PLATFORM CUSTOMER AGREEMENT (B2B)

Version v.1.1 as of 28.11.2025

1.General Provisions
2.Terms and Definitions
3.Subject Matter and Scope of Services
4.Procedure for Conclusion (Acceptance) of the Agreement
5.Account and Access
6.Terms of Use for Trial Services and Beta Versions
7.Rates and Subscription
8.Prices, Calculations, and Taxes
9.Acceptable Use
10.Data and Results
11.Confidential Information and Personal Data
12.Security and Incidents
13.SLA and Support
14.Integrations and Third-Party Services
15.Intellectual Property
16.Warranties and Disclaimers
17.Liability and Limitations Thereof
18.Indemnity
19.Suspension and Termination
20.Governing Law, Jurisdiction, and Disputes
21.Sanctions, Export Control, and Anti-Corruption
22.Publicity and Use of Marks
23.Notifications
24.Assignment of Rights and Subcontracting
25.Force Majeure
26.Amendments to the Agreement
27.Priority of Documents
28.Final Provisions

1. General Provisions

1.1.

This Customer Agreement (hereinafter – the “**Agreement**” or “**CA**”) governs the procedure for providing access to the gro.now Platform and its use under the Software as a Service (SaaS) model. The Platform includes functional modules (hereinafter – the “**Modules**”), including a reputation module, a survey module, and a referral programs and partnerships module, allowing the Customer to independently launch and administer Surveys and other Activities using analytical and AI tools.

1.2.

**Provider** – “Pwron” LLP, BIN 241040012133, address: Republic of Kazakhstan, Almaty, Bostandyk district, Satpayev St., 90/54, apt. 5, index 050000; e-mail: t@gro.now; website: https://gro.now/.

**Customer** – a legal entity or an individual entrepreneur that has joined the Agreement in accordance with Section 4 and acts through its authorized representatives – **Users**.

1.3. Territory and International Nature.

gro.now Services are available to Customers from the Republic of Kazakhstan and other states, provided that the laws of the Republic of Kazakhstan shall apply to the Agreement (see Section 20). Restrictions due to sanctions and export control may apply (see Section 21).

1.4. Publicity and Form.

The Agreement is posted on the Internet at: https://app.gro.now/legal. The Customer joins the Agreement without signing a single paper document by the parties and does not require seals, unless otherwise explicitly agreed upon in writing.

1.5. Related Documents.

The documents posted on the Website and accessible at the following addresses (in their current version) are an integral part of the Agreement:

Description of Rates https://www.gro.now/ru#pricing;
Billing Policy https://app.gro.now/legal/billing-policy;
Service Level Agreement (SLA) https://app.gro.now/legal/sla;
Acceptable Use Policy (AUP) https://app.gro.now/legal/acceptable-use-policy
Rules for Conducting Surveys and Activities https://app.gro.now/legal/activity-rules;
General Personal Data Processing Policy https://app.gro.now/legal/general-privacy-policy;
Data Processing Addendum (DPA) https://app.gro.now/legal/dpa;
Cookie Policy https://app.gro.now/legal/cookie-policy;

The order of priority of documents is established in Section 27.

1.6. Language Versions.

The Agreement may be published in Russian, Kazakh, and English. In case of discrepancies, the Russian version prevails.

1.7. Provider's Contacts.

For claims and contractual correspondence, use the addresses specified in clause 1.2. The Provider has the right to update contact details by publishing an update on the website.

1.8. Customer Account.

Access to the Platform is provided through the Customer's user accounts, managed by the Customer's administrator (see Section 5). By registering/SSO, the Customer confirms familiarity with this Agreement and related documents.

2. Terms and Definitions

Unless the context otherwise requires, the following terms shall have the meanings set forth below:

**2.1. Platform** – the gro.now hardware and software complex, including web interfaces, mobile applications (app), backend services, AI-based analytics modules, data connectors, SDK and (if any) API, as well as related documentation.
**2.2. Services** – the Provider’s services for providing access to the Platform under the SaaS model, ensuring its operability and infrastructure support within the limits of the SLA, as well as configuration work on setting up the Platform's functionality (including Modules), if such work is provided for by the Rate or agreed upon separately.
**2.3. SaaS (Software as a Service)** — is a cloud model for providing software (SW), in which the Provider develops cloud software, ensures its maintenance, automatic updating, and availability, and provides such software to customers over the Internet for a fee proportional to the volume of use. The Provider manages all hardware, standard software, including middleware, software applications, and security.
**2.4. Customer, Customer User** – respectively: the organization/IE that has joined the Agreement; employees, contractors, and other authorized persons acting on behalf of the Customer and using the Platform based on the rights granted by the Customer.
**2.5. Customer Administrator** – a Customer user empowered to manage access and Customer settings in the Platform (creating/deleting users, assigning roles, selecting a rate plan, etc.).
**2.6. Account** — a set of records and settings that ensure Customer Users’ access to the Platform, including identifiers, roles, tokens, and authentication methods (including SSO).
**2.7. Modules** – pre-configured software components within the Platform's functionality that allow for automated collection, conducting of Activities, and analysis of information. The Provider ensures their operability and, if necessary, carries out configuration/inclusion in the scope provided for by this Agreement and the Rate.
**2.8. Activities (Activity)** — a set of marketing, research, and/or engagement activities carried out by the Customer using the Platform's functionality for interacting with respondents and/or collecting and analyzing data. Activities include, in particular, Surveys, tests and quizzes, gaming and gamified scenarios, contests and sweepstakes, referral and partner programs, and other campaigns.
**2.9. Survey (Surveys)** – an Activity in the form of an online questionnaire and/or interview conducted in an automated manner using the Platform, in which respondents answer the Customer's questions according to a predefined scenario (including NPS, CSI, ENPS, and other satisfaction/engagement metrics).
**2.10. Respondent** – a natural person participating in an Activity (Survey, test, contest, referral or other program) initiated by the Customer and/or its partners through the Platform. Legal relations between the Provider and Respondents are governed by separate gro.now documents (Customer Agreement for respondents, policy on processing of respondents' data, terms of a specific Activity, etc.).
**2.11. Customer Data** – any data, materials, and other information (including personal data) uploaded, provided, or otherwise transferred by the Customer to the Platform, as well as data obtained from sources/integrations connected by the Customer (e.g., Google SSO, Calendly, others).
**2.12. Results** – any reports, visualizations, metrics, and other output materials generated by the Platform automatically based on Customer Data and/or data from open sources during the use of the Platform's functionality (including analytical metrics for Surveys and other Activities), excluding materials the rights to which belong to the Provider under Section 14.
**2.13. Subscription** — a paid right to access the Platform for a selected period (month/year or other) within the selected **Rate**, with included limits/functionality and valid SLA.
**2.14. Rate (Plan)** – a package of functionality, limits, and conditions for providing Services, published at https://www.gro.now/ru#pricing, indicating the price, period, and restrictions.
**2.15. Invoice** – the Provider’s document/invoice sent to the Customer, containing a link to the current version of the Agreement and Subscription/services parameters (Rate, number of seats/limits, period, price, currency, taxes, start date).
**2.16. Additional Agreement / Order** – a document signed by the Parties and explicitly providing for special obligations of the Provider to perform tasks outside the scope of the Services (e.g., development/configuration of an additional Module), including the scope, timing, and cost of such services.
**2.17. Effective Date** – the date of the Customer’s acceptance of the Agreement by: (i) signing a separate contract/order referencing the Agreement; or (ii) paying the Invoice for the Subscription (see Section 4).
**2.18. Website** – the public pages https://gro.now/ and https://app.gro.now/.
**2.19. Personal Data (PD)** — information relating to an identified or identifiable natural person, processed during the provision of the Services and/or during the conduct of Activities, including as part of Customer Data or respondent data.
**2.20. DPA** – the Data Processing Addendum, posted at https://www.gro.now/legal/dpa, regulating the roles of the Parties (Customer – operator/controller, Provider – processor, if applicable), security measures, and interaction procedure.
**2.21. SLA** – the Service Level Agreement, posted at https://www.gro.now/legal/sla, setting target availability/response metrics and service credits.
**2.22. AUP** – the Acceptable Use Policy, posted at https://www.gro.now/legal/acceptable-use-policy, defining prohibitions and restrictions on the use of the Platform.
**2.23. Third-Party Services (Integrations)** – external services and providers not controlled by the Provider (e.g., authentication/SSO providers, scheduling tools, payment organizations), interaction with which may be carried out at the Customer’s choice.
**2.24. Subprocessors** – persons engaged by the Provider for data processing and/or providing part of the Services https://www.gro.now/legal/dpa.
**2.25. Security Incident** – a confirmed violation of information security that resulted in unauthorized access, loss, modification, disclosure, or destruction of Customer Data or personal data.
**2.26. Trial Features** – mean any free access to the Platform: a trial version, pilot/proof of concept, beta version, demo environment, or other Services provided without charge, as indicated by the Provider in the interface, order/invitation, or otherwise communicated to the Customer.
**2.27. API** – the Platform’s software interface (if provided), allowing the Customer to integrate external systems and automate feature calls, available under separate API terms (if any).
**2.28. Business Day** – a calendar day, excluding weekends and official holidays according to the legislation of the Provider's place of registration, unless otherwise specified in the SLA/Support Policy.
**2.29. Remuneration/Fee** – the amount payable by the Customer for the Subscription and/or other services under the Agreement, including taxes and duties, if applicable.
**2.30. Taxes** – VAT and other indirect/direct taxes, levies, and withholdings applicable to the Customer’s payments to the Provider.
**2.31. Notification** – a message sent in accordance with Section 23 (including e-mail, notifications in the Platform interface/personal account, and publications on the Website, when permitted by the Agreement).

3. Subject Matter and Scope of Services

3.1. Provision of Access to the Platform (SaaS).

The Provider grants the Customer paid access to the gro.now Platform in the scope of the selected Rate, and also ensures its operability and scalability within the limits of the SLA. Access is provided to Customer Users through the Customer Account and managed by the Customer Administrator (Section 5).

3.2. Platform Functionality.

The Platform consists of interconnected modules, the availability and scope of functions of which are determined by the selected Rate and current limits (see https://www.gro.now/ru#pricing). Functionality may include, but is not limited to:

**3.2.1. Reputation Module.** Consolidation and analysis of user reviews/ratings and other customer experience signals from supported sources for reputation research and service quality monitoring, with the presentation of aggregated Results, for example:
a) consolidated monthly and regional performance reports;
b) AI analysis of strengths/weaknesses, dynamics of service quality indicators (including NPS);
c) trend tracking and notifications of significant deviations according to defined rules;
d) comparable overview of market players based on available metrics and comparative dashboards for selected competitors/categories;
e) identification of best practices and lagging areas, benchmarks for planning and monitoring changes
**3.2.2. Surveys Module.** Tools for the Customer to independently conduct Surveys and other Activities, for example:
a) questionnaire builder with customizable question types, multilingual support;
b) support for CSI, NPS, ENPS, and other satisfaction/engagement metrics;
c) gaming formats (including swipes/stories/quizzes) and a “voice-to-text” option;
d) collection, processing, and visualization of Results in the Platform interface.
**3.2.3. Referral Programs Module.** Means for engaging consumers, launching referral and partner activities, for example:
a) automatic identification of promoters based on Survey responses/metrics;
b) invitation to a referral program, generation of personalized promo codes, and sharing tools;
c) tracking of referrals/activities and basic analytics in a unified dashboard.
**3.2.4. General Tools.** Integrations with supported data sources, export of Results, user and role administration, notification management, API/SDK access (if available).
Notes: (i) the list of sources, metrics, and formats may change without degrading the basic scope under the Rate; (ii) individual functions may be provided in the status of Trial Features “as is” (see clause 3.11).

