Datazag Partner Agreement

Version: 1.6 · Effective date: 26 October 2026 · Governing law: England and Wales

1. Parties, Acceptance and Order of Precedence

1.1 This Partner Agreement ("Agreement") is between Datazag Ltd, a company registered in England and Wales under company number 13217786, with its registered office at 12 South Drive, Wokingham, England, RG40 2DH ("Datazag", "we", "us"), and the business entity identified at acceptance by its registered name, registration number and registered address ("Partner", "you").

1.2 You accept this Agreement by ticking the acceptance checkbox in the Datazag customer portal before subscribing to a Partner Plan, after giving the Partner's registered name, registration number and registered address and your own name and job title. The individual ticking the box represents and warrants that they have full legal authority to bind the Partner. For each acceptance, Datazag records the Partner details given; the individual's name, job title and portal user identity; the version and SHA-256 fingerprint of this Agreement and of each document it incorporates; the acceptance wording; the plan and founding status selected; the timestamp; and the IP address.

1.3 This Agreement includes Schedules 1 and 2 and incorporates the Datazag Terms of Service and Data Processing Addendum (DPA) identified by version and date at acceptance. These documents are together the General Terms. Mandatory data transfer clauses prevail over conflicting provisions in all documents. For personal data processing, the DPA then prevails over this Agreement and the Terms of Service. For other Partner Program matters, this Agreement and its Schedules prevail over the Terms of Service. The Privacy Policy provides privacy information and does not vary contractual rights. A signed variation must identify the provisions it overrides and cannot override mandatory transfer clauses.

1.4 This is version 1.6, effective from 26 October 2026 for Partners accepting it on or after that date, and for existing Partners in accordance with Clause 18. The applicable Terms of Service and DPA versions must be identified and available before acceptance; subsequent changes are subject to Clause 18.

2. Definitions

3. Appointment and Relationship

3.1 We appoint you as a non-exclusive Datazag partner. You may access the Portal to generate Reports and deliver them to your Clients and Prospects as a component of your own professional services, strictly subject to the terms of this Agreement.

3.2 We reserve the right to appoint other partners without geographic or industry restriction, including partners operating in your specific target market. You are free to contract with other cybersecurity, threat intelligence, or data vendors.

3.3 The parties are independent contractors. Neither party is an agent, employee, partner, or legal representative of the other. You have no authority to bind Datazag, make commitments or warranties on our behalf, or represent our business. Your Clients contract solely with you, not with Datazag.

3.4 You have complete discretion to establish your own pricing, commercial structures, and service agreements for your Clients.

4. Plans, Allowances and Additional Reports

4.1 Schedule 1 specifies your Partner Plan fee, Report Allowance and included monitoring. Checkout records your selected plan and founding status. Portal or website descriptions do not override these terms or vary an existing subscription except under Clauses 6.5 and 18.

4.2 Your Allowance resets at the start of each Billing Period. Unused Reports do not roll over to subsequent months and carry no cash, credit, or surrender value.

4.3 Each single-domain assessment order consumes one Report from your Allowance at the moment of submission. If a technical failure on our platform prevents a Report from generating, that Report is returned to your active Allowance.

4.4 If you exhaust your Allowance within a Billing Period, you may purchase additional Reports via the Portal. Estate assessments (multi-domain scans) are scoped and purchased separately. Additional Reports and estate assessments are billed at our standard published rates less your 20% partner discount.

4.5 Reports must be generated solely for bona fide Client and Prospect engagements. You must not order Reports using external scripts, scrapers, or unauthorized automated mechanisms, nor may you order Reports to assemble comparative databases or aggregated data sets.

5. Founding Partner Terms

5.1 The Founding Partner promotion applies exclusively to the Managed Practice plan. It is limited to the first 10 qualifying partners who subscribe, and expires on December 31, 2026, or earlier once all 10 slots are filled.

5.2 A Founding Partner pays the preferential recurring fee displayed at checkout ($1,250 USD per month) instead of the standard rate ($1,850 USD per month). This founding fee remains locked for as long as your subscription remains continuously active on the Managed Practice plan.

5.3 The preferential rate terminates permanently if you cancel your subscription, downgrade to another tier, or if your subscription is terminated for non-payment under Clause 17. If you re-subscribe at a later date, standard pricing applies.

5.4 The founding fee covers the baseline service scope set out in Schedule 1. Any scope extensions requested by you (such as extra monitored infrastructure or custom integrations) will be billed at then-current rates.

