Service Legal Agreements

1. Parties

1.1 On the one hand: the contracting entity responsible for providing the Services (hereinafter, “INVOFOX”):

INVOFOX, Inc., a company of United States nationality, registered with the Delaware Division of Corporations under number 7218056, with registered office at 251 Little Falls Drive, Wilmington, New Castle County, DE 19808, Delaware (United States), with business address at 95 3rd Street, 2nd Floor, San Francisco, CA 94103, California (United States), and email address support@invofox.com.
INVOFOX INC SUCURSAL EN ESPAÑA, a branch of Spanish nationality, with Tax ID (NIF) number W0265699I, with registered office at calle Aranjuez 2, local, 28039 Madrid (Spain), tax and business address at calle Ferrocarril 37, 28045 Madrid (Spain), and email address support@invofox.com.

The CLIENT shall contract the Services with the entity designated in the Order Form.

1.2 On the other hand: the CLIENT, the legal entity contracting the Services of INVOFOX

1.3 Hereinafter, INVOFOX and the CLIENT shall be referred to jointly as the “Parties” and individually as a “Party”.

1.4 The Parties mutually and reciprocally acknowledge that they have sufficient legal capacity to enter into this agreement and to perform their obligations.

2. Purpose of the agreement

2.1 The Parties agree to enter into this data processing agreement in order to regulate the personal data processing operations carried out by INVOFOX, to establish the procedure that will govern the processing of personal data, as well as the rights, responsibilities and obligations inherent to its capacity as data processor (hereinafter, the “Data Processing Agreement” or the “Agreement”).

2.2 Based on the contractual relationship established and the nature of INVOFOX’s services, the CLIENT is the data controller (hereinafter also, the “CONTROLLER”) and INVOFOX is the data processor (hereinafter also, the “PROCESSOR”).

2.3 The Parties agree that this Data Processing Agreement shall be governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter, the “GDPR”), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, the “LOPDGDD”), as well as by the applicable regulations and the other terms set out in the Data Processing Agreement.

2.4 The signature of the Order Form by the CLIENT entails full acceptance of the Data Processing Agreement, unless INVOFOX has expressly accepted its modification in writing.

3. Purpose of the processing

By means of this Data Processing Agreement, the PROCESSOR is authorized to process, on behalf of the CONTROLLER, the personal data necessary for the provision of INVOFOX’s services. The processing shall mainly consist of:

The digitization and processing of the Documents that the CONTROLLER sends to the PROCESSOR through the various channels enabled for that purpose.
The storage of such Documents sent by the CONTROLLER, and of the processed data, on storage servers managed by the PROCESSOR, which shall be accessible to both Parties through the INVOFOX Platform during the Retention Period set out in clause 3.7 of the General Terms and Conditions or as agreed in the Order Form.
The provision of a maintenance and support service for the INVOFOX Platform.
The generation and use of technical metrics and aggregated statistics on the use of the services, which do not include the content of the Documents and do not allow any natural person to be identified, in order to improve the services provided by the PROCESSOR, under the terms of clause 10.4 of the General Terms and Conditions. In no event shall the PROCESSOR use the Documents or the personal data they contain to train or improve artificial intelligence models used to provide services to other clients. The generation of Derived Resources and, where applicable, the retention of data authorized by the CONTROLLER under clause 10.4 of the General Terms and Conditions shall always be carried out in isolation within the CONTROLLER’s account.

4. Duration of the processing

4.1 The processing of personal data covered by this Data Processing Agreement shall be carried out throughout the term of the Contract. However, the Documents and the personal data they contain shall be kept on the Platform during the Retention Period set out in clause 3.7 of the General Terms and Conditions or as agreed in the Order Form, including, where applicable, Minimum Retention. Once such period has elapsed, the PROCESSOR shall not be obliged to keep them and may delete them, unless the CONTROLLER has authorized their retention under clause 10.4 of the General Terms and Conditions.

4.2 Upon termination of the Contract for any reason, the PROCESSOR may keep the personal data during the retention periods set out in clause 7.p) of this Data Processing Agreement and in clause 13.2 of the General Terms and Conditions, as well as during any applicable statutory retention periods. Once such periods have elapsed, the PROCESSOR shall proceed in accordance with the provisions of those clauses.

5. Identification of the information concerned

5.1 The CONTROLLER makes available to the PROCESSOR the information contained in the Documents subject to the processing and digitization services, a non-exhaustive list of which is as follows:

Identification data, such as: first and last names, national ID numbers, passport numbers, tax ID numbers, social security numbers, mutual insurance numbers, public and private health cards, dates of birth, signatures, email addresses, telephone numbers, bank account numbers, IP addresses, etc.
Professional or employment data, such as: professional categories, positions and job titles, professional experience, professional qualifications, licenses, professional association data, salaries, remuneration, withholdings, hirings and terminations, leave, etc.
Academic data, such as: degrees, academic records, specific training, etc.
Other data, such as: usernames and passwords of Authorized Users, geographical areas and Platform usage data.

5.2 The CONTROLLER, in its capacity as data controller, is solely responsible for determining the actual types of personal data it makes available to the PROCESSOR through the Documents. The PROCESSOR does not control, does not systematically review and assumes no liability whatsoever for the specific types of personal information contained in the Documents sent by the CONTROLLER.

In this regard, the CONTROLLER shall in no event make available to the PROCESSOR Documents containing special categories of personal data within the meaning of article 9 of the GDPR (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for the purpose of uniquely identifying a natural person; data concerning health; or data concerning a natural person’s sex life or sexual orientation), or personal data within the meaning of article 10 of the GDPR (data relating to criminal convictions and offences), except with the prior express written agreement of the Parties setting out the enhanced technical and organizational measures and additional safeguards that apply. The CONTROLLER shall hold the PROCESSOR harmless from any claims, damages, losses, penalties or costs arising from the breach of this obligation.

5.3 The categories of data subjects whose personal data may be processed under this Data Processing Agreement are determined exclusively by the CONTROLLER based on the nature, content and origin of the Documents it makes available to the PROCESSOR. In no event shall the PROCESSOR be responsible for determining the categories of data subjects, nor shall it assume any liability in respect thereof, such determination being the full and exclusive responsibility of the CONTROLLER.

6. Obligations of the CONTROLLER

a. To apply and comply with the GDPR, the LOPDGDD and all applicable data protection regulations.
b. At the time of collecting the personal data, to provide the data subjects affected by the processing operations with the information required by the GDPR.
c. To the extent possible, to anonymize or pseudonymize the data and, in any event, to deliver to the PROCESSOR only the data referred to in Clause 5.
d. Where required under the applicable data protection regulations, to carry out a data protection impact assessment of the processing operations to be performed by the PROCESSOR.
e. Where required under the applicable data protection regulations, to carry out the relevant prior consultations.
f. To supervise the processing, including carrying out audits and inspections of the PROCESSOR.
g. To ensure, prior to and throughout the processing, that the PROCESSOR complies with the regulations in force.

7. Obligations of the PROCESSOR

a. To use the personal data subject to processing, or those collected for inclusion, solely for the purpose of this engagement. In no event may the PROCESSOR use the data for its own purposes, except as provided in Clause 10.4 of the General Terms and Conditions.
b. To process the data in accordance with the CONTROLLER’s instructions. If the PROCESSOR considers that any of the instructions infringes the GDPR, the LOPDGDD or any other applicable data protection regulation, the PROCESSOR shall immediately inform the CONTROLLER.
c. To keep a written record of all categories of processing activities carried out on behalf of the CONTROLLER, containing:
i. The name and contact details of the PROCESSOR and of each CONTROLLER on behalf of which the PROCESSOR acts and, where applicable, of the CONTROLLER’s or PROCESSOR’s representative and of the data protection officer.
ii. The categories of processing carried out on behalf of each CONTROLLER.
iii. Where applicable, transfers of personal data to a third country or an international organization, including the identification of such third country or international organization and, in the case of transfers referred to in the second subparagraph of article 49(1) of the GDPR, the documentation of suitable safeguards.
iv. A general description of the technical and organizational security measures relating to:
The pseudonymization and encryption of personal data;
The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and
A process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
d. Not to disclose the data to third parties, unless it has the express authorization of the CONTROLLER, in the legally permissible cases.

