Last Updated: June 27, 2019 (superseded Terms of Use dated December 5, 2013)

This service agreement (the “Agreement“) is an agreement between the person or entity visiting, browsing, accessing or otherwise using (the term “use” will refer to any of the foregoing) the Offering (“Customer“) and Flyp Technologies Inc. and Vmags Media Solutions with offices at 1109 Kimberly Court, Roseville, CA 95661(“Vmags“, together with Customer, the “Parties” and each, a “Party“), and is entered into as of the earlier of: (A) the date Customer first uses any element of the Offering; and (B) the date Customer agrees to be bound by the terms and conditions set out herein (the “Effective Date“).

BY USING ANY ELEMENT OF THE OFFERING (INCLUDING THE WEBSITE), CUSTOMER ACKNOWLEDGES THAT IT HAS READ, ACCEPTS AND AGREES TO BE BOUND BY AND COMPLY WITH THE TERMS AND CONDITIONS SET OUT IN THIS AGREEMENT, AS AMENDED FROM TIME TO TIME IN ACCORDANCE WITH SECTION 15(K). IF CUSTOMER DOES NOT ACCEPT AND AGREE TO BE BOUND BY THIS AGREEMENT, CUSTOMER WILL IMMEDIATELY CEASE ANY FURTHER USE OF THE OFFERING, INCLUDING USE OF ANY ELEMENT THEREOF. CUSTOMER REPRESENTS AND WARRANTS TO VMAGS THAT CUSTOMER HAS THE CAPACITY TO ENTER INTO THIS LEGALLY BINDING AGREEMENT. IF CUSTOMER IS USING THE OFFERING ON BEHALF OF ANOTHER PERSON OR ENTITY, CUSTOMER HEREBY REPRESENTS AND WARRANTS TO VMAGS THAT CUSTOMER HAS THE AUTHORITY TO BIND SUCH PERSON OR ENTITY TO THIS AGREEMENT.

1. Definitions

   
   

   1. “Agreement” has the meaning set out in the introductory paragraph of this Agreement.

      
      

   2. “Billing Period” means the date as set out in the Order Terms or the Website.

      
      

   3. “Customer Data” has the meaning ascribed to it in Section 4(b), and includes Personal Information (if any).

      
      

   4. “Derivative Data” means all modifications, compilations, derivative works and results from processing (including analyses, usage statistics and patterns, datasets, databases, reports, recommendations and visual representations) created or developed from Customer Data or on the basis of Customer’s use of the Services by Vmags or through the Platform in connection with the Services.

      
      

   5. “Effective Date” has the meaning set out in the introductory paragraph of this Agreement.

      
      

   6. “Fees” means the fees and other charges that apply to Customer’s initial setup and ongoing access to and use of the Services, payable in the amounts and frequency indicated on the Website, in the Order Terms (if applicable) or otherwise communicated by Vmags to Customer from time to time (including through the Website).

   7. “Offering” means, collectively, the Platform and the Services.

      
      

   8. “Order Terms” means, if applicable, the order terms provided to Customer which may supplement or modify the terms and conditions set forth herein.

      
      

   9. “Personal Information” means information about an identifiable individual transferred by Customer or its permitted agents to Vmags hereunder, and any personal information derived or otherwise create by Vmags in connection therewith.

      
      

   10. “Platform” means, collectively, the Website and all systems of Vmags and Vmags’s third- party suppliers that are used in the provision of the Services.

       
       

   11. “Services” means the services to be provided by Vmags to Customer, as described on the Website, as may be amended or supplemented by Vmags from time to time in its sole discretion and without notice.

       
       

   12. “Website” means, collectively, the Vmags websites, including the website located at: http://www.vmagsmedia.com.

       
       

   13. “Term” means the duration of this Agreement.

   
   

2. Services

   
   

   1. Provision of the Services. Vmags will make the Services available to Customer on the terms and conditions set out in this Agreement and conditional on Customer: (i) making commercially reasonable efforts to cooperate with the reasonable requests of Vmags; (ii) providing Vmags with access to any required systems of Customer or third parties (and making all required third- party disclosures and obtaining all required third party consents in respect of such access) which Customer wishes the Platform to obtain data from or provide data to in the course of providing the Services; and (iii) to the extent Customer Data includes Personal Information, providing all notices and disclosures and obtaining all necessary consents and authority in respect of such Personal Information as required under and in compliance with applicable privacy law in order for Vmags to provide the Services on behalf of Customer and process Personal Information in the manner set out in the Vmags Privacy Policy.

      
      

   2. Subcontractors. Customer acknowledges and agrees that Vmags may use subcontractors in the performance of the Services, provided that the use of a subcontractor will not release Vmags from any of its obligations pursuant to this Agreement.

      
      

   3. Provisioning of the Platform. Vmags will: (i) provide to Customer basic support through the Website as described more fully in Section 8 (Customer Support); and (ii) use commercially reasonable efforts to make the Platform reasonably available with minimal downtime; except for:

      1. downtime and scheduled upgrades (as described more fully below); and (B) unavailability caused by circumstances beyond Vmags’s reasonable control, including acts of God, acts of government, flood, fire, earthquakes, civil unrest, acts of terror, strikes or other labour problems,

         Internet service provider failures or delays, or the unavailability of any third-party provided goods or services.

         
         

   4. Platform Updates and Scheduled Downtime. Vmags may update the functionality and user interface of the Platform from time to time in its sole discretion as part of its ongoing mission to improve the Offering and the use of the Offering by Vmags’s other customers. Vmags may from time to time schedule downtime for maintenance and upgrades without prior notice.

      
      

   5. No Responsibility for Data Storage and Backup. Vmags cannot guarantee that the Platform will provide regular data backups of any Customer Data stored on it. It is Customer’s responsibility to backup onto Customer’s own local system all Customer Data, including all data, files and records that Customer submits to Vmags.