5.5 Founding Partners receive priority onboarding and direct operational access to the Datazag product and technical teams, as outlined in Schedule 1.

6. Fees, Billing and Taxes

6.1 You pay the monthly fee for your chosen Partner Plan in advance via credit card or an alternative payment method supported at checkout. Our primary payment processor is Stripe. Fees for additional Reports or estate assessments are billed immediately upon order.

6.2 All fees are denominated and charged in US Dollars (USD) unless agreed otherwise in writing. Any pricing shown on our public website in alternative currencies is indicative only.

6.3 Fees exclude VAT and applicable sales, use, goods and services, turnover and similar transaction taxes. Datazag will charge and account for taxes it is legally required to collect. You are responsible for transaction taxes legally payable by you, but not taxes on Datazag income, profits, payroll or property. Each party will provide reasonably required tax information, including valid business tax identifiers. Reverse charge or exemption applies only where legally available. You may deduct legally required withholding, remit it to the authority and promptly provide official evidence; the parties will reasonably cooperate to obtain lawful treaty relief. No gross-up applies unless separately agreed in writing. You bear your bank and currency conversion charges.

6.4 If payment fails, we will notify you and re-attempt collection over a 14-day grace period, maintaining Portal access. After that period, we may suspend new Report generation and monitoring for overdue undisputed fees under Clause 17.4. You must promptly explain any good-faith invoice dispute and pay undisputed amounts; the parties will work promptly to resolve it.

6.5 We may adjust standard Partner Plan subscription fees upon giving at least 30 days' advance written notice. Any fee adjustment takes effect from your next Billing Period following the expiry of the notice. Active Founding Partner subscription rates protected under Clause 5 are exempt from standard price increases.

6.6 All subscription and transactional fees are non-refundable, except as expressly set out in this Agreement or required by statutory law. If you subscribe to a Partner Plan for the first time, you may cancel within 14 days of your initial payment date. If you cancel under this clause and have generated no more than 2 paid Reports from your Allowance (excluding your initial free internal domain report), we will refund your initial monthly fee.

7. Licence to Use and Pass on Reports

7.1 While your plan is active and in good standing, Datazag grants you a non-exclusive, non-transferable licence, terminable only under this Agreement and subject to the surviving rights in Clause 7.4, to:

1. use Reports and Datazag Data to deliver your professional managed, security, or advisory services;

2. deliver complete, unaltered copies of Reports to the specific Client or Prospect for which they were generated, subject to the Co-branding Requirements in Schedule 2; and

3. incorporate excerpts, scores, charts, and findings from a Report into your own branded deliverables for that specific Client (such as Quarterly Business Reviews, remediation roadmaps, board presentations, and cyber insurance verification packs), provided the attribution requirements in Schedule 2 are satisfied.

7.2 A Client or Prospect may use a supplied Report for its own internal business purposes, including confidential sharing with its external auditors, legal counsel, insurance underwriters and authorised service providers acting for it, subject to confidentiality, limited-purpose use and applicable data protection duties. You must contractually require each recipient not to publish, resell or further distribute it except as this Agreement permits. These permissions do not create a direct services contract with Datazag.

7.3 You must not:

1. resell, sublicense, rent, lease, or publish Reports or Datazag Data other than as expressly authorised in Clauses 7.1, 7.2, 7.4 and 7.5;

2. provide a Report to anyone other than its intended Client or Prospect, except sharing expressly permitted by Clauses 7.2 and 7.4;

3. extract, harvest, scrape or systematically store Datazag Data to compile an external database, data pipeline, feed or competitive product, except the operational alert handling expressly permitted by Clause 7.5; or use Datazag Data to train, fine-tune or benchmark machine learning models or artificial intelligence systems;

4. use Reports or Datazag Data to build, support, or optimize a commercial product or service that directly competes with Datazag;

5. remove, obscure, or alter the Datazag attribution, or modify the empirical findings or scores in a Report while presenting them as authentic Datazag findings; or

6. pool alerts into a reusable intelligence dataset or shared commercial feed or disclose one Client's alerts to another Client. A shared security operations platform may receive alerts for multiple Clients under Clause 7.5 if access and use are controlled for each Client, and correlations are used only to protect those Clients without disclosing their confidential information to each other.