The PROCESSOR may disclose the data to other processors of the same CONTROLLER, in accordance with the CONTROLLER’s instructions. In such case, the CONTROLLER shall identify, in advance and in writing, the entity to which the data must be disclosed, the data to be disclosed and the security measures to be applied for the disclosure.

If the PROCESSOR is required to transfer personal data to a third country or to an international organization under Union or Member State law to which it is subject, it shall inform the CONTROLLER of that legal requirement in advance, unless that law prohibits such information on important grounds of public interest.

e. The CONTROLLER authorizes the PROCESSOR to subcontract the services necessary for the provision of the Platform Service to the entities listed from time to time in the updated list of sub-processors available through Invofox’s Trust Center: https://trust.invofox.com (hereinafter, the “Sub-processor List”).

The PROCESSOR undertakes to keep the Sub-processor List up to date and to notify the CONTROLLER, at least fifteen (15) calendar days in advance, of the addition or replacement of any sub-processor, by publishing it at the aforementioned link or, where applicable, through the email address designated by the CONTROLLER to the PROCESSOR under the General Terms and Conditions.

The subcontracted entity, which also has the status of processor, is likewise bound to comply with the obligations set out in this Agreement and the instructions issued by the CONTROLLER. The initial PROCESSOR shall be responsible for regulating the new relationship so that the new PROCESSOR is subject to the same conditions (instructions, obligations, security measures, etc.) and the same formal requirements as the initial PROCESSOR with regard to the proper processing of personal data and the safeguarding of the rights of the data subjects. In the event of a breach by the sub-processor, the initial PROCESSOR shall remain fully liable to the CONTROLLER for the performance of the obligations.

In such case, the subcontracting may be carried out if the CONTROLLER does not object, on reasonable data protection grounds, within fifteen (15) calendar days from the date on which the PROCESSOR has notified the subcontracting in writing.

The PROCESSOR may freely entrust all or part of the processing to any company of the same group that it controls or by which it is controlled, in accordance with article 42 of the Spanish Commercial Code.

f. To maintain the duty of secrecy with respect to the personal data to which it has had access under this engagement, even after its purpose has ended.
g. To ensure that the persons authorized to process personal data expressly undertake in writing to respect confidentiality and to comply with the corresponding security measures, of which they must be duly informed.
h. To keep at the CONTROLLER’s disposal the documentation evidencing compliance with the obligation set out in the preceding paragraph.
i. To ensure the necessary data protection training for the persons authorized to process personal data.
j. To the extent possible, to assist the CONTROLLER in responding to requests to exercise the rights of access, rectification, erasure, objection, restriction of processing, data portability and not to be subject to automated individual decision-making.

Where data subjects exercise their rights of access, rectification, erasure and objection, restriction of processing, data portability and not to be subject to automated individual decision-making directly before the PROCESSOR, the PROCESSOR must notify the CONTROLLER by email. Such notification must be made immediately and in no event later than the business day following receipt of the request, together, where applicable, with any other information that may be relevant to resolve the request.

k. At the time of collecting the data, the PROCESSOR must provide the information relating to the data processing to be carried out.
l. To notify the CONTROLLER, without undue delay and in any event within a maximum of forty-eight (48) hours, through the email address designated by the CONTROLLER to the PROCESSOR under the General Terms and Conditions, of any personal data breaches under its responsibility of which it becomes aware, together with all information relevant for documenting and reporting the incident in accordance with the applicable data protection regulations.

Notification shall not be required where such breach is unlikely to result in a risk to the rights and freedoms of natural persons.

m. To support the CONTROLLER, where appropriate, in carrying out data protection impact assessments.
n. To make available to the CONTROLLER all information necessary to demonstrate compliance with its obligations.
o. In any event, it shall implement mechanisms to:
i. Ensure the quasi-permanent confidentiality, integrity, availability and resilience of processing systems and services.
ii. Restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
iii. Regularly test, assess and evaluate the effectiveness of the technical and organizational measures implemented to ensure the security of the processing.
p. In accordance with the General Terms and Conditions, upon termination of the Contract, the CLIENT shall have a period of sixty (60) calendar days to consult and download, through the Platform or the API, the Documents, the Extracted Data and the corrections that are kept in accordance with the applicable Retention Period, without INVOFOX being obliged to deliver them to the CLIENT. Once such period has elapsed, INVOFOX shall not be obliged to store the Extracted Data, including personal data, or any Documents of the CLIENT, and may delete them. Where applicable, once such period has elapsed, upon the express written request of the CONTROLLER, the PROCESSOR shall delete all personal data or return them to the CONTROLLER, and shall destroy any existing copies, without such deletion extending to the Derived Resources defined in clause 10.4 of the General Terms and Conditions to the extent that they do not contain personal data, unless European Union or Member State law requires the retention of the personal data.
q. For business continuity and disaster recovery purposes, the PROCESSOR may keep the Extracted Data and other personal data stored in the Platform’s database in backup copies for a maximum period of twelve (12) months from their creation, even if they have been deleted from the Platform because the Retention Period, including Minimum Retention, has elapsed or because the Contract has been terminated. During such period, the data contained in the backup copies (i) shall be protected with the same security measures as the data on the Platform; and (ii) shall not be subject to any other processing or used for any other purpose. Once the maximum period indicated has elapsed, the backup copies shall be deleted.

8. Liability of the PROCESSOR

8.1 The PROCESSOR shall be considered a CONTROLLER if it uses the data for another purpose, discloses them or uses them in breach of this Data Processing Agreement. In such cases, the PROCESSOR shall be liable for the infringements it has personally committed.

8.2 The PROCESSOR shall indemnify the CONTROLLER for any direct and foreseeable damages that may result from the breach of the obligations undertaken under this Data Processing Agreement, in accordance with and within the limits set out in clause 11.3 of the General Terms and Conditions, which the Parties agree shall also apply to this Data Processing Agreement.

8.3 INVOFOX holds a valid civil liability insurance policy with a solvent and reputable insurer. Among others, the policy includes (1) coverage for civil liability arising from personal data breaches and (2) coverage for penalties for personal data breaches.

9. Notices

9.1 Notices between the Parties in connection with the Data Processing Agreement shall be given in writing by email.

9.2 Notices addressed to the CLIENT shall be sent to the email address designated by the CLIENT in the CLIENT’s identification details; notices addressed to INVOFOX shall be sent to the email address support@invofox.com.

9.3 For all notices between the Parties, the date recorded in the system used as the date of sending shall be deemed valid for the purpose of calculating time periods, regardless of the date on which the recipient accessed it.

10. International data transfers

10.1 The Parties agree that personal data may only be transferred to and/or kept by a recipient outside the European Economic Area (hereinafter, the “EEA”) in a country, territory or jurisdiction not covered by an adequacy decision issued by the European Commission by way of exception and only if necessary to fulfil the obligations of the Data Processing Agreement.

10.2 Where applicable, such transfer shall be governed, in addition to the provisions of the Data Processing Agreement, by the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, in the module corresponding to the actual data flow.

The standard contractual clauses are incorporated into this Data Processing Agreement by reference.

In the event of any contradiction, inconsistency or incompatibility between the provisions of the Data Processing Agreement and those of the standard contractual clauses, the provisions of the standard contractual clauses shall prevail. Any replacement, revision or update of the standard contractual clauses adopted in accordance with the GDPR shall automatically replace the standard contractual clauses incorporated into the Data Processing Agreement.

10.3 In addition to the availability of an adequacy decision or the adoption of standard contractual clauses, other mechanisms provided for by the applicable data protection legislation may apply.

10.4 The CONTROLLER expressly agrees that personal data may be transferred to and/or stored by sub-processors outside the EEA, including to or in a country, territory or jurisdiction not covered by an adequacy decision issued by the European Commission, in order to provide the Platform Service, provided that the conditions of clauses 10.2 and 10.3 of the Data Processing Agreement are met.