   
   

3. License Grants.

   
   

   1. License Grants by Vmags. Subject to the terms and conditions of this Agreement and Customer’s compliance therewith, Vmags grants to Customer: (i) a revocable, non-exclusive, non-transferable license during the Term to access and use the Platform over the Internet and through the then available standard interface for the Platform in connection with receiving the Services in accordance with this Agreement; and (ii) a revocable, perpetual, non-exclusive, non- transferable license to copy, use, reproduce and modify any Derivative Data provided to Customer for Customer’s internal business purposes only.

      
      

   2. License Grant by Customer. Subject to the terms and conditions of this Agreement, including Vmags’s confidentiality obligations, Customer grants to Vmags a transferrable, sublicenseable, royalty-free, fully paid-up, worldwide license to copy, use, reproduce, modify, develop, access, collect and store the Customer Data solely for the purpose of providing the Services.

   
   

4. Reservation of Rights.

   
   

   1. Rights Reserved by Vmags. Vmags expressly reserves all rights in the Services, the Platform, all Derivative Data and all materials (other than Personal Information) provided by Vmags hereunder and not specifically granted to Customer (“Vmags Property”). All right, title and interest in the Vmags Property, as well as any update, modification, adaptation, translation, customization or derivative work thereof, and all intellectual property rights therein will remain with Vmags (or Vmags’s third party suppliers, as applicable). The Vmags Property is licensed on a subscription basis on the terms and conditions of this Agreement and not “sold” to Customer.

      
      

   2. Rights Reserved by Customer. Customer expressly reserves all rights in any data, information, records and files that Customer (or any User) loads, transmits to or enters into the Platform, including data that the Platform is configured to obtain from Customer’s servers or systems or from third parties on Customer’s behalf, but excluding any Derivative Data (the “Customer Data”), subject to the license that Customer grants Vmags in accordance with the provisions of this Agreement, and provided that Customer does not acquire any intellectual property rights in the Services, the Platform, any Derivative Data or any elements of any of the foregoing.

5. Privacy Policy; Internet Security Disclaimer; Limitation, Suspension or Termination of Access.

   
   

   1. Privacy Policy. To the extent that Customer Data may contain any Personal Information, Vmags will collect, use, disclose such Personal Information for the purposes authorized under this Agreement and in accordance with Vmags’ privacy policy located at: Vmags.com/privacy (the “Privacy Policy“). The Privacy Policy is hereby incorporated by reference and forms part of this Agreement.

      
      

   2. Internet Security Disclaimer. As between Vmags and Customer, Customer is solely responsible for the accuracy, quality, integrity, legality, reliability, and appropriateness of all Customer Data. Customer understands that the technical processing and transmission Customer Data is fundamentally necessary to use of the Services. Therefore, Customer expressly consents to Vmags’s storage of Customer Data, which will involve transmission over the Internet, and over various networks, only part of which may be owned and/or operated by Vmags. Vmags will endeavor to provide industry-standard secure data transmission channels for use by Customer to upload, enter or transmit Customer Data to the Services, for example through the use of the HTTPS protocol. However, despite such efforts, Customer acknowledges and understands that Customer Data may be accessed by unauthorized persons when communicated across the Internet, network communications facilities, telephone or other electronic means. Vmags is not responsible for any Customer Data which is delayed, lost, altered, intercepted or stored during the transmission of any data whatsoever across public networks not owned or operated by Vmags, including, the Internet, third party websites, and Customer’s local network. Customer agrees that Vmags is not in any way responsible for any interference with Customer’s use of or access to the Services or security breaches arising from or attributable to the Internet, and Customer waives any and all claims against Vmags in connection therewith.

      
      

   3. Limitation, Suspension or Termination of Access. In addition to any other suspension or termination rights of Vmags pursuant to this Agreement, certain extraordinary circumstances may require Vmags to suspend, terminate or limit (as appropriate and as determined in Vmags’s sole discretion) Customer’s access to or use of the Platform or the Services, or any component thereof, without notice in order to: (i) prevent any misuse or abuse of the Offering or other Vmags Property; (ii) prevent any damage to, or degradation of the integrity of Vmags’s systems or Vmags Property; (iii) comply with any law, regulation, court order, or other governmental request or order; or (iv) otherwise protect Vmags from potential legal liability or harm to its reputation or business. Vmags also reserves the right to approve, reject, cancel or remove any Customer Data or other content that is posted on, provided or uploaded to, or transmitted through the Platform or the Services at any time and for any reason in Vmags’s sole discretion, and Vmags will not be liable or responsible for exercising this right. For greater clarity, Customer acknowledges and agrees that Vmags does not guarantee that any Customer Data or other content that is posted on, provided or uploaded to, or transmitted through the Platform or the Services will be available or displayed. Vmags will use commercially reasonable efforts to notify Customer of the reasons for such limitation, suspension or termination action as soon as reasonably practicable. In the event of a limitation or suspension, Vmags will promptly restore Customer’s access to the Offering as soon as the event giving rise to the limitation or suspension has been resolved, as determined in Vmags’s sole discretion. Nothing contained in this

   Agreement will be construed so as to limit Vmags’s ability to take action or invoke remedies, or act as a waiver of Vmags’s rights in any way with respect to any of the foregoing activities.

   Vmags will not be responsible for any loss or damages incurred by Customer as a result of any limitation, termination or suspension of access to or use of the Platform or the Services under this Section.

   
   

6. Customer Responsibilities and Restrictions.

   
   

   1. Customer ID. Upon Customer’s request, but subject to any applicable limitations associated with Customer’s subscription, Vmags will issue user identification and password (“User ID”) to Customer for each individual Customer wishes to have access to and use of the Offering (each, a “User”). Customer may only identify its partners, shareholders, employees and contractors who, in each case, are bound by confidentiality restrictions at least as restrictive as this Agreement as Users. Users may only access and use the Platform and the Services through a User ID issued to Customer. Customer will not allow Users to share their User ID with any other person. Customer is responsible for any and all activity occurring under the User IDs associated with Users. Customer is responsible for all use of the Offering by Users and for maintaining the confidentiality of their User ID and will promptly notify Vmags of any actual or suspected unauthorized use of the Offering. Vmags reserves the right to replace any User ID if it determines it may have been used for an unauthorized purpose.

