LEGAL NOTICE AND GENERAL CONTRACTING CONDITIONS OF NALANDA

This document establishes the General Contracting Conditions of services between NALANDA GLOBAL, S.A., with N.I.F. A82692617, with registered office at Calle Proción, 7- Edificio América II Portal 4, 2° I, 28023, Madrid, an entity registered in the Madrid Mercantile Registry, volume 15270, book 8, folio 86, sheet M-255781 (hereinafter, «NALANDA»), and the individual or legal entity requesting such services (hereinafter, «CLIENT»), according to the identification of the parties specified in the Particular Conditions.

The conditions established in this document govern the contractual relationship between NALANDA and the CLIENT, together with the Particular Conditions, the obligations and responsibilities established in the Privacy Policy, and any other agreements reached between NALANDA and the CLIENT.

Additionally, the section «Terms of Use of the Web Platform» in this document will directly apply to anyone browsing the URLs provided by NALANDA (“Visitor”) or those accessing the Web Platform, such as personnel designated by the CLIENT as user(s) of the Web Platform (“User”).

In the absence of other specific terms or conditions, these General Conditions will also apply to the technological tools, applications, and devices provided by NALANDA for the provision of complementary services to the main service offered through the Web Platform.

Notwithstanding the terms specified below, the relationship between NALANDA and the CLIENT will be governed by compliance with current regulations on data protection, information society service provision, subcontracting, occupational risk prevention, and money laundering prevention. Without being exhaustive:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”)
• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (“LOPDGDD”)
• Law 34/2002, of 11 July, on services of the information society and electronic commerce (“LSSICE”)
• Law 10/2010, of 28 April, on the prevention of money laundering and terrorist financing.
• Law 32/2006, of 18 October, regulating subcontracting in the Construction Sector.
• Law 31/1995, of 8 November, on the Prevention of Occupational Risks.
• Royal Decree 171/2004, of 30 January, implementing article 24 of Law 31/1995, of 8 November, on the Prevention of Occupational Risks, regarding the coordination of business activities.

An internal study of the points where the aforementioned regulations converge has been carried out, and procedures have been defined to ensure orderly and rigorous compliance with all of them.

1. Obligations of NALANDA

• NALANDA will provide the CLIENT with a Web Platform for the provision of contracted services, maintaining an adequate service level, in accordance with industry standards.
• NALANDA will ensure the security of the data entered by the CLIENT on the Web Platform.
• NALANDA will ensure compliance with applicable current legislation.

2. Obligations of the CLIENT

• Pay the corresponding annual economic consideration for each service contracted, among those provided by NALANDA through the Web Platform, in accordance with the rates and Particular Conditions.
• Ensure the veracity, accuracy, and non-manipulation of the documents provided and data entered on the Platform or sent to NALANDA, as well as carry out any necessary updates, confirming that the documentation and data are correct, truthful, and adequate.
• Ensure that the incorporation of personal data, for which the CLIENT (and/or its subcontractors) is responsible, processed by NALANDA on its behalf as the data processor, has been carried out in accordance with current legislation and the conditions of the data processing agreement, obtaining the appropriate authorizations from individuals, if necessary.
• Diligently safeguard the “username” and “password” provided by NALANDA to the CLIENT, which are strictly personal and non-transferable, preventing unauthorized third-party access, ensuring confidentiality, as well as any other credentials provided. NALANDA reserves the right to deactivate any user who is not an employee of the CLIENT or does not have the CLIENT’s email domain, and to initiate legal actions in case of non-compliance with this obligation of personal and exclusive use for CLIENT employees, with the transfer to third parties not being allowed.
• Make good use and promote good use, among the users designated by the CLIENT, of the services provided by NALANDA through the Web Platform and the technological tools provided, in accordance with the law, good faith, and the terms outlined in the following clause (“Terms of Use of the Web Platform”), which the CLIENT declares to know and accept and commits to informing the users.
• Not cause harm, damage, or deterioration to the software, tools, and/or content that form the basis of the Web Platform, and not impede its normal functioning.
• NALANDA reserves the right to take legal action against fraudulent activities.

