Terms of Service

Last updated: October 2026 (v3.8, Reconciliation and Order Linking)

Preamble

DIALOG provides a conversational tool (Chat Widget) using an Artificial Intelligence system, intended for e-commerce websites, and includes a back-office platform ("the Platform") for configuring the Chat Widget and analysing interactions with end users. A customised conversational tool ("Personal Shopper") may also be subscribed to by the Client. The Chat Widget service, and/or the Personal Shopper service where subscribed to, accessible via the Platform, together constitute the Dialog service in SaaS mode (the "Service(s)"). The Service is intended to respond to visitors to the website so that they may benefit from recommendations within the Client's product catalogue. Based on DIALOG's digital expertise, facilitated by Artificial Intelligence tools, the Chat Widget and/or the Personal Shopper strengthen the channels of communication and of recommendation of relevant products to end users.

These general terms and conditions (the "Terms"), their Annexes, including the Data Processing Agreement, and the Online Subscription summary govern access to and use of the Dialog Services.

By subscribing online on the askdialog.com website or on any other platform where the Dialog online subscription offer is available, by accessing or using the Services, the Client acknowledges that it has read and understood the Terms of Service and their Annexes, including the Data Processing Agreement, and warrants compliance therewith by all of the Client's Users. The Client acknowledges and accepts that the Services shall be used exclusively for commercial/professional purposes.

The Client's general terms and conditions of purchase or any other similar document issued or habitually used by the Client shall not apply to the Services.

Dialog reserves the right to amend the Terms at any time. In such case, Dialog shall inform the Client at least 30 days before any material amendment, including price changes. If the Client continues to use the Services as from that effective date, it accepts the new Terms and undertakes to comply with them If the Client does not accept the Terms, it shall notify Dialog thereof and terminate its subscription at the scheduled expiry date, the Terms of Service initially subscribed to then remaining in force until the end of the term.

Article 1 – Definitions

Terms beginning with a capital letter in the Terms and listed below shall have the following meaning:

Subscription: means the subscription plan for the Dialog Services chosen by the Client, detailing the fees and the features, which may be available on Shopify, Prestashop, other e-commerce platforms, on the Dialog website or transmitted by Dialog to the Client;

Defect: means a substantial non-conformity with the Documentation preventing the Client's Users or end users from benefiting from the features of the Service.

Online Subscription: means the order summary accepted by the Client when subscribing to its Subscription online on the askdialog.com website or on any other platform where the Dialog online subscription offer is available, specifying the Client's identification details, the Subscription plan, the features activated, including where applicable the Personal Shopper feature, and the applicable prices;

Client: means the legal person client which subscribes to the Services;

Documentation: means the Dialog documentation describing the features of the Service, the technical specifications and any information made available to the Client enabling the compliant use of the Service by the Client.

Client Data: means the content owned by the Client, in particular its product catalogue, FAQ and blog which it provides, stores or processes through the Services, in order to create or enrich the knowledge base of the Service, any suggestion, comment or idea of the client or of the user, and any other personal information relating to the Client and the Client's Users;

End User Data: means the interactions of the End Users with the Service, including the personal data of the End Users

Intellectual Property Rights: means all intellectual property rights and related rights (copyright, trade mark rights, patent rights, trade names, databases) protected by the French Intellectual Property Code as well as by the intellectual property laws of the country in which the Client resides and the applicable international conventions;

Party / Parties: means, collectively or individually, Dialog and the Client;

Platform: means the platform operated and made available to the Client by Dialog, accessible at the address https://app.askdialog.com/login, enabling the Client and its Users to analyse the data of the end users and to configure the Service in accordance with the Documentation;

Privacy Policy: means the privacy policy applicable to the Client and to the Users of the Services;

Personal Shopper: means the Personalised Recommendation feature, enabling the AI Chat Widget conversational tool to ask questions to the End Users, including health data, following the express consent of the End User to that effect, and enabling Dialog to offer a Personalised Recommendation, also sent by email to the End User.

POC: means the free trial period of the Service, of a duration of fourteen (14) days, under the conditions of Article 4.1.

Reconciliation: means the linking of the End Users' conversations to the orders placed on the Client's e-commerce platform, by means of the pseudonymous identifier assigned by the Posthog cookie for statistical purposes ("PostHog Identifier"), common to the Chat Widget and to the checkout, and of a time window between the last message and the order, in order to measure the attribution of sales to the Services. Reconciliation is activated by the installation of the Dialog application on the Client's store and the acceptance of these Terms.

Linking: means the optional feature, activated by the Client from the Dialog Platform (transmission of its orders), enabling the orders linked to a conversation to be flagged within the Client's e-commerce platform and, where applicable, the conversation to be associated with the purchaser identified by their email address, under the conditions of Article 7.2 and of Annex 3. Dialog does not base its invoicing on the attribution of sales.

Data Protection Regulations: means Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons, the e-Privacy Directive, as well as French Law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties, and any subsequent regulation amending the aforementioned regulations;

Company or Dialog: means DIALOG, a French company (société par actions simplifiée), registered under number 922 195 300 with the Paris Trade and Companies Register, with a share capital of 506 082,10 euros, whose registered office is located at 3 boulevard de Sébastopol, 75001 Paris, France;

User: means any natural and/or legal person authorised by the client to use the Platform

End Users: means the visitors or customers of the Client who visit the website, application or domain of the Client integrated with the Services or who use the same;

Widget: means a standalone software application, of small size, easy to integrate into a website, as they are designed "plug-and-play"

Chat Widget: means the widget which provides the specific conversational tool feature and enables the End Users to interact with the Client Data without leaving the web page of the Client's e-commerce website.

Article 2 – Access to the services

To use the Services and the Platform, the Client shall:

1. subscribe to the Services in accordance with the available online subscription arrangements, enabling the Client to select a Dialog online offer and to check the online order summary before entering its bank card details and paying.

2. create an account for each of the Users.

iii. install the Dialog application on its online store

The User account may be created by following Dialog's instructions, in accordance with the Documentation. Upon the Client's instruction, Dialog may create the account for the Users on behalf of the Client. The Users shall provide a valid professional email address, which Dialog reserves the right to verify at any time.

The User account on the Platform is strictly personal and shall not be used by another person. The Users shall not assign their account to another person and shall not share it with a third party. The Client is in any event solely responsible for (i) compliance with the provisions of the Terms by the Users and the End Users and (ii) the use of the Services via the account of the Users.

Dialog shall not be liable for any loss or damage resulting from the failure of the Users to comply with the above obligations.

The Users undertake not to use the Services, or any information and data, for unlawful or harmful purposes, including the mass sending of unsolicited emails.

Dialog shall not be held liable in the event of erroneous or misleading information provided by the Client or the Users of the Services.

Article 3 – Description and use of the Services

Dialog is a SaaS solution specially designed for e-merchants, for professional use only. During the term of the Subscription, Dialog shall provide the Client with the following Services, in accordance with these Terms of Service and with the Online Subscription.

Dialog provides Services incorporating an artificial intelligence tool and a back-office Platform for their configuration and for the analysis of interactions with the End Users, for the term of the Subscription.

Where the Client installs the Dialog Service via its e-commerce platform (Shopify, PrestaShop, etc.), the Dialog integration module synchronises with the Client Data, in particular the product catalogue and the content library, such as blog articles and key pages of the website (for example, the FAQs). The Dialog Service builds a structured and searchable knowledge base from this Client Data.

The Service provides, under a best-efforts obligation, answers to the questions of the End Users under the brand of the Client, which is editorially responsible for its website or its application.

The Service enables the Client:

- to integrate the Chat Widget or the Personal Shopper directly into each product page of its e-commerce website;

- to display pre-written prompts with two customisable questions to guide the End Users;

- to open an input field to enable the End Users to ask questions relating to the products; and

- to generate answer suggestions from the knowledge base built as described above, as and when the End Users interact, and to display product recommendation cards where this is relevant.

The Client acknowledges and accepts that interactions with the End Users may draw upon the documentary bases of the Artificial Intelligence tool, external to the Client Data. An additional configuration option available to the Client makes it possible to broaden recourse to the own documentary bases of the artificial intelligence tool used, where the knowledge base built by the Service does not make it possible to provide an answer to the interactions requested by the End User.

The Platform enables the client to:

1. Configure the Service by:

- Enriching the knowledge base of the AI, for the exclusive benefit of the Client (uploading of Client Data, in particular PDF, DOCX or TXT documents containing the updated product specifications, the FAQs and the policies);

- Fine-tuning the behaviour of the AI (by injecting customised message extracts to set the tone and to handle specific cases);

- Selecting pre-written questions (automatic generation via LLM or creation of specific prompts for the product pages).