7.4 Reports lawfully generated and paid for during an active subscription, and permitted bespoke deliverables incorporating them, may be retained and used after suspension, expiry or termination by you and their intended Client or Prospect for that same engagement and internal business records. You may continue supplying copies and permitted excerpts to that same recipient, including Reports not yet delivered at termination. Clause 7.2 permits confidential adviser and underwriter sharing. These historical rights survive indefinitely, subject to Clauses 7.2, 7.3, 8 and Schedule 2; they confer no right to new generation, updates, monitoring, new recipients or database exploitation. A material breach affecting a historical Report permits restriction of that Report only after notice and 14 days to remedy, unless law or prevention of serious harm requires immediate action. Restrictions must be proportionate and do not affect accrued lawful use.

7.5 Direct API integration, raw data streaming, bulk intelligence feeds and automated cloud data shares require a separate executed Data Licensing Agreement, except alert delivery included in Schedule 1. For included alerts, you may configure Slack, SIEM or webhook destinations that you control or are authorised to operate for the relevant Client. You may receive, store, index, search, correlate, annotate and route those alerts within your managed security service, including through authorised service providers bound by confidentiality and data protection duties. A shared platform is permitted with logical Client separation and access controls. This permission does not allow a reusable intelligence product, onward resale or cross-Client disclosure. Alerts are Reports for licence, confidentiality and liability purposes; Schedule 2 paragraph 5 governs their attribution. The intended Client and permitted advisers may receive relevant alerts under Clause 7.2. Historical retention follows Clause 7.4; personal data remains subject to lawful retention and the DPA. You are responsible for authorising destinations and your providers; Datazag remains responsible for its own delivery processing and providers under the DPA.

8. Co-Branding and Attribution

8.1 Standard Reports are co-branded, with your Partner Brand as primary visual identity and the legible phrase "Intelligence powered by Datazag" as supporting attribution under Schedule 2. Bespoke deliverables follow Schedule 2 paragraph 3. Attribution must not be concealed or misleading.

8.2 You grant Datazag a non-exclusive, worldwide, royalty-free licence to use, store, and display your Partner Brand within the Portal and on generated Reports solely to fulfill our obligations under this Agreement.

8.3 You warrant that you own or possess all requisite intellectual property rights, permissions, and licences to upload and use your Partner Brand. You must not upload any logo, trademark, or trade name that infringes third-party rights or implies an unauthorized commercial association or endorsement.

8.4 We reserve the right to review uploaded partner branding assets. Pending visual approval, Reports will display your business name in plain text in place of a graphical logo. We may reject or remove any Partner Brand asset that violates Clause 8.3 or Clause 9.

8.5 You may state publicly that your services incorporate technical intelligence supplied by Datazag. You must not state, imply, or suggest that Datazag audits, certifies, endorses, or warrants your services, personnel, or Clients without our express prior written agreement.

8.6 Except for the limited licences granted herein, neither party acquires any right, title, or interest in or to the other party's trademarks, trade names, or corporate branding.

9. Acceptable Use

9.1 Reports reflect observational analysis of publicly routable, externally accessible internet infrastructure. You may generate Reports solely for existing Clients, or Prospects with whom you have a verifiable, legitimate commercial reason to engage regarding your services.

9.2 When utilizing Reports during outreach to a Prospect, you must:

1. represent all findings and risk scores accurately, without deceptive manipulation, ungrounded technical extrapolation, or unwarranted urgency;

2. comply with privacy, data protection and direct marketing laws applicable in the relevant territories, including where applicable UK GDPR, the Data Protection Act 2018, PECR, EU GDPR and national ePrivacy rules, US state privacy laws and CAN-SPAM; a commercial reason alone does not establish consent or another lawful basis; and

3. immediately cease contact and remove from your outreach lists any Prospect that requests the cessation of communications.

9.3 You must not use Reports, Datazag Data, or the Portal to:

1. harass, intimidate, threaten, or extort any entity, or assert or imply that an infrastructure security compromise or breach has occurred when the underlying Report does not confirm one;

2. conduct unauthorized penetration testing, port scanning, vulnerability exploitation, denial-of-service testing, or unauthorized interception of computer systems described in a Report;

3. facilitate, plan, or execute fraud, phishing, domain spoofing, social engineering, or corporate impersonation;

4. assess an organization for any unlawful purpose or in breach of a duty of confidentiality owed to that organization;

5. mischaracterize a Report as an internal systems penetration test, an exhaustive attack surface assessment, a compliance certification, or an official regulatory audit; or

6. share, sub-license, or disclose your Portal administrative credentials, or permit any party outside your immediate organization to order Reports.

9.4 Suspected or identified misuse is subject to the proportionate notice, suspension, cure and restoration procedures in Clause 17.4.