3.3. What is NOT included in the Services.

The following is in no event considered as Services under this Agreement (and is not provided by the Provider within its framework):

**3.3.1.** professional, scientific, and technical services, including engineering services;
**3.3.2.** services in the field of advertising and market research (market research in the meaning of services provided by the Provider as a contractor);
**3.3.3.** information services provided as an independent type of service (preparation of reports/summaries by the Provider, editorial/analytical data processing, etc.).

3.4. Additional Services.

Additional work/services not included in the scope of the Services may be performed under a separate Additional Agreement/Order, including:

**3.4.1.** development/customization of Modules for the Customer's tasks;
**3.4.2.** refinement of the Platform's functionality for specific requirements (feature customizations);
**3.4.3.** configuration and/or extended configuration of the API;
**3.4.4.** integration of the Platform with the Customer's systems and implementation of the Platform into the Customer's infrastructure.

The scope, timing, cost, and acceptance terms for such additional services are determined only in the relevant Additional Agreement/Order.

3.5. Customer Responsibility in Using the Services.

**3.5.1.** The Customer independently plans and conducts Activities (including Surveys), forms goals and hypotheses, designs and scenarios for interacting with respondents, determines target audiences and data sources, ensures the legality of their receipt and processing, and the availability of all necessary consents/notifications from data subjects (if applicable).
**3.5.2.** The Customer is responsible for the compliance of the content of Activities (including Surveys), scripts, questionnaires, triggers, and collected data with the requirements of applicable law, AUP, and DPA.
**3.5.3.** The Provider does not control and is not obliged to control the content of Activities (including Surveys) and is not responsible for the correctness of the Customer's methodology, interpretations, or conclusions.

3.6. Restrictions and Acceptable Use.

Use of the Platform, including the Modules and the conduct of Activities, is subject to the AUP. The Provider has the right to suspend or restrict access in case of violation of the AUP, security requirements, or the law (Section 19).

3.7. Rates, Limits, and Quotas.

The specific scope of functionality, limits (including the number of users, projects, storage/query volume, API calls, data collection/processing speed) is determined by the selected Rate and is published in the Description of Rates (https://www.gro.now/ru#pricing). Exceeding limits is allowed only by upgrading the Rate or separate agreement.

3.8. Support and SLA.

The procedure for support, categories of incidents, target response/recovery times, and service credits are defined in the SLA (https://www.gro.now/legal/sla). Service credits are the sole legal remedy for SLA violations, unless explicitly agreed otherwise.

3.9. Third-Party Services and Integrations.

The Platform may interact with external services (e.g., Google SSO, meeting schedulers, payment providers, etc.). Such services are not controlled by the Provider and are provided under the terms of the respective third parties. The Provider is not responsible for their availability, changes, or the results of their use. By connecting integrations, the Customer confirms having the rights to transfer data to such services and process it.

3.10. Data from Open Sources.

When using Modules for automated collection and analysis of information from open sources, the Customer guarantees compliance with the rules of the respective platforms, copyrights and related rights, as well as robots.txt/terms-of-use restrictions, and confirms that the purposes of processing are lawful.

3.11. Service Evolution and Trial Features.

The Provider has the right to develop, modify, and improve the Platform (including replacing or removing non-essential functions) without degrading the basic scope provided for by the Rate. Access to Trial Features may be provided “as is,” without guarantees of availability or support; such features may be changed or terminated without compensation.

3.12. Results and Export.

The Platform generates Results in accordance with the selected Rate and current limits. The Customer has the right to export Results within the Platform’s functionality. Additional formats/custom exports are provided only if they are available or by separate agreement.

3.13. Geography and Compliance Restrictions.

Access provision may be restricted for certain jurisdictions and categories of Users due to sanctions or export control reasons. The Provider has the right to refuse or suspend access if providing service violates applicable regimes (Section 21).

3.14. Priority of Documents.

In terms of the scope of functions provided, limits, and metrics, the following apply: Description of Rates, SLA, AUP, and other documents specified in clause 1.5. In case of conflict, the priority order established in Section 27 applies.

3.15. Specifics of Activity Regulation.

The conduct of Activities involving Respondents is carried out by the Customer as the organizer of such Activities. The technical support of Activities, the processing of Respondent data, and interaction with them by the Provider are governed by separate gro.now documents (including the customer agreement for respondents, the Personal Data Processing Policy for respondents, and the Rules for Conducting Surveys and Activities). In case of a conflict between this Agreement and such documents regarding the rights and obligations of Respondents, the documents for Respondents prevail.

4. Procedure for Conclusion (Acceptance) of the Agreement

4.1. Offer.

The text of the Agreement posted on the Website is a public offer by the Provider to grant access to the Platform on the terms specified in the Agreement and related documents (clause 1.5).

4.2. Methods of Adherence (Acceptance):

**4.2.1. By signing a separate contract/order** between the Provider and the Customer, containing a reference to the current online version of the Agreement at the time of signing.
**4.2.2. By paying the Invoice for the Subscription** issued by the Provider (invoice/bill). Payment of such an invoice constitutes unconditional adherence of the Customer to the Agreement in the version that was effective at the time of payment (unless a different “version/hash” is specified in the invoice/order).

4.3. Moment of Conclusion and Effective Date.

**4.3.1. ** Upon signing a separate contract/order - from the date of signature by the last Party of the corresponding contract/order (or another date explicitly specified therein).
**4.3.2. ** Upon payment of the invoice – from the moment the payment is received by the Provider (or from the Subscription start date specified in the invoice/order, if such date is later).

4.4. Online Version and Archive.

The current version of the Agreement is available at https://www.gro.now/ru/legal; an archive of previous versions with the date and version identifier (hash) is also available. Upon acceptance under clause 4.2, the Parties are deemed to have agreed to the version indicated in the contract/order/invoice or the one effective at the time of payment, unless otherwise recorded.

4.5. Additional Agreements and Orders for Additional Services/Services.

**4.5.1.** The Parties may execute **Additional Agreements** and/or **Orders** (SOW/Work Order) for the provision of Additional Services.
**4.5.2.** Such Additional Agreement/Order must contain a description of the work, deadlines, cost/payment procedure, acceptance criteria, and a reference to the current version of this Agreement as of the date of signing.
**4.5.3.** Unless explicitly stated otherwise, the execution of the Additional Agreement/Order does not change the Subscription parameters and is not considered an amendment to this Agreement.

4.6. Amendment of Individual Terms in Contractual Documents.

**4.6.1.** Individual terms of this Agreement may be amended or detailed in a Contract/Additional Agreement/Order signed by the parties.
**4.6.2. ** In case of a conflict between this Agreement and the terms of the corresponding Contract/Additional Agreement/Order, the terms of the signed Contract/Additional Agreement/Order shall prevail, but only in the part explicitly regulated by it.
**4.6.3.** The priority indicated in clause 4.6.2 applies locally to the relevant project/services formalized by that Contract/Additional Agreement/Order and does not alter the effect of this Agreement in its remaining part.
**4.6.4.** If a certain issue is not regulated in the contractual document, the provisions of this Agreement and related documents (SLA, AUP, Description of Rates, etc.) shall apply.

4.7. Authority and Actions of Representatives.

The Customer guarantees that the person who signed the order/contract, or initiated the payment of the invoice/Account creation/Administrator appointment, acts with due authority. Actions of the Customer Administrator (selecting a Rate, inviting users, consenting to updated limits, etc.) are considered the actions of the Customer.

4.8. Electronic Forms and Signing.

The Parties recognize the legal force of electronic documents, electronic signatures (including simple ones), and scanned copies/PDFs, as well as acceptance through conclusive actions (payment of an invoice), on par with paper originals, unless explicitly prohibited by applicable law.

4.9. Confirmation of Acceptance and Logging.

The Provider has the right to maintain logs (log entries) of payment facts, Account creation/modification, Administrator appointment, and other Customer actions, which serve as proof of acceptance and Subscription parameters.

4.10. Related Documents and Amendments.

The Agreement applies in conjunction with the SLA, AUP, Description of Rates, etc. (clause 1.5). The procedure for amending the Agreement is in Section 26; the priority of documents is in Section 27.

5. Account and Access

5.1. Account Creation and Roles.

Access to the Platform is provided within the Customer Account. The Customer appoints at least one Customer Administrator, who manages users, roles, settings, and integrations. The Administrator’s actions are considered the Customer’s actions (see clause 4.7).

5.2. Customer Users.

Access is granted to natural persons – employees and/or engaged contractors of the Customer, acting under the Customer's control. The Customer ensures that such persons comply with the Agreement, AUP, and applicable legislation.

5.3. Named Access and Prohibition of Sharing.

Each account is tied to one specific user and cannot be transferred/used jointly. Group/shared accounts are not permitted, with the exception of service accounts for integrations, if explicitly allowed by the Provider.

5.4. Seats/Licenses and Limits.

The number of active users, projects, integrations, and other limits are determined by the selected **Rate** and Subscription parameters. Exceeding limits is possible only through an upgrade or separate agreement (see clause 3.7).

5.5. Authentication and Security.

The Customer ensures compliance with information security requirements, including:

**5.5.1.** use of strong passwords and, if available, multi-factor authentication (mandatory recommended for Administrators);
**5.5.2.** up-to-date user data, timely deactivation of dismissed/unauthorized personnel;
**5.5.3.** protection of devices and networks from which access is made;
**5.5.4.** keeping keys/tokens/passwords confidential and immediately notifying of their compromise.

5.6. SSO and Authentication Integrations.

When using SSO (e.g., Google), the Customer is responsible for the correctness of their provider's settings, the password/MFA policy on the provider's side, user lifecycle management, and timely revocation of rights.

5.7. API Access.

If API access is provided, tokens/keys are confidential and must not be transferred to third parties, except for contractors under the Customer's control. The Customer must comply with technical restrictions (rate limits, request sizes, etc.) and other conditions.

5.8. Administration and Principle of Least Privilege.

The Customer must assign roles based on the principle of “minimum necessary access,” regularly review rights, and keep records of service and integration accounts.

5.9. Responsibility for Content and Actions.

The Customer is responsible for all actions in the Account, including the uploading of Customer Data, launching of Activities, forming questionnaires, and working with Modules, as well as for complying with third-party rights and the requirements of the AUP/DPA.

5.10. Suspicion of Compromise.

In case of suspicion of unauthorized access, the Customer must immediately: (i) change passwords/revoke tokens; (ii) deactivate compromised accounts; (iii) notify the Provider. The Provider has the right to temporarily suspend access until risks are eliminated (see Section 19).

5.11. Logs and Audit.

The Platform may maintain technical logs (authentication, parameter changes, security events) for security and support purposes. The procedure for storing and accessing logs is determined by the Rate, SLA.

5.12. Access Restriction and Blockages.

The Provider has the right to restrict or block access to individual users/integrations in case of (i) violation of AUP or the law; (ii) security threat; (iii) overdue payment (see Sections 8 and 19). Reasonable restrictions are not considered a breach of the Provider's obligations.

5.13. Deactivation and Deletion.

The Customer Administrator independently manages the user lifecycle (activation/deactivation). Data deletion and export upon termination are governed by Section 19 and the Platform’s current settings.

5.14. Customer Contractor Access.

The Customer has the right to grant access to its contractors solely for the purpose of providing services to the Customer and under its control and responsibility. Any “outsourcing” use of the Platform in the interests of third parties (other than the Customer) is prohibited without the Provider's separate consent.

5.15. Trial Features.

During trial use, use of test environments, and beta features, the Customer must not upload sensitive personal data, unless explicitly permitted by the Provider. Trial Features are provided “as is” (see Section 6).