3. Terms of Use of the Web Platform

3.1 Applicability of this clause and definitions

Mere access to the Platform or browsing through the URLs provided by NALANDA grants the person performing it the condition of “Visitor,” whether or not they hold the status of CLIENT and/or User. The visitor can access and use those functionalities that are not restricted to CLIENT and/or User.

The Web Platform has restricted content, tools, and utilities, whose access is limited to the Users designated by the CLIENT active in Nalanda services, after completing the contracting process for these services. The active CLIENT will be the one who is up to date with their payment obligations to NALANDA.

In general, anyone who holds the status of active CLIENT and/or User has the possibility to access the content and functionalities provided by NALANDA through the Web Platform. This Platform is designed for use by active NALANDA CLIENTS and the users they create and designate. Therefore, the “User” is the person designated by the CLIENT who has access credentials to carry out the operations available through NALANDA.

3.2 Access to the Web Platform

Simple access and browsing by the visitor, CLIENT, and User of the Web Platform implies their express and unreserved acceptance of the terms outlined in this clause.

The visitor, CLIENT, or User declares that they have read, know, and understand this clause, and assume all the obligations that concern them according to their specific condition, as a visitor, CLIENT, or User of the Web Platform.

This clause will have an indefinite duration. The access, use, and browsing performed by the visitor, CLIENT, or User after the entry into force of possible changes or modifications will imply their acceptance by the person accessing.

Additionally, in the absence of other specific terms of use, this clause will govern the conditions of access and use of the mobile applications and specific technological tools offered as complementary to the services managed through the Web Platform.

3.3 License to use the Web Platform granted to Users and CLIENTS

NALANDA grants the active CLIENT, and the Users they designate, a license to access and use the Web Platform, limited exclusively to the use of the functionalities contracted or offered through the technological platform made available to them, in accordance with these General Conditions and Particular Conditions.

This license is granted in favor of the CLIENT and Users on a non-exclusive, temporary, universal (without any geographical limitation), and non-sublicensable basis, with the sole purpose of enabling the development of the functionalities for which the Web Platform was conceived.

This license does not, in any case, imply that the Client or User acquires any ownership or proprietary rights over the Web Platform, its content, or its utilities.

Except for the uses permitted by the license regulated in this section, it is expressly prohibited for visitors, CLIENT, and Users of the Web Platform to perform

any act of reproduction, distribution, public communication, or other forms of making available, transformation, and, in general, any form of exploitation of all or part of the content that makes up the Web Platform or to which the user accesses from the Web Platform, without the express written authorization of NALANDA or its legitimate owners.

3.4 CLIENT responsibility in the use of the Web Platform as data controller and NALANDA responsibility as data processor

The CLIENT and the User designated by the CLIENT, who has access to the NALANDA Web Platform, are obliged to use the Web Platform, the tools offered on it, and the functionalities offered through it, in accordance with current legislation and regulations, good faith, public order, and generally accepted uses and customs.

Specifically, the CLIENT and the User who use the platform and carry out the consultation, upload, and/or download of documents containing personal data of workers or third parties must ensure that they have the necessary legitimacy to carry out these operations.

The CLIENT who, according to current regulations, holds the position of data controller for any of the data processing operations that can be carried out through the Web Platform, must observe the obligations imposed by the regulations as the data controller.

In these cases, the relationship between the data processor and data controller, respectively, between NALANDA and the CLIENT, will be governed by the provisions of the data processing agreement agreed to for this purpose and, in the absence of an agreement, will be governed by the following subparagraphs (i) CLIENT Responsibilities as data controller, and (ii) NALANDA Responsibilities as data processor

• (i) CLIENT Responsibilities as data controller:

The CLIENT, as the data controller:

• Will comply with current labor, subcontracting, and coordination of business activities regulations in the instructions given to NALANDA as a result of the provision of services.

• It will be the responsibility of the CLIENT to determine if, according to current data protection, labor, subcontracting, and coordination of business activities regulations: (i) they have sufficient legitimacy to upload, download or carry out any data processing activity on documentation containing personal data of their own employees or another client with whom they maintain any type of relationship; (ii) the scope of the employees, or categories of employees, on whom it is legitimate to carry out processing operations and (iii) the period during which they hold such legitimacy.