11. Miscellaneous

11.1 The Data Processing Agreement forms an integral part of the Contract for all purposes. Accordingly, the term of this Data Processing Agreement is subject to the duration of the contractual relationship established by the Parties.

In the event of any contradiction, inconsistency or incompatibility between the General Terms and Conditions and the Data Processing Agreement, the Data Processing Agreement shall prevail over the General Terms and Conditions with respect to its subject matter.

11.2 The legal relationship established between the Parties as CONTROLLER and PROCESSOR is governed solely by this Data Processing Agreement and by the Privacy Policy of the INVOFOX Platform, which constitutes the only valid data processing agreement between the Parties and supersedes any prior agreement or commitment, written or oral, on the same subject matter, and may only be amended by an agreement signed by both Parties.

11.3 The Parties may not assign all or part of their rights or obligations under this Data Processing Agreement to any third party without the prior written consent of the other Party.

However, as the sole exception, prior written consent shall not be required where INVOFOX assigns all or part of its rights or obligations to companies, subsidiaries or branches controlled by it or belonging to its same group of companies.

11.4 Any change of address of either Party must be notified to the other immediately and by a means that guarantees receipt of the message.

11.5 If any of the clauses or provisions of the Data Processing Agreement is held to be null, voidable, illegal or unenforceable, the validity, legality and enforceability of the remaining provisions shall not be affected or impaired thereby.

11.6 INVOFOX may review, update and amend the Data Processing Agreement at any time to adapt it to new legislation, case law or interpretations of the Spanish Data Protection Agency, as well as to reflect any changes that may arise in the Platform and the Services. INVOFOX shall inform the CLIENT in writing prior to their entry into force.

12. Data Protection Officer

Equal Consulting, S.L.P., with Tax ID (NIF) number B86823267, address at calle Santa Engracia 17, planta 6, 28010 Madrid (Spain), email equaldpo@equalprotecciondedatos.com and telephone +34 914 456 569, has been appointed as Data Protection Officer.

Last revised: October 2026

1. Parties

1.1 On the one hand: the contracting entity responsible for providing the Services (hereinafter, “INVOFOX”):

INVOFOX, Inc., a company of United States nationality, registered with the Delaware Division of Corporations under number 7218056, with registered office at 251 Little Falls Drive, Wilmington, New Castle County, DE 19808, Delaware (United States), with business address at 95 3rd Street, 2nd Floor, San Francisco, CA 94103, California (United States), and email address support@invofox.com.
INVOFOX INC SUCURSAL EN ESPAÑA, a branch of Spanish nationality, with Tax ID (NIF) number W0265699I, with registered office at calle Aranjuez 2, local, 28039 Madrid (Spain), tax and business address at calle Ferrocarril 37, 28045 Madrid (Spain), and email address support@invofox.com.

The CLIENT shall contract the Services with the entity designated in the Order Form.

1.2 On the other hand: the CLIENT, the legal entity contracting the Services of INVOFOX.

1.3 Hereinafter, INVOFOX and the CLIENT shall be referred to jointly as the “Parties” and individually as a “Party”.

1.4 The Parties mutually and reciprocally acknowledge that they have sufficient legal capacity to enter into this agreement and to perform their obligations.

2. Purpose of the agreement

2.1 The Parties agree to enter into this confidentiality agreement in order to guarantee the confidentiality of the information and data to which the Parties have access, to establish the procedure that will govern the safekeeping and non-disclosure to third parties of such information, as well as the rights, responsibilities and obligations inherent to their capacity as sender, owner and recipient of such information (hereinafter, the “Confidentiality Agreement”).

2.2 The signature of the Order Form by the CLIENT entails full acceptance of the Confidentiality Agreement, unless INVOFOX has expressly accepted its modification in writing.

3. Confidential information

3.1 The Parties agree that any information relating to their commercial, financial, technical and/or industrial matters supplied to the other Party shall be deemed confidential information and shall be treated in accordance with this Confidentiality Agreement (hereinafter, “Confidential Information”). By way of example and without limitation, the following shall be deemed Confidential Information: billing data, addresses, customer databases, emails, concepts, knowledge, techniques, procedures, know-how, business plans, designs, drawings, trademarks or logos.

Likewise, all information marked as confidential at the time of its delivery to the other Party shall be deemed Confidential Information.

3.2 The information supplied, and any copies and/or reproductions thereof, shall be deemed Confidential Information for the purposes of this Confidentiality Agreement, regardless of whether it is transmitted orally, in writing, on magnetic media or by any other computer, graphic or other means of whatever nature.

3.3 Neither Party shall make public the content of, or make announcements relating to, the Confidentiality Agreement without the prior written consent of the other Party, unless required by law or by a competent authority.

4. Nature of the Confidential Information

4.1 The Confidential Information shall at all times remain the property of the source that supplies it. INVOFOX undertakes to use the Confidential Information supplied by the CLIENT solely within the framework of carrying out its activity.

4.2 The CLIENT represents and warrants that it is duly entitled to send the documentation and information it provides, and shall hold INVOFOX harmless from any third-party claim arising from access to the documentation or information sent.

5. Safekeeping and non-disclosure

5.1 The Parties undertake to strictly keep and safeguard the Confidential Information that the other Party may supply to them. The Parties shall limit access to the Confidential Information to those of their personnel whose involvement is necessary for the provision of the services, undertaking in any event to pass on to them the obligations and responsibilities set out in this Confidentiality Agreement.

5.2 The Parties agree that they shall not disclose the Confidential Information, in whole or in part, to any third party without the prior, express and written consent of the other Party. Such consent shall not be required where the obligation to supply or disclose the Confidential Information is imposed by applicable law or by a final administrative or judicial decision.

6. Exclusions from this Confidentiality Agreement

The following information shall not be deemed Confidential Information, nor shall it receive such treatment:

I – Information that is publicly known at the time of its notification to the recipient, or that becomes public after such notification without the recipient being the ultimate cause of its disclosure.
II – Information that the recipient can prove was lawfully in its possession prior to this Confidentiality Agreement.
III – Information that has been widely disclosed without any restriction by its legitimate creator.
IV – Information that must be disclosed as required by applicable law or regulation or by a final administrative or judicial decision, in which case the recipient undertakes to immediately notify the disclosing party of the existence, circumstances and terms of such request.

7. Breach

7.1 Total or partial breach of the confidentiality obligations set out in this Confidentiality Agreement may give rise to the termination of the contractual relationship. In addition, the non-breaching Party shall be entitled to any compensation that may be due to it from the breaching Party for the damages arising from its breach.

7.2 In this regard, INVOFOX shall be liable in accordance with and within the limits set out in clause 11.3 of the General Terms and Conditions, which the Parties agree shall also apply to this Confidentiality Agreement.

7.3 The Parties expressly acknowledge and accept that part of the Confidential Information exchanged under this Confidentiality Agreement may qualify as a trade secret under the trade secrets legislation in force from time to time.

In such case, without prejudice to the general breach regime set out in clauses 7.1 and 7.2 above, the non-breaching Party shall be expressly entitled to bring against the breaching Party any civil actions provided for in such legislation.

8. Entry into force and term

8.1 This Confidentiality Agreement shall enter into force on the date of its signature and shall remain in force for the entire duration of the contractual relationship between the Parties.

8.2 The confidentiality obligations set out in this Confidentiality Agreement shall survive for a period of ten (10) years from the date of termination, for any reason, of the contractual relationship between the Parties.

8.3 Notwithstanding the foregoing, with respect to any Confidential Information that qualifies as a trade secret under the trade secrets legislation applicable from time to time, the confidentiality obligations set out in this Confidentiality Agreement shall survive for as long as such information retains its secret nature, without being subject to the period set out in clause 8.2 above.

9. Notices

9.1 Notices between the Parties in connection with the Confidentiality Agreement shall be given in writing by email.

10. Miscellaneous

10.1 The Confidentiality Agreement forms an integral part of the Contract for all purposes.

The Confidentiality Agreement constitutes the final agreement between the Parties with respect to such Confidential Information and supersedes any other prior understanding, oral or written, that may have existed between the Parties.