5.16. AUP Compliance.

Any use of the Account and access to the Platform are subject to the Acceptable Use Policy (AUP) https://www.gro.now/legal/acceptable-use-policy. The Provider may require the Customer to implement reasonable measures (multi-factor authentication, key rotation, password policy) to mitigate risks.

6. Terms of Use for Trial Services and Beta Versions

6.1. Trial Use Period

Trial Features are available until the earlier of the following events: (i) the end of the period announced by the Provider for trial/pilot/beta access; (ii) the start date of any paid Subscription for the same (or equivalent) services; (iii) the Provider sending a written notice of termination of trial access.

6.2. Scope of Use.

For the duration of the Trial Features, the Provider grants the Customer a **non-exclusive, non-transferable** right to access and use **solely for internal evaluation and testing**, in accordance with this Agreement, AUP, and applicable documentation. Production/mission-critical operation is not recommended and is undertaken at the Customer’s risk.

6.3. Data and Risk of Loss

**6.3.1.** Any data and settings entered by the Customer within the scope of Trial Features may be **irrevocably lost** at the end of the period, except when: a) the Customer formalizes a paid Subscription for the same Services; or b) before the end of the period, the Customer performs an export using available Platform tools (to the extent provided by the functionality).
**6.3.2.** The Customer undertakes **not to upload** sensitive categories of data (including special categories of personal data) into Trial/beta environments, unless explicitly permitted by the Provider and formalized in the DPA.

6.4. Functionality and Changes

**6.4.1.** The Provider **does not guarantee** that the functions available in Trial/beta versions will be available, unchanged, or equivalent in the generally available version. The Customer must separately evaluate the functionality of the purchased Services.
**6.4.2.** Beta features may be changed or disabled at any time without compensation (see also clause 3.11 of the Agreement).

6.5. Warranties, Support, and SLA

**6.5.1.** Trial Features are provided “**as is**” and “**as available**” without any express or implied warranties, including merchantability, fitness for a particular purpose, non-infringement, and accuracy of results (see Section 16).
**6.5.2.** The Provider **is not obliged** to provide support for Trial/beta versions; the SLA and service credits **do not apply** to them.

6.6. Liability, Indemnity, and Disclaimer

**6.6.1.** To the maximum extent permitted by law, the Provider’s liability for Trial Services is **excluded**; the Customer's sole remedy for dissatisfaction is to cease using the Trial Services (see also the limits in Section 16).
**6.6.2.** The Provider **does not undertake to indemnify losses** for claims related to the use of Trial/beta versions, except for cases explicitly provided for by mandatory legal norms.

6.7. Termination of Trial Access

**6.7.1.** The Provider has the right to terminate Trial Services at any time by notifying the Customer; access may be restricted immediately if required for security or legal reasons.
**6.7.2.** Upon termination of Trial Services, the rules of clause 6.3 (data and export) apply.

6.8. Miscellaneous

**6.8.1.** Trial/beta versions are subject to the AUP and other applicable provisions of the Agreement (including Sections 10, 11, 12, 14, 21). The DPA and the Personal Data Processing Policy apply to the processing of personal data.
**6.8.2.** Any commercial terms (prices, limits, support) apply only to a paid Subscription and are not implied for Trial/beta versions.

7. Rates and Subscription

7.1. Plans and Scope of Access.

Access to the Platform is provided under a subscription model within the selected plan (rate), the parameters of which (functions, limits, user types, API/storage quotas, etc.) are published on the **Description of Rates** page (https://www.gro.now/ru#pricing) and are considered included in the Agreement.

7.2. Subscription Term.

The Subscription is formalized for a fixed term (e.g., monthly or monthly-within a yearly commitment, or yearly – depending on the chosen model), specified in the order/invoice. Unless otherwise stipulated, the term **automatically renews for a similar period (auto-renewal)** until the Subscription is terminated according to Section 19 and clause 7.9.

7.3. Number of Seats and Limits.

The number of active users/seats, as well as other limits, are determined by the selected plan and/or order. Actual usage is measured by Platform tools and logs. Exceeding limits is prohibited, except when auto-upgrade or additional quota purchase is provided for (if available).

7.4. Plan Change (Upgrade/Downgrade).

**7.4.1. Upgrade** (to a higher plan/increase in seats/quotas) takes effect immediately or from the specified date; the remaining cost of the current period may be accounted for proportionally (co-term) or through an additional invoice – as specified in the Billing Policy (https://www.gro.now/legal/billing-policy).
**7.4.2. Downgrade** (to a lower plan/decrease in seats/quotas) applies from the beginning of the next Subscription term, unless otherwise agreed. The Customer is obliged to timely adjust usage to the new limits.

7.5. Additional Options.

Separate functions/quotas may be provided as add-ons, the terms of which are published at https://www.gro.now/ru#pricing or stipulated in the order/additional agreement. The term of the add-on follows the Subscription term or is fixed separately – according to the text of the order.

7.6. Trial Periods/Pilots.

If trial access is granted, it is subject to the restrictions indicated in the interface/order, as well as the provisions on Trial Features (clause 3.11). Upon expiration of the trial period, access is terminated or converted into a paid Subscription upon the Customer's express consent.

7.7. Change in Plan Parameters.

The Provider has the right to update plans (functions/limits), provided that a significant deterioration of the basic scope for a current paid Subscription is not allowed until the end of its current term, unless otherwise agreed. Updates are published at https://www.gro.now/ru#pricing.

7.8. Usage Accounting.

**7.8.1.** The Platform maintains records of events, queries, storage volumes, and other metrics to calculate compliance with limits/quotas. Such data may be used for billing, reporting, and applying measures under AUP/SLA.
**7.8.2. Acts are not formalized.** Within the framework of this Agreement, acceptance acts for rendered services are not drawn up or signed. The Platform's accounting data serves as confirmation of the scope and fact of Service provision.
**7.8.3. Platform Reports.** Usage reports are generated by the Platform’s tools and are available in the personal account/exported in supported formats. Such reports and system logs are proper proof of the calculation metrics, unless the Customer proves otherwise documented in accordance with clause 8.3.

7.9. Cancellation of Auto-Renewal and Termination.

The Customer may disable auto-renewal before the renewal date, observing the notification deadlines specified at https://www.gro.now/legal/billing-policy (if the deadline is not specified – at least 30 calendar days). Termination of the Subscription entails the consequences and procedure for data export/deletion according to Section 19.

8. Prices, Calculations, and Taxes

8.1. Remuneration and Currency.

The cost of the Subscription, add-ons, over-limit usage, and other paid options (collectively – “**Remuneration**”) is indicated in the Provider’s order/invoice and/or on the page https://gro.now/#pricing. Unless explicitly stated otherwise, prices **do not include taxes** and apply in the currency specified in the invoice (KZT / USD / EUR). Bank fees and transfer costs are borne by the payer.

8.2. Invoices and Payment Terms (Subscription).

Invoices for the Subscription period are issued **in advance** and are payable **no later than the start date** of the corresponding paid Subscription period. In the absence of payment by the specified deadline, access/renewal is not activated (or may be suspended) until funds are received.

8.3. Acceptance per Reporting Period and Disputes.

**8.3.1.** Taking into account the advance payment model, challenging an invoice before the end of the reporting period is allowed only in case of obvious technical errors (incorrect currency/rate/period/duplication).
**8.3.2.** Following each reporting month, the Platform generates a usage report (volumes, limits, add-ons, over-limit), available to the Customer Administrator in the interface/export.
**8.3.3.** The Customer has the right to send a reasoned claim regarding the volume/quality of the provided Service within **3 business days** from the end of the corresponding reporting month.
**8.3.4.** In the absence of a reasoned claim within the specified period, the Service for the reporting month is considered rendered in full and of proper quality, and the usage volumes are considered agreed upon. The undisputed part is subject to payment/offset in the general order.

8.4. Taxes and Withholdings.

**8.4.1.** Prices are indicated **excluding VAT** and other indirect/direct taxes; if they are applicable, they are charged in addition to the price and paid by the Customer.
**8.4.2.** Payments under the Agreement are made **without withholdings or deductions**. If the Customer's law requires withholding tax at the source, the Customer increases the payment (gross-up) so that the Provider receives the full amount, and provides supporting documents (withholding/remittance certificate).
**8.4.3.** Upon the Customer's request, the Provider provides a tax residency certificate for the purposes of applying double taxation treaties (if applicable).

8.5. Price Changes.

The Provider has the right to change public prices and/or billing terms for **future periods**. For current paid Subscriptions, the price is unchanged until the end of the current term; the new price applies from the next renewal upon notification at least **5 calendar days** before the renewal date (unless otherwise agreed in the order).

8.6. Over-Limit and Additional Services.

Payment for additional services (including under Additional Agreements/Orders) and over-limit usage is made **in advance or post-factum** – as indicated in the invoice:

**8.6.1.** if advance payment is indicated in the invoice — it is made **before the start** of the provision of the corresponding additional service/work;
**8.6.2.** if post-factum payment is indicated in the invoice – the payment term is **3 (three) business days** from the invoice date.

Additional services not paid for in advance are not launched; post-factum debt may lead to suspension under clause 8.2. The Provider has the right to combine items in summary invoices.

8.7. Prohibition of Set-off.

The Customer is not entitled to unilaterally withhold or set off amounts (set-off), except for cases explicitly provided for by the Agreement between the Parties.

8.8. Refunds and Service Credits.

Money refunds for paid periods are **not provided**, unless explicitly stated otherwise in the order/invoice or the Billing Policy (https://www.gro.now/legal/billing-policy). Compensation for SLA violations are service credits (see https://app.gro.now/legal/sla), which are not converted into money and are offset against future payments.

8.9. Settlement Currency and Exchange Rates.

When paying in a currency other than that specified in the invoice, conversion and related fees are borne by the payer; the amount actually credited to the Provider's account in the invoice currency is accepted for settlement.

8.10. Anti-Fraud and Payment Compliance.

The payer of the invoice must be the Customer itself or its affiliate explicitly specified in the order. The Provider has the right to reject a payment from any other person until the grounds are confirmed and/or request KYC/AML information within reasonable limits.

8.11. Billing Priority.

Special terms of price/payment/indexation agreed upon in the Contract/Additional Agreement/Order take precedence over this Section. The Billing Policy (https://www.gro.now/legal/billing-policy) supplements this Section and applies in the part not regulated by the order.

9. Acceptable Use

9.1. AUP as Part of the Agreement.

The use of the Platform is governed by the **Acceptable Use Policy (AUP)**, posted at https://www.gro.now/legal/acceptable-use-policy, which is an integral part of the Agreement.

9.2. Basic Prohibitions.

The Customer and its Users undertake not to:

**9.2.1.** violate the law and third-party rights, upload/process illegal content;
**9.2.2.** attempt to circumvent technical restrictions, conduct unauthorized access, penetration tests without consent;
**9.2.3.** carry out reverse engineering, deobfuscation, scraping, and automated data collection outside the functions provided by the Platform;
**9.2.4.** transfer access to third parties, share accounts or tokens;
**9.2.5.** exceed established limits and quotas, abuse the API/integrations.

9.3. Monitoring and Measures.

The Provider has the right to use reasonable technical means to monitor compliance with the AUP, and in case of violation – to restrict/suspend access (fully or partially) until violations are eliminated (see Sections 5, 19), and also request explanations and corrective measures.

9.4. AUP Priority.

In case of a conflict between this Section and the AUP, the AUP prevails. AUP updates are published at https://www.gro.now/legal/acceptable-use-policy and apply in accordance with Section 26.