- Configuring the answers (output) in order to prevent erroneous answers (output) provided to the End Users

- Allowing more open recourse to the own documentary base of the Artificial Intelligence tool in accordance with the applicable conditions

- Configure the disclaimer appearing at the bottom of the Chat Widget or of the Personal Shopper feature, in compliance with the principle of transparency of the use of an artificial intelligence tool laid down by the European AI Act Regulation.

Dialog recommends the following wording for the Chat Widget: "This answer is generated by an AI, which may make mistakes. Contact our sales advisers in store."

Dialog recommends the following wording for Personal Shopper:

"This personalised recommendation is generated by an AI, which may make mistakes. This recommendation does not replace a dermatological consultation with a healthcare professional.

1. Manage its workspace on the Platform (invite and manage the team members with different levels of access).

2. Measure and optimise the performance of the chat by means of the statistical analyses and the information available (display of conversations, trends, impact measurements).

3. Measure the attribution of sales to the Services through Reconciliation

4. where the Client has activated the transmission of its orders in the back office of the Dialog Service, find within its e-commerce platform the orders linked to a conversation (Linking feature), for the End Users having consented to marketing or advertising performance trackers via the Client's CMP, under the conditions of Article 7.2 and of Annex 3.

The Client and/or its Users undertake to transmit any comment and report in the event of an erroneous or imprecise answer of the Service. The End Users may provide comments or reports when they use the services. The client acknowledges and accepts that Dialog may use the comments, and the data relating to the customer journey in the purchase funnel on the e-commerce website. The Client acknowledges and accepts that the queries, answers and associated interactions with the End Users shall also be processed, for the purpose of providing the Client with usage and conversion statistics where applicable.

The Client expressly authorises Dialog to anonymise the said queries, for the purposes of training the artificial intelligence models and technologies of Dialog (RAG) or of modifying and improving the Dialog services. It is specified that only generic information (lexical fields) and anonymised information (random identifier), which does not identify the Client, the Users or the End Users and which does not incorporate the Client Data, may be processed for the aforementioned purposes of improvement of the Services or of the Dialog technologies.

The Client shall not use the Services in a manner which:

- infringes or violates the intellectual property rights or any other right of a third party, in particular as regards the Client Data;

- infringes any law or regulation, including the French Consumer Code, the General Data Protection Regulation ("GDPR") of the EU and/or any applicable export control law;

- is harmful, fraudulent, misleading, threatening, harassing, defamatory, obscene or otherwise objectionable;

- attempts, in any manner whatsoever, to obtain the password, the account or other security information of another client or user;

- breaches the security of any computer network or cracks passwords or security encryption codes; or

- interferes with the proper functioning of the Services (including by imposing an unreasonable load on the infrastructure of the Services).

- Carries out reverse engineering of the Dialog Service, rents, assigns or otherwise re-exploits all or part of the Dialog Service.

The Client shall indemnify Dialog against any pecuniary consequence in relation to the aforementioned prohibitions.

Article 4 – Term

4.1. Term and termination of the contract

The Subscription taken out online, on the Dialog website or via another platform, in particular Shopify, is entered into for a monthly term and shall be renewed tacitly, save termination by the Client, which becomes effective at the end of the month during which the Client terminated its online subscription.

POC. Where the Subscription begins with a POC, the latter is provided free of charge for a duration of fourteen (14) days from the going live of the Service on the Client's website ("Start Date").

The Client may terminate the POC at any time, without charge or justification, by email sent to Dialog no later than the last day of the POC.

Failing termination within that period, the paid Subscription takes effect automatically on the day following the end of the POC, for a monthly term tacitly renewable under the conditions of this article, at the price indicated upon the Online Subscription. By subscribing to the POC, the Client accepts that price and those terms.

In all cases, the Subscription may be terminated by a Party if the other Party breaches any of the essential provisions of these terms (payment, availability of the Service, intellectual property rights) and does not remedy such breach within thirty (30) days of the written notification describing the breach addressed to the defaulting Party by registered letter with acknowledgement of receipt.

Following prior notification by registered letter with acknowledgement of receipt which has remained without full remediation, Dialog reserves the right to suspend or to terminate the access of the Client or of the User to all or part of the Services, without any compensation or refund to the Client, if: (i) the Client or the User for whom the Client warrants breaches these Terms or the applicable laws, (ii) the Client does not pay the fees due (iii), Dialog must suspend or terminate the access of the Client or of the User in order to comply with the applicable law.

In addition to this possibility of termination for breach, Dialog may suspend performance of the Service in particular if the use of the Service could cause damage or a risk of damage to Dialog or to the Client, or to the End Users, until such risk or damage has been assessed and/or remedied. In such case, the Client shall be granted a Service Credit period corresponding to the duration of the interruption.

4.2 Consequences of termination of the contract

Termination or expiry shall not affect the rights or obligations, including the payment of the amounts due. Upon termination or expiry of the Contract, the provisions of these Terms which, by their nature, are intended to survive termination shall remain in full force and effect, in particular the provisions relating to confidentiality, to intellectual property rights, to payment obligations and to limitations of liability.

Upon termination or expiry of the Subscription, for whatever reason, the Client and the Users shall no longer be able to access the Services. The Client shall have a period of thirty (30) days from the end of the Subscription to retrieve or to have erased its Data, under the conditions provided for in Annex 7 (Right to switch providers). The Client Data shall be made available in a structured, commonly used and machine-readable format. At the end of that period, the account of the Client and of the Users on the Platform shall be deleted, together with the Client Data, and Dialog shall confirm such erasure under the conditions of Annex 7.

In the event of termination, unless the fault lies exclusively with Dialog, Dialog shall not grant any refund or credit for any unused period of the Services, for whatever reason, before the end of the Initial Period.

Article 5 – Price

5.1. Financial conditions

Save where the Services are provided free of charge to the Client and to its Users, in particular by way of a test or POC, the Services are provided to the Client at the price applicable to the Subscription taken out, as displayed on the Dialog website or on the subscription platform and restated within the Online Subscription summary. Save written agreement to the contrary between the Parties, the price is determined according to the number of monthly unique visitors to the website or the application of the Client.

Dialog reserves the right to change the price of the Services at any time. In such case, Dialog shall inform the Client on the Platform and on a durable medium of the said changes, at least thirty (30) days before they take effect. Save notification of refusal by the Client communicated to Dialog with acknowledgement of receipt, the change to the price of the Services shall take effect upon renewal of the online Subscription.

The Client is invoiced each month in advance. The management of payments, including the processing and storage of payment data, is carried out by Stripe Payment Europe, Ltd or Shopify.

Payment is made by bank card on a recurring monthly basis for online subscriptions.

The invoice shall be accessible to the Client via Stripe or Shopify and may be sent by Dialog by email.

In the event of late payment:

- any late payment shall automatically entail the application of a late payment penalty, applicable as of right, equal to the ECB rate increased by ten points, and of recovery costs in the statutory amount of forty (40) euros, without prejudice to any additional costs which Dialog may have incurred beyond that amount;

- if that sum is not paid within fifteen (15) calendar days of the receipt by the Client of a formal notice sent by registered letter with acknowledgement of receipt, Dialog reserves the right to suspend the Services and/or to terminate the Contract with the Client.

5.2 Right of control

Dialog reserves the right to control the use of the Platform and of the Services by the Client and its Users, in particular in order to ensure that the Client and its Users use the Platform and the Services in accordance with these Terms. Dialog may also audit the Client as regards the applicable Subscription, in particular as regards the number of monthly unique visitors to the website or the application of the Client.

Any audit shall be carried out upon prior notification of 15 days to the Client, at Dialog's expense, unless the audit were to reveal a payment discrepancy to the detriment of Dialog.

In such case, Dialog shall adjust the amount of the Subscription due by the Client according to the updated number of monthly unique visitors.

Article 6 - Intellectual property

6.1 Intellectual property of Dialog

6.1.1 The services

All the trade marks, illustrations, photographs, texts, comments, images, video sequences, sounds, know-how, site architecture, software, algorithms, artificial intelligence, databases as well as all the computer applications, in particular the Dialog application, used to operate the AI chat widget and the Platform and, more generally, all the elements reproduced or used to provide the Services are protected by the laws in force in matters of intellectual property.

Dialog is the owner and/or the beneficiary of the intellectual property rights necessary for the provision of the Services. In this respect, Dialog grants the Client and its Users a personal, limited, non-assignable, non-sub-licensable and non-exclusive right of use to use the Services, including the Dialog application, for professional purposes only and for the term of the Subscription or, where applicable, of the Initial Period and its renewals. The sole purpose of this right of use is to enable the use of the Services as provided by Dialog, subject to the Terms. The Client acknowledges that only Dialog has the right to maintain, to improve or to modify the Services and the Dialog technology.

