE PROVIDER may suspend a Service in whole or in part, with prior notice where reasonably possible, if: (a) it is entitled to terminate it under clauses 17.7, 17.8 or 17.9; (b) the owner of a Third-Party Platform requires it; (c) the law or a competent authority requires it; or (d) it is necessary to protect the security of the systems of the SERVICE PROVIDER, the SERVICE RECIPIENT or third parties. The suspension will remain in place until the cause has been resolved. In the case of (a), fees will continue to accrue; in the cases of (b) to (d) not attributable to the SERVICE RECIPIENT, the recurring fees for the suspension period will be credited pro rata.

6.3. No liability. Suspension carried out under this clause will not give rise to any liability for the SERVICE PROVIDER for interruption or loss of continuity of the SERVICE RECIPIENT’s business.

7. OBLIGATIONS OF THE PARTIES AND USE OF THE SERVICES

7.1. SERVICE PROVIDER’s obligations. The SERVICE PROVIDER will provide the Services with due professional diligence, through trained personnel, in accordance with the Service-Specific Terms, generally accepted industry standards and applicable laws.

7.2. SERVICE RECIPIENT’s obligations. The SERVICE RECIPIENT undertakes to: (a) provide in a timely manner the information, access and cooperation reasonably required for the provision of the Services; (b) designate a responsible contact for the SERVICE PROVIDER; (c) use the Services in accordance with the Contract and the law; (d) be responsible for the acts and omissions of its Users and Affiliates; (e) keep current the licenses and accounts of Third-Party Platforms for which it is responsible; and (f) ensure the lawfulness of the Recipient Data, including the authorizations of the data subjects of Personal Data.

7.3. General use restrictions. Unless expressly authorized in the Service Order, the SERVICE RECIPIENT may not: (i) sublicense, resell, lease or make the Services available to third parties; (ii) reverse engineer, decompile or disassemble the Provider Tools, except to the extent the law expressly permits; (iii) circumvent security, authentication or usage-limit mechanisms; (iv) use the Services for unlawful activities or activities that infringe third-party rights; (v) use the Services to develop a competing product or service; or (vi) share credentials between Users.

7.4. Mutual security. Each Party will use reasonable efforts to (a) scan its systems with generally accepted malicious code detection software; (b) protect its computing environments in accordance with accepted industry standards; and (c) correct the vulnerabilities of which it becomes aware. Each Party will notify the other, without undue delay, of security incidents of which it becomes aware and that may affect the Services.

7.5. Export controls and sanctions. The SERVICE RECIPIENT will not use or allow access to the Services in breach of applicable export control or economic sanctions laws, including those of the United States of America and the European Union. The SERVICE RECIPIENT declares that neither it nor the Affiliates or third parties to whom it gives access are designated or sanctioned under those laws.

7.6. Anti-money laundering and anti-corruption. Each Party declares that its funds come from lawful activities; that neither it nor its shareholders, directors or ultimate beneficial owners are included in national or international restrictive lists related to money laundering, terrorist financing or the proliferation of weapons of mass destruction; and that it will comply with applicable anti-corruption laws. Each Party may screen the other against those lists at any time.

7.7. Restricted territories. The Services are not offered in countries or territories subject to comprehensive sanctions of the United States of America, the European Union or the United Nations, nor in those where the Third-Party Platforms on which the Services depend restrict their availability. The SERVICE PROVIDER may decline to accept Service Orders, suspend the Services or terminate them without liability when their provision involves access from those territories or infringes those restrictions.

8. PERSONAL DATA PROTECTION

8.1. Conditional application of the DPA. The DPA will enter into force and be binding only if, and to the extent that, the nature of the Services described in a Service Order requires the SERVICE PROVIDER to process Personal Data on behalf of and under the instructions of the SERVICE RECIPIENT, as Processor.

8.2. Non-application. If the Services consist strictly of the provisioning of automated technical infrastructure, the consumption of standardized APIs or components self-hosted by the SERVICE RECIPIENT, in which the SERVICE PROVIDER neither has access to nor processes the SERVICE RECIPIENT’s Personal Data, the DPA will not apply to that Service Order. The transit of Personal Data through components hosted by the SERVICE PROVIDER constitutes processing, even if transitory.