10. Data and Results

10.1. Definitions (for the purposes of this Section)

**10.1.1. Customer Data** – any data, materials, and information (including personal data) uploaded/provided by the Customer to the Platform or obtained from integrations connected at the Customer’s choice.
**10.1.2. Data from Open Sources** – information aggregated by the Platform from publicly available sources on the Internet, including, but not limited to, review systems, navigators, media/articles, social networks, competitor websites, and other public resources.
**10.1.3. Data Owners** – natural/legal persons who own the rights to the corresponding sources from which Data from Open Sources enters the Platform.
**10.1.4. Results** – any reports, visualizations, metrics, and other output materials generated by the Platform automatically based on Customer Data and/or Data from Open Sources.

10.2. Rights to Data and Licenses

**10.2.1. Customer Ownership.** All rights to Customer Data are retained by the Customer. The Provider does not acquire any rights thereto, except for the limited license under clause 10.2.3.
**10.2.2. Data Owners' Rights.** Rights to Data from Open Sources belong to the respective Data Owners; the Platform processes only publicly available information within the limits permitted by law and platform rules.
**10.2.3. License to the Provider.** The Customer grants the Provider a non-exclusive, royalty-free license, limited in purpose and duration of the Agreement, to use the Customer Data solely for:
(i) providing and supporting the Services,
(ii) improving the Services (for details, see clause 10.7)
(iii) ensuring security/backup,
(iv) complying with legal/governmental requirements if there is a legal basis.
**10.2.4. Results.** Unless explicitly stated otherwise in the order/additional agreement, the rights to the Results (as a collection of automatically generated materials), excluding the Provider's materials/IP (source code, models, algorithms, templates), belong to the Customer.

10.3. Data Collection and Processing

**10.3.1. Customer Data.** The Customer guarantees the legality of uploading/use, the availability of all necessary rights/grounds (including data subjects' consents if necessary), and compliance with the AUP/applicable law.
**10.3.2. Data from Open Sources (Aggregation).** The Provider performs automated collection, aggregation, and processing of Data from Open Sources, including the use of AI technologies and filtering/“cleansing.” The Provider makes reasonable efforts regarding the quality of processing, but does not guarantee the absolute reliability, completeness, or relevance of such data; they are provided “**as is**.”
**10.3.3. Independence from Sources.** The Provider does not control the availability and composition of Data from Open Sources; suspension of data access/modification/deletion of information by Data Owners is not a breach by the Provider and does not constitute a deterioration of the quality or completeness of the Services' operation.

10.4. Restrictions, Publication, and External Use

**10.4.1. Internal Use.** The Customer uses the Data (including Results) solely for its own internal needs.
**10.4.2. Compliance with Data Owners' Restrictions.** The Customer undertakes to independently comply with all legal/technical restrictions of Data Owners (consent to use, terms of use, robots.txt, etc.).

10.5. Reliability, Liability, and “As Is” Condition

**10.5.1.** The Provider is not responsible for: (i) errors/inaccuracies/distortions in Data from Open Sources; (ii) the consequences of the Customer’s decisions made based on the Results. The Customer independently verifies the suitability of the Results for its purposes.
**10.5.2.** The Provider has the right to suspend or restrict access to individual data/functions if:
a) the Data Owner has imposed restrictions;
b) access to the sources has been suspended/terminated; (
c) the Customer violates the Agreement or the rules of the corresponding sources;
d) it is necessary to comply with the law/protect third-party rights.

10.6. Export, Storage, and Deletion

**10.6.1. Export.** During the Subscription period, the Customer has the right to export Results and, where provided by functionality, – copies of Customer Data, in supported formats.
**10.6.2. Storage and Backups.** The Provider ensures storage and backup in the volume necessary for providing the Services and fulfilling the SLA; technical backups are retained for a limited time and then overwritten.
**10.6.3. Deletion/Anonymization.** Upon the request of the Customer Administrator, the Provider deletes/anonymizes data within functional/legal possibilities. The procedure upon termination is in Section 19.

10.7. Use for Service Improvement.

By default, the Provider does not use the content of Customer Data/Results to improve the Services in a form that allows identification of the Customer/subjects. The use of anonymized aggregated metrics (performance indicators, error types) for quality/security monitoring is allowed.

10.8. System Data and Usage Accounting

The Platform may collect telemetry, authentication/event logs, performance metrics, and consumption accounting (for billing, SLA, AUP, and support). This data does not include the content of Customer Data, unless otherwise implied by an incident/support request.

10.9. Third-Party Claims and Indemnity.

In case of claims by Data Owners/third parties related to the Customer’s use of Results/Data contrary to the Agreement or the terms of the sources, the Customer provides documents/explanations upon request, and also indemnifies the Provider for reasonable losses, fines, and expenses (including defense costs) to the extent compatible with Section 18.

10.10. Content Restrictions.

It is prohibited to upload/process categories of data in the Platform that are prohibited by the AUP or explicitly restricted by law/documentation (e.g., highly sensitive PD – if not provided for by functionality and a separate agreement).

10.11. Security Incidents.

In the event of a confirmed Security Incident, the Provider acts according to the notification and response procedures established in the DPA and security policies, and takes reasonable measures to restore integrity/availability.

10.12. Form of Analytics Provision.

The Provider provides analytical materials exclusively in the Platform interface; they are generated in an automated mode and are not subject to manual refinement or provision as separate documents, unless explicitly provided for by an Additional Agreement/Order.

11. Confidential Information and Personal Data

11.1. Confidential Information (CI): Definition.

CI means any non-public information disclosed by one Party to the other in verbal, written, electronic form, or through the Platform, marked as “confidential” or obviously being such by its nature and the circumstances of disclosure (including commercial plans, finances, technologies, architecture/models/algorithms, source texts, keys/tokens, user data, transaction terms/prices, security, Customer Data, and Results).

11.2. Exclusions.

Information is not considered CI if it: a) became publicly available without violating the Agreement; b) was already lawfully known to the receiving Party before disclosure; c) was obtained from a third party without restriction and without violating its obligations; d) was independently developed by the receiving Party without using the disclosing Party's CI.

11.3. Obligations regarding CI.

The receiving Party undertakes to: a) use the CI solely for the purposes of performing this Agreement; b) not disclose the CI to third parties without the prior written consent of the disclosing Party, except for permitted contractors/subprocessors engaged for performance and bound by equivalent confidentiality obligations; c) ensure a regime of “no less than reasonable” level of protection (and, where applicable, no less than standard industry security measures); d) grant access to the CI only to employees/contractors on a need-to-know basis and not use the CI to the detriment of the disclosing Party.

11.4. Term of Confidentiality Regime.

The Parties observe the confidentiality regime regarding the CI for 3 years from the moment of each actual disclosure/transfer of the corresponding CI.

11.5. Compelled Disclosure.

In case of a legal/governmental authority's demand for disclosure of CI, the receiving Party (to the extent permissible) promptly notifies the disclosing Party and discloses only the necessary part of the CI, taking reasonable measures to preserve the confidential regime (including petitioning for closed proceedings/a protective order).

11.6. Return/Deletion.

Upon the disclosing Party's request or upon termination of the Subscription, the receiving Party returns or deletes the CI within a reasonable time, except for: (i) backup copies, which are deleted according to the backup lifecycle; (ii) archival copies, retained for compliance with law/internal reporting purposes while continuing to comply with the confidentiality regime.

11.7. Violation and Remedies.

Violation of the CI regime may cause irreparable harm; in addition to compensating losses, the disclosing Party has the right to demand an injunction/other preventive remedy without the need to prove the inadequacy of monetary compensation.

11.8. Priority of Separate NDA.

The Parties may enter into a separate Non-Disclosure Agreement (NDA). In case of a conflict between this Section and the signed NDA, the terms of the NDA shall prevail, but only in the part explicitly regulated by it.

11.9. Personal Data.

**11.9.1.** If personal data is processed during the use of the Platform, the Parties are guided by the DPA (https://www.gro.now/legal/dpa) and the Privacy Policy (https://www.gro.now/legal/general-privacy-policy). Roles: Customer – operator/controller, Provider – processor (where applicable).
**11.9.2.** Security procedures, incident notifications, cross-border transfers, and subprocessors are governed by the DPA.
**11.9.3.** Nothing in this Section limits the Parties' obligations under the DPA and applicable PD law; in case of conflict, the DPA terms prevail regarding PD.

12. Security and Incidents

12.1. Approach and Division of Responsibilities.

Security is provided under a shared responsibility model:

**12.1.1. The Provider is responsible** for the security of the Platform and the cloud infrastructure on which it is hosted (perimeter, computing resources, networks, storage, backup, logs, monitoring, and response tools).
**12.1.2. The Customer is responsible** for the security of its Account and users (access/role management, SSO/MFA, password policy, protection of end devices/networks, secure use of API and integrations), as well as for the legality of the uploaded data.

12.2. Technical and Organizational Measures (TOMs).

The Provider maintains and regularly updates a reasonable set of security measures, including, at a minimum:

**12.2.1.** encryption of data in transit (TLS) and at rest (at the level of cloud storage/key services);
**12.2.2.** access control based on the “least privilege” principle, role segregation, multi-factor authentication for administrative access;
**12.2.3.** environment segmentation, secrets/keys management, token rotation;
**12.2.4.** logging of authentication/accesses/significant system events and their monitoring;
**12.2.5.** backup and periodic recovery testing;
**12.2.6.** secure development and change management (code review, vulnerability analysis, managed releases);
**12.2.7.** risk assessment and management, personnel training on security and confidentiality.

12.3. Audits and Standards.

The Provider may undergo external audits/assessments (e.g., according to industry standards) and, upon Customer's request, provide summary reports/attestation letters and a list of key controls under NDA. Provision of original artifacts and access to the Provider's environments is not carried out.

12.4. Penetration Testing and Scanning.

Unauthorized scanning/pen-testing by the Customer against the Platform is prohibited. Testing is allowed only with the Provider's prior written consent, based on an agreed window and methodology, without access to the data of other customers.

12.5. Incident Notification.

In the event of a confirmed Security Incident affecting Customer Data or Customer's confidential information, the Provider will notify the Customer without undue delay (target guideline **within 72 hours** after confirming the incident) specifying available information about the nature, scope, taken, and planned measures. Further notifications and interaction are carried out in accordance with the DPA and applicable law.

12.6. Response and Mitigation.

The Provider has the right to temporarily suspend certain functions/Customer access if necessary to localize/neutralize the incident or eliminate a critical vulnerability, with subsequent restoration of functionality as risks are eliminated (see Sections 19 and SLA https://www.gro.now/legal/sla).

12.7. Notification and Coordination.

The Parties appoint contact persons for the exchange of operational information regarding incidents. The Customer undertakes to: a) timely report discovered vulnerabilities/suspicious activities in its Account; b) follow the Provider's reasonable instructions to reduce risks (including enabling MFA, revoking tokens, changing passwords); c) maintain the confidentiality of incident details until official communications.

12.8. Customer Responsibility for Accounts.

All actions performed using the Customer's accounts, keys, and integrations are considered the Customer's actions. The Customer must promptly deactivate access for dismissed/unauthorized persons and revoke compromised keys/tokens (see clauses 5.5, 5.10).

12.9. Business Continuity and Recovery.

The Provider maintains measures for business continuity and disaster recovery (BCP/DR), including backup of critical components and a procedure for service restoration within reasonable timeframes, agreed upon in the SLA.

12.10. Vulnerabilities and Responsible Disclosure.

The Provider maintains a process for triage/remediation of vulnerabilities. Please report discovered vulnerabilities to the Provider's designated security channel; public disclosure is allowed only after a term/remediation agreed upon with the Provider, so as not to create risks for the Customer and other users.

