SuppliAssure (Supply) Terms & Conditions

SuppliAssure

Software as a Service End User Licence Agreement

Version 1.0

Effective date: 16 July 2026

SmartAIConnect Pty Ltd ABN 92 655 590 775 Wotso Suite 18, Shop 6001, Level 2/19 Robina Town Centre Dr, Robina, QLD 4226, Australia suppliassure@smartaiconnect.com

1 AGREEMENT AND ACCEPTANCE

(a) This Agreement governs access to and use of the SuppliAssure software-as-a-service platform, associated interfaces, dashboards, reports, documentation, support and related services made available by SmartAIConnect Pty Ltd (SmartAIConnect).

(b) This Agreement applies to each organisation and individual that registers for, accesses or uses the Platform, including Customers, Suppliers, authorised Users, trial users and Free Supplier Account users.

(c) A person accepting this Agreement on behalf of an organisation warrants that they have authority to bind that organisation. If the person does not have that authority, they must not accept or use the Platform on the organisation’s behalf.

(d) Any Order Form, subscription schedule or written special conditions accepted by SmartAIConnect form part of this Agreement. Special conditions prevail to the extent of any inconsistency.

2 THE PLATFORM

2.1 Nature of the service

(a) SuppliAssure is a hosted SaaS platform that assists Customers and Suppliers to collect, manage, assess and share supplier assurance information, manual evidence and automated signals.

(b) The Platform does not include gateways, security camera devices, AI models, an AI model store, reseller services or hardware unless expressly stated in an Order Form.

(c) SmartAIConnect may update, enhance, modify, replace or discontinue features of the Platform from time to time, provided that paid Customers are not deprived of the material core functionality purchased for the then-current subscription period.

2.2 No certification or professional advice

(a) The Platform is an information management and assurance support tool only. It does not provide legal, accounting, audit, certification, cyber security, procurement or other professional advice.

(b) Use of the Platform does not certify, warrant or guarantee that any Customer, Supplier, system, product, service, control, evidence item or signal complies with any law, standard, framework or contractual requirement.

(c) Each organisation remains responsible for its own due diligence, decisions, risk acceptance, supplier engagement, procurement, compliance and professional advice.

3 ACCOUNT TYPES AND ELIGIBILITY

3.1 Customer Accounts

(a) A Customer Account may be provided under a paid subscription, pilot, trial or other commercial arrangement agreed with SmartAIConnect.

(b) The Customer may invite authorised Users and Suppliers subject to account limits, permissions and the applicable Order Form.

3.2 Free Supplier Accounts

(a) SmartAIConnect may make Supplier Accounts available without charge. A Free Supplier Account is provided at SmartAIConnect’s discretion and does not create any entitlement to continued free access, minimum functionality, support, storage, availability or future features.

(b) SmartAIConnect may introduce fees, limits or paid tiers for Supplier Accounts, or modify, suspend or discontinue a Free Supplier Account or feature, on reasonable notice where practicable.

(c) A Supplier may decline to use the Platform. Any obligation for a Supplier to participate is a matter between the Supplier and the relevant Customer and is not imposed by SmartAIConnect.

3.3 User eligibility and authority

(a) Users must provide accurate registration information, keep it current and use the Platform only for legitimate business purposes.

(b) Each organisation is responsible for its Users, permissions, account administration and all activity conducted through its account, except to the extent caused by SmartAIConnect’s breach of this Agreement.

4 LICENCE AND PERMITTED USE

(a) Subject to this Agreement and any applicable Order Form, SmartAIConnect grants the organisation a limited, non-exclusive, non-transferable, non-sublicensable and revocable right during the Term to permit its authorised Users to access and use the Platform for the organisation’s internal business purposes.

(b) No software is sold. All rights not expressly granted are reserved by SmartAIConnect and its licensors.

(c) The organisation must ensure that access credentials are not shared, sold, transferred or used by unauthorised persons and must promptly notify SmartAIConnect of suspected unauthorised access.

5 ACCEPTABLE USE AND PROHIBITED CONDUCT

(a) The organisation and its Users must not, directly or indirectly, and must not permit or assist any other person to:

(1) copy, reproduce, republish, transmit, distribute, disclose, sell, license, sublicense, rent, lease, loan, provide service-bureau access to, commercially exploit or make available any part of the Platform or Documentation except as expressly permitted;

(2) download, capture, export or retain Platform content other than through authorised Platform functions and only for the organisation’s legitimate internal use;

(3) adapt, modify, translate, create derivative works from, imitate, replicate or recreate any part of the Platform;

(4) reverse engineer, decompile, disassemble, decode, decrypt, inspect, probe, analyse or otherwise attempt to discover or derive source code, object code, architecture, algorithms, logic, data models, database structures, schemas, APIs, security mechanisms or non-public functionality;

(5) scrape, crawl, spider, harvest, index, mine, monitor, extract or collect data or content from the Platform by automated or systematic means, including by bots, scripts, browser automation, robotic process automation, AI agents or similar tools;