8.3. Automatic activation. The Service Order will state whether the DPA applies. However, the DPA will be activated automatically, without the need to amend the Service Order, from the moment the SERVICE PROVIDER processes Personal Data on behalf of the SERVICE RECIPIENT, regardless of the statement contained in it. The Parties may update the Service Order to reflect the description of the processing.

8.4. Managed Git Organizations Service. With respect to the Managed Git Organizations Service, the DPA is always deemed applicable, with the standard description of the processing set out in its Annex 1, unless the Service Order extends it.

8.5. Data processed as Controller. The contact details of the SERVICE RECIPIENT’s representatives, employees and Users that the SERVICE PROVIDER receives to manage the commercial relationship, billing and support will be processed by it as Controller, in accordance with its Personal Data Processing Policy published at https://greyfieldstrata.com/es/legal/privacidad/.

9. INTELLECTUAL PROPERTY

9.1. The SERVICE PROVIDER’s. Nothing in the Contract transfers the Parties’ pre-existing intellectual property. The SERVICE PROVIDER, or its licensors, retains exclusive ownership of its trademarks, including Greyfield Strata, and of the Provider Tools.

9.2. The SERVICE RECIPIENT’s. The SERVICE RECIPIENT retains exclusive ownership of the Recipient Data, its repositories and source code, its business models and any proprietary information passing through the Services.

9.3. Custom Developments. Once the corresponding full price has been paid, the economic rights in the Custom Developments will be deemed assigned to the SERVICE RECIPIENT. That assignment does not include the Provider Tools incorporated in the Custom Developments, to which the license in clause 9.4 will apply.

9.4. Tools implemented in the SERVICE RECIPIENT’s environments. The SERVICE PROVIDER grants the SERVICE RECIPIENT a non-exclusive, non-transferable license to use internally the Provider Tools it implements in the SERVICE RECIPIENT’s environments during the term of the Service. Upon termination of the Service, the SERVICE RECIPIENT will retain a non-exclusive, perpetual, non-transferable license to use internally the Provider Tools implemented in its environments as of that date, without the right to support, updates or redistribution. This perpetual license does not apply to components provided by subscription under the MCP, API & CLI Subscription Service Terms.

9.5. Feedback. The SERVICE PROVIDER may freely use, without any obligation, the comments and suggestions the SERVICE RECIPIENT makes about the Services.

9.6. Usage data. The SERVICE PROVIDER may collect and use technical and usage data from the Services (such as consumption, performance and error metrics) to provide and support the Services, verify compliance with the Contract and improve its products, provided that such data are used in aggregated or anonymized form and do not identify the SERVICE RECIPIENT or any natural person. In no case will the SERVICE PROVIDER use the content of the Recipient Data to train Artificial Intelligence models.

9.7. Open source. Open-source components included in the Services or deliverables are governed by their respective licenses. The SERVICE PROVIDER will identify them at the SERVICE RECIPIENT’s request.

9.8. Use of name and commercial references. Neither Party will use the other’s name or trademarks without its prior written consent, except: (a) to the extent necessary to provide the Services; (b) when required by law; and (c) that the SERVICE RECIPIENT authorizes the SERVICE PROVIDER to include its name and logo in client listings on its website and in its commercial presentations, in accordance with the brand guidelines the SERVICE RECIPIENT provides, unless the Service Order states otherwise. The SERVICE RECIPIENT may revoke this authorization at any time by written notice, and the SERVICE PROVIDER will remove the references within thirty (30) calendar days. Case studies, press releases and statements attributing opinions to the SERVICE RECIPIENT will require its prior written approval.

10. CONFIDENTIALITY

10.1. Confidential Information. Confidential Information is all technical, commercial or financial information, including API documentation, engineering specifications, Recipient Data and Service Order prices, that one Party (the “Disclosing Party”) discloses to the other (the “Receiving Party”) in connection with the Contract and that the Receiving Party knows or should reasonably know is confidential.

10.2. Obligation. The Receiving Party will use the Confidential Information solely to perform the Contract and will protect it with the same degree of care it uses for its own confidential information, which in no case will be less than reasonable care.