12.11. Subprocessors and Suppliers.

The engagement of subprocessors and cloud providers is permitted subject to comparable security measures and the DPA. The current list is formalized as an appendix to the DPA; the Provider conducts a reasonable check of key providers and monitors compliance with contractual security requirements.

12.12. Logs and Storage.

The retention periods for access/event logs and the format of their provision to the Customer (if applicable) are determined by the Platform's functionality, documentation, and SLA. Access to “raw” infrastructure logs may be restricted due to security and privacy considerations of other clients.

12.13. Limitations of Liability and Relationship with DPA.

This section governs the security of the Platform and the Parties' interaction during incidents. The procedure for personal data processing, notification of data subjects/regulators, and other PD requirements are governed by the DPA; in terms of PD, the DPA terms prevail.

13. SLA and Support

13.1. SLA Applicability.

Service levels are governed by the SLA document (https://www.gro.now/legal/sla), which is an integral part of the Agreement and applies within the scope of the paid Subscription and selected plans/rates.

13.2. Availability and Metrics.

Target metrics (service availability, response/recovery time, incident prioritization, uptime measurement) are defined in the SLA. Measurement is based on the Provider's logs and monitoring.

13.3. Service Credits (Sole Remedy).

Service credits are provided for deviations from target metrics, the calculation and application procedure of which is established in the SLA. Service credits are the sole and exclusive remedy for SLA violation and are not converted into money.

13.4. Exclusions.

The SLA does not apply to: (i) scheduled maintenance windows announced according to the SLA rules; (ii) cases caused by the Customer’s violation of the AUP/Agreement; (iii) failures in third-party services/Customer's infrastructure/Internet providers; (iv) Trial Features and test environments; (v) force majeure circumstances.

13.5. Credit Claim Procedure.

To receive a service credit, the Customer submits a request within the timeframe and by the method specified in the SLA, indicating the affected intervals and supporting data. Missing the deadline for submitting the request forfeits the right to a credit for the corresponding period.

13.6. Support.

Channels, operating hours, support languages, request prioritization, target response times, and escalation are indicated in the SLA (https://www.gro.now/legal/sla). Requests concerning security/incidents are submitted to the dedicated channel (see Section 12).

13.7. Scheduled Works.

The Provider has the right to carry out scheduled work during agreed windows. Notifications are published in advance according to the procedure established by the SLA (and, if necessary, in the Platform interface).

13.8. Interrelation with Other Documents.

In case of a conflict between this Section and the SLA, the SLA prevails; service credit billing issues are governed by Section 8 and the Billing Policy (https://www.gro.now/legal/billing-policy).

14. Integrations and Third-Party Services

14.1. General Provisions.

The Platform may interact with third-party services and providers (including authentication/SSO providers, schedulers, payment services, content storage/delivery systems, analytical tools, as well as large language model providers – LLM). Such services are not controlled by the Provider and are provided under the terms of the respective third parties.

14.2. LLM and Generative Components.

**14.2.1.** Individual Platform functions use third-party LLMs (as subprocessors/technology providers) for analysis, summarization, text generation, and other operations.
**14.2.2.** The transfer of input data (prompts/content/metadata) to such providers is carried out only to the extent necessary for the operation of the corresponding function and within the framework of the DPA and the list of subprocessors (formalized as an appendix to the DPA).
**14.2.3.** By default, the Provider does not use Customer Data to train external models; training is allowed only on anonymized aggregated metrics or with the Customer’s separate opt-in.
**14.2.4.** LLM outputs are probabilistic and may contain inaccuracies; the Customer must conduct a reasonable check and not rely on them as legal, medical, financial, or other professional advice.

14.3. Connection of Integrations at the Customer's Choice.

When connecting external integrations (including SSO, calendars, CRM, storage), the Customer confirms having the rights to transfer data to such services, independent compliance with their terms, and configuration of privacy/security settings. The Customer bears the risks associated with incorrect integration settings on its side.

14.4. Responsibility and Limitations.

The Provider is not responsible for: a) the availability/quality/changes in the functionality of third-party services (including LLM providers); b) the consequences of changes to their API/quotas/policies; c) incidents caused by failures/restrictions on the side of such services. However, the Provider takes reasonable measures to replace/workaround solutions, if commercially reasonable.

14.5. Changes and Replacement of Providers.

The Provider has the right to replace, add, or disable a specific integration/provider (including LLM) at any time, if this does not lead to a significant deterioration of the basic scope of functions under the current Subscription. The list of key subprocessors (formalized as an appendix to the DPA); changes are published in the manner specified in the DPA.

14.6. Cross-Border Processing.

The use of certain providers (including LLM) may involve cross-border data transfer. Such transfer is carried out according to the legal mechanisms provided for by the DPA and applicable law; upon the Customer’s request, the Provider provides information about the relevant jurisdictions and providers.

14.7. Data Minimization and Masking.

The Provider implements the principles of minimization and, where functionally available, masking/anonymization of input data when addressing the LLM. The Customer undertakes not to transmit personal data and other sensitive information in prompts/content if it is not necessary to achieve the processing purpose and is not provided for by the functionality/agreement.

14.8. Third-Party Licenses and Rights.

When using materials from external sources within integrations, the Customer ensures the availability of the necessary rights/licenses and compliance with the requirements of Data Owners (see Section 10). Publication/distribution of materials outside the Customer's internal needs is allowed only upon compliance with the terms of the corresponding sources and the Agreement.

14.9. Integration Security.

Technical protection measures for data exchange with third-party services include encryption in transit and access control with tokens/keys. The Customer must keep integration keys/secrets confidential and immediately revoke compromised keys. The Provider has the right to temporarily block integration if compromise is suspected (see Sections 5 and 12).

14.10. Disconnection on Demand.

Upon the Customer's reasoned request, the Provider may disable the use of individual integrations/providers (including LLM) within the limits permissible by the Platform's architecture and commercial feasibility. Such disconnection may lead to a limitation of functionality.

14.11. Priority of Documents.

In matters of personal data processing and subprocessors, the DPA and the subprocessors page prevail; in case of conflict between this Section and the terms of a specific integration/order — the signed document prevails (see clause 4.6).

15. Intellectual Property

15.1. Provider's Rights to the Platform.

All rights to the gro.now Platform and its components – including, without limitation, source code, architecture, models/algorithms (including AI models), data schemas, design/UX, documentation, templates, SDK, API, as well as to knowledge bases and other materials created or lawfully acquired by the Provider, — belong to the Provider or are used by it on lawful grounds. This Agreement **does not transfer** any exclusive rights to such objects to the Customer.

15.2. License to the Customer for the Subscription Period.

For the term of the paid Subscription, the Provider grants the Customer a limited, non-exclusive, non-transferable, **without the right to sublicense** license to access and use the Platform strictly within the scope of the selected plan, AUP, and other documents (clause 1.5). Any use outside the specified scope requires the Provider's separate written consent.

15.3. Customer Data and Results.

Rights to Customer Data and Results belong to the Customer in accordance with Section 10. However, neither Customer Data nor Results grant the Customer rights to the Provider's IP objects (source code, models, algorithms, templates, etc.), even if the Results are generated by the Platform’s tools.

15.4. Customizations and Developments by Assignment.

Developments, modifications, and integrations performed by the Provider under an Additional Agreement/Order belong to the Provider, unless explicitly agreed otherwise in such document. The Customer is granted a license to use the results of such work within its business goals and integration with the Platform. If the Parties desire a different distribution of rights (e.g., assignment/co-ownership), it is fixed in the text of the Additional Agreement/Order.

15.5. Feedback.

The Customer may send comments, ideas, and suggestions for improvements. The Customer **royalty-free** grants the Provider a **non-exclusive, irrevocable, perpetual, and worldwide license** to use such feedback for developing/improving the Platform without an obligation of attribution and without any payments to the Customer.

15.6. IP-Related Prohibitions.

Without the Provider's prior written consent, the Customer is not entitled to: a) copy, modify, adapt, distribute, rent/lease the Platform or its parts; b) carry out reverse engineering, decompilation, circumvention of technical protection means, except for cases explicitly permitted by law and the AUP; c) use the Platform and/or its results for training or improving its own models/systems intended for competing or analogous functionality, or for benchmarking for the purpose of public publication without the Provider's consent; d) remove/alter notices of copyrights, trademarks, and other rights.

15.7. Third-Party Components and Open Source Software.

The Platform may include or use third-party components (including LLM, open-source libraries). Such components may be subject to separate licenses/terms, available via links in the documentation/interface. In case of conflict between such terms and this Agreement, the terms of the respective licenses apply – to the extent of the use of such components.

15.8. Trademarks and Publicity.

Trademarks, trade names, and branding of the Parties are used only with their prior written confirmed consent, unless otherwise provided for in Section 22 (Publicity and Use of Marks).

15.9. Restriction of Implied Rights.

Except for the rights expressly granted in the Agreement and/or orders, no licenses or rights are **implied** (including by estoppel doctrine). All rights not granted to the Customer are expressly retained by the Provider.

15.10. Residual Knowledge.

Nothing in the Agreement prevents the Provider's employees/contractors from using general knowledge, skills, and ideas that are not protected by confidentiality and remain in memory, provided that the Customer's Confidential Information (Section 11) is not disclosed and the IP rights of the Customer/third parties are not violated.

15.11. Violation of Third-Party IP.

The procedure for settling third-party claims regarding Platform IP infringement, as well as indemnity and remedies, are defined in Section 18 and this Section. The Provider may, at its option: (i) modify the Platform, (ii) replace the component, (iii) obtain a license, or (iv) terminate the provision of the affected functionality with a proportional adjustment of payment (if applicable).

16. Warranties and Disclaimers

16.1. Mutual Basic Warranties.

Each Party represents and warrants that: (i) it is duly organized and has the authority to enter into and perform the Agreement; (ii) the person accepting the terms/signing the documents is authorized; (iii) performance does not violate mandatory legal norms and contracts of the Party.

16.2. Provider's Limited Warranty.

The Provider will provide access to the Platform and related Services with reasonable professional care and in substantial compliance with the published documentation and SLA. This warranty does not extend to: (i) use contrary to the Agreement/AUP/documentation; (ii) failures of third-party services/Customer’s infrastructure/Internet; (iii) Trial Features and test environments; (iv) force majeure circumstances.

16.3. Disclaimer.

**16.3.1.** To the maximum extent permitted by law, the Platform, its functions (including generative/LLM components), Results (including those generated based on Data from Open Sources), and any related information are provided “**as is**” and “**as available**.”
**16.3.2.** The Provider **expressly disclaims** all explicit, implied, statutory, or other warranties, including, without limitation, merchantability, fitness for a particular purpose, non-infringement, data accuracy/completeness, continuity/error-free operation beyond the SLA. The Provider does not guarantee that the Customer will achieve any business results.

16.4. LLM and Analytics.

LLM outputs and other AI results are probabilistic, may contain inaccuracies, bias, or omissions. They do not constitute legal, financial, medical, or other professional advice. The Customer must check their suitability and correctness before using them in decision-making.

16.5. Open Sources and External Services.

The availability, composition, and quality of Data from Open Sources and the functions of third-party services (including review services, classifieds sites, public maps, LLM/SSO/other integration providers) are not controlled by the Provider and may change or be terminated without the Provider's fault. Corresponding reservations and restrictions are set out in Sections 10 and 14.

16.6. Customer Warranties.

The Customer warrants that: (i) it possesses all necessary rights to Customer Data and its use on the Platform; (ii) it will comply with the Agreement, AUP, DPA, and applicable law; (iii) it will not rely on the Platform as a substitute for independent expertise/verification where necessary by law or by the nature of the decision.

