Business Services Terms and Conditions

1. Parties and scope

These Koll business services terms and conditions (the "Terms") form an agreement between Koll Group Oy, Business ID 3410913-5, Joensuunkatu 7, 24100 Salo, Finland ("Koll"), and the business customer of the Service (the "Customer").

The Terms apply to the Koll service provided by Koll to businesses and other entities carrying out commercial activity, and to related applications, web services, interfaces, integrations, SmartCard messages and other separately agreed features (together, the "Service").

The Service is intended solely for the Customer's own commercial activity. The Customer may not use the Service as a consumer or resell the Service to a third party without Koll's prior written consent.

2. Definitions

Customer Data means information, content and material that the Customer or its User enters, transmits or otherwise submits to the Service, or whose processing the Customer enables through an integration.

AUP means the Acceptable Use Policy in Annex 2, in its version in force from time to time.

DPA means the Data Processing Agreement in Annex 1.

User means an employee, contractor or other person authorised by the Customer for whom access to the Service has been created.

Service Description means Koll's published description, or one agreed by the parties, of the features of the Service ordered by the Customer.

Order Confirmation means an order, quotation or other document signed by the parties, accepted electronically, or delivered by Koll to the Customer, setting out the scope of the Service, pricing, billing period and contract term.

Third-Party Service means, for example, a service provided by a telecom operator, an SMS, RCS or WhatsApp provider, or a CRM, CCaaS, authentication or other integration service.

3. Formation of the agreement and order of precedence

The agreement is formed when the Customer accepts the Order Confirmation or these Terms electronically, signs the agreement, activates the Service, or otherwise indicates acceptance of the agreement. The person accepting on behalf of the Customer must be authorised to bind the Customer.

If the contract documents conflict with one another, the following order of precedence applies:

• individually and expressly agreed exceptions in the Order Confirmation;
• the DPA on matters concerning the processing of personal data;
• any customer-specific SLA and Service Description;
• these Terms; and
• the AUP.

The Customer's own general procurement or contract terms do not apply unless Koll has expressly accepted them in writing.

4. Service content and development

The Service enables the Customer to transmit information related to a call or contact attempt to a recipient, such as the caller's name, company name, phone number, reason for calling, and the Customer's brand information. Information may be transmitted in the Koll app, over public communications networks, and through Third-Party Services such as SMS, RCS or WhatsApp channels, to the extent those features are included in the Service ordered by the Customer.

Koll may develop and modify the Service, its technical implementation and user interface. However, during a fixed contract term Koll may not, without a justified reason, materially impair the core functionality of the Service ordered by the Customer. If a change materially impairs the Service and Koll does not remedy the situation within a reasonable time following the Customer's written notice, the Customer is entitled to terminate the affected order and receive a refund of any prepaid, unused portion.

Koll may offer new, replacement or beta features. Beta, trial and preview versions are provided "as is", may be changed or removed at any time, and are not covered by any SLA unless separately agreed.

The Service is not an emergency call service and must not be used for emergency numbers or other safety-critical communications. Koll does not guarantee that a recipient will see the message or caller information, open the message, answer the call, or take the desired action.

5. Access rights, Users and account management

Koll grants the Customer, for the duration of the contract term, a limited, non-exclusive, non-transferable and revocable right to use the Service in the Customer's internal business in accordance with the Order Confirmation and these Terms.

The Customer is responsible for ensuring that:

• only its authorised Users use the Service;
• user accounts are personal and credentials are not shared;
• User information and access rights are kept up to date;
• Users comply with the agreement, the AUP and applicable law;
• Koll is notified without undue delay of suspected misuse of credentials or a security incident; and
• the Customer's administrators have the authority to take actions binding on the Customer regarding administration of the Service.

The Customer is responsible for its Users' actions as if they were its own. Koll may apply technical limits to monitor the number of users, usage volumes and subscribed features.