10.3. Representatives. The Receiving Party may disclose the Confidential Information to its Affiliates, employees, contractors and professional advisers who need to know it to perform the Contract and are subject to substantially equivalent confidentiality obligations. The Receiving Party will be liable for any breach by those persons.

10.4. Disclosure required by law. If the Receiving Party is legally required to disclose Confidential Information, it will notify the Disclosing Party with due notice, to the extent the law permits, so that the latter may seek the appropriate protective measures, and will limit the disclosure to what is strictly required.

10.5. Exclusions. Confidential Information does not include information that: (a) is or becomes public without fault of the Receiving Party; (b) the Receiving Party lawfully knew before its disclosure; (c) the Receiving Party lawfully receives from a third party not bound by a duty of confidentiality; or (d) the Receiving Party develops independently, without use of the Confidential Information.

10.6. Duration. The obligations in this clause will apply during the term of the Contract and for three (3) years after the termination of the last Service. With respect to trade secrets, source code and Recipient Data, they will apply for as long as that information remains confidential.

10.7. Return and destruction. Upon termination of the Contract, or earlier at the Disclosing Party’s request, the Receiving Party will return or destroy the Confidential Information, except for copies it must keep by legal requirement or to defend its rights, which will remain subject to this clause. Copies in backup systems will be deleted in accordance with ordinary rotation cycles.

10.8. Injunctive relief. Breach of this clause may cause harm that is difficult to remedy, so the affected Party may seek from the competent authority the appropriate interim measures, without prejudice to any other actions available.

11. WARRANTIES AND DISCLAIMER

11.1. SERVICE PROVIDER’s warranties. The SERVICE PROVIDER warrants that: (a) it will provide the Services with professional diligence and in accordance with the Service-Specific Terms; (b) it will not intentionally introduce malicious code into the SERVICE RECIPIENT’s environments; and (c) it has the capacity and authority to enter into the Contract.

11.2. Remedy. The SERVICE RECIPIENT will report any breach of the warranty in clause 11.1(a) within thirty (30) calendar days after the deficient Service was provided. The SERVICE PROVIDER will correct or re-perform the Service at no additional cost; if that is not possible within a reasonable time, the SERVICE RECIPIENT may terminate the affected Service and receive a pro rata refund of amounts prepaid and unused. This is the exclusive remedy for breach of that warranty.

11.3. Disclaimer. Except for the express warranties in the Contract, and to the maximum extent permitted by law, the SERVICE PROVIDER gives no warranties of any other kind, including warranties of merchantability or fitness for a particular purpose, and does not warrant that the Services will operate uninterrupted or error-free.

11.4. No advice; SERVICE RECIPIENT’s decisions. The results, reports, recommendations and content generated through the Services, including those produced by Artificial Intelligence models, are support tools. The SERVICE RECIPIENT is solely responsible for validating them, subjecting them to human review and for the decisions it makes based on them.

11.5. SERVICE RECIPIENT’s warranties. The SERVICE RECIPIENT warrants that it has the capacity and authority to enter into the Contract and that the Recipient Data and their use in the Services do not infringe the law or third-party rights.

12. LIMITATION OF LIABILITY

12.1. General cap. Except as provided in clauses 12.3 and 12.4, each Party’s total aggregate liability to the other for claims arising from a Service Order will not exceed the greater of: (a) the total amounts paid and payable by the SERVICE RECIPIENT under the Service Order giving rise to the claim during the twelve (12) months preceding the triggering event; or (b) the equivalent of ten thousand United States dollars (USD 10,000).

12.2. Excluded damages. Except as provided in clause 12.4, neither Party will be liable to the other for indirect, consequential, incidental or punitive damages, lost profits, loss of business opportunities, revenue or reputation, or interruption of operations, even if advised of their possibility. Fees owed to the SERVICE PROVIDER do not constitute lost profits.

12.3. Special cap. Liability arising from breach of the confidentiality obligations (clause 10) or of Personal Data protection obligations (DPA) will not exceed two (2) times the amount resulting from clause 12.1. This special cap includes the reasonable costs of handling the incident and of notifying data subjects and authorities.