In the event of any contradiction, inconsistency or incompatibility between the General Terms and Conditions and the Confidentiality Agreement, the Confidentiality Agreement shall prevail over the General Terms and Conditions with respect to its subject matter.

10.2 The Parties may not assign all or part of their rights or obligations under this Confidentiality Agreement to any third party without the prior written consent of the other Party.

10.3 If any of the clauses or provisions of the Confidentiality Agreement is held to be null or voidable, such declaration shall not invalidate the remainder of the Confidentiality Agreement. Null clauses or provisions shall be replaced or supplemented by others which, in accordance with the law, reflect the spirit and purpose of those replaced.

10.4 Any delay or failure by INVOFOX to exercise any right under the Confidentiality Agreement shall in no event imply a waiver of its exercise, nor may it be construed as a waiver of its exercise in relation to subsequent events.

10.5 INVOFOX shall not be liable for the breach of any of its obligations under the Confidentiality Agreement where such breach results from an event of force majeure. For as long as the cause of the force majeure situation persists, the contractual obligations shall be deemed suspended.

11. Governing law and jurisdiction

11.1 The Confidentiality Agreement shall be governed by and construed in accordance with Spanish law where the contracting entity designated in the Order Form is INVOFOX INC SUCURSAL EN ESPAÑA, and in accordance with the laws of the State of Delaware (United States) where the contracting entity is INVOFOX, Inc.

11.2 The Parties agree to submit any dispute that may arise to the Courts and Tribunals of the city of Madrid (Spain) where the contracting entity designated in the Order Form is INVOFOX INC SUCURSAL EN ESPAÑA, and to the state and federal courts located in New Castle County, Delaware (United States), where the contracting entity is INVOFOX, Inc., expressly waiving any other jurisdiction that may correspond to them.

Last revised: October 2026

1. Parties

1.1 On the one hand: the contracting entity responsible for providing the Services (hereinafter, “INVOFOX”):

INVOFOX, Inc., a company of United States nationality, registered with the Delaware Division of Corporations under number 7218056, with registered office at 251 Little Falls Drive, Wilmington, New Castle County, DE 19808, Delaware (United States), with business address at 95 3rd Street, 2nd Floor, San Francisco, CA 94103, California (United States), and email address support@invofox.com.
INVOFOX INC SUCURSAL EN ESPAÑA, a branch of Spanish nationality, with Tax ID (NIF) number W0265699I, with registered office at calle Aranjuez 2, local, 28039 Madrid (Spain), tax and business address at calle Ferrocarril 37, 28045 Madrid (Spain), and email address support@invofox.com.

The CLIENT shall contract the Services with the entity designated in the Order Form.

1.2 On the other hand: the CLIENT, the legal entity contracting the Services of INVOFOX.

The CLIENT represents and warrants that:

1. The representative executing the contracting of the Services is duly authorized to act in the name and on behalf of the contracting entity.
2. The Services are contracted exclusively to meet business or professional needs.
3. It is not, and will not be, located in or under the control of any natural or legal person belonging to any country, territory or jurisdiction in respect of which the United States, the European Union and/or the United Kingdom maintain financial, trade or any other type of restrictions, embargoes and/or sanctions.

1.3 Hereinafter, INVOFOX and the CLIENT shall be referred to jointly as the “Parties” and individually as a “Party”.

1.4 The Parties mutually and reciprocally acknowledge that they have sufficient legal capacity to enter into this agreement and to perform their obligations.

2. Purpose

2.1 INVOFOX makes available to the CLIENT a cloud platform based on artificial intelligence technology for the digitization and automatic processing of documents of various kinds, designed and intended exclusively to meet business or professional needs (hereinafter, the “INVOFOX Platform”, the “Platform Service” or the “Platform”).

2.2 These general terms and conditions of the INVOFOX Platform govern its contracting by the CLIENT and its provision by INVOFOX (hereinafter, the “General Terms and Conditions”).

2.3 The exhaustive list of the Platform features contracted by the CLIENT (hereinafter, the “Contracted Services” or the “Services”), together with the applicable financial terms and any other specific conditions, is set out in a separate document expressly agreed by the Parties (hereinafter, the “Order Form”).

2.4 The Order Form, together with the General Terms and Conditions and any amendments that both Parties may expressly agree in writing, shall constitute the entire applicable and binding agreement between INVOFOX and the CLIENT (hereinafter, the “Contract”).

2.5 Within the commercial catalogue offered by INVOFOX, the CLIENT may choose and contract the Services and Platform features that best suit its needs from time to time.

Unless otherwise provided in the General Terms and Conditions, any modification of the Order Form shall be formalized by means of an addendum (hereinafter, the “Addendum/Addenda”). The Addendum shall relate solely to the specific conditions set out in the Order Form and shall set out the Platform features contracted by the CLIENT together with the new applicable financial terms. Each Addendum entered into shall be numbered consecutively.

2.6 The signature of the Order Form by the CLIENT entails full acceptance of the General Terms and Conditions, unless INVOFOX has expressly accepted their modification in writing.

2.7 In the event of any contradiction, inconsistency or incompatibility between the Order Form or any subsequent Addendum and the General Terms and Conditions, the Order Form or subsequent Addendum shall prevail over the General Terms and Conditions.

3. Platform Service

3.1 License of Use. During the term of the Contract and subject to payment of all applicable amounts, INVOFOX grants the CLIENT a non-exclusive and non-transferable right to access and use the Platform in accordance with the features contracted in the Order Form or through an Addendum (hereinafter, the “License of Use”). The License of Use grants the CLIENT the right to use the Platform as a service for its own internal purposes (“Software as a Service”), accessed online through the website app.invofox.com by entering a username and password that give access to its private area. Each CLIENT has its own private area within the Platform.

3.2 Feeding the Platform. Once in its private area of the Platform, the CLIENT shall be responsible for feeding the Platform with the types of documents to be digitized and processed as determined in the Order Form or through an Addendum (hereinafter, the “Document(s)”).

For the Platform to operate correctly, the files containing the Documents must meet the following conditions:

1. The supported formats are: ISO 19005 (PDF/A), PNG, JPEG2000, Acrobat 5 (PDF 1.4) or higher, and TIFF 6.0 or higher.
2. If the file is compressed, the compression technique used must be lossless.
3. Each file must contain a single Document, whether of one or several pages. This condition shall not apply where the CLIENT has contracted the automatic Document splitter as an additional feature.
4. The file must not contain attached documents or notes.
5. The content of the file must be centered, aligned and clearly legible. The spatial resolution of the file must be at least 200 dpi.

3.3 Digitization and processing of Documents. In the Order Form or through an Addendum, the CLIENT shall determine the type and characteristics of the Documents together with the information parameters to be processed (hereinafter, the “Data Configuration”), as well as the estimated volume of Documents to be processed (hereinafter, the “Volume of Documents”).

Once the CLIENT feeds the Platform, the Documents shall be digitized and processed automatically in accordance with the Data Configuration and the features contracted in the Order Form or through an Addendum. The processing result may vary depending on the Data Configuration.

The CLIENT may consult at any time the information on the volume of Documents processed in its private area.

3.4 Viewing of Extracted Data. Once the Documents have been digitized and processed, the data contained in the Documents shall be extracted and obtained in accordance with the Data Configuration and the features contracted in the Order Form or through an Addendum (hereinafter, the “Extracted Data”).

The CLIENT may view and shall have the Extracted Data available on the Platform. Where applicable, the Extracted Data may be viewed in third-party software.

3.5 Subject to payment of all applicable amounts, the License of Use is granted for the term of the Contract on a limited, personal, revocable, non-transferable and non-exclusive basis. The License of Use does not grant the CLIENT any right to exploit INVOFOX’s intellectual and industrial property rights.