      
      

   2. Customer Responsibilities and Restrictions. Customer agrees that Customer is responsible for the compliance by the Users with this Agreement and for the Users’ use of the Offering, as well as for ensuring that the Users maintain the confidentiality of their User IDs. Customer agrees that Customer is responsible for all charges incurred by the Users in connection with access to or use of the Offering and generally for any activity occurring through a User ID. Without limiting the generality of any of the foregoing, Customer agrees that Customer will not, and will not permit any person to:

      
      

      1. use the Offering other than as permitted by this Agreement;

         
         

      2. use the Offering to send, store, publish, post, upload or otherwise transmit any Customer Data in violation of any warranty, representation or obligation of Customer under this Agreement;

         
         

      3. license, sublicense, sell, resell, rent, lease, transfer, assign, distribute, time share or otherwise commercially exploit or make the Offering (in whole or in part) available to any third party, other than to the Users, or as otherwise expressly contemplated in accordance with this Agreement;

         
         

      4. use the Offering to upload, collect, transmit, store, use or process, or ask Vmags to obtain from third parties, any Customer Data: (A) that Customer does not have the lawful right to copy, transmit, distribute, and display (including any Customer Data that would violate any confidentiality or fiduciary obligations that Customer might have with respect to the Customer Data); (B) for which Customer does not have the authority, consent or permission from the individual(s) to whom the Personal Information relates in accordance with applicable privacy

         legislation; (C) that infringes, misappropriates or otherwise violates any intellectual property or other proprietary rights of any third party (including any copyright, trademark, patent, trade secret, or other intellectual property right, or moral right or right of publicity); (D) that is tortious, defamatory, obscene, or offensive; or (E) that violates, or encourages any conduct that would violate, any applicable law or regulation (including applicable privacy and anti-spam legislation) or would give rise to civil or criminal liability.

         
         

      5. use the Offering to send, store, publish, post, upload or otherwise transmit any viruses, Trojan horses, worms, time bombs, corrupted files or other computer programming routines that are intended to damage, detrimentally interfere with, surreptitiously intercept or expropriate any systems, data, personal information or property of another;

         
         

      6. continue to use the Offering in a manner that interferes with or disrupts the integrity or performance of the Offering following a notice from Vmags of such use;

         
         

      7. attempt to gain unauthorized access to the Offering or its related systems or networks;

         
         

      8. use or knowingly permit the use of any security testing tools in order to probe, scan or attempt to penetrate or ascertain the security of the Offering;

         
         

      9. use any data mining, robots or similar data gathering or extraction methods (including electronic address harvesting);

         
         

      10. access the Offering for the purpose of building a similar or competitive product or service or for the purpose of obtaining unauthorized access to the Offering; or

          
          

      11. copy, translate, create a derivative work of, reverse engineer, reverse assemble, disassemble, or decompile the Offering or any part thereof or otherwise attempt to discover any source code or modify the Offering, except as expressly provided for in this Agreement.

      
      

   3. Customer Responsibility for Customer Data. Customer has sole responsibility for providing all notices, making all disclosures and otherwise obtaining all necessary consent and authority required by and in accordance with applicable laws regarding Customer Data (including any Personal Information). Vmags will use the Customer Data it is provided by Customer or third parties in performing the Services “as is”, and is not responsible for reviewing, validating or otherwise confirming the accuracy, appropriateness or completeness of Customer Data.

      
      

   4. Removal of Customer Data on Request by Customer. Customer may control the Customer Data stored by the Services, including (subject to Section 10(b)) by deleting or requiring Vmags to delete all or part of the Customer Data (including Personal Information) at any time.

   
   

7. Term.

   
   

   This Agreement will commence on the Effective Date and continue in effect until terminated in accordance with its terms, or as otherwise set out in the Order Terms.

8. Customer Support.

   
   

   Vmags will provide the following support to Customer:

   
   

   1. Web and Email Support. Customer will have access to Vmags’s technical support part of the Website and may use the available interfaces, including any customer support email addresses posted thereon, to submit service requests.

      
      

   2. Incident Management. Vmags will use commercially reasonable efforts to correct any reproducible failure of the Offering to substantially conform to its expected operation; provided that Vmags will not have an obligation to provide a correction for all such nonconformities.

   
   

9. Fees and Payment.

   
   

   1. Fees. Customer will pay to Vmags the Fees in the manner, amounts and frequencies indicated on the Website, in the Order Terms (if applicable) or otherwise communicated by Vmags to Customer from time to time (including through the Website).

      
      

   2. Payment. Unless otherwise indicated on the Website or, if applicable, the Order Terms: (i) Fees are payable in advance on or after the first day of the applicable billing period; and (ii) if required by Vmags, Customer will provide to Vmags (and keep current at all times during the Term) the details (including number, date of expiry and CVC) of a valid credit card that is acceptable to Vmags in its sole discretion (the “Credit Card”). Customer hereby agrees and authorizes Vmags to charge the Credit Card for any Fees that become due and payable hereunder. Any Fees in respect of non-recurring or one-time charges incurred during a billing period will be automatically charged to the Credit Card on or after the first day of the next billing period. One time fees (including any fees for add ons) are charged at the time in which the Applicable Agreement is approved. In the event the Billing Start Date set out in the Order Terms is a date that is not the first day of the calendar month, Vmags may pro-rate the applicable Fees based on the number of days in the first Billing Period of the Term and thereafter adjust the payments to recur on the first day of the calendar month for each of the remaining billing periods during the Term. If the Term ends on any day other than the date that is not the last day of the calendar month, Vmags may pro-rate the applicable Fees based on the number of days in the last billing period of the Term. If applicable, any Fees paid in advance will be applied against monthly invoices on the first day of each calendar month of the Term.