It is strictly prohibited for the Client and the User:

- copy, reproduce, represent, disseminate, distribute, rent, assign or publish, permanently or temporarily, all or part of the Platform and/or of the Chat Widget and more generally of the Services, by any means and on any medium known or unknown as at this date; modify, translate, adapt, arrange, disassemble, decompile, reverse-engineer or create derivative works based on all or part of the Services;

- circumvent the usage limits or other usage restrictions incorporated into the Services;

- remove the proprietary notices, labels or marks from the Services or from the content and technologies of Dialog. It is specified that the Client or the User may not modify the interface of Dialog, in particular the interface of the AI chat widget integrated into the Client's website or the Dialog application; or

- access the Services in order (i) to create a competing product or service; or (ii) to copy ideas, characteristics, functions or graphics of the Services.

Any unauthorised use of the Platform, of the Dialog application and of the Services or of any of the elements which it contains shall be considered an infringement and shall be prosecuted in accordance with the provisions of Articles L.335-2 et seq. of the French Intellectual Property Code.

6.1.2 Trade marks of the parties

The name and the figurative trade mark of Dialog are protected by the applicable trade mark law. The use of the trade mark without the prior written agreement of Dialog, on any medium, for commercial purposes or to promote products and services, is strictly prohibited.

During the term of the subscription or, where applicable, during the initial period and its renewals, Dialog may refer to the Client, its brand (including the logos of the Client) publicly as a client of Dialog, including on its website and in other marketing materials.

6.2. Intellectual property of the client

The Client is the owner of and retains the ownership of the Client Data. The Client hereby grants Dialog a non-exclusive, royalty-free, transferable, sub-licensable and worldwide licence to access, use, store and reproduce its Client Data in order (i) to provide the Services and (ii) to use the anonymised Client Data for the purposes of training, of modification and of improvement of the Services or of the Dialog technologies, including the comments, the data relating to the customer journey in e-commerce, as well as the queries, answers and associated interactions with the end users through the Services, provided that these are solely generic client Data, which do not identify the Client, the User or the end users and which do not incorporate the Confidential Information of the client as defined below. The Client acknowledges and accepts that it has no right, licence or authorisation in respect of the modifications or improvements made by Dialog on the basis of the foregoing data.

The Client represents and warrants that it is the owner of the Client Data provided on the Platform or that it holds all the rights, powers and authorisations necessary to grant the aforementioned rights and licence and that the use of the client Data shall not infringe the rights of a third party. It undertakes to indemnify Dialog against any complaint, claim and judgment arising therefrom.

6.3 Integrated services

Dialog may make available certain features enabling the Client to integrate other services into the platform. The use of those services shall be governed by the applicable conditions.

When using the Services or the third-party integrations to the Platform, the latter may contain links to third-party websites or applications. These links are provided solely for the convenience of the Client and do not constitute an approval by Dialog of the content of those third-party websites. Dialog disclaims all liability as regards the content of the linked third-party websites.

6.4. Confidentiality

In this document, the term "Confidential Information" means all the confidential and proprietary information of a party (the "Disclosing Party") disclosed to the other party (the "Receiving Party"), whether orally or in writing, which is designated as confidential or which must reasonably be considered confidential having regard to the nature of the information and the circumstances of its disclosure, including the general terms and conditions of these Terms, the Client Data, the services, the business and marketing plans, the technological and technical information, the product designs and the business processes. Confidential information does not include information which: (a) is or becomes generally known to the public without breach of an obligation owed to the disclosing party; (b) was known to the receiving party prior to its disclosure by the disclosing party without breach of an obligation owed to the disclosing party; (c) was developed independently by the Receiving Party without breach of any obligation owed to the Disclosing Party; or (d) is received from a third party without breach of any obligation owed to the Disclosing Party.

The Receiving Party shall not disclose or use the Confidential Information of the Disclosing Party for purposes other than those provided for in these Terms, save with the prior written authorisation of the Disclosing Party. Notwithstanding the foregoing, Dialog may disclose this agreement to its current and potential investors, advisers and partners.

Each party undertakes to protect the confidentiality of the confidential information of the other party

Article 7 – Personal Data

7.1. Processing of the personal data of the Client or of the Users as controller

Dialog shall process the personal data of the Client and of the Users as data controller for the purposes of (i) providing the Services to the Client (providing access to the Platform and enabling its use by the Users) and (ii) managing the relationship with the Client in accordance with these Terms, including any invoicing, payment or marketing activity.

These processing activities shall be carried out in accordance with the Privacy Policy, available on this page. The Client undertakes to provide this Privacy Policy to the Users.

7.2. Processing of the personal data of the end users as processor

In order to provide the Chat Widget Service, Dialog does not use the directly identifying personal data of the end users, but uses the Dialog cookie, stored in the browser's local storage and associated with a unique identifier (UUID). The Dialog cookie is strictly necessary to ensure the continuity of the conversation in progress on the Client's store, expressly requested by the End User; the retention of the conversation history for a subsequent session is a functional purpose, subject to the consent of the End User collected by the Client's CMP. The Client undertakes to include it in the list of trackers available within its privacy policy.

The Chat Widget Service is not designed to process directly identifying personal data of the End Users and shall not be used by the Client for that purpose. In order to limit the risks to the privacy and to the rights and freedoms of individuals, the Client shall ask the End Users to refrain from communicating personal data within the Chat Widget. Dialog shall make commercially reasonable efforts to implement a purge system in order to delete the accidental processing of personal data entered by the End Users within the Chat Widget. This stipulation shall not apply to the Personal Shopper feature, which processes personal data, including health data, subject to the express consent of the data subject, under the conditions described below and in Annex 3.

Reconciliation. In order to measure the attribution of sales to the Services, Dialog links, on behalf of the Client, the conversations to the orders placed on the Client's e-commerce platform. This linking relies exclusively on the PostHog Identifier, common to the Chat Widget and to the checkout, and on a time window between the last message and the order. The order data processed for that purpose (amount, currency, order identifier, products and quantities) is collected within the checkout on the Client's e-commerce platform by the Dialog pixel. The Dialog pixel is a tracker executed by the Client's e-commerce platform within its checkout (Shopify Web Pixel), installed automatically with the Dialog application; it places nothing on the End User's device, but reads the PostHog Identifier (i) in the browser's local storage or, (ii) for stores whose checkout is served from a separate domain, in the _dialog_distinct_id and _dialog_session_id cookies, and is executed only if the e-commerce platform signals to it the End User's consent to marketing or advertising performance trackers. In the absence of transmission of the orders by the Client, Dialog accesses neither the Client's orders nor its customer records through the application programming interface of its e-commerce platform for the purposes of sales attribution.

Reconciliation is carried out only for the End Users having consented to marketing or advertising performance trackers via the Client's CMP, whose signal is read by the Chat Widget and by the Dialog pixel; the conversations conducted without that consent are excluded from it. Its results (attributed revenue, conversion rate) constitute Client Data, processed by Dialog on behalf of the Client for the purposes of sales attribution and returned to the Client within the Platform. The Client has all of its Client Data at event level of detail (export from the Platform, Annex 7). The Client acknowledges and accepts that Dialog retains, for its own needs, only aggregated and anonymised statistics, under the conditions of this article, which the Client expressly authorises. Dialog ensures that these statistics do not allow an End User to be re-identified, in particular by deleting any identifier and by not producing any statistics relating to a number of End Users too small to guarantee their anonymity.

Linking through Transmission of orders. Where the Client activates the transmission of its orders from the Platform (order webhook of its e-commerce platform), Dialog additionally receives, on behalf of the Client, the order data transmitted by that platform. This transmission is limited from the outset, through the filtering of the webhook fields, to the following data alone: order identifier, date, amount, currency, products and quantities, status, email address and customer identifier of the purchaser; postal addresses, telephone numbers and payment data are not transmitted to Dialog. Dialog may then (i) flag, on the Client's instruction, the orders linked to a conversation within the Client's e-commerce platform (tag or attribute affixed to the order), so that the Client may distinguish therein the orders placed with and without the Service; (ii) associate the conversation linked to the order with the purchaser's email address, for the sole purposes of returning to the identified purchaser their conversation history, of providing the Client with performance statistics per identified customer within the Platform, and of transmitting, on the Client's instruction, the conversation or its summary to the Client's customer relationship management tools. These processing operations are carried out only for the End Users having consented to the placing or reading of trackers for marketing or advertising purposes, via the Client's CMP. Dialog carries out no profile enrichment and no reuse of this association on its own behalf.