• Will ensure they have sufficient legitimacy to upload, download, or carry out any data processing activity on documentation containing personal data, through NALANDA’s tools.

• Will ensure compliance with the GDPR and other applicable regulations, as well as their obligations as the data controller, prior to and throughout the processing.

• Authorizes NALANDA to subcontract, within the framework of the services provided as part of the Service, its foreign subsidiaries Nalanda Colombia SAS, Nalanda Chile, and Nalanda Panama, which would hold the position of sub-processors. The international data transfers that may occur due to the services provided by these sub-processors will be guaranteed in accordance with the standard contractual clauses of Decision 2021/914/EU, of 4 June 2021. If it is necessary to subcontract any service in the future, the identifying details of the provider will be incorporated into the list and previously communicated to the client, who may express their opposition within the following 10 days after the notification. If such opposition does not occur, the incorporation of the subcontractor as a sub-processor will be considered authorized. In any case, NALANDA guarantees that the sub-processor is subject to the same conditions established in this clause

Authorizes and entrusts NALANDA to formalize, on behalf of the CLIENT, the standard contractual clauses with the sub-processor(s) (data importer(s)), regulating the international data transfers necessary for the proper performance of the obligations established in this data processing agreement entered into between the client and NALANDA (as the data exporter).

• (ii) Nalanda’s Responsibilities as data processor:

For its part, NALANDA, as the data processor, will carry out the personal data processing derived from the provision of the contracted service, in accordance with the following conditions, in compliance with Article 28 of the GDPR:

• Will not carry out any other processing of personal data, nor apply or use the data for a purpose other than the provision of the contracted service.
• Will ensure that the individuals authorized to process personal data for which the CLIENT is responsible have committed to respecting confidentiality and complying with security measures and have been adequately trained in data protection.
• Will immediately inform the CLIENT if, in its judgment, it considers that any of the instructions transmitted by the client infringes the GDPR or any other data protection provision of the Union or Member States.
• Will support the CLIENT in carrying out data protection impact assessments and prior consultation, if applicable.
• Will make available to the CLIENT the necessary information to demonstrate compliance with its obligations, as well as allow and actively collaborate in conducting audits. In this regard, the CLIENT, with a thirty (30) business day notice, if possible, may visit NALANDA’s facilities to perform on-site controls and audits deemed appropriate, provided that they do not exceed the limit of one on-site audit per calendar year.
• Will adopt security measures that meet the requirements of Article 32 of the GDPR to ensure the confidentiality, integrity, availability, and resilience of processing systems and services.
• Will notify the client, without undue delay, and in any case within 72 hours, of any personal data breaches for which it is responsible.
• Will destroy the personal data for which the CLIENT is responsible once the service provision is completed unless the CLIENT expressly requests the return of the data subject to the processing before the end of the service.
• Will assist the CLIENT in responding to data subject requests and notify the CLIENT of any data subject rights exercised directly with NALANDA, which will be notified within a maximum period of five business days.

3.5 Third-party responsibility, advertising, and/or links

The Web Platform may temporarily or permanently host links, hyperlinks, or similar technologies that redirect the Visitor to other pages or websites managed by third parties.

In the event of such links, their sole purpose will be to facilitate and enable access to content and/or services that may be of interest but are, in any case, managed by third parties and not by NALANDA. Therefore, only the owners of the destination pages or websites of the links will be solely responsible for ensuring that the content hosted on them meets all applicable legal requirements, and Users accessing the pages or websites to which such links direct will be solely responsible for the legal relationships of any kind they establish with the third parties responsible for the destination pages or websites, and therefore, in an external and unrelated scope to NALANDA, assuming the user under their sole and exclusive responsibility any damages and/or harm that may be caused as a result of using the linked pages or websites.

NALANDA assumes no responsibility, whether direct or indirect, derived from the connections that may be made through the links or from the content to which they direct, nor does it guarantee the technical availability, legality, truthfulness, usefulness, quality, reliability, accuracy, correctness, or morality of the content, information, or services accessed through such links, provided that they are not directly managed or controlled by NALANDA.