(6) circumvent, disable, defeat, bypass or interfere with any access control, usage limit, technical protection, authentication, security, watermarking, logging or monitoring mechanism;

(7) access or use the Platform to develop, train, test, validate, improve, procure, market, support or provide a product or service that competes with or substitutes for SuppliAssure;

(8) use any Platform content, output, screenshot, recording, workflow, report, methodology or Documentation to train, fine-tune, ground, evaluate or operate an artificial intelligence or machine learning system without SmartAIConnect’s prior written consent;

(9) benchmark the Platform or publish any performance, security or comparative analysis without SmartAIConnect’s prior written consent;

(10) publicly display, publish or distribute screenshots, screen recordings, demonstrations, videos or other depictions of non-public areas of the Platform, except with SmartAIConnect’s prior written consent;

(11) remove, obscure or alter any copyright, trade mark, confidentiality, proprietary rights or attribution notice;

(12) upload malware, malicious code, unlawful material, infringing content or content intended to disrupt, damage or gain unauthorised access to any system or data;

(13) impersonate another person, misrepresent authority, create false accounts, submit knowingly false evidence or signals, or use the Platform for fraudulent, deceptive or unlawful purposes;

(14) attempt to gain unauthorised access to another account, tenant, document, signal, environment or system; or

(15) perform penetration testing, vulnerability scanning or security testing without SmartAIConnect’s prior written approval and agreed rules of engagement.

(b) SmartAIConnect may monitor use of the Platform for security, support, compliance, capacity planning, fraud prevention and protection of its rights, subject to applicable law and its Privacy Policy.

6 INTELLECTUAL PROPERTY

6.1 SmartAIConnect ownership

(a) SmartAIConnect and its licensors own all rights, title and interest, including all Intellectual Property Rights, in and to the Platform, Software, Documentation, SmartAIConnect Content and all improvements, updates, configurations and derivative works.

(b) SmartAIConnect’s protected materials include, without limitation:

• user interfaces, screen designs, layouts, navigation structures, dashboards, visualisations and reports;

• workflows, business logic, supplier assurance processes and customer assurance processes;

• control libraries, control mappings, taxonomies, evidence types, evidence structures, signal definitions and signal structures;

• verification tiers, evidence coverage measures, assurance scoring, risk scoring, trust scoring and the Assurance Signal Quality Index;

• algorithms, formulae, calculations, rules, data models, database schemas, APIs, metadata structures and system architecture;

• templates, guidance, documentation, training materials, implementation methods and know-how;

• product names, brands, logos, trade marks, trade secrets and Confidential Information; and

• any analytics, aggregated statistics, telemetry and de-identified insights generated from operation of the Platform, excluding Customer Data in identifiable form.

6.2 SuppliAssure Methodologies

(a) The concepts, methods and structures described in clause 6.1(b), including the Control Signal Library, Evidence Types, Automated Signals, Verification Tiers, Evidence Coverage, assurance workflows and Assurance Signal Quality Index, are collectively the SuppliAssure Methodologies.

(b) The organisation acknowledges that the SuppliAssure Methodologies embody substantial investment, skill and confidential know-how and may constitute valuable trade secrets of SmartAIConnect.

(c) No right is granted to use a SuppliAssure Methodology outside the Platform, to reproduce it in another system or process, or to disclose it to a third party, except with SmartAIConnect’s prior written consent.

6.3 Feedback and improvements

(a) If an organisation or User provides feedback, suggestions, ideas, enhancement requests or other input relating to the Platform, SmartAIConnect may use, commercialise and incorporate that input without restriction, attribution or payment, provided SmartAIConnect does not identify the contributor without consent.

(b) Any feature, configuration, integration, report, workflow or other material developed by or for SmartAIConnect in connection with the Platform is owned exclusively by SmartAIConnect unless an executed written agreement expressly states otherwise.

6.4 Injunctive relief

(a) The organisation acknowledges that unauthorised copying, disclosure, reverse engineering or misuse of the Platform may cause harm that is not adequately compensable by damages. SmartAIConnect may seek urgent injunctive or equitable relief in addition to any other remedy.

7 CUSTOMER DATA AND SUPPLIER DATA

7.1 Ownership

(a) As between SmartAIConnect and the uploading organisation, that organisation retains ownership of documents, files, certifications, policies, responses, comments, evidence, signals and other content it uploads or submits to the Platform (Organisation Data).

(b) No ownership of Organisation Data transfers to SmartAIConnect merely because it is hosted, processed, analysed, displayed or shared through the Platform.

7.2 Licence to operate the Platform

(a) The organisation grants SmartAIConnect and its service providers a non-exclusive, worldwide, royalty-free licence during the Term and any permitted retention period to host, copy, transmit, process, transform, display, back up and otherwise use Organisation Data as reasonably necessary to provide, secure, support, improve and administer the Platform and comply with law.