Transmission to the Client's tools. Where the End User communicates their email address within the Personal Shopper feature and the Client has activated the corresponding connectors from the Platform, Dialog transmits, on the Client's instruction, that address and the summary of the recommendation to the Client's customer relationship management tools (in particular Klaviyo, Yotpo, Connectif) and affixes, where applicable, tags to the corresponding customer record of the Client's e-commerce platform. These recipients are designated by the Client, which remains their sole controller. The email address collected in Personal Shopper is not used as a Reconciliation key.

The Personal Shopper feature, where it is activated by the Client upon the Online Subscription or from the Platform, requires the processing of personal data of the End Users, which comprises (i) the skin type, (ii) a photograph of the face of the End User, (iii) health data, subject to the prior and express consent of the End User as collected directly within Personal Shopper on behalf of the Client, and (iv) its email address, in order to send to it a summary of the personalised recommendation.

Dialog is the processor of the client. The Client shall (i) make available end users a privacy policy compliant with the Regulations, and (ii) obtain, the consents necessary for the placing and reading of trackers, via a Consent Management Platform (CMP) compliant with the Regulations, allowing the processing of personal data by the Dialog Services, in accordance with the Data Processing Agreement (also DPA) attached. A Posthog cookie is placed, on the Chat Widget as well as on the Personal Shopper feature, after the End User's consent, in order to collect events on the user journey; its processing is governed by the Personal Data Processing Agreement (Annex 3).

The Client thus benefits from statistics compiling the events and User Data (input and output) of the Chat Widget and of the Personal Shopper feature, in its capacity as controller. These statistics include the attribution of sales to the Services resulting from Reconciliation.

The Client expressly authorises Dialog to carry out on the basis of these statistics, on an anonymous basis, an extraction of the lexical fields most frequently addressed by the End Users, associated with a random ID replacing the cookie identifiers, so as to improve the Service and the functioning of the artificial intelligence tool which it includes. Dialog is responsible for the anonymisation of the End User Data to that effect.

7.3 Cookies

In order to provide the Dialog Services, Dialog must place cookies on the terminal equipment of the end users via the website or the application of the Client.

The following trackers are used:

- the Dialog cookie, strictly necessary to ensure the technical continuity of the conversation in progress between the various pages of the website or of the application and, subject to the End User's consent (functional purpose), to retain their conversation history in the event of a subsequent interaction with the Chat Widget,

- the Posthog cookie, which collects the events (click on the product offered, order basket, etc.), for an analytical and Reconciliation purpose. It is activated only after the End User's consent and relies on the browser's local storage; for stores whose checkout is served from a separate domain, two marketing/advertising cookies (_dialog_distinct_id and _dialog_session_id, with a duration of thirty (30) days) are additionally placed after the End User's consent to marketing or advertising performance trackers, in order to enable Reconciliation. The term "cookie" here means any tracker within the meaning of Article 82 of the French Data Protection Act, including the browser's local storage.

- the Dialog pixel, a marketing performance tracker installed with the Dialog application and executed within the checkout of the Client's e-commerce platform, which is limited to reading the PostHog Identifier and the order data, subject to the End User's prior consent to marketing or advertising performance trackers, collected by the Client's CMP and signalled to Dialog by its e-commerce platform.

These technologies are governed by Article 82 of the French Data Protection Act. The client undertakes to provide the required information to the End Users in this respect,to obtain where applicable their consent via a tracker consent manager (CMP) and to transmit this consent signal to Dialog without alteration. The Client shall indemnify Dialog in this respect. The Parties acknowledge and accept that the Client remains the sole controller of the processing of the personal data collected and read via these trackers, for the purposes set out above and described in Annex 3, Dialog acting in the capacity of processor.

Article 8 – Liability, warranties and indemnification

Limitation of indirect liability. Under no circumstances shall either party be liable to the other party or to a third party for any indirect or immaterial damage, including loss of opportunities, of turnover, loss of data, loss of reputation, additional staffing or operating costs or costs of procuring substitute services arising from the acts or omissions of either party under these terms or otherwise connected with the services.

Limitation of the amount of liability.

The total liability of each party for all claims (whatever the form of the action, the damage, the claim, the liability, the cost, the expense or the loss) relating to these Terms and to the Services provided shall not exceed the equivalent of the fees paid by the Client to Dialog during the twelve (12) months preceding the event giving rise to the claim.

Exceptions to the limitations. This limitation of liability shall not apply to infringements of one party's intellectual property rights by the other party, or to payments owed by the Client.

The Parties consider that these limitations, which result from their discussions during the drafting of the contract, respect the economic balance of the contract and take account of the consideration granted in exchange for these limitations, including the innovative features of the Service. In particular, the Parties consider that the amount of the indemnification which they have agreed upon is significant.

Any claim relating to these Terms shall be made no later than two (2) years from the date on which the claimant became aware or ought to have become aware of the facts entitling it to claim. Any claim shall be made by registered letter with acknowledgement of receipt.

8.1. Dialog's responsibilities and obligations

Availability. Dialog undertakes (i) under an enhanced best-efforts obligation to maintain the security and availability of the Client Data within the Service and (ii) to enable the availability of the Platform and the Services twenty-four (24) hours a day, seven (7) days a week under a best-efforts obligation, in accordance with the Service Level Agreement set out in the Annex.

Security. Dialog shall ensure the security of the Client Data and of the Service within the framework of the technical and organisational security measures described in the Annex, under an enhanced best-efforts obligation.

Client Support. The Client shall benefit from technical support under the conditions set out in the Annex. Dialog undertakes to respond and to correct the Defects as soon as reasonably possible under a best-efforts obligation.

Reversibility. The Service enables the Client to export the Client Data and the User Data at any time. The provisions relating to the right to switch providers within the meaning of Regulation (EU) 2023/2854 (Data Act) are set out in Annex 7.

Updates and Maintenance. Dialog reserves the right to interrupt the Services and the Platform in order to carry out updates and maintenance of the Services and the Platform. Dialog shall endeavour to schedule updates and maintenance outside business hours. Except in an emergency, Dialog shall inform the Client in advance of the dates and times of the intervention.

Warranties. Dialog shall indemnify the Client against any third-party intellectual property rights claim concerning the use of the Services. The Client shall indemnify Dialog against any infringement of third-party intellectual property right in relation to the Client Data.

Warranties. The Parties warrant to each other (i) to be empowered to enter into and to accept these Terms, and (ii) to comply with the obligations arising from these Terms.

Dialog's liability.

Dialog is subject to an obligation of result for the making available of the SaaS Service, and to a best-efforts obligation in respect of (i) the quality of the outputs, the availability of the Service, the correction of Defects, and to an enhanced best-efforts obligation in respect of the security of the Service.

The Client acknowledges and accepts that the Services rely on Artificial Intelligence tools which, as at today's date, do not make it possible to guarantee that all responses will be appropriate (output), in particular in the event of questions asked by the Users (input) intended to mislead the Service or to push it into contradictions, or in the event of use not in compliance with the Client's general terms of use, which it is for the Client to make accessible to the End Users.

In view of the operation and the intrinsic risks of artificial intelligence tools, and of the technical and pricing limits of the operation of the third-party digital services required for their deployment, the Provider does not warrant that the operation of the chat Widget will be free of error or defect.

Dialog shall not be liable:

- for difficulties relating to the Internet and to the hosting of the e-commerce site or app and, more generally, any technical disruption relating to mobile networks or to Internet access;

- any error or omission in the Client Data, the User's information or in the analysis of conversations with the End Users. The Client shall be solely liable for any decision it takes on the basis of the analyses and the information;

- any error or omission or deliberate manipulation intended to circumvent the normal operation of the Chat Widget or of the Personal Shopper functionality, resulting from the End User Data supplied by the End User

- for erroneous responses of the Service (output), subject to diligently proceeding with the improvement of the prompts or any other required configuration enabling the hallucination and/or the erroneous response to be corrected.

- for the rate of conversion of conversations into purchases by the End Users

- for any configuration intervention or autonomous modifications by the Client on the Platform

- for compliance with the provisions of the French Consumer Code, which fall exclusively within the Client's responsibility.