3.6 The License of Use entitles the CLIENT to as many users as it needs, provided that each natural person using the Platform is identified. INVOFOX shall provide the CLIENT with the username and password of the administration account (hereinafter, the “Administrator User”). Through the Administrator User, the CLIENT may create, manage and delete the users it needs (hereinafter, the “Authorized User(s)”). INVOFOX reserves the right to delete Authorized Users who make non-operational or inappropriate use of the Services.

3.7 Retention Period. The Documents and the Extracted Data shall be kept on the Platform for a period of three (3) months from the date of processing of each Document (hereinafter, the “Retention Period”). Once the Retention Period has elapsed, INVOFOX shall not be obliged to keep the corresponding Documents or Extracted Data and may delete them, in which case they cannot be recovered. The CLIENT is responsible for downloading or exporting, before the end of the Retention Period, any Extracted Data it needs to keep.

The Parties may agree a different Retention Period in the Order Form or in an Addendum. Likewise, the CLIENT may contract minimum retention, in which case the Documents and the Extracted Data shall be deleted from the Platform within a maximum of twenty-four (24) hours after their processing is completed and the Extracted Data are made available to the CLIENT (hereinafter, “Minimum Retention”), under the conditions set out in the Order Form. Minimum Retention does not extend to the backup copies of the Platform’s database, in which the Extracted Data may be kept for the maximum period set out in the Data Processing Agreement.

INVOFOX shall configure the Retention Period applicable to the CLIENT on the Platform as agreed, and only INVOFOX may modify it.

The provisions of this clause are without prejudice to (i) the retention of backup copies of the Platform’s database under the terms of the Data Processing Agreement; (ii) any retention authorized by the CLIENT under clause 10.4; and (iii) any retention periods required by law.

4. Initial Set-up Service. Platform Adjustments

4.1 INVOFOX shall make the Platform available to the CLIENT operational and ready for use.

4.2 The CLIENT may request INVOFOX to carry out the initial configuration and preparation of the Platform (hereinafter, the “Initial Set-up Service”).

Depending on the type of Initial Set-up Service, the CLIENT accepts that its implementation may entail an additional cost. In such case, prior to providing the Initial Set-up Service, INVOFOX shall assess its feasibility and, if it approves its implementation, shall inform the CLIENT of the price of the Initial Set-up Service. The CLIENT shall sign the corresponding Order Form and pay the applicable amount.

The Initial Set-up Service may include the CLIENT’s onboarding process; the configuration of the contracted features; the creation and configuration of the Administrator User and of the initial Authorized Users requested by the CLIENT; the customization and configuration of the data display screen; the upload of the chart of accounts used by the CLIENT; and training for the CLIENT’s staff.

4.3 During the term of the Contract, the CLIENT may request INVOFOX to make adjustments, modifications and configuration changes to the Platform (hereinafter, the “Platform Adjustments”).

The CLIENT accepts that their implementation may entail an additional cost. In such case, prior to making the Platform Adjustments, INVOFOX shall assess their feasibility and, if it approves their implementation, shall inform the CLIENT of the price of the Platform Adjustments. The CLIENT shall sign the corresponding Order Form and pay the applicable amount.

5. Obligations and liabilities of INVOFOX

i. Provided that the CLIENT is up to date with the payment of any amount due, INVOFOX undertakes to deliver and maintain the Platform fully operational, and to use commercially reasonable efforts to offer the Platform in optimal conditions of use twenty-four (24) hours a day.

However, INVOFOX shall not be liable for any failure or interruption of the Platform due to causes attributable to third parties or to any unforeseeable event beyond INVOFOX’s control, fortuitous event or force majeure.

ii. INVOFOX guarantees Platform availability of ninety-seven percent (97%) per month.
iii. INVOFOX undertakes to resolve incidents that may compromise the maintenance of adequate levels of the Platform Service. In this regard, so that any incidents that may arise have the least possible impact on the provision of the Platform Service, the following incident prioritization criteria are established to allow for adequate response and resolution times:
Critical: incidents that prevent the use of the Platform or of an essential feature of the Platform, or that entail a complete stoppage of the Platform Service (hereinafter, the “Critical Incident(s)”).

By way of example, Critical Incidents may consist of a total interruption of the CLIENT’s access to the Platform, the inability to process Documents or the inaccessibility of the Extracted Data.

The maximum response and resolution time for Critical Incidents is forty-eight (48) hours from the time the CLIENT notifies INVOFOX or INVOFOX detects the incident. This period runs Monday to Friday, in accordance with the working calendar of the Community of Madrid (Spain), from 08:00 to 18:00, Madrid (Spain) time.

Intermediate: incidents that prevent the use of part of the Platform or of a non-essential feature of the Platform, or that entail a partial stoppage of the Platform Service (hereinafter, the “Intermediate Incident(s)”).

By way of example, Intermediate Incidents may consist of the temporary outage of a Document upload module, persistent slowness in processing that significantly delays operations, or a failure in the integration with third-party software causing significant disruption.

No specific response and resolution time is established for Intermediate Incidents. They shall be handled in accordance with good practices and ordinary continuous improvement processes.

Minor: all other incidents that are neither Critical Incidents nor Intermediate Incidents (hereinafter, the “Minor Incident(s)”).

By way of example, Minor Incidents may consist of minor errors in the graphical interface that do not affect the processing of Documents, data synchronization failures without significant impact, or issues that can be fixed with one-off configuration adjustments.

No specific response and resolution time is established for Minor Incidents. They shall be handled in accordance with good practices and ordinary continuous improvement processes.

The Parties may agree other specific incident response and resolution times. The CLIENT accepts that their implementation shall entail an additional cost. In such case, prior to their acceptance, INVOFOX shall inform the CLIENT of the price of their implementation and the CLIENT shall confirm it by signing the corresponding Order Form or addendum.

iv. Provided that the CLIENT is up to date with the payment of any amount due, INVOFOX undertakes to provide the Platform maintenance, daily operation and support service. In any event, Platform support shall be provided through support@invofox.com, Monday to Friday, in accordance with the working calendar of the Community of Madrid (Spain), from 08:00 to 18:00, Madrid (Spain) time.

The Parties may agree additional support channels and priority handling, subject to the applicable financial terms.

v. INVOFOX reserves the right to interrupt the Platform Service where necessary to carry out maintenance, update or improvement work for as long as required, making every effort to ensure that the interruption is as short and has as little impact as possible.
vi. INVOFOX reserves the right to modify the characteristics of the Platform at any time to adapt it to technical developments or legislative changes, add new features, correct errors or improve the performance or security of its services.