12.4. Exclusions from the limits. The limitations in this clause will not apply to: (a) damage caused by willful misconduct or gross negligence; (b) the SERVICE RECIPIENT’s payment obligations; (c) the indemnity obligations in clauses 13.1 and 13.3; or (d) the SERVICE RECIPIENT’s use of the Services in breach of the use restrictions or of the SERVICE PROVIDER’s intellectual property rights.

12.5. Data loss. The SERVICE PROVIDER will not be liable for loss or corruption of data, except when directly caused by an act or omission of its personnel in the exercise of the administrative access granted. In that case, its liability will be limited to the reasonable costs of recovery or restoration from available backups, within the cap in clause 12.1.

12.6. Service credits. When the Service-Specific Terms provide for credits for failure to meet service levels, those credits will be the exclusive remedy for the availability or response-time failures to which they refer, and will count toward the cap in clause 12.1.

12.7. Third-Party Platforms. The SERVICE PROVIDER will not be liable for failures, outages, changes or suspensions of Third-Party Platforms, including global outages of Git platforms or Artificial Intelligence model providers.

12.8. Scope. The limitations in this clause apply regardless of the basis of the claim, whether contractual or non-contractual, to the maximum extent permitted by law.

13. INDEMNITY

13.1. SERVICE PROVIDER’s indemnity. The SERVICE PROVIDER will defend and hold harmless the SERVICE RECIPIENT against third-party claims alleging that the Provider Tools, as supplied, infringe third-party intellectual property rights in Colombia, the United States of America, the European Union and the other countries indicated in the Service Order, and will pay the judgments and the settlements it approves. This obligation does not apply when the claim arises from: (a) combination with products, data or technology not supplied by the SERVICE PROVIDER; (b) modifications not made by the SERVICE PROVIDER or its subcontractors; (c) use of a superseded version after notice was given of the need to use the new one; (d) the Recipient Data or its instructions; or (e) breach of the Contract by the SERVICE RECIPIENT. When the claim relates to Third-Party components or Platforms, the SERVICE PROVIDER’s liability will be limited to what it actually recovers from the relevant third party.

13.2. Alternatives. Faced with an actual or likely claim of the type in clause 13.1, the SERVICE PROVIDER may, at its option: (a) obtain the right for the SERVICE RECIPIENT to continue using the affected item; (b) modify or replace it without altering the fundamental nature of the Service; or (c) terminate the affected Service and refund pro rata the amounts prepaid and unused. Clauses 13.1 and 13.2 set out the SERVICE PROVIDER’s entire liability for infringement of intellectual property rights.

13.3. SERVICE RECIPIENT’s indemnity. The SERVICE RECIPIENT will defend and hold harmless the SERVICE PROVIDER and its Affiliates against third-party claims, including administrative sanctions, arising from: (a) the Recipient Data or the lack of authorizations from their data subjects; (b) the use of the Services by the SERVICE RECIPIENT, its Users or Affiliates in breach of the Contract or the law; or (c) compliance with the SERVICE RECIPIENT’s instructions.

13.4. Procedure. The indemnity obligation is subject to the indemnified Party: (a) notifying the other of the claim in a timely manner; (b) giving it control of the defense and of any settlement; (c) cooperating reasonably, at the indemnifying Party’s expense; and (d) not admitting liability or entering into settlements without its prior written authorization. The indemnified Party may participate in the defense with counsel of its choice and at its own cost.

14. FORCE MAJEURE

14.1. Exemption. Neither Party will be liable for delay or failure to perform its obligations caused by force majeure or fortuitous events, or by circumstances beyond its reasonable control, such as natural disasters, epidemics, acts of authority, war, civil unrest, widespread internet or power failures, massive cyberattacks not attributable to a lack of reasonable security measures and failures of Third-Party Platforms. Force majeure does not excuse payment obligations.

14.2. Duty to notify and mitigate. The affected Party will notify the other of the event as soon as possible and will use reasonable efforts to mitigate its effects and resume performance.

14.3. Termination. If the event causes substantial deficiencies in a Service for more than thirty (30) calendar days, either Party may terminate the affected Service by written notice, with a pro rata refund of amounts prepaid and unused.