10. Partner Responsibilities to Clients

10.1 You remain solely responsible for the delivery, quality, accuracy, and contractual terms of your professional services and advisory outputs. You have sole responsibility for analyzing, interpreting, contextualizing, and implementing any recommendations derived from Reports.

10.2 You must not make any warranty, guarantee, indemnity, or representation to any Client or Prospect regarding the functionality, scope, or coverage of Reports or Datazag Data that exceeds the commitments made by Datazag to you in this Agreement.

10.3 You are responsible for first-line client support and communication regarding your services. If a Client raises a formal technical inquiry regarding the evidence base of a specific Report finding, Datazag will provide reasonable secondary technical support via the Portal or email.

10.4 You must take reasonable measures to secure credentials and promptly notify Datazag of suspected compromise. You are responsible for activity you authorise or that results from breach of those duties, subject to Clause 16, but not to the extent caused by Datazag breach or security failure.

11. Data Protection and Client Data

11.1 Applicable Data Protection Law means privacy and data protection laws applicable to the processing, including UK GDPR and the Data Protection Act 2018, EU GDPR and applicable Member State laws, and applicable US federal and state privacy laws, including CCPA as amended. Each party must comply with its own obligations. Public availability does not remove personal data from protection. Roles depend on actual purposes and means of each processing activity.

11.2 Datazag acts as independent controller for account administration, billing, fraud prevention and security where it determines purposes and essential means, and independently collected infrastructure intelligence where it makes those decisions. Each party is independent controller for its own business contacts and marketing, responsible for lawful basis, transparency, minimisation, retention and rights responses. If actual processing requires joint controllership, the parties must agree the required arrangement before it begins.

11.3 The Client List comprises organisation identities, domains, technical identifiers and related information you submit for assessment or monitoring. For personal data processed solely on your documented instructions to provide those services, you act as controller and Datazag as processor. Where you act as processor for a Client, Datazag acts as sub-processor; you must obtain necessary authorisation and pass down lawful instructions. Datazag must not use instructed personal data for its own marketing or unrelated purposes. Independent controller processing must remain distinct and lawful.

11.4 The separate DPA must be reviewed and agreed before any processing requiring a controller-processor or processor-sub-processor contract begins. This Agreement is not a substitute for that review or a complete Article 28 contract. The DPA must specify processing subject matter, duration, purposes, data categories and subjects; instructions; confidentiality and security; breach notification without undue delay; assistance with rights, assessments and regulatory obligations; sub-processor authorisation and equivalent obligations; audits; and return or deletion. Where US service-provider or contractor terms are required, it must specify permitted business purposes, prohibit sale, sharing and unauthorised use, retention, disclosure or combination, and include required compliance, monitoring, notification and remediation rights. Labels alone do not establish statutory status.

11.5 Before a restricted international transfer, the responsible party must establish a valid mechanism under Applicable Data Protection Law. The DPA must identify processing locations, recipients and onward transfers and, where required, incorporate appropriate EU standard contractual clauses and modules, the UK International Data Transfer Agreement or UK Addendum, completed annexes, necessary transfer assessments and supplementary safeguards. Adequacy applies only where valid for the recipient and transfer. This Agreement does not itself implement a transfer mechanism or certify compliance.

11.6 Your Client List and the fact of assessments for named organisations are your Confidential Information. Datazag will not use it to solicit your Clients directly or share it with competing partners. On termination, instructed personal data will be returned or deleted at your choice under the DPA, allowing the 30-day export period unless you request earlier deletion. Client Lists must be deleted from active production systems within 90 days at the latest unless law requires retention. Retained data must be isolated, protected and used only for the lawful retention purpose; backups must expire under the documented DPA cycle. Financial and transactional records may be retained for applicable legal requirements only. The DPA prevails for personal data, including shorter deadlines.

12. Confidentiality

12.1 "Confidential Information" means all non-public commercial, operational, or technical information disclosed by one party ("Disclosing Party") to the other party ("Receiving Party") under this Agreement, including your Client List, Datazag's proprietary methodologies, algorithms, and unpublished commercial terms. Delivered Reports constitute your Confidential Information, excluding the underlying Datazag Data contained within them.