6. Obligations and liabilities of the CLIENT

i. The CLIENT shall pay INVOFOX the applicable amounts within the agreed periods. The CLIENT must at all times be up to date with the payment of all amounts it may owe to INVOFOX.
ii. The CLIENT shall use the Platform as authorized, instructed and recommended in this Contract and/or by INVOFOX. For the Platform to operate correctly, the CLIENT acknowledges and accepts that it must follow the instructions and recommendations given by INVOFOX. In case of doubt, INVOFOX recommends that the CLIENT get in touch through the available channels.
iii. The CLIENT voluntarily and expressly acknowledges and accepts that it is solely responsible for determining the suitability of the Services and for determining the Volume of Documents. Likewise, the CLIENT voluntarily and expressly acknowledges and accepts that its use of the INVOFOX Platform shall be at its own risk and under its sole and exclusive responsibility at all times.
iv. The CLIENT represents and warrants that it is duly entitled to upload, digitize and process the Documents. In this regard, the CLIENT shall hold INVOFOX harmless from any third-party claim arising from the access to, upload, digitization and/or processing of the Documents and the Extracted Data.
v. The CLIENT shall only grant access to the INVOFOX Platform to the personnel strictly necessary for its use and the performance of their duties. In any event, the CLIENT shall pass on the obligations and responsibilities contained in the Contract to all Authorized Users with access to the INVOFOX Platform. Within reasonable efforts, the CLIENT shall prevent unauthorized access to the Platform and notify INVOFOX as soon as it detects any unauthorized access.
vi. The CLIENT shall not: (1) copy, duplicate, lease, assign, lend, sell, transfer, distribute or sublicense the Platform; (2) use the Platform for, or make it available to, any third party; (3) interfere with or affect the integrity or performance of the Platform; (4) modify, decompile, disassemble, reverse engineer, decrypt or otherwise obtain, modify and/or reproduce the Platform and its source code; (5) attempt to gain unauthorized access to the Platform; (6) split the Platform into separate modules for independent use; (7) introduce any harmful code or any damaging content into the Platform; (8) use the Platform and/or any of its features or characteristics to develop a service or product that directly or indirectly competes with the Services provided by INVOFOX; (9) use the Platform in an unlawful, fraudulent or harmful manner; contrary to good faith, morality or public order; in breach of any applicable provision; or in any manner incompatible with the provisions of the Contract.
vii. The CLIENT shall be solely responsible for ensuring that its IT systems have the equipment and connections to INVOFOX’s systems that allow the Platform to be made available. INVOFOX shall not be responsible for any such equipment or connections.
viii. The CLIENT voluntarily and expressly acknowledges and accepts that the identification and access credentials of the Administrator User and the Authorized Users are personal and confidential, may not be shared and are provided for the exclusive use of the CLIENT. The CLIENT acknowledges that INVOFOX shall in no event be liable for the CLIENT’s management of the identification and access credentials of the Administrator User and the Authorized Users. The CLIENT shall endeavor to prevent unauthorized third parties from accessing these codes.
ix. The CLIENT shall ensure that it communicates and implements within its organization the security and confidentiality measures necessary to comply with the obligations undertaken under the Contract.
x. The CLIENT shall scrupulously respect INVOFOX’s intellectual and industrial property rights, including without limitation the provisions of Clause 10.
xi. The CLIENT undertakes to keep its identification and contact details up to date at all times. In the event of any change or variation, the CLIENT undertakes to notify INVOFOX as soon as possible.
xii. The CLIENT undertakes not to use the Services by or for the benefit of any natural or legal person belonging to any country, territory or jurisdiction in respect of which the United States, the European Union and/or the United Kingdom maintain financial, trade or any other type of restrictions, embargoes and/or sanctions. The CLIENT voluntarily and expressly acknowledges and accepts that all of INVOFOX’s Services are subject to the export control laws and regulations of the United States and/or the European Union; accordingly, the CLIENT undertakes to comply with all applicable export control laws and regulations in connection with the CLIENT’s use of INVOFOX’s Services. Where there are reasonable doubts as to the person or persons receiving or benefiting from the Services, INVOFOX may determine the jurisdiction and/or identity of the recipient of INVOFOX’s Services by any means of its choice, including, among others, Internet Protocol address (hereinafter, “IP”) lookup technology designed to identify the location of the IP address and block IP addresses located in certain territories.

Breach of this provision shall be grounds for automatic termination of the Contract.

xiii. The CLIENT shall defend, hold harmless and indemnify INVOFOX against any losses, damages and/or claims arising from or related to the information, data and/or Documents placed on the INVOFOX Platform by the CLIENT, the Administrator User and/or its Authorized Users, provided that such losses, damages and/or claims arise from intentional acts, negligence or breaches of applicable regulations and/or the Contract by the CLIENT, the Administrator User and/or its Authorized Users.

7. Credits. Credit Packages

7.1 Credits. A credit is the unit of consumption of the Service that enables the processing of one (1) Document in accordance with the Data Configuration determined and the features contracted in the Order Form or in any Addendum or Addenda that the Parties may enter into (hereinafter, the “Credit(s)”). One (1) Credit is consumed when one (1) Document is entered into the Platform, regardless of the processing result.

Based on the Volume of Documents, the CLIENT shall purchase packages of Credits under the conditions set out in the Order Form or in any Addendum or Addenda that the Parties may enter into (hereinafter, the “Credit Package(s)”).

7.2 Activation of Credit Packages. Credit Packages shall be activated on the date of issue of the invoice for the corresponding Credit Package (hereinafter, the “Activation”).

7.3 Validity of Credit Packages. Each Credit Package shall be valid for a maximum of twelve (12) months from its Activation (hereinafter, the “Validity Period”).

Once the Validity Period of the corresponding Credit Package has expired, any unused Credits shall automatically expire without any right to a refund.

7.4 Renewal of Credit Packages. Depending on the Volume of Documents and any other special conditions that may apply, the CLIENT may: (i) renew the contracted Credit Package with another for the same Volume of Documents; or (ii) purchase a Credit Package for a higher Volume of Documents. The invoice reflecting the Contracted Services shall be sufficient evidence of their formalization.

Once the contracted Credit Package has been used up, or from the expiry date of the Validity Period of the corresponding Credit Package, without the CLIENT having renewed the contracted Credit Package, the CLIENT shall have a grace period of thirty (30) calendar days to renew the Credit Package under the same conditions, provided that it renews the corresponding Credit Package within such grace period. During the thirty (30) calendar day grace period, exceptionally and temporarily, the contracting model shall be pay-per-use. The applicable price shall be the price per unit Credit.

8. Price and financial terms

8.1 Price. The price per Credit and of the Credit Packages is as set out in the Order Form, in any Addendum or Addenda that the Parties may enter into or in the successive invoices issued; applicable taxes shall be added to the price (hereinafter, the “Platform Service Price” or the “Price”).

The price of the Initial Set-up Service is as set out in the Order Form; applicable taxes shall be added to the price (hereinafter, the “Initial Set-up Price”).

8.2 Price Update. INVOFOX may review, update and modify the Platform Service Price. Any Price revision shall be prospective and shall not affect Credit Packages already purchased. Price updates shall apply (i) to the next renewal of the corresponding Credit Package; and/or (ii) to purchases of Credit Packages made after the effective date of the revision.

INVOFOX shall notify the CLIENT at least one (1) month before the updated Platform Service Price takes effect. The CLIENT shall have fifteen (15) calendar days from the effective date of the notice to notify INVOFOX of its objection and of the termination of the Contract. If no notice is received from the CLIENT, INVOFOX shall understand that the CLIENT has given its tacit consent.

The update of the Price of the Services shall not require the Parties to sign an Addendum. The invoice reflecting the updated Price shall be sufficient evidence of its formalization.

8.3 Contracting models. The contracting model for the Platform Service is as set out in the Order Form or in any Addendum or Addenda that the Parties may enter into.

8.4 Payment methods. As the payment method for the Price of the Services, INVOFOX uses the Stripe payment gateway, integrated with its Odoo invoicing system. Likewise, depending on the amount, INVOFOX may accept payment by bank transfer to the account held by INVOFOX indicated on the corresponding invoice.

Stripe guarantees that all purchase transactions are carried out within a strict framework of confidentiality and encryption thanks to the SSL protocol. INVOFOX does not access or store the bank details linked to the payment methods and does not know or record such details. For more information about Stripe, please visit its website. INVOFOX reserves the right to modify and determine the payment gateway used from time to time.

The payment method chosen by the CLIENT to pay for the Set-up Service and/or the first Credit Package shall be set as the default payment method. However, the CLIENT may choose the payment method that best suits it at any time.

The CLIENT undertakes to maintain a valid and funded payment method at all times during the term of the Contract.

Once any applicable amount has been paid, INVOFOX shall only refund it if an amount above the agreed price has been charged or in the event of an error in the charge and/or invoicing.

8.5 Invoicing terms. Invoices shall be payable on demand and shall be paid in the currency agreed with the CLIENT using the established payment method.

INVOFOX shall automatically issue invoices as appropriate in accordance with the contracting model.

Unless the CLIENT provides INVOFOX with other billing details, INVOFOX shall issue the invoices for the Contracted Services in the name of the CLIENT’s contracting entity.

The CLIENT expressly authorizes INVOFOX to invoice by electronic means which, in any event, shall be those authorized by the applicable legislation in force and shall guarantee the authenticity of their origin and the integrity of the content of the invoices.

8.6 Regarding the Initial Set-up Service and Platform Adjustments. INVOFOX shall issue to the CLIENT the invoices for the Initial Set-up Price and for the Platform Adjustments, which shall be payable on demand and shall be paid in the currency agreed with the CLIENT before their implementation begins.