      
      

   3. Invoices. From time to time, Vmags may prepare and send to Customer, at the then-current contact information on file with Vmags, invoices for any Fees and other amounts that have become due and payable under this Agreement. Unless otherwise expressly stipulated in an invoice, Customer agrees to pay all invoiced amounts immediately upon receipt.

      
      

   4. No Set-Off and Late Payment Charge. Customer may not withhold or “set-off” any amounts due under this Agreement. Unless otherwise indicated on the Website, all Fees are non- refundable and Vmags will provide no full or partial credits or refunds, including in respect of Services that are paid for but not used by Customer. Vmags reserves the right to suspend Customer’s access to the Offering until all due amounts are paid in full. Any late payment will be

      increased by the costs of collection (including reasonable legal fees), and will incur interest at the rate of one and a half percent (1.5%) compounded monthly (19.56% annually), or the maximum legal rate (if less) per month or fraction thereof until fully paid.

      
      

   5. Certain Taxes. Fees and charges quoted in this Agreement do not include, and Customer will pay, indemnify and hold Vmags harmless, from all sales, use, gross receipts, value-added, GST/HST, personal property or other taxes, and all applicable duties, tariffs, assessments, export and import fees or similar charges (including interest and penalties imposed thereon) on the transactions contemplated in connection with this Agreement, other than taxes based on the net income or profits of Vmags.

   
   

10. Confidential & Proprietary Information.

    
    

    1. Definitions. For purposes of this section, a Party receiving Confidential & Proprietary Information (as defined below) will be the “Recipient” and the Party disclosing such information will be the “Discloser“, and “Confidential & Proprietary Information” includes all information disclosed by Discloser to Recipient during the Term of this Agreement and marked as “confidential” or “proprietary” or which a reasonable person would understand to be confidential or proprietary; provided that: (a) the terms and conditions of this Agreement, all Derivative Data and all parts of the Offering, whether marked as “confidential” or “proprietary” or not, will be considered to be Vmags Confidential & Proprietary Information; and (b) all Customer Data (but excluding any Derivative Data), whether marked as “confidential” or “proprietary” or not, will be considered Customer’s Confidential & Proprietary Information; and further provided that Discloser’s Confidential & Proprietary Information (other than Personal Information) does not include: (i) information already known or independently developed by Recipient outside the scope of this relationship by personnel not having access to any Discloser’s Confidential & Proprietary Information; (ii) information that is publicly available through no wrongful act of Recipient; or (iii) information received by Recipient from a third party who was free to disclose it without confidentiality obligations.

       
       

    2. Covenant. Recipient hereby agrees that during the Term and at all times thereafter it will not:

       (i) disclose such Confidential & Proprietary Information of the Discloser to any person or entity, except to its own personnel, affiliates or contractors having a “need to know”, to its accountants, auditors or other professional advisors relating to its business, to Vmags’s subcontractors having a “need to know” for purposes relating to the provision of the Services to Customer, and to such other recipients as the Discloser may approve in writing; (ii) use Confidential & Proprietary Information of the Discloser except to exercise its license rights or perform its obligations under this Agreement; or (iii) alter or remove from any Confidential & Proprietary Information of the Discloser any proprietary legend. Recipient will use at least the same degree of care in safeguarding the Confidential & Proprietary Information of the Discloser as it uses in safeguarding its own confidential information of a similar nature, but in no event will less than due diligence and reasonable care be exercised. Each party will be deemed to have fulfilled its confidentiality obligations under this Section 10, if it affords the other party’s Confidential & Proprietary Information at least the same degree of care it takes in protecting its own confidential information from unauthorized disclosure (but in no event using less than a reasonable degree of care). Upon the earlier of: (A) Discloser’s written request; and (B) the termination or expiration

       of this Agreement, regardless of whether a dispute may exist, Recipient will return or destroy (as instructed by Discloser) all Confidential & Proprietary Information of Discloser in its possession or control and cease all further use thereof. Vmags may retain a copy of such Confidential & Proprietary Information for the sole purpose of and to the extent necessary for it to comply with applicable and legal, regulatory, or reasonable internal back-up or archival policies and requirements. Notwithstanding the foregoing, Recipient may disclose Discloser’s Confidential & Proprietary Information to the extent that such disclosure is necessary for the Recipient to enforce its rights under this Agreement or is required by law or by the order of a court or similar judicial or administrative body, provided that the Recipient promptly notifies the Discloser in writing of such required disclosure and cooperates with the Discloser to seek an appropriate protective order.

       
       

    3. Injunctive Relief. Recipient acknowledges that violation of the provisions of this section would cause irreparable harm to Discloser not adequately compensable by monetary damages. In addition to other relief, it is agreed that injunctive relief will be available without necessity of posting bond to prevent any actual or threatened violation of such provisions.

    
    

11. Customer Warranty; Disclaimer; Indemnity.

    
    

    1. Customer Warranty. Customer represents and warrants to, and covenants with Vmags that: (i) the Customer Data will contain no information about an identifiable individual or information that is otherwise subject to privacy laws (“Personal Information“), except for Personal Information: (A) in respect of which Customer has provided all notices and disclosures and otherwise obtained all necessary consents and authority from all applicable individuals in accordance with applicable laws to enable Vmags to provide the Services on behalf of Customer and to process Personal Information in the manner set out in the Vmags Privacy Policy; and (B) that complies with Customer’s representations, warranties and obligations set out in this Agreement; and (ii) Customer will agree to and at all times comply with (and will cause each User to agree to and at all times comply with) all third-party terms and conditions applicable in respect of the Offering.