12.2 The Receiving Party must protect Confidential Information with at least the care it uses for its own similar information, and never less than reasonable care. It may use it only to exercise rights or perform obligations under this Agreement. Disclosure is permitted to staff, professional advisers and authorised service providers who need to know and are bound by appropriate confidentiality obligations, and to intended Clients, Prospects, permitted recipients and configured alert destinations to the extent expressly permitted by Clauses 7.2 and 7.5 and the DPA. Each party remains responsible for recipients acting on its behalf; no permission allows cross-Client disclosure or overrides data protection duties.

12.3 Confidential Information does not include information that:

1. is or becomes publicly available without breach of this Agreement;

2. was already lawfully in the possession of the Receiving Party without restriction prior to disclosure;

3. is independently developed by the Receiving Party without reference to or reliance on the Disclosing Party's Confidential Information; or

4. is required to be disclosed by order of a court of competent jurisdiction or regulatory authority, provided the Receiving Party gives prompt written notice (where legally permissible) to enable the Disclosing Party to seek a protective order.

12.4 The obligations under this Clause 12 survive for a period of 3 years following the termination or expiration of this Agreement, except in respect of Datazag Data, trade secrets, and core algorithmic methods, which remain protected for as long as they retain commercial confidentiality under English law.

13. Service Delivery and Monitoring

13.1 Standard single-domain assessment Reports are generally generated and delivered to the Portal within minutes of submission. Estate assessments require expanded data collection, and estimated completion times are shown in the Portal upon order placement. Delivery timeframes are operational targets and not guaranteed delivery thresholds.

13.2 We apply commercially reasonable efforts to ensure continuous Portal availability, but do not warrant uninterrupted, error-free, or zero-downtime operation. We will provide reasonable advance notice of scheduled maintenance where feasible.

13.3 On Partner Plans with active infrastructure monitoring, you may assign monitored organization slots up to your plan tier limit. Monitoring actively tracks changes across observable public DNS configurations, mail routing records, web hosting targets, and TLS/SSL certificates. We may adjust or expand the technical monitoring methodology over time, provided we do not materially degrade the scope of monitoring during an active, prepaid Billing Period.

13.4 We may modify the design, scoring presentation, metrics, and visual format of Reports. We will not materially diminish the core functional deliverables of your Partner Plan during any prepaid Billing Period.

13.5 Standard technical support is provided via email and the Portal during UK business hours (09:00 to 17:30 GMT/BST, Monday to Friday, excluding UK public holidays). Managed Practice partners receive priority onboarding and direct channel access to the Datazag technical team as detailed in Schedule 1.

13.6 Alert delivery depends on correctly configured destinations and third-party availability. Datazag is not responsible to the extent a delivery failure is caused by a destination outside its control, but must exercise reasonable skill and care in its own integration and delivery processing. Datazag will expose delivery status or failure information where supported by the service and reasonably assist diagnosis. Alerts do not guarantee detection of every change or threat. No continuous human review, guaranteed response time or incident response service is included unless separately agreed.

14. Intellectual Property Rights

14.1 Datazag (and its licensors) retains absolute ownership of all right, title, and interest (including all patent rights, copyrights, database rights, trade secrets, and other intellectual property rights) in and to the Portal, Datazag Data, our analytics engines, algorithms, taxonomy, and the structure, design, and layout of our Reports. No ownership rights are transferred to you under this Agreement.

14.2 You retain absolute ownership of all right, title, and interest in and to your Partner Brand, as well as your proprietary methodologies, advisory documentation, and any independent analysis or commentary you attach to your service deliverables.

14.3 If you provide suggestions, feature requests, or feedback regarding the Portal or Reports, you grant us an irrevocable, perpetual, royalty-free, worldwide licence to use, implement, and commercialize such feedback without restriction or financial accounting to you.

15. Warranties and Disclaimers

15.1 Datazag warrants that it will provide the Portal and generate Reports with reasonable skill and care in accordance with applicable industry standards. Each Report provides an empirical summary of the observable technical evidence underpinning its ratings.

15.2 Reports describe externally observable public infrastructure using observations and third-party sources that may have different collection times. Generation time does not mean every finding was observed at that instant. Datazag will show generation time and, where available, material observation or source timestamps and identify material timing limitations. Reports cannot observe internal networks, air-gapped systems, private configurations or non-public administrative systems, and may omit unindexed assets, ephemeral configurations and later changes. Findings must be interpreted in their stated time context.

15.3 A Report does not constitute a penetration test, a code audit, an ethical hacking engagement, an attack surface guarantee, or a regulatory compliance audit. It does not constitute legal, regulatory, or insurance underwriting advice. Datazag makes no representation or warranty that any finding or score will ensure, maintain, or preserve cyber insurance coverage for a Client.