The inclusion of links and external connections will not imply, in any case, unless expressly stated otherwise, the existence of a recommendation, association, relationship, or participation of NALANDA with the entities or third parties connected.

4. Economic consideration

To use NALANDA’s services, the CLIENT must previously pay the fixed fee. To this end, NALANDA will issue invoices according to the agreed conditions. Failure to pay within the required deadlines will result in the interruption of access to the contracted services.

NALANDA issues and deposits all invoices within its website, in the billing service, available to customers. NALANDA is not responsible for the consultation, reception, and accounting by the CLIENT of the invoices, which does not exempt them from their payment obligation.

The CLIENT and NALANDA, in accordance with Article 34 of Royal Decree 19/2018 on payment services and other urgent financial measures, agree not to return direct debits once 10 days have passed since the settlement of the direct debit. The CLIENT will be responsible for all expenses incurred by NALANDA due to the return of current receipts. Non-payment by the CLIENT, by any means of payment, will result in the obligation of a recovery cost from the date of non-payment until the date it is fully complied with, depending on the delay period of such payment.

The applied rates are related to the number of workers and, if applicable, machines the CLIENT has, as well as the number of clients to whom the CLIENT is assigned and therefore their documentation is viewed. If the CLIENT has made one or more expansions of workers or machinery for administrative simplification, NALANDA reserves the right to

unify their expansions or previous contracts into a single contract. Annually, the annual rate to be paid will be informed before renewal, based on assignments or views and certifications or connections with their clients.

The official rates in force are published on our website, within each service, and can be consulted at https://nalandaglobal.com/conoce-nuestras-tarifas-y-packs/.

5. Duration

The Contract will be in force from the moment of its signing and will have an initial minimum duration of one year. The contract will be automatically renewed for periods of equal duration each time a year is completed, according to the rates in force, subject to updates according to the evolution stipulated in the Particular Conditions of services and rates.

6. Withdrawal, modification, or early termination.

NALANDA or the CLIENT may terminate or modify this contract with the sole obligation of written notice 30 days in advance. In the event of requesting withdrawal or modification, it must be sent in writing to bajas@nalandaglobal.com. If the withdrawal is notified after those 30 days prior to renewal, the contract will be automatically renewed, and the invoice will be issued, with the CLIENT being obligated to pay for that renewed year, and the withdrawal will take effect the following year of renewal.

The CLIENT may exercise their right of withdrawal, rendering the contract void within 14 calendar days from its conclusion. To do this, they must simply communicate it in writing to bajas@nalandaglobal.com.

7. Voluntary exclusion from services

If NALANDA detects or becomes aware that a CLIENT, or a User designated by the CLIENT, is using the Web Platform, or the contents, tools, and utilities made available through it, in an illegal, inappropriate, fraudulent manner, contrary to current legislation and regulations or these General Conditions and Particular Conditions, NALANDA reserves the right to deny access or use of the Web Platform to the Users designated by the CLIENT, as well as the possibility of canceling their CLIENT account.

By way of example, the following uses are explicitly prohibited:

• Use of access keys by different people.
• Reuse of information accessible through the Web Platform in other sources or companies.
• Manipulation of documentation.
• Non-compliance with legal regulations related to the beginning of these General Conditions (data protection, information services, occupational risk prevention, subcontracting, or money laundering prevention).

8. Assignment

The rights and obligations established in the Contract or in this document may not be assigned by either Party. This prohibition includes any parent, subsidiary, or affiliate company of the Client. By exception, the contractual relationship with its rights/obligations may be assigned to any entity resulting from a structural modification of the capital companies, for which written notification of this change must be provided.

9. Security

NALANDA will use all means at its disposal to provide adequate security systems to protect its systems and the data contained therein against deliberate attacks, malicious software, and other threats. However, the CLIENT understands and accepts the aspects involved in the provision of services over the Internet, given the open, decentralized, and global nature of the network. For this reason, NALANDA cannot guarantee the invulnerability of its security systems. If the CLIENT has any indication that there is a security breach on the Web Platform, or that inappropriate or prohibited use of the services provided by NALANDA through the Web Platform or the tools made available by NALANDA is occurring, or any kind of security failure or breach, they must notify NALANDA immediately and in a verifiable manner.