       
       

    2. Disclaimer. THE OFFERING AND ANY OTHER PRODUCTS AND SERVICES PROVIDED BY VMAGS TO CUSTOMER ARE PROVIDED “AS IS”, “AS AVAILABLE”, WITH ALL FAULTS AND WITHOUT ANY WARRANTIES, REPRESENTATIONS OR CONDITIONS OF ANY KIND. VMAGS HEREBY DISCLAIMS ALL EXPRESS, IMPLIED, COLLATERAL OR STATUTORY WARRANTIES, REPRESENTATIONS OR CONDITIONS, WHETHER WRITTEN OR ORAL, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, NONINFRINGEMENT, SECURITY, RELIABILITY, COMPLETENESS, QUIET ENJOYMENT, ACCURACY, QUALITY, INTEGRATION OR FITNESS FOR A PARTICULAR PURPOSE. VMAGS DOES NOT WARRANT THAT THE OFFERING WILL OPERATE WITHOUT INTERRUPTION OR BE ERROR FREE. WITHOUT LIMITING THE GENERALITY OF ANY OF THE FOREGOING, VMAGS EXPRESSLY DISCLAIMS ANY REPRESENTATION OR WARRANTY THAT ANY DATA OR INFORMATION PROVIDED TO CUSTOMER IN CONNECTION WITH CUSTOMER’S USE OF THE OFFERING WILL BE ACCURATE, OR CAN OR SHOULD BE RELIED UPON BY CUSTOMER FOR ANY PURPOSE WHATSOEVER.

    3. Indemnity. Customer agrees to indemnify and hold harmless Vmags, its employees, officers, directors and affiliates against any and all liability (including losses, damages, recoveries, deficiencies, interest, penalties and reasonable attorney’s fees) relating to: (i) Customer Data, (ii) Customer’s breach of any of Customer’s obligations, representations or warranties under this Agreement; or (iii) Customer’s use of the Offering, including in combination with any third party software, application or service.

    
    

12. Limitation of Liabilities.

    
    

    The Parties acknowledge that the following provisions have been negotiated by them and reflect a fair allocation of risk and form an essential basis of the bargain and will survive and continue in full force and effect despite any failure of consideration or of an exclusive remedy:

    
    

    1. Amount. IN NO EVENT WILL THE TOTAL AGGREGATE LIABILITY OF VMAGS IN CONNECTION WITH OR UNDER THIS AGREEMENT EXCEED THE TOTAL AMOUNT OF FEES RECEIVED BY VMAGS UNDER THIS AGREEMENT DURING THE PRECEDING 12 MONTHS. FOR GREATER CERTAINTY, THE EXISTENCE OF ONE OR MORE CLAIMS UNDER THIS AGREEMENT WILL NOT INCREASE THIS MAXIMUM LIABILITY AMOUNT. IN NO EVENT WILL VMAGS’S SUPPLIERS HAVE ANY LIABILITY ARISING OUT OF OR IN ANY WAY CONNECTED TO THIS AGREEMENT.

       
       

    2. Type. IN NO EVENT WILL VMAGS BE LIABLE TO CUSTOMER FOR ANY: (I) SPECIAL, INDIRECT, INCIDENTAL OR CONSEQUENTIAL DAMAGES; (II) LOST SAVINGS, PROFIT, DATA, USE OR GOODWILL; (III) BUSINESS INTERRUPTION, EVEN IF NOTIFIED IN ADVANCE OF SUCH POSSIBILITY; OR (IV) PERSONAL OR PROPERTY DAMAGE ARISING OUT OF OR IN ANY WAY CONNECTED TO THIS AGREEMENT, REGARDLESS OF CAUSE OF ACTION OR THE THEORY OF LIABILITY, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE, GROSS NEGLIGENCE, FUNDAMENTAL BREACH, BREACH OF A FUNDAMENTAL TERM) OR OTHERWISE. IN NO EVENT WILL VMAGS BE LIABLE FOR PROCUREMENT OR COSTS OF SUBSTITUTE PRODUCTS OR SERVICES.

    
    

13. Notices.

    
    

    Notices sent to either Party will be effective when delivered in person or by email, one day after being sent by overnight courier, or two days after being sent by first class mail postage prepaid to the official contact designated by the Parties and immediately after being received by the other party’s server. Notices must be in writing and sent: (a) if to Vmags, to the address set out in the introductory paragraph of this Agreement; and (b) if to Customer, to the current postal or email address that Vmags has on file with respect to Customer. Vmags may change its contact information by posting the new contact information on the Website or by giving notice thereof to Customer. Customer is solely responsible for keeping its contact information on file with Vmags current at all times during the Term.

    
    

14. Termination.

    1. Generally. Either Party may, in addition to other relief, suspend or terminate this Agreement if the other Party: (i) commits a material breach of this Agreement, and either: (A) fails within seven days after receipt of notice of such breach to correct such material breach or to commence corrective action reasonably acceptable to the aggrieved Party and proceed with due diligence to completion; or (B) such material breach is incapable of being cured; or (B) becomes insolvent, makes an assignment for the benefit of its creditors, a receiver is appointed, or a petition in bankruptcy is filed with respect to the Party and is not dismissed within 30 days.

       
       

    2. Survival. Upon termination or expiration of this Agreement for any reason: (a) all rights and obligations of both Parties (except for Customer’s payment of all Fees and other amounts then owing in accordance herewith), including all licenses granted hereunder, will immediately terminate except as provided below; (b) within 30 days after the effective date of termination, each Party will comply with the obligations to return or destroy all Confidential Information of the other Party, as set forth Section 10 (Confidential & Proprietary Information). The following Sections will survive expiration or termination of this Agreement for any reason: Section 4 (Reservation of Rights), Section 6 (Customer Responsibilities and Restrictions), Section 10 (Confidential & Proprietary Information), Section 11 (Customer Warranty; Disclaimer; Indemnity), Section 12 (Limitation of Liabilities), Section 14(b) (Survival), and Section 15 (General Provisions).