8.7 Taxes. The applicable taxes and/or levies shall be included in the Order Form and in any subsequent Addenda entered into by the Parties.

Each Party shall be responsible for paying the taxes it is required to pay in accordance with the applicable legislation in force.

If the CLIENT is exempt from any tax or levy, the CLIENT must provide INVOFOX with a valid and current tax exemption certificate.

8.8 Late payment and non-payment. If the CLIENT fails to pay any amount within the agreed period, the overdue and unpaid amount shall automatically accrue the corresponding late-payment interest without the need for any notice of maturity or demand by INVOFOX. The applicable late-payment interest shall be the statutory rate in force from time to time.

INVOFOX reserves the right to suspend the Platform at any time and without prior notice until the CLIENT pays the total amount due in full.

The start of the Initial Set-up Service and the implementation of Platform Adjustments are subject to the CLIENT’s payment of the corresponding invoices.

If INVOFOX is forced to formally claim payment of any amount due, whether out of court and/or in court, the CLIENT shall bear all the costs incurred by INVOFOX, including, among others, lawyers’ fees, court representatives’ fees and court fees.

9. Term

9.1 The Contract between the Parties shall be deemed entered into and shall enter into force on the date indicated in the Order Form.

9.2 The Contract shall have a term of one (1) year from the date of Activation of the first Credit Package purchased by the CLIENT and shall be extended for successive periods of one (1) year, unless either Party has given notice of its intention to terminate the Contract or any of its extensions in accordance with Clause 13.

10. Intellectual and industrial property rights. Confidentiality

10.1 All present and future intellectual and industrial property rights in the INVOFOX Platform shall be the exclusive property of INVOFOX and shall be considered by the CLIENT as confidential information of INVOFOX.

INVOFOX grants the CLIENT only the License of Use to make use of the Platform in accordance with the Contract. In no event shall this Contract be construed as an assignment to the CLIENT of any other intellectual or industrial property right owned by INVOFOX in the Platform or in any of its elements.

All present and future intellectual and industrial property rights in the INVOFOX Platform capable of being protected by trade secret, utility model, patent, copyright, design, trademark or any other form permitted by law, database rights, know-how and other proprietary rights of any kind, documentation, improvements, design contributions or derivative works, as well as any knowledge or process related thereto, including rights in and to all applications and registrations relating to the INVOFOX Platform, shall at all times be the sole and exclusive property of INVOFOX.

10.2 The CLIENT grants INVOFOX, free of charge, an irrevocable, perpetual and unlimited right to use for its own purposes all opinions, suggestions, recommendations and/or proposals made by the CLIENT to INVOFOX regarding the Platform.

10.3 If the CLIENT receives a third-party claim alleging a possible infringement of intellectual property rights in the INVOFOX Platform, the CLIENT shall immediately notify INVOFOX and shall hand over the defense against the third party to INVOFOX so that INVOFOX manages and takes charge of the claim, as well as of the costs it may incur in its defense.

10.4 The CLIENT shall be the legitimate owner for all purposes of all rights in any information, data and/or Documentation uploaded, digitized and/or processed on the Platform by the CLIENT, including, among others, the Extracted Data.

INVOFOX shall not use the CLIENT’s Documents, Extracted Data or corrections to train or improve artificial intelligence models used to provide services to other clients. Any improvement obtained from the CLIENT’s data shall be applied exclusively within the CLIENT’s account. If the CLIENT expressly authorizes it, INVOFOX may keep the Documents, the Extracted Data and the corrections beyond the Retention Period for the sole purpose of continuously improving extraction within the CLIENT’s account.

However, INVOFOX may collect and analyze technical metrics and aggregated statistics on the use of the Services (such as processing volumes, response times, error rates or accuracy levels), provided that they do not include the content of the Documents or of the Extracted Data and do not allow the CLIENT or any natural person to be identified, for the sole purpose of operating, maintaining and improving the Services. INVOFOX shall ensure that such use complies with applicable law, including data protection regulations.

Likewise, based on the validations and corrections made by the CLIENT to the Extracted Data, the Platform automatically generates models, rules, configurations and other technical resources that improve extraction accuracy in the CLIENT’s account (hereinafter, the “Derived Resources”). The Derived Resources form part of INVOFOX’s technology, are the exclusive property of INVOFOX pursuant to clause 10.1, and do not constitute Extracted Data. The Derived Resources are used exclusively within the CLIENT’s account. To the extent that the Derived Resources contain personal data, their processing shall be governed by the Data Processing Agreement.

10.5 INVOFOX does not in any event authorize the CLIENT to use the INVOFOX trademark, except upon the CLIENT’s request for authorization and INVOFOX’s express written consent.

During the term of the Contract, the CLIENT grants INVOFOX a revocable, non-transferable and non-exclusive right to use the CLIENT’s trademark(s) for commercial, marketing or promotional purposes, such as, for example, customer references on INVOFOX’s website, sales presentations and promotional materials.

10.6 With regard to Confidential Information, the Parties expressly refer to the Confidentiality Agreement, which forms an integral part of the Contract for all purposes and is accessible at all times at the following link: https://www.invofox.com/en/service-agreements/

11. Limitation of liability

11.1 The Platform is provided “as is”, “where is” and “as available”, and INVOFOX assumes no warranty (whether express or implied) of merchantability, adequacy and fitness of the service or the software for a particular purpose, compatibility with any system, absence of defects and errors or correction of all of them, absence of interruptions or impregnable security.

The CLIENT voluntarily and expressly acknowledges and accepts that the use of the INVOFOX Platform by the CLIENT, the Administrator User and its Authorized Users shall be at their own risk and under their own sole and exclusive responsibility at all times. Likewise, the CLIENT voluntarily and expressly acknowledges and accepts that there are risks inherent to internet connectivity that could result in the loss of the CLIENT’s privacy, technology, software, data, proprietary information or other materials.

11.2 INVOFOX shall in no event be responsible for the lawfulness, truthfulness, accuracy and/or content of the information, data and Documents that the CLIENT uploads to the Platform. The CLIENT shall be liable for any fraudulent use or breach of its contractual and confidentiality obligations with respect to the information, data and Documents that the CLIENT uploads to the Platform. In this regard, the CLIENT shall hold INVOFOX harmless from any third-party claim arising from the access to, upload, digitization and/or processing of the information, data and Documents that the CLIENT uploads to the Platform.

11.3 Compensation for damages caused to the CLIENT and attributable to INVOFOX is limited to the total amount paid by the CLIENT to INVOFOX during the twelve (12) months preceding the event. It must relate to direct and foreseeable damage, expressly reported in writing by the CLIENT to INVOFOX within one (1) month of its occurrence and never later than one (1) month after the termination of the Contract for any reason. In no event shall it include damages arising from the CLIENT’s use and exploitation of the Platform in respect of (1) loss of profits and indirect damages; (2) loss of goodwill or reputational damage; (3) third-party claims for infringement of intellectual or industrial property rights; (4) damages suffered by third parties; (5) loss or corruption of data; (6) costs of procuring substitute goods or services; and (7) any other item beyond INVOFOX’s reasonable control.

11.4 The above limitation of liability is an essential element of the contractual relationship between INVOFOX and the CLIENT. The INVOFOX Platform is not provided without the above limitation of liability.

12. Data protection and processing

12.1 In performing this Contract, INVOFOX must process personal data of the CLIENT’s partners, employees and executives, which may include, in particular but not limited to, first and last names, telephone numbers, email addresses or business addresses. INVOFOX requests these data from the CLIENT and their processing is essential for the development of the relationship between the Parties and of INVOFOX’s activity. The CLIENT declares that it may transfer such personal data to INVOFOX and that it has complied with the applicable data protection regulations.

As controller of these personal data, INVOFOX undertakes to process personal data only if strictly necessary for carrying out its activity and, in this regard, undertakes to comply with the applicable legal provisions and, in particular, to apply all technical and organizational measures necessary to guarantee the protection of personal data against accidental or unlawful destruction, accidental loss, alteration, dissemination or unauthorized access, as well as against any form of unlawful processing.