However, NALANDA has adopted appropriate security measures to ensure the confidentiality, integrity, availability, and resilience of processing systems and services.

On the other hand, access to the Web Platform’s functions will require the introduction of usernames and passwords to protect the account from any unauthorized access attempts. To ensure the confidentiality, integrity, and individuality of User records, the system will request the password as a means of identification and authentication before some of the functionalities provided on the Web Platform are accessed.

The password for access to the Web Platform will have a length of between 10 and 30 characters, including at least one uppercase letter, one lowercase letter, one digit, and one special character. This password cannot contain the username or appear in the list of 30,000 commonly used passwords. The password’s expiration is configurable.

The CLIENT will be solely and exclusively responsible for safeguarding their system access keys. NALANDA assumes no responsibility, whether direct or indirect, for the safekeeping performed by the CLIENT or the User designated by the CLIENT of their identification or authentication keys, for any illegitimate intrusions that may occur in the CLIENT’s accounts, or for the uses that such keys may be subjected to by a third party, with or without the CLIENT’s consent.

10. Industrial and intellectual property

The CLIENT grants a license to use their brand in favor of NALANDA for its use on the Web Platform. This license is granted non-exclusively, with a universal character for its dissemination through the Web Platform or other websites edited by NALANDA, for the duration of the contractual relationship established through these General Conditions and free of charge, without generating any right to remuneration in favor of the CLIENT (in their capacity as licensor).

NALANDA will retain exclusive ownership of the source code of the designed web pages and, if applicable, the domain, hosting, and contracted services.

Moreover, all NALANDA software and content, including graphic designs, provider coding structure, logos, trade names, domain names, texts, animations, images, data, emails, phones, as well as the programs and functionalities used, are the exclusive property of NALANDA and are protected by national and international intellectual and industrial property laws. The Client may adapt their internal coding structure to that defined by Nalanda, with express written authorization from Nalanda.

All those intangible assets (intellectual works, content, information, videos or images, brands, or distinctive signs, and, in general, any asset susceptible to protection under the regulations governing industrial and intellectual property) made available to the public by the Web Platform and not owned by NALANDA, have been included on this site with the prior authorization of their legitimate owners and/or in compliance with current legislation and regulations.

The fact that the Web Platform makes protected assets and/or utilities available to the public under industrial and intellectual property laws will not, in any case, allow Users of the Web Platform to be understood as being granted any exploitation license concerning them, whether total or partial. Obtaining such a license by the Users will require the prior, express, and written authorization of the legitimate owners of the intangible asset in question.

The CLIENT and the User designated by the CLIENT expressly commit and undertake to respect all and each of the assets protected or not by industrial or intellectual property rights to which they access through the Web Platform. It is expressly prohibited for the user of the Web Platform to perform any act of reproduction, distribution, public communication, making available, transformation, and, in general, any form of exploitation of intangible assets, works, or content to which they access through the Web Platform, without prior, express, and written authorization from the legitimate owners of the intangible asset in question. The fact of being a CLIENT or User does not, in any case, entail the transfer in their favor of any right, title, or interest over any part of the intellectual/industrial property of their ownership or that of third parties. Likewise, none of the Web Platform’s content may be copied, transferred, or exchanged with any other User, client, or third party

Nalanda is exempt from any responsibility arising from third parties accessing this information, provided that such access results from deception, attack, fraudulent access, or similar against Nalanda’s computer systems or derives from a lack of diligence on the part of the CLIENT or the User.

11. Protection of CLIENT personnel data

The personal data of contact persons, administrators, legal representatives, and agents of the CLIENT and the CLIENT’s personnel designated as Users of the Web Platform will be processed in accordance with our Privacy Policy.

12. Modification of General Conditions or the Web Platform, suspension of Web Platform availability

NALANDA reserves the right to modify the General Conditions contained in this document. These will be presumed accepted by the CLIENT if they do not initiate the procedures to unsubscribe from the service within thirty (30) days following the publication on the Internet.