15. CHANGES TO THE SERVICES, EXTERNAL FACTORS AND OBSOLESCENCE

15.1. Modifications. The SERVICE PROVIDER may modify the Services provided that it does not alter their fundamental nature, except as provided in clauses 15.4 and 15.5. It will use reasonable efforts to notify the SERVICE RECIPIENT of significant changes.

15.2. Updates. The SERVICE RECIPIENT will implement in a timely manner the updates and fixes that the SERVICE PROVIDER makes available to it at no cost. Improvements that add new functionality may be subject to additional charges.

15.3. Technical changes. If the SERVICE PROVIDER introduces a change to the APIs, formats, protocols or technical requirements that requires adjustments to the SERVICE RECIPIENT’s systems, it will give at least three (3) months’ notice. When the change is imposed by a third party, it will give notice as soon as possible.

15.4. Obsolescence. The SERVICE PROVIDER may declare obsolete (a) a version of a Service, with at least six (6) months’ notice from the general availability of the version replacing it; or (b) a Service in its entirety, with at least six (6) months’ notice. If the new version is subject to additional charges, the SERVICE RECIPIENT may terminate the affected Service by notice within thirty (30) calendar days of the notice. In the case of (b), the Service will terminate on the obsolescence date, with a pro rata refund of amounts prepaid and unused.

15.5. External factors. The SERVICE PROVIDER may terminate or modify a Service in whole or in part, or the terms on which it is provided, if: (a) the Service depends on an agreement with a third party or on a Third-Party Platform that is modified, restricted or terminated; (b) the Service becomes unlawful or contrary to an order of a competent authority; or (c) the Service is the subject of a claim for infringement of third-party rights. The SERVICE PROVIDER will give ninety (90) calendar days’ notice or the shorter period the event allows. If the modification fundamentally or detrimentally alters the nature of the Service, the SERVICE RECIPIENT may terminate it by notice within thirty (30) calendar days of the notice. In all cases, amounts prepaid and unused will be refunded pro rata, without any additional penalty or compensation.

16. AUDIT AND USAGE DECLARATIONS

16.1. Usage declarations. When the fee for a Service depends on variables the SERVICE PROVIDER cannot measure directly (such as the number of Users, applications or integrations), the SERVICE RECIPIENT will deliver a usage declaration at the frequency and in the format indicated by the SERVICE PROVIDER, and will maintain reasonable internal controls that allow it to be verified.

16.2. Verification. The SERVICE PROVIDER may verify compliance with the Contract’s usage limits once every twelve (12) months, with at least ten (10) business days’ notice, during business hours and subject to the SERVICE RECIPIENT’s reasonable security and confidentiality policies. It may do so more frequently if it has reasonable grounds to suspect a breach or if a previous verification revealed one. Verification may be carried out through remote or automated reports.

16.3. Consequences. If the verification reveals usage above what was contracted, the SERVICE RECIPIENT will pay the corresponding charges in accordance with clause 5.11. If the difference exceeds five percent (5%) of the charges for the period verified, the SERVICE RECIPIENT will also bear the reasonable costs of the verification.

17. DURATION, TERM, RENEWAL AND TERMINATION

17.1. Duration of the MSA. This MSA will remain in force indefinitely for as long as at least one Service Order is in force. Either Party may terminate it by written notice ninety (90) calendar days in advance, provided that there are no Service Orders in force. If there are Orders in force, the MSA will continue to govern them until their full technical and financial termination.

17.2. Term start. The Initial Term of each Service Order will begin on the later of (a) the first day of the month following the month in which the Services are first available to the SERVICE RECIPIENT; and (b) the first day of the month following the date of the last signature of the Service Order (the “Term Start Date”). Days of service before the Term Start Date will not be invoiced.

17.3. Initial Term. Unless the Service Order provides otherwise, the Initial Term will be thirty-six (36) months from the Term Start Date.

17.4. Automatic renewal. On expiry of the Initial Term, the Service Order will renew automatically for successive periods of thirty-six (36) months, or of the duration stated in the Service Order (each, a “Renewal Period”), unless either Party gives written notice of its decision not to renew at least ninety (90) calendar days before the end of the current period. The SERVICE PROVIDER will send the SERVICE RECIPIENT a reminder of the expiry date at least one hundred and twenty (120) calendar days before that expiry. Failure to send the reminder will not prevent renewal.