8.2. The Client's responsibilities and obligations

The Client and the Users for whom the Client stands guarantor shall be responsible for:

- their access to and compliant use of the Services;

- all Client Content supplied hereunder and compliance with the Terms, including obtaining all licences, rights, authorisations and consents necessary to enable Dialog to transmit, host, use and store, in accordance with these Terms, all the elements comprising the Client Data and the End User Data. The Client warrants the accuracy, quality, integrity, lawfulness, reliability and relevance of all the Client Data. The Client acknowledges and accepts that it must supply relevant information to enable Dialog to create the AI knowledge base required for the development of the AI chat widget and for the provision of the Services. The Client understands that the performance of the Services depends in particular on the quality of the Client Data supplied;

- acting in the capacity of deployer within the meaning of Regulation (EU) 2024/1689 (AI Act) and, on that basis, (i) ensuring a sufficient level of AI literacy of its staff using the Service, in accordance with Article 4 of that regulation, (ii) appointing a person responsible for supervising the use of the Service, handling reports of inappropriate responses and ensuring liaison with Dialog, (iii) using the Service in accordance with the Documentation and Dialog's instructions, and (iv) keeping visible to the End Users the warning of interaction with an artificial intelligence system provided for in Article 3 hereof, pursuant to Article 50 of the same regulation;

- in respect of Reconciliation and of the activated connectors: (i) mention in its privacy policy the measurement of sales attribution by the Posthog cookie and the Dialog Pixel and, where applicable, the transmission of the email address collected in Personal Shopper to its customer relationship management tools and to its e-commerce platform, (ii) include the Dialog cookie, the PostHog cookie and the Dialog pixel in the list of trackers of its CMP, (iii) attach the PostHog cookie to the "audience measurement" (statistics) category, the Dialog cookie to the "functional" category for the retention of the conversation history, and the Dialog pixel to the "marketing or advertising performance" category of its CMP, and transmit this consent signal to Dialog without alteration (Shopify privacy API, TCF, Google Consent Mode or equivalent), and (iv) inform the End Users, at the point of collection of their email address, of the recipients thereof; the Client shall indemnify Dialog for compliance with these obligations;

- for stores whose checkout is served from a separate domain, include in its CMP the two marketing performance cookies (_dialog_distinct_id and _dialog_session_id, with a duration of thirty (30) days) and attach these cookies to the "marketing or advertising performance" category of the CMP, in order to enable Reconciliation;

- where it activates the transmission of its orders: mention in its privacy policy that Dialog is a recipient of the order data (including the purchaser's email address), the flagging of the orders linked to a conversation within its e-commerce platform and the association of the conversations with the purchaser's email address; and that Dialog is processor of the data relating to the Posthog and Dialog cookies as well as to the Dialog Pixel and to the marketing performance cookies _dialog_distinct_id and _dialog_session_id.

- any misuse of the Services by its Users, by circulating to them terms of use, warnings or Frequently Asked Questions (FAQ) in relation to the Chat Widget or to the Personal Shopper functionality;

- their connection to the Internet and all associated costs, as well as the equipment used to connect to the Platform. The Client shall take all appropriate measures to ensure the security of its equipment and of the Client Data. The Client and the Users for whom they stands guarantor undertake to access the Platform using equipment free of viruses and a latest-generation, up-to-date browser. The Client shall use its best efforts to prevent any unauthorised access to or use of the Services and shall inform Dialog without delay of any unauthorised access or use;

- any payment incident, such as a late payment or a failed direct debit transaction.

- reporting to Dialog any inappropriate response of the bot during compliant use of the Service which it may observe, in order to enable Dialog to identify the source of the error and to remedy it.

Warranties. The Client shall indemnify Dialog against any recourse or action which any third party, including the End Users, might bring as a result of a use of the Services contrary to the Terms by the Users or, more generally, of a breach of the law.

The Client warrants to Dialog (i) that it has the power to enter into and to accept these Terms, and (ii) that the Users shall use the Service (in particular the Platform) in accordance with the Terms and with applicable laws and regulations.

Indemnification. The Client undertakes to indemnify, defend and hold Dialog harmless in the event of claims, liabilities, damages, costs and expenses (including reasonable attorneys' fees) payable to a third party and arising from (i) its misuse or that of the Users of the Services in breach of the Terms or of applicable laws, (ii) the Client's products, and (iii) the Client Data. The indemnification obligations are subject to the condition that the Client (i) promptly receives written notice of such claim from Dialog; (ii) has sole control of the defence and settlement of the claim (it being understood that Dialog may participate in its own defence at its own expense); and (iii) that Dialog provides the cooperation and assistance reasonably necessary, including the sharing of relevant information. The Client may not enter into any settlement or compromise concerning a claim without Dialog's prior written consent,.

Article 9 – Anti-corruption

Each Party complies and undertakes to comply with all applicable laws and regulations, in particular those relating to the prevention of and the fight against corruption, in particular the requirements of the Sapin II law, the duty of vigilance and, generally, prohibited commercial practices.

In this respect, Dialog undertakes not to offer, promise or accept, directly or indirectly, with a view to influencing decisions in favour of the Parties, any contribution or payment to any public official, any payment, gifts, meals, travel, invitations or other item of value to a public official to anyone, including to the Client's employees, throughout the term of this Agreement.

Article 10 – Subcontracting

Dialog may subcontract to a third party the performance of all or part of its obligations under the Contract, in particular (i) hosting, (ii) the use of language model providers and of the third-party software underpinning the Service, (iii) electronic communications and ticketing services, and (iv) statistical trackers. The Client gives Dialog a general authorisation to use sub-processors, without prior case-by-case approval. The sub-processors in place are listed in Annex 5 and in Annex III of Annex A. Any change to this list shall be notified to the Client in writing under the conditions and within the time limit provided for in clause 7.7 of the Data Processing Agreement set out in Annex 3.

Article 11 – Miscellaneous

Insurance. The Parties declare that they have each taken out professional and operating liability insurance which they undertake to maintain for the term of the Contract. Dialog undertakes to provide any insurance certificate upon the Client's request.

Right of withdrawal. The Services are intended for professional use only. On that basis, the Client, acting as a professional and for the purposes of its commercial activity, and the agreement between Dialog and the Client being a distance contract, acknowledges that the right of withdrawal is expressly excluded.

Severability. Should a provision of the Terms prove to be void or unenforceable in the parties' assessment, or be declared void or unenforceable by a court or another competent authority, that provision shall be deemed not to affect the other provisions, which shall remain in force, to the fullest extent permitted by law. Dialog and the Client undertake to replace that provision with another provision having an equivalent effect.

No waiver. The fact that one of the parties does not invoke the benefit of one of the stipulations of the Terms may in no event be regarded or construed as a waiver of the benefit thereof. The waiver of a specific stipulation in a particular situation does not constitute a general waiver of that stipulation, nor a waiver of any other stipulation in another situation.

Force majeure. The term "force majeure" has the meaning given to it in Article 1218 of the French Civil Code. Neither party shall be liable, save in the event of late payment, for the non-performance of any of its contractual obligations arising from or connected with an event of force majeure.

Assignment. Dialog may assign, in whole or in part, its rights and obligations under the Contract, subject to informing the Client beforehand. The Client may not assign any of its rights or obligations hereunder, whether by operation of law or otherwise, without Dialog's prior written consent.

Independent contractors. Dialog and the Client declare that they are and shall remain, throughout the term of the Contract, independent commercial and professional partners. No provision of the Terms shall create or may be construed as creating for either party a relationship of subordination towards the other party, nor a relationship of partnership, joint venture, employment, franchise or agency.

Good faith. Dialog and the Client undertake always to conduct themselves towards each other as loyal counterparties and to perform their obligations and exercise their rights in good faith.

Agreement on evidence. The data collected and stored via the Platform have evidential value as regards the use of the Platform and of the Services by the Client and the Users. Data on computer or electronic media therefore constitute valid evidence and, as such, are admissible under the same conditions and with the same evidential force as any document drawn up, received or kept in writing.

Non-solicitation of personnel

Each of the parties undertakes not to hire the other's personnel throughout the term of this contract and for the 12 months following the termination of the contractual relationship. Failure to comply with this clause shall result for the infringing party in paying to the other party, by way of indemnity, the amount equivalent to the gross remuneration received by the employee during the last 12 (twelve) months preceding his or her departure.

Electronic signature. If the Contract is signed electronically, the Parties acknowledge and accept that this contract is entered into in accordance with the provisions of Articles 1366 and 1367 of the French Civil Code, by means of a reliable identification process, which confers on it the same evidential force as a writing on paper medium and that it may be validly relied upon against them and confers on it a certain date, and undertake not to contest its validity.

Governing law, competent jurisdiction and dispute resolution. The Terms are governed by and construed in accordance with French law.

In the event of a dispute, the Parties undertake to attempt to settle it amicably, the more diligent party notifying the other Party of the dispute and/or of the contractual breach concerned. The Parties undertake to meet within the month following such notification by registered letter with acknowledgement of receipt.

Failing an amicable agreement, the courts of Paris (France) shall have jurisdiction to hear any dispute arising from or connected with the validity, interpretation, performance and/or breach of the terms of use and of the services, irrespective of the plurality of defendants or of indemnification clauses.

Annex 1 – Special conditions of use applicable to the free Subscription to the Platform and the Services

Dialog may provide access to and use of the Platform and the Services under a free Subscription, on the terms indicated at the time of the Online Subscription.