16.7. Exclusive Remedy for Availability.

For breaches of service level metrics specified in the SLA, the sole remedy is service credits under the SLA (see Section 13); no other availability warranties are provided.

16.8. Survival.

The disclaimers of this Section remain in effect regardless of the termination of the Subscription/Agreement and supplement, but do not replace, the provisions of Sections 10, 12-14, and 17.

17. Liability and Limitations Thereof

17.1. General Rule.

Each Party is liable for a breach of the Agreement within the limits established by this Section, only if there is fault and only in respect of direct, documented, and foreseeable damages proximately caused by the breach at the time the Agreement was concluded.

17.2. Exclusion of Consequential Damages.

The Provider **is not liable** for lost profits, loss of revenue/contracts/goodwill, business interruption, loss or corruption of data, indirect, incidental, special, punitive, and other consequential damages, even if the Party was advised of the possibility thereof, except when such limitation is explicitly prohibited by applicable law.

17.3. Liability Cap.

The aggregate liability of each Party under the Agreement **is limited to the amount of Remuneration actually paid by the Customer under the Agreement for the 12 months** immediately preceding the event giving rise to liability (or if less than 12 months have passed – the amount paid for the actually elapsed period).

**17.3.1.** For trial/free access, the limit is 0 (zero), except in cases of willful misconduct or gross negligence.
**17.3.2.** All multiple claims/incidents in the aggregate shall not exceed the stated limit.

17.4. When the Liability Cap Does Not Apply.

The limitation in clause 17.3 does not apply to a Party's liability for: (i) willful misconduct or gross negligence; (ii) breach of confidentiality obligations (Section 10); (iii) confirmed infringement of third-party intellectual property rights by the Platform within the scope of the Provider's indemnity obligation described in clause 18.1; (iv) breaches of personal data requirements that arose due to the Party's breach of its obligations under the DPA; (v) undisputed amounts of debt for rendered Services.

17.5. Related Documents and Sole Remedy.

For deviations from the SLA, service credits under Section 13 apply, which are the **sole remedy** for breaching availability metrics and are not cumulative with other remedies for the same periods/events.

17.6. Third-Party Services and Open Sources.

A Party is not responsible for the unavailability/changes in the functionality of third-party services (including LLM, SSO, etc.) and/or for the composition/reliability of Data from Open Sources – see Sections 10 and 14. This limitation does not relieve the Parties from fulfilling explicitly assumed obligations under the DPA and security.

17.7. Assistance in Damage Mitigation.

Each Party must take reasonable measures to minimize damages. The Provider has the right to apply workaround solutions/temporary recovery measures; their application is not considered a breach if it complies with the SLA/Agreement.

17.8. Contributory Negligence and External Causes.

A Party's liability is reduced proportionally to the fault/negligence of the other Party or the influence of circumstances beyond the control of the breaching Party (including actions of third parties/sources, failures of Customer's infrastructure/Internet, force majeure - see Section 25).

17.9. Form of Claims.

Any claims for damages must be reasoned, include a calculation and supporting documents, and be sent in accordance with Section 23. The undisputed part is subject to payment in the general order.

17.10. Prevalence of Limitations.

This Section applies regardless of the legal qualification of the claims (contract, tort, etc.) and remains in effect after the termination of the Agreement. If applicable law does not allow the exclusion/limitation of liability – such exclusions/limitations apply to the maximum extent permitted.

18. Indemnity

18.1. Provider's Indemnification Obligation.

The Provider will indemnify the Customer for reasonable losses, expenses, and amounts under court judgments/settlements (including reasonable legal fees) arising from a third-party claim that the Platform, in its unmodified form, infringes the valid intellectual property rights of such third party in the applicable jurisdiction.

**18.1.1. Remedies.** In the event of such a claim, the Provider may, at its option and expense:
a) modify or replace the affected functionality with a non-infringing equivalent; or
b) terminate the provision of the affected functionality with a proportional credit/refund for the unused paid period (if applicable).
**18.1.2. Exclusions.** Indemnity is not provided if the claim is caused by:
a) use of the Platform in combination with products/data/services not provided by the Provider;
b) inappropriate/unauthorized use contrary to the Agreement, AUP, and related documents (see clause 1.5);
c) modifications performed by a party other than the Provider;
d) Trial Features;
e) third-party services/integrations or Data from Open Sources;
f) Customer materials (including Customer Data, Results, Customer publications).

18.2. Customer's Indemnification Obligation.

The Customer will indemnify the Provider for reasonable losses, expenses, and amounts under court judgments/settlements (including reasonable legal fees) if a third-party claim is related to: a) Customer Data, the content of Surveys, questionnaires/scripts, the Customer's publication/distribution of Results; b) the Customer's violation of the AUP, applicable law, the terms of sources/Data Owners, including restrictions on the use of Data from Open Sources (see Section 10); c) the use of the Platform by third parties to whom the Customer unlawfully provided access/allowed joint use of accounts or keys; d) claims by personal data subjects/regulators caused by the Customer's breach of its obligations under the DPA/law; e) infringement of third-party Intellectual Property rights by Customer materials or combinations/integrations performed by the Customer.

18.3. Procedure (Mandatory for both Parties).

The Party requesting indemnity must: (vi) immediately notify the other Party in writing of the claim (delay releases from liability to the extent of the damage caused); (vii) provide exclusive control over the defense and settlement to the indemnifying Party (provided that a settlement imposing obligations/admission of guilt on the other Party is allowed only with its written consent); (viii) provide reasonable assistance and furnish documents/data.

18.4. Limitations and Priorities.

**18.4.1.** Indemnity under clause 18.1 is the **sole and exclusive remedy** of the Customer for IP claims against the Platform.
**18.4.2.** Exclusions/limitations of liability in Section 17 apply, **except for cases** explicitly excluded from the limit (see clause 17.4); furthermore, the exclusion of consequential damages (clause 17.2) applies, unless otherwise prescribed by a mandatory legal norm or agreed upon in writing.
**18.4.3.** Nothing in this Section limits a Party's right to preventive remedies for confidential information (clause 11.7).

18.5. Consistency with Section 10 (Data Owners).

For clarity: claims/restrictions originating from Data Owners or platforms related to the Customer's use of Data from Open Sources and/or publication of Results outside internal needs are covered by the Customer's indemnification liability (clause 18.2) and are governed by the restrictions of Section 10.

18.6. Mitigation.

Each Party undertakes to cooperate in good faith to mitigate damages, take reasonable technical/organizational measures to mitigate risks, and not take actions that unreasonably increase the scope of potential indemnity.

19. Suspension and Termination

19.1. Grounds for Suspension (in full or in part).

The Provider has the right to temporarily suspend access to the Platform (Account, individual functions/integrations) if any of the following grounds exist:

**19.1.1. Non-Payment:** overdue payment for subscription, services.
**19.1.2. AUP/Agreement Violation:** use that creates legal/security risks, infringement of third-party rights, attempts to circumvent restrictions, unfair consumption.
**19.1.3. Security Risks/Incident:** confirmed or reasonably suspected compromise of credentials, API keys, unauthorized access, dissemination of malicious code (see Section 12).
**19.1.4. Sanctions/Export Control/Anti-Corruption:** grounds under Section 21.
**19.1.5. Legal/Governmental Requirement:** necessity to comply with mandatory norms/prescriptions of governmental authorities.
**19.1.6. Sources/Data Owners:** restrictions imposed by Data Owners/platforms or termination of access to sources (see Section 10), regarding the corresponding functionality/data.

19.2. Procedure and Scope of Suspension.

Suspension is applied to the minimum necessary extent and for a period sufficient to eliminate the causes. The Provider, if possible, sends a notification in advance or immediately after suspension (Section 22), except in cases where immediate action is necessary to prevent damage.

19.3. Access Restoration.

Access is resumed no later than the next business day following the day the reasons for suspension are eliminated (payment, confirmation of violation correction, security measures, etc.). The Provider may request supporting documents/actions (including password change, token revocation, enabling MFA). Reactivation fees may apply for repeated suspensions due to the Customer's fault.

19.4. Termination at the Customer's Initiative.

**19.4.1. Without cause (future effect):** The Customer has the right to terminate the Subscription by disabling auto-renewal under clause 7.9 with termination at the end of the current paid term.
**19.4.2. Material Breach by the Provider:** The Customer's right to terminate the Agreement arises only after the consistent completion of the following steps: (i) the Customer's appeal in the manner and within the timeframe provided for by the SLA (opening an incident/ticket, providing information, requesting a service credit, and other actions according to SLA procedures), and the failure to eliminate the breach within the recovery/response times established by the SLA, or the Provider's unjustified refusal to apply the measures provided for by the SLA; and (ii) the Customer sending a written claim in accordance with clause 20.2. If, after receiving the claim, the breach is not eliminated **within 10 calendar days**, the Customer has the right to terminate the Agreement. Deviation from SLA target metrics alone, when service credits are properly provided, **is not considered a material breach** and does not give the right to terminate, unless explicitly provided for by the SLA/signed documents.

19.5. Termination at the Provider's Initiative.

**19.5.1. Material Breach by the Customer** (including repeated/material violation of AUP, overdue payment, violation of DPA/Section 20), not remedied within **10 calendar days** from the moment of notification (or other reasonable period indicated in the notification, if security/legal risk requires faster remediation).
**19.5.2. Impossibility of Lawful Provision of Services:** prolonged (more than 30 days) impossibility of lawful provision of individual functions/data due to reasons beyond the Provider's control (sanctions, restrictions by Data Owners, regulatory requirements). In such a case, termination is allowed selectively regarding the affected functions with a proportional adjustment of future payments (if applicable).

19.6. Automatic Termination.

The Agreement terminates automatically upon the liquidation of a party (other than reorganization with universal succession), or upon a court injunction prohibiting the provision of Services to the Customer taking effect.

19.7. Consequences of Termination.

**19.7.1. Access:** on the termination date, access to the Platform ceases, except for the data export window described below.
**19.7.2. Data/Results Export:** within **30 calendar days** after termination (unless otherwise specified in the order/DPA), the Customer may request and perform export using available Platform tools. After the deadline, the Provider has the right to delete or anonymize data according to standard procedures (backups are erased according to the lifecycle).
**19.7.3. Payments:** all accrued and unpaid amounts are payable within **10 calendar days** from the termination date. Refunds are made according to the rules described in the Billing Policy https://www.gro.now/legal/billing-policy.
**19.7.4. Special Services/Additional Agreements:** termination of the Subscription does not automatically terminate the effect of signed Additional Agreements/Orders, unless explicitly specified therein or indicated in the termination notice; such documents remain in effect regarding the obligations provided for by their terms.

19.8. Survival.

The following provisions survive termination: Section 8 (regarding debt/taxes/reporting), Section 9 (AUP – for previously committed breaches), Section 10 (data and dissemination restrictions), Section 11 (confidentiality), Section 12 (security – regarding incidents/disclosure), Clause 13.3 (service credits), Section 15 (intellectual property), Section 16 (disclaimers), Section 17 (limitations of liability), Section 18 (indemnity), Section 20 (disputes), Section 21 (sanctions/export), Section 22 (trademarks and mentions).

19.9. No Waiver of Claims.

Suspension/termination does not relieve the Customer of the obligation to pay for already rendered Services/add-ons/over-limit and does not deprive the Provider of the right to other remedies provided for by the Agreement and the law.

19.10. Notification Procedure.

Notifications of suspension/termination are sent in accordance with Section 23. In case of urgent security measures, notification after suspension is allowed (with an explanation of the reasons and necessary steps for restoration).