17.5. Orders without automatic renewal. When the Service Order states that it is not subject to automatic renewal, it will terminate on expiry of its term, unless the Parties extend it in writing.

17.6. Early termination by the SERVICE RECIPIENT. The SERVICE RECIPIENT may terminate a Service Order early by written notice ninety (90) calendar days in advance. In that case it will pay (a) all amounts accrued up to the effective date of termination; and (b), as a penalty clause, an amount equal to fifty percent (50%) of the recurring fees that would have accrued during the remaining time of the current period. Initial setup fees and advance payments will not be refundable in this case.

17.7. Termination for breach. Either Party may terminate a Service Order if the other commits a material breach and fails to cure it within thirty (30) calendar days of written notice describing it, or within fifteen (15) calendar days if the breach consists of non-payment. If the breach relates only to one or more Services, termination will be limited to the affected Services. Material breaches include, among others, payment delays exceeding sixty (60) days, breach of clause 10 and use of the Services in breach of clause 7.3.

17.8. Immediate termination. The SERVICE PROVIDER may immediately terminate any Service Order by written notice if the SERVICE RECIPIENT (a) uses the Services for unlawful purposes or in a way that compromises the security of the infrastructure of the SERVICE PROVIDER or third parties; or (b) breaches clauses 7.5, 7.6 or 7.7. The SERVICE RECIPIENT may immediately terminate any Service Order if the SERVICE PROVIDER breaches clause 7.6.

17.9. Dissolution or liquidation. To the extent permitted by applicable law, either Party may terminate this MSA and the Orders in force if the other Party enters into dissolution or liquidation proceedings.

17.10. Effects of termination. Upon termination of a Service Order:

(a) access to the Services and the licenses of use granted under that Order will cease, except as provided in clause 9.4;

(b) all accrued amounts will become immediately payable;

(c) the SERVICE PROVIDER will remove its administrative access and credentials within five (5) business days, and the SERVICE RECIPIENT will revoke the credentials, tokens and permissions granted;

(d) data will be returned or deleted in accordance with the DPA, where applicable, and clause 10.7; and

(e) at the SERVICE RECIPIENT’s request, the SERVICE PROVIDER will provide transition assistance for up to thirty (30) calendar days, at its current rates, and will deliver documentation of the implemented configuration.

17.11. Independence of Orders. Termination of a Service Order will not affect other Orders in force or the MSA, except in the case of termination for non-payment under clause 17.7, in which the SERVICE PROVIDER may terminate all of the SERVICE RECIPIENT’s Service Orders.

17.12. Survival. In addition to those that by their nature must survive, accrued payment obligations and clauses 9, 10, 12, 13, 16 (with respect to prior periods), 17.10, 18 and 19 will survive termination, as will the obligations under the DPA until the data are returned or deleted.

18. GOVERNING LAW AND DISPUTE RESOLUTION

18.1. Governing law. The Contract will be governed by and construed in accordance with the laws of the Republic of Colombia.

18.2. Direct settlement. The Parties will seek to resolve any dispute arising from the Contract through direct negotiation between their representatives, within thirty (30) calendar days of written notice of the dispute. Direct settlement will not be a prerequisite for bringing enforcement actions or for requesting interim measures.

18.3. Resolution mechanism. Disputes not resolved through direct settlement will be resolved as follows: (a) Recipients domiciled in Colombia: (i) disputes whose claims are below fifty (50) current monthly legal minimum wages will be submitted to the competent courts of Bogotá, D.C.; and (ii) all others will be submitted to an arbitral tribunal of the Arbitration and Conciliation Center of the Bogotá Chamber of Commerce, which will decide in law, sit in Bogotá, D.C., conduct proceedings in Spanish and be governed by that Center’s rules, composed of one (1) arbitrator, unless the claims are equal to or greater than one thousand (1,000) current monthly legal minimum wages, in which case it will be composed of three (3) arbitrators. (b) Recipients domiciled abroad: international arbitration administered by the Arbitration and Conciliation Center of the Bogotá Chamber of Commerce, under its International Arbitration Rules and Section Three of Law 1563 of 2012, seated in Bogotá, D.C., Colombia, in the Spanish language unless the Service Order provides for English, and composed of one (1) arbitrator, unless the claims are equal to or greater than five hundred thousand United States dollars (USD 500,000), in which case it will be composed of three (3) arbitrators. The award will be final and binding on the Parties. (c) Collection of amounts owed: enforcement proceedings for the collection of sums of money, including those based on electronic invoices that qualify as negotiable instruments, are excluded from the arbitration agreement and may be brought before the competent courts.