    
    

15. General Provisions.

1. Assignment. Customer may not assign this Agreement to any third party without Vmags’s prior written consent, except that Customer may assign its rights (but not obligations) hereunder to an affiliate of Customer. Vmags may assign this Agreement, in whole or in part, to any third party without Customer’s consent. Any assignment in violation of this Section will be void. The terms of this Agreement will be binding upon and inure to the benefit of the Parties’ successors and permitted assignees.

   
   

2. Choice of Law. This Agreement and any action related thereto will be governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflicts of law principles. The Parties hereby irrevocably attorn to the exclusive personal jurisdiction and venue of the courts sitting in Toronto, Ontario. The U.N. Convention on Contracts for the International Sale of Goods will not apply to this Agreement.

   
   

3. Right to List as a Customer. Customer agrees that Vmags may utilize Customer’s name in listings of current customers. Use of Customer’s name in any other marketing materials or press announcements will be submitted to Customer in advance for approval, provided that such approval will not be unreasonably withheld.

   
   

4. Compliance with Export Regulations. Customer has or will obtain in a timely manner all necessary or appropriate licenses, permits or other governmental authorizations or approvals; will indemnify and hold Vmags harmless from, and bear all expense of, complying with all foreign or domestic laws, regulations or requirements pertaining to the importation, exportation, or use of the Offering. Customer will not directly or indirectly export or re-export (including by

   transmission) any regulated technology to any country to which such activity is restricted by regulation or statute, without the prior written consent, if required, of the administrator of export laws.

   
   

5. Construction. Except as otherwise provided herein, the Parties rights and remedies under this Agreement are cumulative. The term “including” means “including without limitation.” The headings of sections of this Agreement are for reference purposes only and have no substantive effect. The terms “consent” or “discretion”, when used in respect of Vmags herein mean the right of Vmags to withhold such consent or exercise such discretion (as applicable) arbitrarily and without any implied obligation to act reasonably or explain its decision to Customer. Unless otherwise indicated, all dollar amounts are in United States Dollars.

   
   

6. Force Majeure. Neither Party will be liable for delays caused by events beyond its reasonable control, except non-payment of amounts due hereunder will not be excused by this provision.

   
   

7. Severable. Any provision hereof found by a tribunal of competent jurisdiction to be illegal or unenforceable will be automatically conformed to the minimum requirements of law and all other provisions will remain in full force and effect.

   
   

8. No Waiver. Waiver of any provision hereof in one instance will not preclude enforcement thereof on future occasions. Any waiver by one Party of any default by the other Party will not affect or impair any rights of the first Party arising from any subsequent default by that other Party.

   
   

9. Independent Contractors. Customer’s relationship to Vmags is that of an independent contractor, and neither Party is an agent or partner of the other. Customer will not have, and will not represent to any third party that it has, any authority to act on behalf of Vmags.

   
   

10. Entire Agreement. This Agreement constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all other communications, whether written or oral. This Agreement may be executed in one or more counterparts, each of which will be deemed an original and all of which will be taken together and deemed to be one instrument.

    
    

11. Amendments. Subject to the following sentence, no amendment, supplement, modification, waiver or termination of this Agreement and, unless otherwise specified, no consent or approval by any Party, will be binding unless executed in writing by the Party or Parties to be bound thereby. NOTWITHSTANDING THE PRECEDING SENTENCE, VMAGS MAY UNILATERALLY AMEND THIS AGREEMENT, IN WHOLE OR IN PART (EACH, AN “AMENDMENT“), BY: (I) GIVING CUSTOMER PRIOR NOTICE OF SUCH AMENDMENT; OR (II) POSTING NOTICE OF SUCH AMENDMENT ON THE WEBSITE. UNLESS OTHERWISE INDICATED BY VMAGS, ANY SUCH AMENDMENT WILL BECOME EFFECTIVE AS OF THE DATE NOTICE THEREOF IS PROVIDED TO CUSTOMER OR IS POSTED ON THE WEBSITE (WHICHEVER IS EARLIER).

12. English Language. It is the express wish of the parties that this Agreement and all related documents be drawn up in English. C’est la volonté expresse des parties que la présente convention ainsi que les documents qui s’y rattachent soient rédigés en anglais.

Data Security Policy

Last Updated: July 20, 2020

This Vmags Security Policy (“Security Policy”) outlines the technical and procedural measures that Vmags undertakes to protect the confidentiality, integrity, and availability of Customer Data. Vmags has a written information security plan to implement the terms of this Security Policy that is reviewed and approved annually by its senior management team. This Security Policy forms part of the Vmags Services Agreement or similar agreement entered into between Flyp Technologies Inc., Vmags Media Solutions and Customer where referenced therein (the “Agreement”) and any capitalized terms used but not defined herein shall have the meaning set forth in the Agreement. In the event of any conflict between the terms of the Agreement and this Security Policy, this Security Policy shall govern with respect to the subject matter in question. This Security Policy may be updated from time to time upon notice to Customer (which may be provided through the Service or by publishing the updated Security Policy to Vmags’s website) to reflect process improvements or changing practices, but any such modifications will not materially diminish either party’s obligations as compared to those reflected below. As used in this Security Policy: “Cloud Provider” means the third-party cloud provider, such as Amazon Web Services, Inc. (AWS) that hosts the Service; and “Vmags Personnel” means Vmags employees and contractors.

1. Customer Data Access and Management

   1. Customer controls access to its account in the Service via User IDs and passwords.

   2. Vmags Personnel may access Customer’s admin console in order to help with support issues. Customer may block access to Vmags Personnel by enabling the “Block Support/Management Access” setting using the security tab of their account settings.