20. Governing Law, Jurisdiction, and Disputes

20.1. Applicable Law.

The substantive law of the Republic of Kazakhstan shall apply to this Agreement and all legal relations of the Parties, irrespective of conflict of laws rules.

20.2. Claim Procedure (Mandatory).

**20.2.1.** Before applying to court/arbitration, the Parties must undergo the claim procedure. If the dispute concerns an incident, availability, metrics, or measures under the SLA, the Customer first follows the SLA procedures and waits for the actions/timeframes established by the SLA. Only in the absence of proper settlement under the SLA is a claim sent in accordance with this clause.
**20.2.2.** The Party receiving the claim must send a reasoned response **within 10 calendar days** from the date of receipt. However, for issues of incidents/availability, the response times for elimination are governed by the SLA, and the response time for the claim is governed by this clause.
**20.2.3.** If the dispute is not settled by SLA procedures and by claim, the Party has the right to apply for dispute resolution in court or arbitration as set out below.
**20.2.4.** If no response is received within the specified period or if the claim is rejected, the Party has the right to apply for dispute resolution in the manner provided for below in this Section. Passing the claim procedure does not limit a Party's right to seek interim measures.

20.3. Customers from the Republic of Kazakhstan (Courts).

For Customers registered/domiciled in the Republic of Kazakhstan, all disputes, disagreements, or claims arising out of or in connection with the Agreement are subject to final resolution in court in the **authorized court at the Provider's location**.

20.4. Foreign Clients (IAC Arbitration).

For Customers who are non-residents of the Republic of Kazakhstan, all disputes, disagreements, and claims arising out of or in connection with the Agreement (including issues of performance, breach, termination, or invalidity) are subject to final resolution in the **International Arbitration Court “IAC” (Republic of Kazakhstan, Almaty)** in accordance with the following terms:

**20.4.1. Rules and Composition:** the dispute is considered under the IAC Rules, the arbitration is composed of **one arbitrator**.
**20.4.2. Place of Arbitration:** the city of Almaty, Republic of Kazakhstan.
**20.4.3. Language of Arbitration:** **Russian** language.
**20.4.4. Applicable Law:** the substantive law of the Republic of Kazakhstan.
**20.4.5. Electronic Communications:** for the purpose of shortening the proceedings, IAC notifications to the parties (about dates/times of hearings, rulings, copies of claims, petitions, and materials), as well as the submission of petitions/claims and the sending of scanned copies of documents by the parties to the IAC, are allowed by email to iac@arbitration.kz, except in cases where the IAC requires originals.
**20.4.6. Parties' Addresses:** electronic correspondence is conducted from the email addresses of the Parties specified in the “Full Details and Signatures of the Parties” section of the relevant Contract and/or Order, and is recognized as proper.
**20.4.7. Electronic Proceedings:** the dispute is considered in the form of electronic arbitration proceedings (video conference) using the contact information for video communication specified by the Parties in the “Full Details and Signatures of the Parties” section of the Contract and/or Order.
**20.4.8. Confidentiality:** the arbitration proceedings are confidential, unless otherwise provided by the IAC Rules or mandatory legal norms.

21. Sanctions, Export Control, and Anti-Corruption

21.1. Compliance with Sanctions Regimes.

Each Party represents and warrants that it, its affiliates, beneficiaries, directors, and key employees **are not included in restrictive measures/sanctions lists**, including, without limitation, the sanctions lists of the Republic of Kazakhstan, the UN, the EU, the UK, the USA (OFAC/SDN), and other applicable jurisdictions, and are not controlled by persons on such lists.

21.2. Export Control and Prohibition of Circumvention.

The Customer undertakes to comply with all applicable export control rules, dual-use restrictions, as well as prohibitions on re-export, circumvention, or aiding the circumvention of restrictions. The Platform and related technologies (including crypto tools, AI/LLM components, and encryption) **must not be used in prohibited jurisdictions, for prohibited end-users, or for prohibited purposes**.

21.3. Due Diligence (KYC/AML).

The Provider has the right to request reasonable information and KYC/AML documents from the Customer to confirm compliance with clauses 21.1-21.2. Failure to provide information or the detection of a violation gives the Provider the right to **suspend access to the Platform and/or unilaterally terminate** the Agreement.

21.4. Prohibition of Corrupt Practices.

The Parties undertake **not to offer, promise, give, or accept illegal remuneration, gifts, payments, or other benefits** to any persons, including government officials, for the purpose of obtaining or retaining business, undue influence on decisions, or otherwise violating applicable anti-corruption legislation (RK, FCPA, UK Bribery Act, etc.).

21.5. Interaction with Government Bodies and Public Sectors.

The Customer guarantees compliance with all special requirements applicable to interaction with government customers/state property, including restrictions on gifts/fees, procurement transparency, and conflict of interest. The Provider has the right to request confirmation of such procedures when servicing public sector projects.

21.6. Customer Confirmations.

The Customer represents and warrants that: a) it will not use the Platform for transactions or projects that violate sanctions/export restrictions; b) it will immediately notify the Provider of any change in status affecting compliance with the requirements of this Section; c) it will ensure compliance with these requirements by its Users and contractors.

21.7. Right to Refuse/Suspend.

The Provider has the right to **refuse to conclude/renew** the Subscription, **suspend or restrict access**, and also **terminate** the Agreement **with immediate effect** if there are reasonable grounds to believe that the use of the Platform violates sanctions/export/anti-corruption requirements or creates significant compliance risks.

21.8. Compliance Audit.

Upon the Provider's reasoned request, the Customer provides confirmations (reasonable documents/statements) of compliance with this Section. Such a request must not unreasonably interfere with the Customer's commercial secrets and is carried out taking into account Section 11 (confidentiality).

21.9. Liability and Indemnity.

The Customer's breach of this Section is considered a material breach of the Agreement and may lead to indemnification of the Provider for direct losses, fines, and expenses incurred due to such breach (taking into account the limits/exclusions of Section 17 and the procedure of Section 18).

21.10. Priority of Norms.

In case of a conflict between the norms of different jurisdictions, the Parties are guided by the **strictest** applicable requirements that do not violate the mandatory norms of the RK law. If specific restrictions make the performance of the Agreement illegal or impossible, clauses 21.7 and Section 25 (force majeure) apply.

22. Publicity and Use of Marks

22.1. General Rule (Opt-in).

The use of the Party's trade names, trademarks, logos, and other designations (hereinafter – “**Marks**”) for external communications is allowed **only with the prior written consent** of the respective Party, unless otherwise explicitly permitted by this Section.

22.2. Text and Visual Customer Mentions (Opt-out).

**22.2.1.** The Provider has the right to indicate the Customer's name in text and/or using its logo/Marks **without separate consent** in the list of Platform users, on the website, in presentations, marketing materials, case studies, and press releases, provided that clauses 22.5 – 22.7 are observed.
**22.2.2. Upon the Customer's written request**, the Provider will cease further use of the Marks/mentions and will delete/replace the materials in controlled channels within a **reasonable time (usually up to 10 business days)**.
**22.2.3.** If the Customer has not provided brand guidelines/Marks carriers, the Provider has the right to use publicly available versions of the designations **at its discretion, acting in good faith and without distorting the Marks**.

22.3. Case Materials and Testimonials (Opt-out).

**22.3.1.** The publication of case materials, excerpts from testimonials, and other marketing materials is possible **without separate special consent**, provided that such materials **do not disclose Confidential Information** (Section 11) and do not contain commercially sensitive metrics without the Customer's explicit consent.
**22.3.2.** The Customer has the right to request the deletion/correction of specific materials; the Provider will fulfill the request in accordance with clause 22.2.2.

22.4. License to Marks (Default).

For the duration of the Agreement, the Customer grants the Provider a limited, non-exclusive, royalty-free, non-transferable license to use the Marks for the purposes specified in clauses 22.2-22.3. The license is effective **by default** (without a separate letter), may be **revoked by the Customer through written notice**; after revocation, the deletion procedure under clause 22.2.2 applies. No other rights to the Marks are granted.

22.5. Revocation of Consent and Cessation of Use.

A Party has the right to **revoke consent** for the use of its Marks/materials if: (i) the materials are no longer relevant, (ii) brand guidelines are violated, (iii) the use is misleading or harmful to goodwill. The other Party ceases use and deletes/updates the materials within a **reasonable time (usually up to 10 business days)** from the moment of notification.

22.6. Prohibition of Misleading Use.

The Parties must not represent partnership, exclusivity, endorsement, or sponsorship, unless explicitly agreed upon; distortion of the results of Platform use and incorrect comparisons with competitors are prohibited.

22.7. Joint Events and PR.

Joint webinars, press releases, publications, and presentations are possible upon separate agreement on the plan, content, and deadlines. Each Party is responsible for complying with third-party rights (photo/video, quotes, statistics) and confidentiality/PD regimes (Section 11).

22.8. Confidentiality is Preserved.

This Section **does not override the Confidential Information regime**: publication of information constituting CI is prohibited without separate written permission; if a separate NDA exists – the terms of the NDA prevail.

22.9. Subscription Termination.

Termination of the Subscription automatically terminates the right to new use of the Marks. Already published materials may be retained in the archive and passive channels (e.g., conference recordings, press releases, other published information), unless deletion is required under clause 22.5.

22.10. No Remuneration.

Granting the right to use the Marks **does not entail payment of royalties or other remuneration**, unless explicitly agreed upon by the Parties in writing.

23. Notifications

23.1. Communication Channels.

Legally significant notifications and communications between the Parties are sent:

**23.1.1.** by email to the addresses specified in the “Full Details and Signatures of the Parties” section of the relevant Contract/Order;
**23.1.2.** through the Platform interface (notifications/banners/support tickets — for operational messages, incidents, and SLA);
**23.1.3.** to the addresses specified on the Provider’s “Legal Information” page or in the text of this agreement – **only for notifications addressed to the Provider**, unless a different special address is indicated in the Contract/Order;
**23.1.4.** by other means explicitly agreed upon by the Parties (e.g., through a dedicated ticketing system or e-billing).

23.2. Form and Language.

**23.2.1.** For counterparties – residents of EAEU member countries, notifications are sent **in written form in Russian** (English duplication is allowed).
**23.2.2.** For counterparties – non-residents of EAEU member countries, notifications are sent **in written form in English**.

23.3. Moment of Delivery (Presumptions of Delivery).

**23.3.1. Email** – by the time of sending recorded on the sender's server, in the absence of a non-delivery message within 24 hours; if sent outside the recipient's Business Day – considered received at the start of the next Business Day.
**23.3.2. Notifications in the Platform interface** — by the time of publication/display in the Customer Account.
**23.3.3. Mail/Courier shipments** (if applicable) — by the delivery service's mark of delivery.
**23.3.4.** For communications with the IAC within the arbitration proceedings (clause 20.4), the address iac@arbitration.kz and the IAC Rules also apply.

23.4. Special Channels.

**23.4.1. Incidents and SLA** – through the support channels specified in the SLA/“Support” section; further legally significant communications on the same subject are allowed by email according to clause 23.1.1.
**23.4.2. Security/Leaks** — to the Provider's dedicated security address with a duplicate by email according to clause 23.1.1.

23.5. Change of Details for Notifications.

Each Party is obliged to keep its addresses/contacts up-to-date. A change of address for notifications takes effect **1 Business Day** after the corresponding message is sent to the other Party at the previous address and published (for the Provider) on the Provider's “Legal Information” page or in the text of this agreement, if applicable.

23.6. Trusted Senders and Access.

The actions and messages of the Customer Administrator and other authorized users in the Platform interface are considered the actions/messages of the Customer. The Parties ensure that their email domains and communication channels do not block each other's messages (whitelist).