6. Customer obligations and lawful contact

The Customer is responsible for the purpose of using the Service, the recipients, the content of messages and reasons for calling, and for ensuring that every contact attempt and related processing of personal data has a lawful basis under applicable law. In particular, the Customer must:

• comply with rules on direct marketing, electronic communications, consumer protection, data protection and privacy;
• respect a recipient's objection or other expression of intent limiting contact;
• ensure that the caller's and company's identity and the reason for calling are accurate, up to date and not misleading;
• arrange for necessary consents, information notices, legitimate-interest assessments and do-not-contact lists;
• retain documentation needed to demonstrate lawfulness; and
• comply with the AUP.

The Service itself does not grant the Customer a right to contact a recipient. Koll may request reasonable evidence from the Customer regarding the lawfulness of its use and may suspend use in accordance with section 14 if there is justified reason to suspect a breach.

7. Company profile, caller identity and Customer Data

Koll establishes a company profile for the Customer, which may include the company's official name, trading name, Business ID, billing details, phone numbers, brand information, logo and presentation. Koll may verify information from reliable sources and request further evidence of the Customer's control over the company or number.

The Customer represents that all information it provides is accurate and that it holds the necessary rights to use the company name, phone numbers, logo, trademarks and other Customer Data. The Customer will report changes without delay.

The Customer retains all rights to Customer Data. The Customer grants Koll, for the duration of the contract term, the right to use, copy, transfer, modify and display Customer Data only to the extent necessary to provide, protect and support the Service and implement agreed integrations.

Koll does not record the audio content of calls unless a separate recording feature, processing bases and allocation of liability have been expressly agreed in writing. Koll may process technical metadata relating to calls and messages to the extent necessary for the operation, billing, security and abuse-prevention of the Service.

8. Third-party services and integrations

The Service may rely on telecom operators, message routing providers, cloud, authentication, analytics and customer-service solutions, and other Third-Party Services. These may process, for example, names, phone numbers, company information, reasons for calling, message content, timestamps, delivery data and brand information.

The Customer accepts that the availability, security, encryption and functionality of a Third-Party Service may vary by channel. For example, not all SMS and RCS connections are end-to-end encrypted.

The Customer must not include sensitive or unnecessary personal data in a visible reason for calling or in an unprotected message.

Koll is responsible for its own careful selection of service providers, the Service's own interfaces, and the integration components under Koll's responsibility. Koll is not responsible for a disruption caused by a Third-Party Service beyond Koll's reasonable control, the Customer's systems, an incorrect configuration, or a change that Koll has not made or approved.

The Customer is responsible for the operation and security of its own systems, devices, network connections and integration settings. Koll may separately charge reasonable fees for investigation and change work arising from changes made by the Customer or a third party, if agreed before the work begins.

9. Data protection

The parties comply with applicable data protection legislation. To the extent Koll processes personal data on the Customer's behalf, the Customer acts as controller and Koll as processor, and the DPA applies to that processing.

Koll acts as an independent controller when processing personal data for its own purposes, such as managing the contractual and customer relationship, billing, user authentication, service security, abuse prevention, and fulfilling statutory obligations. This processing is described in Koll's privacy policy.

As controller, the Customer is responsible, among other things, for the legal basis of processing, informing data subjects, data minimisation, accuracy, retention periods and the exercise of data subject rights. The actual assessment of roles is determined by the nature of the processing and not solely by the label used in the agreement.

10. Information security

Koll implements technical and organisational security measures appropriate to the risks of the Service and develops them as technology, costs and risk levels change. More detailed processor security measures are described in the DPA.

The Customer is responsible for managing access rights, devices, integration keys, authentication solutions, instructing personnel, and ensuring that unnecessary or prohibited information is not entered into the Service. Each party will notify the other without undue delay of a security incident that comes to its attention and that may have a material effect on the Service or on data processed under the agreement, and will cooperate reasonably to limit any damage.

11. Service availability, maintenance and support

Koll aims to keep the Service continuously available, except for maintenance, updates, security measures and disruptions beyond Koll's reasonable control. Koll does not guarantee uninterrupted or error-free operation unless otherwise agreed in a separate SLA.

Koll aims to give reasonable advance notice of planned maintenance that materially affects use. Urgent security and remedial measures may be carried out without advance notice.