15.4 Datazag does not warrant that Reports will detect every vulnerability, misconfiguration, or threat actor across an assessed infrastructure, nor that it will identify vulnerabilities faster than third-party intelligence vendors.

15.5 Except as expressly set out in this Agreement, and to the maximum extent permitted by applicable law, Datazag excludes all other warranties, representations, conditions, or terms of any kind, whether express, implied, statutory, or otherwise, including any implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, or non-infringement.

16. Limitation of Liability and Indemnities

16.1 Nothing limits either party's liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or liability that applicable law does not permit to be limited or excluded. Nothing restricts mandatory data subject rights or regulatory powers.

16.2 Subject to Clause 16.1, neither party is liable for indirect or consequential loss, or loss of profits, revenue, opportunity, anticipated savings or goodwill, whether direct or indirect. This exclusion does not exclude reasonable direct data or system restoration costs, confidentiality or personal data breach investigation and response costs, or amounts covered by the express indemnities; all remain subject to the applicable cap. No loss may be recovered twice.

16.3 For each successive 12-month period beginning on acceptance and each anniversary, each party's aggregate liability for claims first arising in that period is capped at the greater of (a) fees paid or payable under this Agreement in the 12 months before the first event giving rise to those claims and (b) 12 times the monthly Partner Plan fee immediately before that event (Base Cap). Related events form one claim allocated to the first event period. Caps apply across all causes of action, including contract, negligence and statutory duty, and all incorporated terms.

16.4 Subject to Clause 16.1 and mandatory data transfer clauses, liability for confidentiality, data protection, licence restrictions or acceptable use breaches and both indemnities below is subject to an enhanced aggregate cap of twice the Base Cap for that period. Ordinary claims remain subject to the Base Cap; all capped claims together cannot exceed twice the Base Cap. No indemnity is uncapped. Properly due fees are a debt outside these caps; associated damages remain capped. Mandatory transfer clauses prevail where required. Other DPA or General Terms provisions create no additional recovery unless a signed variation expressly identifies and varies this clause.

16.5 Partner indemnity. You will defend and indemnify Datazag against third-party claims to the extent caused by your negligent or unlawful professional services or outreach, material breach of Clauses 7, 8 or 9, or infringement by your Partner Brand. Coverage is limited to damages and reasonable legal costs finally awarded by a competent court or agreed in settlement under Clause 16.7. It excludes fines and penalties and loss caused by Datazag breach, negligence or unauthorised alteration, and is subject to Clause 16.4.

16.6 Datazag IP indemnity. Datazag will defend and indemnify you against third-party claims that the Portal, Datazag Data or Reports supplied by Datazag and used as permitted infringe intellectual property rights, including copyright, database rights, patents or trademarks, in a territory where such use is permitted under this Agreement. Coverage includes damages and reasonable legal costs finally awarded by any competent court or agreed in settlement under Clause 16.7, subject to Clause 16.4. Exclusions apply only to the extent infringement results from your Partner Brand, unauthorised modifications, or combinations not supplied or required by Datazag where infringement would not otherwise arise. Permitted co-branding, excerpts and incorporation do not alone trigger exclusions. Datazag may procure continued use or replace or modify affected material without materially reducing function. If neither is reasonably available, it may terminate the affected service, refund unused prepaid fees and reasonably assist cessation or replacement of affected historical material, without extinguishing accrued indemnity claims.

16.7 For either indemnity, the protected party must promptly notify the indemnifying party; delay reduces protection only to the extent it materially prejudices the defence. It must avoid admissions or settlements without consent and reasonably assist at the indemnifying party's expense. The indemnifying party controls defence through competent advisers with reasonable consultation. No settlement may impose an admission, payment, ongoing obligation or restriction on the protected party without its prior written consent, not unreasonably withheld. The protected party may participate through its own advisers at its expense. Each party must reasonably mitigate loss. Indemnities cover third-party claims only; direct contractual claims remain available subject to Clause 16.

17. Term, Suspension and Termination

17.1 This Agreement commences upon the date you accept it by checkbox and continues for as long as you maintain an active Partner Plan. Subscriptions automatically renew on a month-to-month basis unless cancelled.

17.2 You may cancel your Partner Plan at any time directly through the Portal. Cancellation takes legal effect at the conclusion of your current Billing Period, and you retain Portal and report generation access until that date.