23.7. Priority of Special Rules.

If special timeframes/channels are established for a specific process by the Agreement (e.g., SLA), such special rules apply.

24. Assignment of Rights and Subcontracting

24.1. Assignment and Other Disposition of Rights.

The Customer **is not entitled to transfer** (assign, transfer) rights and/or obligations under the Agreement, use them for security transactions, or otherwise dispose of them **without the Provider's prior written consent**, except for the cases in clause 23.2. Any attempt at transfer in violation of this clause **is void**.

24.2. Exceptions (Without Consent):

**24.2.1. Change of Control/Reorganization of the Customer.** Assignment/transfer in connection with a change of control, reorganization, merger, or sale of a substantial part of the Customer's assets to a third party is permitted subject to **prior written notice** to the Provider and **succession** to all of the Customer's obligations (including AUP, DPA, unpaid amounts). The Provider has the right to refuse if such transfer leads to a violation of sanctions/export requirements (Section 21) or to reasonable security/compliance risks.
**24.2.2. Customer Affiliates.** The Customer has the right to transfer rights/obligations to an **affiliate** under the same ultimate control, with written notice **at least 10 business days** in advance and provided that there is joint and several liability with the affiliate until the obligations are fully performed.

24.3. Novation and Formalities.

Upon the Provider's request, the Parties formalize **novation/a tripartite agreement** on the transfer of the contract to the successor. Until the formalities are completed, the original Party remains responsible for the Agreement.

24.4. Prohibition of Splitting and Circumvention.

The Customer must not split the Subscription/accounts between persons who are not the Customer or its affiliates, or provide the Platform under sub-lease/outsourcing to third parties without the Provider's written consent (see clause 5.14).

24.5. Provider's Subcontractors.

The Provider has the right to engage **subcontractors** for the performance of the Agreement, including cloud service providers, integrations, and LLM providers, provided that:

**24.5.1.** The Provider remains **responsible to the Customer** for the actions of such subcontractors as for its own.
**24.5.2. Subcontractors** processing personal data or participating in the provision of Services **are considered subprocessors**; the DPA requirements apply to them, and the current list is published as an appendix to the DPA.
**24.5.3.** The engagement/replacement of material subprocessors is carried out taking into account the notification/objection procedures provided for in the DPA; in case of critical disagreement by the Customer, the parties in good faith seek a workaround, otherwise the provisions of Section 19 apply.

24.6. Transfer of Local Access Rights.

In case of contract transfer under clause 24.2, the Customer Administrator must timely reconfigure access/integrations and ensure the export/migration of data within the Platform's functionality (Sections 10, 19).

25. Force Majeure

25.1. Definition of Force Majeure.

Neither Party **shall be liable** for the complete or partial non-performance of obligations under the Agreement if it was a consequence of **force majeure** circumstances that the Party could not foresee or prevent by reasonable measures, including, without limitation: a) natural disasters; b) fires; c) floods; d) earthquakes; e) epidemics/pandemics and related restrictions; f) military actions, g) acts of terrorism and civil unrest; h) strikes and lockouts (except internal ones at the Party claiming force majeure, if they could have been prevented); i) acts and decisions of governmental authorities, j) sanctions/embargoes, k) export/import restrictions; l) large-scale failures in the operation of electrical grids/Internet/communication channels; m) prolonged (not caused by the Party) failures at cloud providers of data centers/networks; n) other similar circumstances.

25.2. Notification and Confirmation.

The Party affected by force majeure must **notify the other Party without undue delay**, describing the nature, expected duration, and impact on performance, and provide available confirmations (if any, a certificate from authorized bodies/chamber of commerce and industry). Failure to provide notification within a reasonable period deprives the Party of the right to invoke force majeure regarding preventable consequences.

25.3. Suspension of Performance and Extension of Deadlines.

For the duration of the force majeure, the performance of the Party's corresponding obligations is **suspended**, and the deadlines are **proportionally extended**. Obligations to pay for already rendered services and extinguish accrued amounts are not lifted by force majeure, except in cases where the provision of services itself has become legally/factually impossible.

25.4. Mitigation.

Each Party takes reasonable measures to minimize the impact of force majeure (including workaround solutions, shifting loads, alternative communication channels) and regularly informs the other Party about the progress of eliminating the consequences.

25.5. SLA and Service Credits.

Periods during which performance is impossible due to force majeure are **excluded** from the calculation of SLA metrics; service credits for such periods **are not accrued**.

25.6. Prolonged Duration and Right to Terminate.

If the force majeure lasts continuously for **more than 30 (calendar days** and significantly impedes the use of the Platform under the Agreement, either Party has the right to **terminate** the Agreement (in full or in respect of the affected functionality) with written notice. In the event of partial/full termination under this clause, the Provider will make a proportional adjustment to **future payments** (if applicable).

25.7.

Refunds of previously paid amounts are not made, unless explicitly provided for by law or signed documents.

25.7. Data Export during Force Majeure.

If possible, the Provider grants the Customer a window for exporting Results and copies of Customer Data using available tools (see clause 19.7.2). If export is impossible due to the nature of the force majeure (e.g., regulatory prohibition/blockade), the export period is extended for a reasonable period after the obstacles cease.

25.8. Inapplicability to Other Party's Monetary Obligations.

The Customer's monetary obligations for properly rendered Services **are not considered affected by force majeure**, except in cases where the execution of payment is objectively impossible due to regulatory prohibitions/sanctions or systemic failures of payment infrastructure; in such cases, clauses 25.2-25.4 apply, and the Parties agree on an alternative payment method.

26. Amendments to the Agreement

26.1. Online Version and Archive.

The text of the Agreement is published at https://app.gro.now/legal. An archive of versions with dates/version identifiers is available at /legal/archive. The public online version is considered authentic.

26.2. Update Procedure.

The Provider has the right to introduce amendments to the Agreement and related documents (SLA, AUP, Policies, Description of Rates, etc.) with notification to the Customer in accordance with Section 23, unless otherwise provided for by this Section or the law.

26.3. Material Changes (7 Calendar Days).

Amendments that **materially affect the rights/obligations** of the Customer (e.g., new restrictions on use, change in liability mechanics, new Customer obligations) take effect **7 calendar days from the date of notification**. Before the effective date, the Customer has the right to **refuse to renew** the Subscription or **terminate** the Agreement for the future, by notifying the Provider.

26.4. Non-Material/Improving Changes (Effective Immediately).

Editorial, clarifying, error-correcting amendments, as well as those that **clearly improve** the terms for the Customer (e.g., expansion of limits without price increase, clarification of procedures without increasing obligations) apply from the moment of publication/notification.

26.5. Mandatory and Urgent Changes.

Amendments necessary to comply with the law, regulatory requirements, ensure security/eliminate vulnerabilities, as well as to prevent abuse/damage, may be applied **immediately with parallel notification**. Such amendments are not considered material to the extent strictly necessary to comply with mandatory requirements.

26.6. Changes in Prices and Billing.

The procedure for changing prices/rates is governed by Section 8. For a current paid Subscription, prices are unchanged until the end of the current term; the new price applies from the next renewal upon notification within the established timeframe.

26.7. Acceptance of Amendments.

Use of the Platform after the effective date of the amendments or renewal of the Subscription is considered **acceptance of the amendments**. In case of disagreement, the Customer exercises the rights under clause 26.3 and/or terminates the Subscription under Section 19.

26.8. Priority of Special Documents.

If amendments concern the DPA, SLA, AUP, or signed documents (Contract/Additional Agreement/Order), the priority rules of clauses 4.5 – 4.6 and Section 27 apply. In case of conflict between this Agreement and a signed document, the signed document prevails in the part regulated by it.

26.9. Version Fixation for an Order.

For a specific Order/signed Contract, the parties may fix a reference/identifier of the Agreement version; in such a case, the specified version applies to the relations under the relevant document until the expiration of its term, unless otherwise explicitly stipulated by the parties or required by law/security (clause 26.5).

27. Priority of Documents

27.1. General Principle.

In case of contradictions between the documents governing the relations between the Parties, the following hierarchy applies (from higher to lower level), unless otherwise explicitly stipulated in the relevant document:

**27.1.1. Signed Documents** between the Parties (Contract / Additional Agreement / Order) – **only in the part explicitly regulated by them**;
**27.1.2. This Customer Agreement**;
**27.1.3. SLA** - regarding service levels, metrics, and service credits;
**27.1.4. AUP** (Acceptable Use Policy) — regarding prohibitions/restrictions on use;
**27.1.5. Rules for Conducting Surveys and Activities** – regarding the use of the Platform's functionality for launching Activities by the Customer;
**27.1.6. Description of Rates** and published specifications/limits;
**27.1.7. Billing Policy** – regarding the procedure for invoicing/accounting/credits;
**27.1.8. Security Policy** – regarding procedures and technical measures;
**27.1.9. Privacy Policy and Cookie Policy** – regarding the processing of PD by the Provider as an operator;
**27.1.10. DPA** (Data Processing Addendum) – regarding PD processing when the Provider is the PD processor on behalf of the Customer;
**27.1.11. Terms for API/SDK** – regarding access to API/SDK.

27.2. Local Priority of Signed Documents.

In case of a conflict between this Agreement and the terms of a signed Contract/Additional Agreement/Order, the **signed documents prevail**, but **exclusively within their limited scope**.

27.3. Special Rules.

**27.3.1.** For incidents/availability and response times, the **SLA prevails**; the procedure for claims and termination rights is governed by clauses 19.4.2 and 20.4.
**27.3.2.** For personal data and cross-border transfer, the **DPA prevails**; for API – the **Terms for API/SDK**; for AUP violations – the **AUP**.

27.4. Not Included in the Contract.

Marketing materials, presentations, advertising, and public statements (including website pages outside the “Legal Documents” section) **are not part of the contract** and do not alter the Parties' obligations, unless explicitly incorporated by a signed document.

27.5. Versioning.

The versions of documents effective at the time of acceptance/formalization of the relevant Order or in accordance with the procedure established in Section 26 apply. The archive of versions is available at https://www.gro.now/ru/legal.

28. Final Provisions

28.1. Entire Agreement.

This Agreement, together with the documents it references (see clause 1.5) and the documents signed by the Parties (Contract/Additional Agreements/Orders), constitutes the **entire agreement** between the Parties and supersedes all prior arrangements regarding its subject matter.

28.2. Severability.

If any provision is found to be invalid/unenforceable, it shall be applied to the **maximum extent permitted**, and the remainder of the Agreement shall remain in effect. The Parties will in good faith replace such provision with a legally equivalent one in meaning.

28.3. Waiver.

Failure to exercise or delay in exercising any right under the Agreement **is not considered a waiver** thereof. A one-time waiver does not imply a future waiver and must be in writing.

28.4. Independence of Parties.

The Parties are **independent contractors**; the Agreement does not create a partnership, agency, employment, joint venture, or franchise relationship. Neither Party has the right to make statements/assume obligations on behalf of the other without its written consent.

28.5. Assignment of Rights upon Change of Control.

The Agreement remains in effect upon a change of control/reorganization of a Party subject to compliance with Section 24 (Assignment of Rights and Subcontracting).

28.6. Headings and Interpretation.

Headings are for convenience and do not affect interpretation. Terms are interpreted according to Section 2 and the context. The words “including/including but not limited to” mean “including, but not limited to.”

28.7. Electronic Form and Copies.

The Agreement and related documents may be concluded/exchanged in **electronic form** (including electronic signature, scanned copies, PDFs, conclusive actions under Section 4). Electronic copies have the force of originals within the limits permitted by applicable law.

Previous versions:
Version 1.0