The Customer will report a detected error without undue delay and provide Koll with reasonably necessary information to reproduce and investigate the error. The scope and service hours of support are determined by the Order Confirmation or the Service Description.

12. Pricing, invoicing and payment

The Service's prices, billing model, any usage quotas, number of users, message- and traffic-based fees, and billing period are set out in the Order Confirmation or the applicable price list from time to time. Unless otherwise stated, prices do not include value added tax or other statutory charges, which are added to the invoice in accordance with applicable law.

Unless otherwise agreed in the Order Confirmation, recurring fees are invoiced in advance and usage-based and overage fees in arrears. The payment term is fourteen (14) days from the invoice date. Koll's usage measurements form the basis for invoicing unless a clear error is demonstrated.

The Customer must raise any justified objection to an invoice without undue delay. The undisputed portion of an invoice must be paid by the due date. Overdue payments accrue interest under the Finnish Interest Act, and Koll is entitled to charge reasonable collection costs.

Payments made are non-refundable unless these Terms expressly provide otherwise. The Customer is also responsible for usage-based charges arising through its Users or credentials, unless such use results solely from a security breach for which Koll is responsible.

13. Contract term, renewal and termination

The agreement is valid for the fixed term agreed in the Order Confirmation, or indefinitely. If no contract term has been agreed, the agreement is valid indefinitely.

An indefinite agreement may be terminated in writing with one (1) month's notice. The agreement ends at the end of the billing period during which the notice period expires.

A fixed-term agreement may not be terminated mid-term without a right agreed in another contract document. A fixed-term agreement ends at the end of the term unless the Order Confirmation provides for automatic renewal. If automatic renewal has been agreed, either party may prevent renewal by giving notice at least thirty (30) days before the end of the current term.

Either party may terminate the agreement or an individual order in writing with immediate effect if the other party materially breaches the agreement and fails to remedy the breach within fourteen (14) days of written notice. No cure period is required if the breach cannot be remedied or is intentional and so serious that continuation of the contractual relationship cannot reasonably be required.

A party may terminate the agreement immediately if the other party is declared bankrupt, enters liquidation, or otherwise demonstrably becomes insolvent, unless mandatory insolvency law provides otherwise.

14. Suspension of the Service

Koll may suspend the Service in whole or in part if:

• the Customer uses the Service in violation of law, the agreement or the AUP;
• the use causes or threatens to cause a security, safety, abuse or reputational harm to Koll, recipients or a third party;
• the Customer jeopardises the Service or use by other customers;
• an invoice is at least fourteen (14) days overdue and a payment reminder has been sent to the Customer;
• suspension is necessary due to an order of a public authority, law, or the terms of a Third-Party Service; or
• the agreement gives Koll the right to terminate the Service.

Koll aims to give advance notice of a suspension and to limit it to what is necessary. Advance notice is not required in an urgent security, abuse or unlawfulness situation. Koll restores the Service once the cause of suspension has been removed and reasonable clarifications have been made.

15. Effects of termination

On termination of the agreement, the Customer's access right ceases and all amounts due become payable. The Customer is responsible for exporting any data it needs before termination using the Service's normal functionality.

The Customer may request a reasonable return of Customer Data in a commonly used, machine-readable format within thirty (30) days of termination, if the data cannot be exported by the Customer itself. Koll may charge a reasonable, pre-agreed fee for work exceeding a normal export.

Koll deletes or anonymises the personal data it processes on the Customer's behalf in accordance with the DPA, unless the law requires retention. Data remaining in backups is removed in the normal rotation cycle and is not restored to active use for another purpose.

If the Customer terminates a fixed-term agreement without Koll being in breach, the fees for the remaining contract term become payable, unless otherwise agreed in the Order Confirmation. If the Customer terminates the agreement due to Koll's material, unremedied breach, Koll will refund prepaid fees for the unused period.