NALANDA

reserves the right to make, at any time and without prior notice, modifications, deletions, or updates regarding the information made available to the public through the Web Platform, its internal configuration, or its presentation.

Possible modifications may be justified, among other reasons, by improvements or technical changes in the service provided through the Web Platform, regulatory changes, or changes in the functionalities of the Web Platform.

NALANDA does not guarantee uninterrupted availability, access, and continuity of operation of the Web Platform, nor that access to the Web Platform will not be interrupted for technical reasons, nor that the content accessed by clients or Users, or the software that serves as the basis for the Web Platform, is permanently free of errors.

Similarly, NALANDA reserves the right to temporarily suspend, without prior notice, accessibility to the Web Platform for maintenance, repair, updating, or improvement operations, or the definitive suspension of the availability and provision of the Web Platform, without prejudice to the service level agreements contractually reached between the CLIENT and NALANDA.

13. Notifications

For the purpose of making the appropriate notifications, NALANDA designates as contact addresses info@nalandaglobal.com and the registered office at Calle Proción, 7- Edificio América II Portal 4, 2° I, 28023, Madrid.

On the CLIENT’s part, the contact person will be considered to be the one whose email has been provided to NALANDA during the contracting and/or registration process on the Web Platform, which will be used by NALANDA to make notifications to the CLIENT. The CLIENT is obliged to keep the email and contact person provided during the contracting process duly updated or, failing that, to notify the updated ones in each case.

14. Responsibilities

The CLIENT conducts consultations and operations through the Web Platform and the tools made available to the CLIENT at their own risk.

The CLIENT, by themselves or by the Users they designate, will be solely and exclusively responsible for the use made of the tools made available through the Web Platform.

NALANDA assumes no responsibility, whether direct or indirect, for any damage or harm caused to visitors, clients, and users of the Web Platform, which may be caused or could derive from unavailability, access failures, lack of continuity of the website, interferences, interruptions or service blockages, omissions, deficiencies, or overload of telephone or Internet lines, system failures or disconnections, as well as any damage or harm caused as a result of illegitimate intrusions into the Web Platform, whether in the form of malware, viruses, worms, trojans, malicious code, or any other analogous figures.

NALANDA will not be responsible for any damage or harm that the CLIENT may suffer as a result of the success or failure of operations or consultations on the Web Platform. NALANDA assumes no responsibility, whether direct or indirect, derived from the CLIENT’s or Users’ non-compliance with applicable obligations. Likewise, NALANDA’s responsible parties are excluded from any type of responsibility, whether direct or indirect, for any damage or harm caused to the User or a third party, resulting from the CLIENT’s or User’s misuse, intentional or not, of the content, tools, and utilities made available through the Web Platform, or for non-compliance with these General Conditions or Particular Conditions.

Likewise, NALANDA assumes no responsibility, whether direct or indirect, for any consequence, damage, or harm of any kind that the CLIENT or the User may suffer, resulting from access and/or use of the information made available to the public through the Web Platform.

The CLIENT will be solely responsible for any claim, legal action, judicial or extrajudicial, initiated by third parties against both the CLIENT and NALANDA, based on uses of the services contrary to the law and good faith.

15. Electronic invoice

In accordance with Royal Decree 25/2013, which approves the Regulation governing billing obligations, express authorization is granted to NALANDA to issue electronic invoices generated by the CLIENT on the portal.

If the CLIENT receives electronic invoices through NALANDA, they expressly authorize all suppliers using invoice issuance through NALANDA to do so electronically and authorize NALANDA to manage the receipt of electronic invoices sent by any Users of the portal. The CLIENT acknowledges that the identification system used on the portal allows verification of the acceptance of each issued invoice and access and consultation of the electronic invoices made.

16. Applicable law and jurisdiction

All provisions in these General Conditions will be governed and interpreted by the laws of Spain. The parties, expressly waiving any other jurisdiction that may correspond to them, agree to submit to the Courts and Tribunals of Madrid for the litigious discussion of any matter that may arise.