Upon termination of the Contract, the data shall be processed for the purpose of continuing to provide any of the Services that the CLIENT may have contracted and that must be provided beyond the term of the License of Use. If the CLIENT waives such service or objects to the processing, the data shall be blocked and kept solely and exclusively to address any liabilities arising from the processing during the limitation period, normally six (6) years.

INVOFOX informs the CLIENT that, for the proper performance of the Contract, INVOFOX must periodically inform the CLIENT of technical and commercial developments regarding the Platform, as well as of the different conditions applicable to their management, and the CLIENT consents to receiving these communications at the time of contracting. These informative communications are necessary for the performance of the Contract and are strictly linked to the contracting of the Services, and cannot be separated from the performance of the Contract. Once the relationship has ended, the CLIENT may object to receiving these informative communications, either at the end of the Contract or by sending an email to INVOFOX’s Data Protection Officer at: equaldpo@equalprotecciondedatos.com.

In any event, the CLIENT’s personnel whose personal data may be processed in accordance with the subject matter and purpose of this Contract may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability by sending an email to INVOFOX’s Data Protection Officer at: equaldpo@equalprotecciondedatos.com. INVOFOX shall provide the appropriate response within a maximum of one (1) month.

12.2 With regard to the personal data that the CLIENT stores on the Platform, for which the CLIENT is the controller and INVOFOX the processor, the Parties expressly refer to the Data Processing Agreement, which forms an integral part of the Contract for all purposes and is accessible at all times at the following link: https://www.invofox.com/en/service-agreements/

The data hosted by the CLIENT when using the Platform belong to the CLIENT. Likewise, the CLIENT is solely responsible for its processing of third-party data, undertaking to process third-party data in accordance with the data protection regulations in force and holding INVOFOX harmless from any breach in this regard.

All processing carried out by INVOFOX in relation to the CLIENT’s data shall be carried out within the framework of the provision of the Services, duly accepted by the CLIENT when contracting the Platform.

INVOFOX may only access such data for technical maintenance, security and/or Contract compliance purposes, in order to ensure the proper functioning of the Platform, identify the source of a problem and improve customer service when the CLIENT contacts support.

12.3 The Parties undertake to comply at all times with the applicable data protection legislation in force. Accordingly, should any change in the applicable legislation result in one or both Parties not complying with the applicable legislation, the Contract and/or the Data Processing Agreement shall be promptly amended to the extent necessary to remedy such non-compliance.

13. Termination and suspension of the Contract

13.1 The Contract shall terminate in the following cases:

i. By mutual agreement of the Parties, under the conditions agreed for that purpose.
ii. At the CLIENT’s discretion at any time, provided that the CLIENT notifies INVOFOX in writing, in accordance with the notice procedure set out in the Contract, at least thirty (30) calendar days before the expiry date of the Validity Period of the corresponding Credit Package.

Termination of the Contract shall take effect once the CLIENT uses up the current Credit Package or its Validity Period expires, whichever occurs first.

iii. At INVOFOX’s discretion, provided that INVOFOX notifies the CLIENT in writing, in accordance with the notice procedure set out in the Contract, at least sixty (60) calendar days before the expiry date of the Validity Period of the corresponding Credit Package.

Termination of the Contract shall take effect once the CLIENT uses up the current Credit Package or its Validity Period expires, whichever occurs first.

iv. Due to the total or partial breach of any of the Parties’ obligations. Breach of the obligations arising from the Contract shall entitle the non-breaching Party to terminate the Contract and to claim any compensation for damages caused by the breach that may be due to it. Prior to termination, the breaching party shall have a period of fifteen (15) calendar days to remedy the breach from the date of receipt of the notice sent by certified email by the non-breaching party of its intention to terminate the Contract. In any event, the non-breaching Party’s right to claim any compensation for damages that may be due shall be preserved.

13.2 Upon termination of the Contract for any reason, the CLIENT shall have a period of sixty (60) calendar days to consult and download, through the Platform or the API, the Documents, the Extracted Data and the corrections that are kept in accordance with the applicable Retention Period, without INVOFOX being obliged to deliver them to the CLIENT. Once such period has elapsed, INVOFOX shall not be obliged to store the CLIENT’s Extracted Data and/or Documents, and may therefore delete them in their entirety, without prejudice to the provisions of clause 3.7 regarding backup copies and statutory retention periods. The Derived Resources defined in clause 10.4 shall not be delivered to the CLIENT, and INVOFOX may only keep them to the extent that they do not contain personal data.

13.3 Upon termination of the Contract or in the event of suspension of the Platform, INVOFOX reserves the right to invoice any amount pending invoicing and payment.

13.4 The termination, expiry and/or early termination of the Contract shall not affect the validity of those clauses which by their nature must survive the termination, expiry and/or early termination of the Contract.

14. Notices

14.1 Notices between the Parties in connection with the Contract shall be given in writing by email.

14.2 Notices addressed to the CLIENT shall be sent to the email address designated by the CLIENT in the CLIENT’s identification details; notices addressed to INVOFOX shall be sent to the email address support@invofox.com.

14.3 For all notices between the Parties, the date recorded in the system used as the date of sending shall be deemed valid for the purpose of calculating time periods, regardless of the date on which the recipient accessed it.

15. Miscellaneous

15.1 INVOFOX may at any time review, update and amend the General Terms and Conditions, the Confidentiality Agreement and/or the Data Processing Agreement. INVOFOX shall inform the CLIENT in writing prior to their entry into force.

15.2 The Parties may not assign all or part of their rights or obligations under this Contract to any third party without the prior written consent of the other Party.

However, prior written consent shall not be required where INVOFOX assigns all or part of its rights and/or obligations to companies, subsidiaries or branches controlled by it or belonging to its same group of companies.

15.3 For the purposes of the Contract, (1) headings are for reference only and shall in no way be taken into account in interpreting the Contract; (2) references to a legal entity also refer to its governing bodies, officers and managers, whether or not registered; and (3) unless otherwise stated, references to clauses and annexes are references to the clauses and annexes of the Contract.

15.4 If any of the clauses or provisions of the Contract is held to be null or voidable, such declaration shall not invalidate the remainder of the Contract. Null clauses or provisions shall be replaced or supplemented by others which, in accordance with the law, reflect the spirit and purpose of those replaced.

15.5 Any delay or failure by INVOFOX to exercise any right under the Contract shall in no event imply a waiver of its exercise, nor may it be construed as a waiver of its exercise in relation to subsequent events.

15.6 INVOFOX shall not be liable for the breach of any of its obligations under the Contract where such breach results from an event of force majeure. For as long as the cause of the force majeure situation persists, the contractual obligations shall be deemed suspended.

15.7 During the term of the Contract and for two (2) years after its termination, the CLIENT undertakes not to hire, directly or indirectly, INVOFOX personnel, whether as an employee or in any other capacity. If the CLIENT acts in breach of this clause, upon mere notice from INVOFOX, the CLIENT undertakes to pay INVOFOX, within fifteen (15) calendar days from the date of notice, an amount equal to fifty percent (50%) of the gross annual salary received by the person concerned at INVOFOX, plus all recruitment costs necessary to replace the person concerned.

16. Governing law and jurisdiction

16.1 The Contract shall be governed by and construed in accordance with Spanish law where the contracting entity designated in the Order Form is INVOFOX INC SUCURSAL EN ESPAÑA, and in accordance with the laws of the State of Delaware (United States) where the contracting entity is INVOFOX, Inc.

16.2 The Parties agree to submit any dispute that may arise to the Courts and Tribunals of the city of Madrid (Spain) where the contracting entity designated in the Order Form is INVOFOX INC SUCURSAL EN ESPAÑA, and to the state and federal courts located in New Castle County, Delaware (United States), where the contracting entity is INVOFOX, Inc., expressly waiving any other jurisdiction that may correspond to them.

Last revised: October 2026