In such case, these special conditions of use ("Special Conditions") supplement the Terms. The Special Conditions shall prevail over the Terms and over all other Annexes, including Annex 4 (SLA and technical support), which does not apply to the free Subscription or to POCs. For the remainder, in the event of a contradiction between the Terms and the Annexes, the latter shall prevail.

Article 1 – Access to the Platform and the Services and financial terms

Within the limit of two hundred (200) conversations per month, access to and use of the Platform and the Services are provided free of charge to the Client and its Users. This Annex is also intended to apply where the Client benefits from the Service(s) free of charge in other circumstances, including POC contracts.

Dialog reserves the right, in its sole discretion, to create new features for the Platform or the Services and, in such case, not to add those features or Services to the free Subscription.

Article 2 – Warranties and liability applicable to the Special Conditions

To the maximum extent permitted by applicable law, the Platform and the Services are provided "as is" without warranty of any kind.

In addition to the Terms, Dialog does not warrant that the Platform and the Services will meet the Client's requirements, that use of the Platform will be uninterrupted or error-free, or that the Platform will comply with the regulatory requirements applicable to the Client or will appear exactly as described in the accompanying documentation.

Given that use of the Platform and the Services is free of charge, Dialog may not be held liable for any direct or indirect damage, in particular loss of turnover, or other financial losses resulting from the use of, or the inability to use, the Platform or the Services.

The Client may not assert any claim based on the Platform or the Services provided hereunder more than 12 months after the occurrence of the triggering event, in accordance with Article 2254 of the French Civil Code.

Annex 2 - Technical description of the Service

Technical architecture as at the date of the Online Subscription. This description is liable to vary during the performance of the Contract. It forms part of and is supplemented by Dialog's technical documentation, available at https://docs.askdialog.com/.

The Dialog Service uses a proprietary RAG (Retrieval Augmented Generation) architecture developed by Dialog.

How the system works:

1. Information retrieval (Retrieval)

- When an end user asks a question, the Dialog system retrieves the relevant information exclusively from the knowledge base composed of:

- The product catalogue provided by the Client (synchronised via the e-commerce integration)

- The content library provided by the Client (blog articles, FAQs, key web pages)

- Dialog builds a structured and queryable knowledge base from this content

2. Answer generation (Generation)

- The retrieved information is transmitted to a language model (Large Language Model - LLM)

- The LLMs used may vary according to the use case and may change during the Contract, in accordance with an automatic failover mechanism between providers in the event of unavailability. As at the date hereof, the models used are in particular Claude Sonnet 4.5 and Claude Haiku 4 (Anthropic), Gemini 3.1 Pro and Gemini 2.5 Flash (Google) and GPT-4.1 (OpenAI). The computation of vector representations (embeddings) and the re-ranking of search results (reranking) rely on OpenAI and Cohere respectively.

- The LLM formulates the final answer within the strict framework defined by the Dialog system prompt and the Client's customised guidelines

- If the request cannot be satisfied using the Client knowledge base, and subject to the configuration defined by the Client, Dialog may query the LLM directly (using its general knowledge)

Technical installation of the Dialog application

Dialog is installed on the e-commerce store by means of two types of component:

1. Universal JavaScript script

- Installed on every page of the e-commerce store

- Displays the assistant/chatbot as an overlay on the current page

- Manages the conversational interface

2. Components embedded in the product pages

- Vue.js or React component library, or Shopify Liquid code

- Displayed directly within the product pages

- Presents pre-suggested questions and an input field

Key security and confidentiality points:

- Client Data is never used to train the third-party LLMs

- The knowledge base is strictly exclusive and used solely for the Client concerned

- Secure hosting on AWS cloud infrastructure (EU region)

- Encryption of data in transit and at rest

Annex 3 - Personal data processing agreement in accordance with the standard contractual clauses of the European Commission.

Between the Client, as identified at the time of the Online Subscription

Hereinafter referred to as "the Client" or "the controller"

And

The company DIALOG SAS,

Hereinafter referred to as "the Provider" or "the processor"

Have agreed as follows:

Preamble:

The Client is the controller of the personal data of the visitors or customers of the website or mobile application having integrated the Dialog Services, offering visitors and customers a chatbot based on an artificial intelligence tool, making it possible to make recommendations, personalised where applicable, of products sold by the Client on its site or application.

The Parties have wished to subject all processing of the data of the Client's visitors and customers to this amendment relating to the processing of personal data, in accordance with Article 28 of the European General Data Protection Regulation No. 2016/679).

SECTION I

Clause 1 : Purpose and scope

a) The purpose of these standard contractual clauses (hereinafter the "Clauses") is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

b) The controller and the processor have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679.

c) These Clauses apply to the processing of personal data as specified in Annex II.

d) Annexes I to IV are an integral part of the Clauses.

e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679.

f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679.

Clause 2 : Invariability of the Clauses

a) The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them.

b) The Parties are nevertheless not prevented from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards, provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

Clause 3 : Interpretation

a)-Where these Clauses use the terms defined in Regulation (EU) 2016/679 respectively, those terms shall have the same meaning as in that Regulation.

b)-These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

c)-These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4 : Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements existing between the Parties at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 5 — Optional : Docking clause not applicable

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 6 : Description of processing(s)

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Clause 7 : Obligations of the Parties

7.1. Instructions

a)-The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented.

b)-The processor shall immediately inform the controller if, in its opinion, an instruction given by the controller constitutes an infringement of Regulation (EU) 2016/679 or of other Union or Member State data protection provisions.

7.2. Purpose limitation

The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.

7.3. Duration of the processing of personal data

Processing by the processor shall only take place for the duration specified in Annex II.

7.4. Security of processing

a)-The processor shall at least implement the technical and organisational measures specified in Annex 6 to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of personal data or unauthorised access to such data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to the data subjects.

b)-The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring the contract. The processor shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.5. Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person's sex life or sexual orientation, or data relating to criminal convictions and offences ("sensitive data"), the processor shall apply specific restrictions and/or additional safeguards.

7.6. Documentation and compliance

a)-The Parties shall be able to demonstrate compliance with these Clauses.

b)-The processor shall deal promptly and adequately with enquiries from the controller about the processing of data in accordance with these Clauses.

c)-The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679. At the controller's request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.

d)-The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice.

e)-The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

7.7. Use of sub-processors

a)-OPTION 2: GENERAL WRITTEN AUTHORISATION: The processor has the controller's general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 15 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s) concerned. The processor shall provide the controller with the information necessary to enable the controller to exercise its right to object.

b)-Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as those imposed on the processor under these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679.

c)-At the controller's request, the processor shall provide it with a copy of such contract concluded with the sub-processor and of any subsequent amendment thereto. To the extent necessary to protect business secrets or other confidential information, including personal data, the processor may redact the text of the contract prior to sharing a copy.

d)-The processor shall remain fully responsible to the controller for the performance of the sub-processor's obligations in accordance with the contract concluded with the sub-processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations.

e)-The processor shall agree a third-party beneficiary clause with the sub-processor whereby — in the event the processor has factually disappeared, ceased to exist in law or has become insolvent — the controller shall have the right to terminate the contract concluded with the sub-processor and to instruct the sub-processor to erase or return the personal data.

7.8. International transfers

a)-Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject, and shall take place in compliance with Chapter V of Regulation (EU) 2016/679.

b)-The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7 for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

Clause 8 : Assistance to the controller

a)-The processor shall notify the controller of any request it has received from the data subject without delay. It shall not respond to the request itself, unless authorised to do so by the controller.

b)-The processor shall assist the controller in fulfilling its obligations to respond to data subjects' requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with points (a) and (b), the processor shall comply with the controller's instructions.

c)-In addition to the processor's obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the processing and the information available to the processor:

1)-the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a "data protection impact assessment") where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

2)-the obligation to consult the competent supervisory authority/ies prior to processing, where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;

3)-the obligation to ensure that the personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated;

4)-the obligations in Article 32 of Regulation (EU) 2016/679 /.

d)-The Parties shall set out in Annex 6 the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause, as well as the scope and the extent of the assistance required.

Clause 9 : Notification of personal data breach

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 of Regulation (EU) 2016/679, where applicable, taking into account the nature of processing and the information available to the processor.