18.4. Interim measures. The foregoing does not prevent either Party from seeking from the competent authority the interim measures necessary to protect its rights.

18.5. Mandatory rules. The choice of Colombian law does not deprive the Parties of the protection of the mandatory rules of other jurisdictions applicable to them. The Parties exclude the application of the United Nations Convention on Contracts for the International Sale of Goods.

19. GENERAL PROVISIONS

19.1. Notices. Notices will be made in writing and sent to the email address indicated in the Service Order or to the most recent address one Party has given the other. Notices of breach or termination will also be sent with a request for acknowledgment of receipt or delivered to the other Party’s address. A notice sent by email will be deemed received on the business day following its sending, unless the sender receives a non-delivery notice. The SERVICE PROVIDER may send technical and operational notices through its portal or through the Services themselves.

19.2. Assignment. Neither Party may assign the Contract without the other’s prior written consent, which may not be unreasonably withheld or delayed. However, either Party may assign it, by written notice to the other, to an Affiliate or to a successor by virtue of a merger, demerger, acquisition or sale of all or a substantial part of the related business, provided that the assignee assumes all of the assignor’s obligations.

19.3. Subcontracting. The SERVICE PROVIDER may subcontract the performance of part of the Services, while remaining responsible for their performance. Subcontracting that involves the processing of Personal Data will be governed by the DPA.

19.4. Independence of the Parties. The Parties are independent contractors. The Contract does not create an employment relationship, partnership, agency or representation between them. Each Party is solely responsible for its own personnel, including salaries, employment benefits, social security contributions and payroll levies.

19.5. Non-solicitation of personnel. During the term of the Contract and for twelve (12) months after its termination, neither Party will actively solicit the engagement of the other’s personnel who have participated directly in the performance of the Services. General job advertisements do not constitute solicitation.

19.6. Severability. If any provision of the Contract is held invalid or unenforceable, it will be deemed modified to the minimum extent necessary to make it valid, without affecting the other provisions.

19.7. No waiver. A Party’s delay or failure to exercise a right does not constitute a waiver of it.

19.8. Entire agreement. The Contract constitutes the entire agreement between the Parties on its subject matter and supersedes any prior agreement, proposal or communication. Pre-printed terms in purchase orders or other documents of the SERVICE RECIPIENT will not apply, even if accepted or signed by the SERVICE PROVIDER.

19.9. Amendments. Except as provided in clause 3.3, the Contract may be amended only by an amendment Service Order or another written document issued by the SERVICE PROVIDER and accepted by the SERVICE RECIPIENT, or by a written document signed by both Parties.

19.10. Electronic signature and counterparts. The Parties accept the validity of electronic and digital signatures under Law 527 of 1999 and its implementing regulations. The Service Order may be accepted by the sole signature, electronic or handwritten, of the SERVICE RECIPIENT, in accordance with clause 5.2. The documents of the Contract may be signed in separate counterparts, which together will constitute a single instrument.

19.11. Language. The Contract is entered into in Spanish. The SERVICE PROVIDER may make an English version available. In the event of any discrepancy, the Spanish version will prevail, unless the Service Order provides that the English version prevails. The English titles of the documents are used for identification purposes only.

19.12. Identification of the SERVICE PROVIDER. References to the SERVICE PROVIDER, to BCL Group S.A.S. or to Greyfield Strata in any document of the Contract will be understood as made to the company identified with NIT 901.371.032, whatever its corporate name may be at any time. Changes of corporate name or trade name will not affect the validity or performance of the Contract and will be communicated to the SERVICE RECIPIENT.