17.3 Datazag may terminate for convenience on at least 30 days' written notice, extended to at least 90 days for an active Founding Partner. Founding rates and baseline scope remain protected during notice. Datazag will refund prepaid fees for the period after termination. Convenience termination or unilateral changes must not circumvent founding rate protection by requiring migration of the same continuing baseline service to a higher-priced plan.

17.4 Either party may terminate for material breach not remedied within 14 days after written notice describing the breach and remedy required, or immediately if incapable of remedy. Either may terminate on the other's insolvency or equivalent procedure only as legally permitted. Datazag may suspend affected features for reasonably evidenced material breach, overdue undisputed fees after Clause 6.4, or legal or security risk. Except where immediate action is necessary to comply with law or prevent serious harm, it must give reasons, reasonable prior notice and opportunity to remedy. Immediate action must be explained promptly unless prohibited by law. Suspension must be limited to the necessary scope and duration, reviewed promptly and lifted without undue delay when its grounds cease. Safe historical exports must remain available or, if unsafe, a secure alternative provided where lawful. Remediable breaches of Clauses 7.3, 8.3 and 9 receive the same cure period. Suspension alone does not end founding status; permanent loss for non-payment requires valid termination. Datazag will credit prepaid fees for a suspension ultimately found unjustified.

17.5 On expiry or termination, new Report generation and monitoring cease. You have 30 days to download historical Reports, subject to proportionate security controls under Clause 17.4 or earlier deletion instructions. Clause 7.4 survives independently of Portal access. Accrued rights and payment obligations, Clauses 1.3, 7.2 to 7.5, 8 (for historical use), 11 (for retained data and continuing duties), 12, 14, 15, 16, 17.5 and 20, and applicable DPA and transfer provisions survive. Confidential material must otherwise be returned or deleted on request, except lawful archival retention and historical Reports permitted by Clause 7.4, subject to continuing confidentiality and data protection duties.

18. Changes to this Agreement

18.1 We may update or modify this Agreement from time to time. We will notify you by email at least 30 days before any material changes take effect and publish the revised version within the Portal.

18.2 If an update materially disadvantages your commercial or operational rights, you may cancel your Partner Plan before the effective date of the change. In such cases, we will issue a pro-rata refund for any prepaid fees covering the remainder of your current Billing Period.

18.3 Changes strictly necessary for legal compliance or urgent security vulnerabilities or serious misuse may take effect immediately, limited to what is necessary. We will explain the reason and provide as much notice as practicable. This power does not permit retrospective changes to accrued rights or liabilities, removal of historical licences or avoidance of founding fee protection. Mandatory legal requirements remain applicable.

18.4 Each version of this Agreement bears a distinct version number and effective date. The Portal maintains an immutable audit log of the specific version accepted by your account.

19. Publicity

19.1 Datazag will not publicly list you as a partner or display your Partner Brand on our public marketing channels or customer lists without your prior written consent (email confirmation suffices).

19.2 You may publicly reference your status as a non-exclusive Datazag partner, provided all statements adhere strictly to the positioning and branding requirements set out in Clause 8.5.

20. General Provisions

20.1 Assignment. You may not assign, transfer, sub-contract, or novate this Agreement or any of your rights or obligations under it without our prior written consent. Datazag may assign or transfer this Agreement to an affiliate or in connection with a corporate merger, acquisition, restructuring, or sale of substantially all of its assets, and will provide written notice to you if it does so.

20.2 Subcontractors. Datazag may engage third-party service providers (such as hosting infrastructure and payment processing vendors) to support delivery of the Portal. We remain responsible for the performance of our subcontractors in accordance with this Agreement.

20.3 Force Majeure. Neither party is liable for any delay or failure to perform its obligations (excluding payment obligations) caused by events, acts, or circumstances beyond its reasonable control, including natural disasters, acts of war, terrorism, civil unrest, labor disputes, utility failures, major cloud provider outages, or government actions.

20.4 Notices. Formal legal notices must be delivered by email. Notices to Datazag must be sent to partners@datazag.com (with a copy to legal@datazag.com). Notices to the Partner will be sent to the primary billing email address registered in the Portal. An email notice is deemed received on the next business day following transmission.

20.5 Entire Agreement. This Agreement, together with the General Terms and Schedules, constitutes the complete and exclusive agreement between the parties relating to the Partner Program and supersedes all prior proposals, marketing discussions, promises, and understandings. Each party acknowledges that it has not entered into this Agreement in reliance on any statement or warranty not expressly incorporated herein. Nothing in this clause limits liability for fraudulent misrepresentation.