      1. Vmags Personnel may still have access to Customer Data via back-end database, storage, and server access.

   3. Vmags Personnel are prohibited from storing Customer Data on local desktops, laptops, mobile devices, shared drives, removable media such as USB drives, or on public facing systems that do not fall under the administrative control or compliance monitoring processes of Vmags.

   4. Passwords are hashed with SHA-256 and cannot be decrypted.

   5. Vmags may use and share aggregated and anonymized Customer Data. The data will be processed to ensure it cannot be used to identify a single Customer or end-user.

   6. Vmags uses Customer Data (in its original form) only as necessary to provide the Service to Customer including any ancillary services such as customer support, as provided in the Agreement.

   7. Customer Data is stored only in the Service production environment.

   8. Customer Data for Vmags’s Content Experience Platform is stored primarily in the ca-central-1 AWS region, with encrypted backups in the us-east-1 region. Customer Data for Vmags’s SnapApp Platform is stored primarily in the us-east-1 region.

   9. Vmags creates and maintains flow diagram(s) indicating how Customer Data flows through the Service (“Flow Diagrams”) and can provide Flow Diagrams upon Customer’s reasonable request. Flow Diagrams are Vmags Confidential Information.

   10. Vmags may transfer Customer Data to one of its sub-processors for specific purposes. Those subprocessors are listed on

       https://www.vmagsmedia.com/legal   The Customer may subscribe to the list to be notified by email of any changes as soon as they occur.

   11. Vmags will vet all sub-processors prior to allowing sub-processors to process any Customer Data and require that all sub-processors adhere to similar standards as in this agreement.

2. Encryption and Separation of Customer Data

   1. The Service in the production storage environment always encrypts Customer Data while at rest with AES 256-bit encryption.

   2. The Service encrypts traffic with Transport Layer Security (“TLS” AKA “SSL”) minimum version 1.1 when communicating with outside partners across untrusted networks such as the public internet.

   3. Customers may enable TLS communication between their Service and the end-user by either providing a certificate, or requesting Vmags obtain a TLS certificate on their behalf.

3. Service Infrastructure Access Management

   1. Access to the systems and infrastructure that support the Service is restricted to Vmags Personnel who require such access as part of their job responsibilities.

   2. Unique User IDs are assigned to Vmags Personnel requiring access to the Vmags servers that support the Service.

   3. Vmags systems and infrastructure is only accessible via an SSL VPN with multi-factor authentication (“MFA”), and individual SSH keys.

      

   4. Unauthorized access attempts against the VPN server (“Brute force attacks”) are mitigated with an autolockout policy, which requires a set amount of time to pass before the account is able to login – even with the correct password.

   5. Access privileges of departed Vmags Personnel are disabled promptly. Access privileges of persons transferring to roles requiring reduced privileges are adjusted accordingly.

   6. User access to the systems and infrastructure that support the Service is reviewed annually.

   7. Compute instances within the Cloud Provider network have security groups with deny-all default policies and only enable required network protocols between all networks and instances.

   8. Vmags uses principals of least privilege, and segregation of duties when designing access controls.

4. Workstation Security

   1. Vmags Personnel are required to use company supplied and managed workstations when connecting to any production or development system.

   2. All workstations are centrally managed, have anti-virus which detects threats real-time, and updates its signatures daily. Users can not disable the anti-virus.

   3. Passwords are required on all workstations, with auto-lock when the computer sleeps, or the screen saver is engaged.

   4. Vmags Personnel with access to production networks are required to enable full disk encryption.

5. Data Classification

   1. All data under Vmags’s management is classified as to its sensitivity and handled appropriately.

   2. Vmags conforms to GDPR, PIPEDA, and CCPA. As such, Vmags may delete any end-user data upon request.

   3. Vmags’s Data Classification Guidelines can be shared with the Customer upon request and is considered Confidential Information to Vmags.

6. Risk Management

   1. Vmags conducts risk assessments of various kinds throughout the year, including self and third-party assessments and tests, automated scans, and manual reviews.

   2. Results of assessments are reported to the Data Privacy Officer (“DPO”).

   3. Changes to controls and threat mitigation strategies are evaluated and prioritized for implementation on a risk-adjusted basis.

   4. Threats are monitored through various means, including threat intelligence services, vendor notifications, and trusted public sources.

7. Vulnerability Scanning and Penetration Testing

   1. Vmags conducts annual penetration testing by an independent third party to confirm the security of its Content Experience Platform.

   2. Subject to Vmags’s approval, Customers may also perform their own penetration testing and security scans. Customers are required to provide the results of the scans to Vmags.

   3. Scans that detect vulnerabilities are evaluated by employees using Vmags-defined risk criteria to triage and prioritize.

   4. Vulnerabilities are prioritized based on potential impact to the Service, with “critical” and “high” vulnerabilities typically being addressed within 30 days of discovery and “medium” vulnerabilities typically being addressed within 90 days of discovery.

   5. Security management monitors or subscribes to trusted sources of vulnerability reports and threat intelligence.

8. Remote Access & Wireless Network

   1. All access by Vmags Personnel to the VPC requires successful authentication through a secure connection via SSL VPN. For Vmags’s Content Experience Platform this is done via multi-factor authentication (“MFA”).

   2. Vmags corporate offices, including LAN and Wi-Fi networks in those offices, are considered to be untrusted networks.

9. System Event Logging, Monitoring & Alerting

   

   1. Monitoring tools and services are used to monitor systems including network, server events, and Cloud Provider API security events, availability events, and resource utilization.

   2. Vmags infrastructure security event logs are collected in a central system and protected from tampering. Logs are stored for a minimum of 15 months.

   3. All VPCs leverage advanced threat detection tools to monitor and alert for suspicious activities and potential malware.

10. System Administration and Patch Management

    1. Vmags maintains system administration procedures for systems that access Customer Data that meet or exceed industry standards,

       including system hardening, system and device patching (operating system and applications) and threat detection software as well as daily signature updates of same.