9.1. Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

a)- in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant (unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);

b)-in obtaining the following information which, pursuant to Article 33(3) of Regulation (EU) 2016/679, shall be stated in the controller's notification, and must at least include:

1)-the nature of the personal data including, where possible, the categories and approximate number of data subjects concerned by the breach and the categories and approximate number of personal data records concerned;

2)-the likely consequences of the personal data breach;

3)-the measures taken or the measures the controller proposes to take to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay;

c) in complying with, pursuant to Article 34 of Regulation (EU) 2016/679 , the obligation to communicate without undue delay the personal data breach to the data subject, where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2. Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after having become aware of it, and in any event within 24 hours. Such notification shall contain at least:

a)-a description of the nature of the breach identified (including, where possible, the categories and approximate number of data subjects concerned by the breach and of personal data records concerned);

b)-the details of a contact point where more information concerning the personal data breach can be obtained;

c)-its likely consequences and the measures taken or the measures proposed to be taken to address the breach, including to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

The Parties shall set out in Annex 6 all other elements to be provided by the processor when assisting the controller in the compliance with the controller's obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

SECTION III – FINAL PROVISIONS

Clause 10 : Non-compliance with the Clauses and termination

a)-Without prejudice to the provisions of Regulation (EU) 2016/679, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

b)-The controller shall be entitled to terminate the contract insofar as it concerns the processing of personal data in accordance with these Clauses if:

1)-the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;

2)-the processor is in substantial or persistent breach of these Clauses or of its obligations under Regulation (EU) 2016/679;

3)-the processor fails to comply with a binding decision of a competent court or of the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679.

c)-The processor shall be entitled to terminate the contract insofar as it concerns the processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1(b), the controller insists on compliance with the instructions.

d)-Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or return all the personal data to the controller and delete existing copies unless Union or national law requires storage of the personal data for a longer period. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

ANNEX I to Annex A – Contact details of the parties

Controller: the Client, as identified in the header of the contract

Processor: Dialog SAS, as identified in the header of the contract

ANNEX II to Annex A – Description of the processing by the processor Dialog SAS

Categories of data subjects whose personal data is processed:

- Visitors and consumer customers of the website or of the mobile application published by the Client (End Users)

Categories of personal data processed

- Conversations relating to the Client's products

- UUID

- Order data of the End User

End User Data not directly identifying collected via cookies

- Dialog cookie: strictly necessary (conversation in progress) and functional (conversation history, after consent)

- Unique identifier (UUID)

- Conversation history

- Posthog cookie: statistical cookie

- Statistical data, including user journey events (interactions, shopping cart, purchase, etc).

- Reconciliation data, collected by the Dialog pixel (marketing performance tracker) within the checkout, after consent: PostHog Identifier and session identifier, amount and currency of the order, order identifier, products and quantities, page and domain, consent status.

- Reconciliation data transmitted by the Client's e-commerce platform where the Client has activated the transmission of its orders (directly identifying data): email address and customer identifier of the purchaser, order identifier, date, amount, currency, products and quantities, status; association between the conversation, the order and the email address; tag or attribute "order linked to a Dialog conversation" written on the order in the Client's e-commerce platform. Postal addresses, telephone numbers and payment data are not transmitted to Dialog (filtering from the outset).

- Marketing performance cookies _dialog_distinct_id and _dialog_session_id (which collect the PostHog Identifier and the session identifier, thirty (30) days, for stores whose checkout is served from a separate domain only)

Consent to the Posthog Cookie is retained for a period of 6 months. The statistical data is retained for 24 months.

The data collected via the Dialog tracker is retained for the Term of the Contract / for the duration of the interaction with the End User. If the User does not use the Service for 2 years, the Dialog tracker and the conversation history are deleted.

The marketing performance cookies _dialog_distinct_id and _dialog_session_id, where they are placed (for stores whose checkout is served from a separate domain), expire after thirty (30) days.

For the Personal Shopper functionality: directly identifying data

- email, transmitted on the Client's instruction to the customer relationship management tools and to the Client's e-commerce platform where the Client has activated these connectors

- Data relating to the condition of their skin (dry skin, oily skin, redness, etc.)

- Data relating to their usual cosmetic routine

- Data relating to their wishes in respect of cosmetics

- Photograph of the face

- Health data subject to the express and prior consent of the client

The Dialog cookie is strictly necessary for the provision of the Service, in order to make the End User's conversation history available to them.

The Posthog cookie requires the prior consent of the visitors and customers of the Client's website, for statistical purposes.

The Client warrants that it has implemented for this purpose on its website a Consent Management Platform, compliant with Article 82 of the French Data Protection Act (loi informatique et libertés), and with any recommendation issued by the CNIL on the collection and use of trackers. The Parties undertake to transmit to each other and to use the consent signals in accordance with the intention expressed by the End Users.

The collection of the PostHog Identifier via the Dialog pixel and of the order data for the purposes of Reconciliation, as well as the Linking of the conversation to the purchaser's email address, are subject to the End User's consent to marketing or advertising performance trackers, collected by the Client via its CMP and transmitted to Dialog. In the absence of that consent, the conversation is excluded from Reconciliation and from Linking.

Dialog is processor in respect of the access to and the reading of the data collected via the Dialog cookie, the PostHog cookie, the Dialog pixel and, where applicable, the _dialog_distinct_id and _dialog_session_id cookies, as well as of all the User Data thus collected.

Dialog is solely responsible for the anonymisation of the User Data from which are extracted the Lexical Fields reused for the training of Dialog's artificial intelligence tools, as well as for the improvement of its Services, and for the aggregated and statistical data extracted from the Client Data.

The sensitive data processed (if applicable) and the applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as, for instance, strict purpose limitation, access restrictions (including access only for staff having followed specialised training), the keeping of a record of access to the data, restrictions applicable to onward transfers or additional security measures.

Health data is collected following the express consent of the users of the Personal Shopper functionality. It is processed solely for the purposes of delivering the personalised recommendation displayed on the website and transmitted within the conversation reproduced by email to the user.

The data transmitted by the Client's e-commerce platform is limited from the outset to the strictly necessary fields (no postal address, no telephone number, no payment data). All of it is partitioned by Client. The email address, the End User's identifiers and the order data are not transmitted to the language model providers referred to in Annex III: only the content of the messages exchanged is transmitted to them, which justifies the obligation on the Client to ask the End Users not to enter personal data therein (Article 7.2 of the Terms).

Nature of the processing

Access, collection, hosting, electronic communication

Purpose(s) for which the personal data is processed on behalf of the controller, the Client:

- Making product recommendations from the Client's catalogue (Chat Widget)

- Personalised recommendation based on the User Data, following express consent for health data, sensitive data,

- Sending by email of the recommendation provided by the Dialog Personal Shopper Service

- Reconciliation: linking of the conversations to the orders placed on the Client's e-commerce platform and measurement of the attribution of sales to the Services, by matching the PostHog Identifier within a time window, for the End Users having consented to marketing or advertising performance trackers only; return to the Client of its Client Data at event level and of statistics (attributed revenue, conversion rate). No directly identifying data is used as a linking key.

- Linking: Where the Client has activated the transmission of its orders: (i) flagging, on the Client's instruction, of the orders linked to a conversation within its e-commerce platform (tag or attribute on the order); (ii) association of the conversation linked to the order with the email address and the customer identifier of the purchaser, for the purposes of returning to the identified purchaser their conversation history, of performance statistics per identified customer for the exclusive benefit of the Client, and of transmitting, on the Client's instruction, the conversation or its summary to the Client's customer relationship management tools; for the End Users having consented to marketing or advertising performance trackers only.

- Transmission, on the Client's instruction and where the Client has activated the corresponding connectors, of the email address and of the Personal Shopper recommendation summary to the Client's customer relationship management tools (Klaviyo, Yotpo, Connectif) and tagging of the customer record on the Client's e-commerce platform.

- Statistics on the use of the Services

- Anonymisation with a view to the use of the anonymised User Data by Dialog for the purposes of Improvement of the Dialog service (Chat widget and/or "Personal Shopper recommendation), on the basis of legitimate interest

- Anonymisation for the purposes of producing aggregated statistical data

Duration of the processing, according to the purposes of the processing:

For the email data collected on the Personal Shopper functionality:

The data is retained for the duration of the use by the visitor/customer of the website, save in the event of inactivity for 2 years from the last visit.

The emails sent containing the summary of the personalised recommendation are retained in archive for 5 years from their sending.

For the data collected within the Dialog cookie:

The Dialog cookie and the conversation data are retained for the duration of the use by the visitor/customer of the website, save in the event of inactivity for 2 years from the last visit, on which date the Dialog cookie is deactivated.

For the data collected within the Posthog cookie:

The consent to or refusal of the Posthog cookie is retained for 6 months.

The data collected is retained for 24 months

For the Reconciliation data:

The pseudonymous identifiers, the order data (collected by the Dialog pixel or transmitted by the Client's e-commerce platform) and the conversation / order / email address associations are retained for twenty-four (24) months from the order, then deleted or irreversibly anonymised. The email address additionally follows the duration applicable to the conversation data (deletion after two (2) years of inactivity). The aggregated statistics resulting therefrom no longer constitute personal data.