20.6 Third-party rights. Non-parties have no enforcement rights under the Contracts (Rights of Third Parties) Act 1999. This does not affect mandatory statutory rights or rights expressly conferred by applicable transfer clauses. You must pass permitted historical use rights to Clients and Prospects in your own terms; this creates no direct Datazag services contract.

20.7 Severance and Waiver. If any court of competent jurisdiction finds any provision of this Agreement invalid, illegal, or unenforceable, that provision is severed and the remaining provisions continue in full force and effect. No failure or delay by either party in exercising any legal right or remedy constitutes a waiver of that or any other right.

20.8 Governing law and jurisdiction. This Agreement and related non-contractual disputes are governed by the laws of England and Wales, with exclusive jurisdiction of its courts between the parties, subject to mandatory applicable laws and mandatory forum or third-party rights under data transfer clauses. This choice does not displace applicable privacy, marketing, tax, sanctions or other mandatory territorial requirements.

20.9 International compliance. Each party must comply with laws applicable to its activities, including anti-bribery, anti-corruption, sanctions, export control and trade restrictions. Neither must act unlawfully. You must hold permissions for your services and outreach; Datazag remains responsible for lawful service provision and data sourcing. Supply restrictions follow Clause 17.4, with legally permitted refunds of unused prepaid affected services. This Agreement does not warrant lawfulness or enforceability of every use in every jurisdiction.

Schedule 1: Partner Plans

Schedule 1 prices and baseline inclusions apply subject to Clauses 5, 6.5 and 18. Checkout identifies the selected plan; Portal descriptions alone do not amend these terms.

Schedule 2: Co-Branding Requirements

1. Visual Hierarchy and Brand Application

1. Reports generated through your partner account are structured as partner-led assets. Your Partner Brand must serve as the primary visual identity on the document.

2. The supporting Datazag attribution identifies intelligence provenance and must remain visible, unaltered and legible on standard Reports. Bespoke deliverables follow paragraph 3 below.

2. Report Headers and Layout Placements

1. Cover Page & Primary Banner:

◦ Your Partner Brand (logo, corporate trade name, and brand primary accent colors) must appear in the top-left or central title banner.

◦ The statement "Intelligence powered by Datazag" must be displayed in the upper-right banner or the lower footer of the cover page, set in a clear sans-serif font size of no less than 9pt (or 12px for web interfaces).

2. Body Pages & Tables:

◦ Every interior page, tabular export, or summary view must maintain the standard footer: "Intelligence powered by Datazag | www.datazag.com".

◦ The Datazag attribution badge must not be obscured, blurred, scaled to illegibility, cropped, or recolored to a contrast ratio below WCAG 2.1 AA requirements.

3. Automated Exports:

◦ Standard PDF and HTML reports generated directly through the Portal apply these requirements automatically. You must not modify, script, or alter exported document templates to delete, hide, or mask the Datazag attribution.

3. Attribution within Bespoke Deliverables

For permitted findings, scores, excerpts or charts in bespoke deliverables, include the following attribution adjacent to the material, in a relevant page or slide footnote, or in a clearly identified consolidated sources section mapped to the relevant material. Repetition beside every item is not required if provenance is clear. Identify the source Report and date and preserve material observation timing qualifications:

"Source: Datazag Infrastructure Intelligence (via [Partner Name])"

You must not alter any numerical risk score, domain health rating, or empirical infrastructure finding and represent the resulting value as an authentic, unmodified Datazag metric.

4. Partner Brand Assets and Restrictions

1. Partner Brand logos uploaded to the Portal must be high-resolution PNG, JPEG or WebP files, at least 200 pixels wide, preferably on a transparent background. SVG files are not accepted.

2. Uploaded Partner Brand assets must not contain:

◦ any marks, logos, or insignia that infringe or misappropriate third-party intellectual property or registered trademarks;

◦ official government seals, badges, or regulatory emblems that falsely imply official state, military, or statutory authorization; or

◦ misleading designations implying formal certification, ISO auditing accreditation, or warranty cover where none exists.

5. Alert attribution

Machine-readable alerts and messages do not require cover pages, page footers, logos or font sizes. Where the destination supports it, preserve a source field identifying Datazag, the relevant Client or domain, event or observation time where available, and a Report or event reference. If a destination cannot display those fields, retain them in the associated event record or accessible source mapping. Presentation to a Client must preserve clear provenance. Do not remove source metadata to misrepresent origin. Bespoke summaries follow paragraph 3.

End of Agreement — Version 1.6