    2. Vmags Security reviews new vulnerabilities announcements and assess their impact to Vmags based on a Vmags-defined risk criteria, including applicability and severity.

    3. Applicable security updates rated as “high” or “critical” are typically addressed within 30 days of the patch release and those rated as “medium” are typically addressed within 90 days of the patch release.

11. Vmags Security Training and Vmags Personnel

    1. Vmags maintains a security awareness program for Vmags Personnel, which provides initial education, ongoing awareness and requires individual Vmags Personnel to agree to comply with Vmags’s Information Security Policy on an annual basis. New hires digitally sign a non-disclosure agreement, and digitally sign to confirm they have read and understood the Vmags Information Security Policy.

    2. All Vmags Personnel acknowledge they are responsible for reporting actual or suspected security incidents or concerns, thefts, breaches, losses, and unauthorized disclosures of or access to Customer Data.

    3. Vmags performs criminal background screening as part of the Vmags hiring process, to the extent legally permissible.

    4. Vmags uses secure SDLC practices which includes code reviews, secure data access, and centralized logging.

    5. Vmags will take measures to ensure that its subcontractors, vendors, and other third parties (if any) that have direct access to the Customer Data in connection with the services adhere to data security standards consistent with this policy.

12. Physical Security

    1. The Service is hosted with Cloud Providers and all physical security controls are managed by the Cloud Provider. Vmags reviews the Cloud Provider’s security report to ensure appropriate physical security controls, including:

       1. Visitor management including tracking and monitoring physical access.

       2. Physical access point to server locations are managed by electronic access control devices.

       3. Monitor and alarm response procedures.

       4. Use of CCTV cameras at facilities.

       5. Video capturing devices in data centers with 90 days of image retention.

13. Service and Data Availability

    1. Vmags will take all reasonable precautions to provide the service in accordance with the service level terms of the Agreement.

    2. Current status of the Service can be viewed at https://www.vmagsmedia.com/system-status/

    3. Customers can subscribe to the application status page for real-time updates as incidents occur.

    4. Vmags uses DDoS protection supplied by its Cloud Provider on all production networks.

14. Disaster Recovery & Business Continuity

    1. Vmags maintains a Disaster Recovery Plan (“DRP”) for the Service. The DRP is tested annually.

    2. The Vmags Content Experience Platform is deployed and managed in the ca-central-1 region, using Infrastructure-as-Code (“IaC”) and the Vmags SnapApp Platform in the us-east-1 region. Backups are performed at least nightly of all production data and replicated to the AWS us-east-1 region, where they are stored in an encrypted format.

    3. Following a declared disaster, Vmags in it’s sole discretion will re-deploy all infrastructure into another AWS region within North America and restore the latest viable backups. As part of this deployment, the customer may be required to update IPs on their

       firewalls in order to access the new infrastructure. These IPs will be provided at the time of the disaster.

    4. Vmags maintains a Business Continuity Plan (“BCP”). The BCP is assessed annually.

15. Notification of Security Breach

    1. A “Security Breach” is (a) the unauthorized access to or disclosure of Customer Data, except where access was obtained via the customer’s credentials; or (b) the unauthorized access to the backend Vmags platform.

    2. Vmags will notify Customer in writing within forty-eight (48) hours of a confirmed Security Breach, which will include a description of the Security Breach and the status of Vmags’s investigation.

    3. Vmags will take appropriate actions to contain, investigate, and mitigate the Security Breach.

16. Vmags Security Compliance, Certifications, and Third-party Attestations

    1. Vmags hires accredited third parties to perform audits and to attest to various compliance and certifications annually including

       SOC 2 Type 2 Attestation Report.

    2. Vmags is a U.S. company and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA).

    3. Vmags provides the Customer with the controls required to adhere to its requirements under the GDPR.

       
       

17. Customer Responsibilities

    1. Without detracting from Vmags’s security obligations in this Security Policy, security of Customer Data is a shared responsibility between Vmags and Customer. Vmags provides the Customer with numerous tools to mitigate against brute force attacks against their account, setup SSO, define password and session policies, and IP restrictions on their accounts. Customer is responsible for configuring and maintaining these settings.

    2. Customer acknowledges that Vmags does not assess the contents of Customer Data and that Customer is responsible for making appropriate use of the Service to ensure a level of security and compliance appropriate for the Customer, managing and protecting its accounts, roles and credentials.

    3. Customer will promptly notify Vmags if a user credential has been compromised or if Customer suspects possible suspicious activities that could negatively impact security of the Service or Customer’s account.

    4. Customers are responsible to backup and maintain copies of their Customer Data. Vmags’s backups are “Infrastructure level”, which can not be used to restore a single-customer’s data.

Last Updated: September 5, 2013

Vmags does not permit copyright infringing activities and infringement of intellectual property rights through the use of its services and reserves the right to remove any content that breaches its content policy (including materials which are obscene, pornographic, profane, harmful to minors or otherwise objectionable in Vmags’s reasonable view). In addition, Vmags reserves the right, if properly notified that content infringes on another’s intellectual property rights, to remove such content. If a copyright owner or an agent thereof contacts Vmags regarding any content and claiming that its use through the Vmags services infringes upon copyright, Vmags will require the following information from the person claiming copyright infringement or that person’s agent (the “Complainant“):

• an electronic or physical signature of the person authorized to act on behalf of the Complainant if they are the owner of the copyright’s interest;

• a description of the copyrighted work that Complainant claims has been infringed, including the URL (i.e., web page address) of the location where the copyrighted work exists or a copy of the copyrighted work;

• identification of the URL or other specific location where the material that Complainant claims is infringing is located; contact information from the Complainant;

• a statement by Complainant that Complainant has a good faith belief that the disputed use is not authorized by the copyright owner, its agent, or the law;

• a statement by Complainant, made under penalty of perjury, that the above information in his/her notice is accurate and that Complainant is the copyright owner or authorized to act on the copyright owner’s behalf.