ANNEX III to Annex A: processing by the sub-processors, also specify the subject matter, the nature and the duration of the processing

Dialog's sub-processors are recipients of the data for the following purposes and for the same durations as specified above:

- Amazon Web Services (AWS), Europe (Ireland) region: hosting, databases and search engine. Multi-datacenter architecture, replication managed by DynamoDB and RDS. Data hosted within the European Union.

- Anthropic, Google (Gemini) and OpenAI: language model providers, generation of the responses and computation of the vector representations. Any transfer outside the European Economic Area is governed by the standard contractual clauses of the European Commission and by the additional safeguards entered into by Dialog.

- Cohere: reranking of the search results within the Client's knowledge base. Any transfer outside the European Economic Area is governed by the standard contractual clauses of the European Commission.

- PostHog: analytics cookie and usage statistics.

- Langfuse: observability of the calls to the language models.

- Sentry: monitoring of application errors and of performance. Any transfer outside the European Economic Area is governed by the standard contractual clauses of the European Commission.

The Client's e-commerce platform (in particular Shopify) is not a sub-processor of Dialog: the order data used for Reconciliation is collected by the Dialog pixel executed by that platform within the Client's checkout or transmitted by the Client, as controller, by means of the order webhooks of its store, within the limits of the permissions granted by the Client to the Dialog application upon its installation; the tags affixed to the orders are affixed within the Client's own environment. The Client's customer relationship management tools (Klaviyo, Yotpo, Connectif) to which Dialog transmits, on the Client's instruction, the email address and the Personal Shopper summary are recipients designated by the Client and not sub-processors of Dialog.

Annex 4 – SLA and technical support

AVAILABILITY OF THE SOLUTION

The Availability of the Service is assessed on two counts:

- Availability of the Platform for the Users: 99.9% over one month

- Availability of the responses of the Dialog Chat to the queries of the end users: 99.5 % over one month

Where the "Platform" availability indicator is not met under the conditions defined in the Contract over the month, the Provider shall grant the Client the following Service Credits

Where the "Availability of the responses of the Dialog Chat" indicator is not met over the month under the conditions defined in the Contract, Dialog shall grant the Client the following Service Credits. The "Availability of the responses" is defined as follows: for each query of an end user, the Dialog Chat provides a response that can be viewed by the end user, and this, irrespective of the quality or the relevance of the response.

The calculation of the Availability time of the two indicators excludes any planned or emergency maintenance operation, whether corrective, evolutive or adaptive, or any act of a third party or event of force majeure.

Whatever the level and the number of unavailability under the two aforementioned indicators, the Service Credits accumulated over a given month may not exceed 5% of the monthly amount of the Subscription to the Solution, excluding the price per conversation.

This Service Credit may be used by the Client exclusively upon expiry of the contractual term provided for in the Contract.

In the event that one of the availability rates is below 98% over three consecutive months, the Client may terminate the contract, after notification by registered letter with acknowledgement of receipt.

Technical support

Dialog's technical support is available from 9 a.m. to 6 p.m. on business days, excluding French public holidays.

The notification of an incident is made by the Client in accordance with the terms described within Dialog's technical documentation, available at https://docs.askdialog.com/support/.

Annex 5 – List of sub-processors

- Amazon Web Services (AWS), Europe (Ireland) region: hosting, databases, search engine

- Anthropic: language models

- Google (Gemini): language models

- OpenAI: language models and computation of the vector representations (embeddings)

- Cohere: re-ranking of the search results (reranking)

- PostHog: analytics cookie and usage statistics

- Langfuse: observability of the calls to the language models

- Sentry: application error tracking (monitoring)

Annex 6 – Dialog's technical and organisational security measures

The measures described below constitute the technical and organisational measures implemented by Dialog within the meaning of Articles 28.3.c) and 32 of the GDPR. Their detailed and up-to-date version is published within Dialog's technical documentation, available at https://docs.askdialog.com/. Dialog may only change these measures on condition that it maintains an at least equivalent level of security.

1. Hosting and location of the data

Hosting on the Amazon Web Services (AWS) cloud infrastructure, Europe (Ireland) region.

Architecture distributed across several availability zones, replication managed by DynamoDB and RDS.

The Client Data and the End User Data are stored within the European Union.

2. Encryption

Encryption of the data in transit on all flows, including between the Widget and the Platform (TLS 1.2 or higher version).

Encryption of the data at rest on the storage volumes, the databases and the backups.

3. Access control

Access to the production environments restricted to Dialog personnel alone whose duties so justify, in accordance with the principle of least privilege.

Individual named authentication and two-factor authentication for access to the administration consoles and to the infrastructure.

Periodic review of the authorisations and revocation of access upon the departure of the employee.

Confidentiality undertaking of all personnel authorised to process the data.

4. Segregation

Logical segregation of the data by client organisation. The knowledge base built from the Client Data is strictly exclusive to the Client concerned and is never shared between clients.

Separation of the development, test and production environments.

5. Logging and monitoring

Logging of the accesses and of the application and infrastructure events, monitoring of application errors and alerting.

Observability of the calls to the language models.

6. Development security

Source code hosted in a private repository, code review prior to any deployment to production.

Management of secrets outside the source code.

Keeping the dependencies up to date and remediation of identified vulnerabilities.

7. Language models and sub-processors

The sub-processors are listed in Annex 5 and in Annex III to Annex A.

Dialog enters into contractual terms with the language model providers excluding the use of the data transmitted for the purposes of training their models.

8. Continuity and backups

Regular backups of the databases, with a restoration procedure.

Architecture distributed across several availability zones.

9. Management of personal data breaches

Internal procedure for the qualification and handling of security incidents.

Notification to the Client, in its capacity as controller, as soon as possible and at the latest within twenty-four (24) hours of becoming aware of a personal data breach, in accordance with clause 9.2 of this Agreement.

10. Minimisation and retention periods

Minimisation of the data collected via the Chat Widget, which does not require any directly identifying data.

Retention periods in accordance with Annex II to Annex A.

Return or deletion of the data at the end of the contract in accordance with Article 4.2 of the Terms and with Annex 7.

Annex 7 – right to switch provider in accordance with the Data Act – Switching Right Plan

The Parties expressly refer to the standard contractual clauses issued by the European Commission relating to the right to switch provider provided for in Article 25 of the European Data Act Regulation, without any need to reproduce them in full below.

I – Standard Contractual Clauses on Information

The Switching Right Plan is detailed as follows, in accordance with the plan included in the European standard clauses:

Appendix 1 – Switching and exit plan

1. Contact details :

(a) Provider’s contact for switching and exit: Dialog’s support by opening ticket, and confirmation with reference ticket number

(b) Customer’s contact for switching and exit:

2. The Customer must provide the following information in the written notice:

(a) Data concerned by the notice, according to the agreed identification in Appendix 2.

(b) Destination of the Data: Customer’s on-premises ICT infrastructure or a Destination Provider, including relevant technical specifications about the destination site.

(c) Location where the Data should be exported and transported.

3. Provider’s obligations to react to the written notice

Within 3 business days, the Provider will reply to the Customer in writing, with the following information:

(a) Exhaustive specification of all categories of Data to be transferred during the switching process

(i) Exportable Data

• All Data imported by the Customer at the beginning of the Service Agreement including metadata (input Data)

o A, Customer Data

o B Configuration Data

o C Metadata

• All Data directly or indirectly co-generated by the Customer’s use of the Data Processing Service:

o D, with metadata: YES in format XXX

(ii) Digital Assets:

• L, in format XXX for documents

• M, in format XXX for snapshots

(b) Exhaustive specification of categories of Data specific to the internal functioning of the Provider’s Data Processing Service that are to be exempted from the Exportable Data where a risk of breach of the Provider’s trade secrets exists: internal Algorithms, system logs, monitoring and security tooling.

4. Confirmation of the Data to be switched

The Customer will indicate which Data and Digital Assets they want to receive within the agreed (or alternative) transitional period.

5. Order, timing and testing

During the transitional period:

(a) the agreed order and timing for exporting and transferring the chosen Data and Digital Assets shall be agreed upon during the transitional period (2 months)

(b) description of the testing method proposed by the Provider shall be notified during the transitional period.

(c) the Provider or the Customer using the Provider’s tools and processes will test the export and transfer to the agreed location with part of the agreed Data and Digital Assets, to confirm or adapt the order and timing;

(d) the Customer will test importing into and implementation of the agreed Data and Digital Assets in their own systems or the systems of the Destination Provider;

(e) if there are problems with the testing or the results of the testing, the Source Provider and the Customer will determine whether they arise from the export of the agreed Data and Digital Assets and transfer processes under the Provider’s responsibility or from their import and implementation processes under the Customer’s responsibility.