16. Intellectual property rights

Koll and its licensors own all rights to the Service, software, interfaces, documentation, brand, designs, methods, technical solutions and modifications thereof. The agreement does not transfer to the Customer any rights other than the access right expressly granted therein. Without Koll's prior written consent, the Customer may not:

• copy, modify, translate, disassemble, reverse engineer or decompile the Service except to the extent permitted by mandatory law;
• circumvent usage, security or capacity limitations;
• rent, resell, sublicense or offer the Service as a service to a third party;
• use the Service to build a competing product or to benchmark the Service's non-public features; or
• remove copyright, trademark or proprietary notices from the Service.

If the Customer provides Koll with feedback or development suggestions, Koll may freely use them without compensation, provided the use does not disclose the Customer's confidential information or personal data.

17. Confidentiality

Confidential Information means all technical, commercial, financial or other information marked as confidential or which should reasonably be understood as confidential given the circumstances, including Customer Data, non-public product and security information, prices, business plans and integration information.

The receiving party will use Confidential Information only to perform the agreement, protect it with at least the same care it applies to its own similar information, and disclose it only to persons and subcontractors who need to know it and who are bound by an appropriate duty of confidentiality.

The confidentiality obligation does not apply to information that the receiving party can show:

• was public without a breach of this agreement;
• was lawfully in its possession before receipt;
• was lawfully obtained from a third party without a duty of confidentiality; or
• was independently developed without using the other party's Confidential Information.

If disclosure of information is required by law or a public authority, the receiving party may disclose only the required portion and, where legally permissible, will give advance notice. The confidentiality obligation continues for five (5) years after termination of the agreement, and for as long as information remains a trade secret in the case of trade secrets.

18. Warranties and Customer remedies

Koll warrants that the Service will materially operate in accordance with the agreed Service Description and that Koll will provide the Service in a professional manner. The Customer's primary remedy in the event of a defect is for Koll to correct the defect or provide a materially equivalent workaround within a reasonable time.

If a material defect continues after a reasonable remedy period and significantly prevents the agreed use of the Service, the Customer may terminate the affected order and receive a refund of the prepaid, unused portion.

Unless otherwise required by mandatory law or expressly agreed, the Service is provided without other express or implied warranties. Koll does not guarantee a specific response rate, sales result, recruitment result, customer experience, savings or other business impact.

19. Third-party claims and intellectual property infringement

If a third party claims that the Customer's contractual use of the Service infringes its copyright, trademark or patent valid in Finland or another EU member state, Koll will defend the Customer against the claim and be responsible for damages awarded by a final judgment or agreed in a settlement approved by Koll, within the limits of this section and section 20.

Koll may, at its option, obtain a licence, modify or replace the Service, or terminate the affected order and refund the prepaid, unused portion. Koll is not liable for a claim arising from Customer Data, a modification by the Customer or a third party, use contrary to instructions, a combination not supplied by Koll, or continued use after Koll has offered a non-infringing alternative.

The Customer will defend Koll against a third-party claim arising from Customer Data, the Customer's communications, unlawful contact with recipients, unauthorised use of an identity or number, or the Customer's or its User's conduct in violation of the AUP or law, and will be responsible for damages awarded by a final judgment or agreed in a settlement approved by the Customer.

The indemnification obligation requires that the party seeking indemnification notify the claim without undue delay, give the indemnifying party control of the defence and settlement negotiations, and provide reasonable assistance. A settlement may not, without consent, include an admission of the other party's liability or any obligation other than a monetary one.

20. Limitation of liability

Neither party is liable for indirect or consequential damages, such as loss of profit, revenue, savings, business opportunity or goodwill, even if advised of the possibility of such damages. This limitation does not prevent recovery of reasonable direct costs necessary to limit damage for which the other party is responsible or to restore data.

Each party's aggregate total liability for all claims arising under the same agreement is limited to the amount corresponding to the service fees paid and due for payment in respect of the Service to which the Customer's claim relates, for the twelve (12) months preceding the event giving rise to the claim. If the agreement has been in force for less than twelve months, liability is limited to the fees paid up to that point and agreed to be paid during the remainder of the first contract year. The above limitations of liability do not apply to:

• damage caused intentionally or by gross negligence;
• death or personal injury to the extent liability cannot be limited;
• the Customer's payment obligation;
• intentional breach of access restrictions or the other party's intellectual property rights; or
• liability that cannot be limited under applicable mandatory law.

Mutual claims between the parties relating to data protection are subject to the limitation of liability to the fullest extent permitted by law. This does not limit the statutory rights of a data subject or supervisory authority, nor a party's statutory liability towards them.

21. Customer reference

During the contract term, Koll may name the Customer's company as an actual customer reference in sales discussions, customer lists, on the website and in presentation materials. The Customer may prohibit use of its name at any time by written notice, upon which Koll will stop any new use without undue delay and remove the name from digital materials under its control within a reasonable time.

Use of the Customer's logo, trademarks, statements, results, case studies or press releases always requires the Customer's separate written approval. The right to be referenced does not authorise disclosure of Confidential Information.

22. Force majeure

A party is not liable for delay or failure to perform an obligation to the extent it results from an event beyond the party's reasonable control that was not reasonably foreseeable when the agreement was concluded, and whose effects could not reasonably have been avoided or overcome.

Force majeure may include, for example, war, riot, an order of a public authority, a strike, a natural disaster, a major electricity or telecommunications outage, a large-scale disruption of a public communications network or an essential cloud service, or a cyberattack that the party did not contribute to and could not have prevented with reasonable security measures.

The party invoking force majeure must notify the other of the event and its estimated duration without undue delay and seek to limit its effects. If a force majeure event continues uninterrupted for more than sixty (60) days and materially prevents use of the Service, either party may terminate the affected order without liability for damages.

23. Changes to prices and terms

Koll may change the prices of an indefinite agreement by giving at least sixty (60) days' notice. A price change does not take effect during a fixed term, but at the earliest at the start of the next renewal period, unless the change results directly from a new tax or statutory charge.

Koll may amend these Terms for a justified reason, such as a change in law, regulatory guidance, security requirements, the technical implementation of the Service, or the business model. A material change will be notified at least thirty (30) days in advance. If a change materially worsens the Customer's position, the Customer may terminate an indefinite agreement before the change takes effect, or a fixed-term order as of the effective date of the change, without liability to pay for the remaining term.

Koll may implement a change immediately if it is necessary due to law, a regulatory order, or an urgent security reason. Koll will notify the Customer of such a change without undue delay. Mere clarifications and changes that do not materially worsen the Customer's rights or increase its obligations may be made by giving notice no later than when the change takes effect.

24. Notices, assignment and subcontracting

Notices concerning the agreement are given in writing to the contract contact address specified in the Order Confirmation, the Service's admin panel, or the party's website. Koll may also send general notices about the Service to the Customer's administrators. The Customer must keep its contact information up to date.

The Customer may not assign the agreement without Koll's prior written consent. Koll may assign the agreement to a group company or in connection with a business transfer, merger, demerger or other corporate transaction relating to the Service, by notifying the Customer.

Koll may use subcontractors to provide the Service and is responsible for their performance as if it were its own, except to the extent otherwise separately agreed regarding a Third-Party Service. Sub-processors of personal data are subject to the DPA.

25. Other terms, governing law and dispute resolution

The agreement constitutes the parties' entire agreement on its subject matter and supersedes prior oral and written representations regarding it. An amendment to a customer-specific agreement must be made in writing, unless these Terms expressly provide otherwise.

If any provision of the agreement is found invalid or unenforceable, the remaining provisions remain in force. The parties will replace such provision with a valid provision that best matches its intended purpose. Failure to exercise, or delay in exercising, a right does not constitute a waiver of that right.

Provisions that by their nature are intended to survive, such as payment, intellectual property, confidentiality, limitation of liability, data deletion and dispute resolution, survive termination of the agreement.

The agreement is governed by the laws of Finland, excluding its conflict-of-law rules. Disputes will first be resolved through good-faith negotiation. If no resolution is reached within thirty (30) days of a written request for negotiation, the dispute will be resolved at first instance in the Southwest Finland District Court. Koll may nevertheless seek interim relief or recover an undisputed claim in another competent court.

Koll's contact details for contract matters: Koll Group Oy, Joensuunkatu 7, 24100 Salo, Finland, email hannu.nissinen@koll.to.