(b) SmartAIConnect may generate and use aggregated and de-identified data that does not reasonably identify an organisation or individual for analytics, security, benchmarking, research, product improvement and commercial purposes.

7.3 Organisation responsibilities

(a) The organisation warrants that it has all rights, permissions, notices and consents required to upload, process and share Organisation Data through the Platform.

(b) The organisation is responsible for the legality, accuracy, quality, integrity, completeness, currency and appropriateness of its Organisation Data and must not upload information it is not authorised to disclose.

(c) The organisation must maintain its own original or backup copies of material that is critical to its business, regulatory or legal obligations.

8 SHARING BETWEEN SUPPLIERS AND CUSTOMERS

(a) The Platform enables a Supplier to authorise one or more Customers to access selected Supplier Data. The Supplier controls the authorisation it grants, subject to Platform functionality and any separate contractual obligations between the Supplier and Customer.

(b) A Supplier must review the scope of access before authorising sharing and is responsible for ensuring the intended recipient, documents, evidence, signals and permissions are correct.

(c) A Customer may access and use Supplier Data only for legitimate supplier assurance, risk, governance, compliance, procurement and contract management purposes and subject to any confidentiality or other obligations owed to the Supplier.

(d) SmartAIConnect is a neutral platform provider. It is not a party to the commercial, procurement, service, supply or assurance relationship between a Customer and Supplier and does not control how a recipient uses information after lawful access, download or export.

(e) SmartAIConnect is not responsible for disclosure or use that occurs because a Supplier or its User authorises access, selects an incorrect recipient or permission, forwards or exports information, shares credentials, or otherwise acts outside SmartAIConnect’s reasonable control.

(f) Revoking Platform access does not retrieve or delete copies previously downloaded, exported, printed or otherwise retained by an authorised recipient. The parties must manage any continuing confidentiality, retention or deletion obligations directly between themselves.

9 MANUAL EVIDENCE AND AUTOMATED SIGNALS

9.1 Manual evidence

(a) Manual evidence is provided by Customers, Suppliers or their Users. SmartAIConnect does not independently authenticate, audit, certify or verify manual evidence unless expressly agreed in writing as a separate service.

9.2 Automated signals

(a) Automated signals may be received from a Supplier, Customer or third-party system, connector, API, integration or data source. Signals may be delayed, incomplete, unavailable, incorrectly configured, inaccurate or affected by third-party changes.

(b) A signal, score, indicator, alert, status or report is informational only and does not guarantee the existence, design, operation or effectiveness of any control or the absence of a vulnerability, incident or breach.

9.3 Independent validation

(a) Each Customer is responsible for determining what evidence, verification, professional review and due diligence is appropriate before relying on information in the Platform or making a decision concerning a Supplier.

10 HOSTING, AVAILABILITY AND DATA LOSS

(a) SmartAIConnect may host the Platform and Organisation Data using third-party cloud and technology providers selected by SmartAIConnect. Data may be processed in locations disclosed in SmartAIConnect’s Privacy Policy or applicable contractual documents.

(b) SmartAIConnect will use commercially reasonable measures to operate and secure the Platform, but does not warrant that it will be uninterrupted, error-free, continuously available, immune from cyber incidents or compatible with every system or browser.

(c) To the maximum extent permitted by law, SmartAIConnect is not responsible for the loss, corruption, alteration, destruction, delay, failed transmission, unauthorised disclosure or unavailability of Organisation Data arising from events outside SmartAIConnect’s reasonable control, including third-party hosting failures, internet failures, cyber attacks, malware, ransomware, user error, incorrect permissions or failures of external integrations.

(d) Backups and disaster recovery processes reduce risk but do not guarantee that a complete, current or error-free copy of Organisation Data can always be restored. Each organisation must retain its own copies of critical source documents and records.

(e) Nothing in this clause excludes liability that cannot lawfully be excluded.

11 SECURITY AND ACCOUNT MANAGEMENT

(a) SmartAIConnect will maintain security measures that it considers commercially reasonable and appropriate to the nature of the Platform and information processed.

(b) Each organisation must implement reasonable security controls for its Users and systems, including strong authentication, least-privilege access, timely user removal, secure devices and protection of credentials.

(c) The organisation must promptly notify SmartAIConnect of suspected unauthorised access, credential compromise, security weakness, improper sharing or misuse affecting the Platform.

(d) SmartAIConnect may suspend access where reasonably necessary to investigate or contain a security risk, protect the Platform or other users, comply with law or prevent prohibited conduct.

12 CONFIDENTIALITY

(a) Each party must protect the other party’s Confidential Information using at least reasonable care and may use it only for the purposes of this Agreement.

(b) A recipient may disclose Confidential Information to its personnel, professional advisers and service providers who need to know it and are bound by confidentiality obligations, or where required by law.

(c) Confidential Information does not include information that the recipient can establish was lawfully known without restriction, independently developed, received lawfully from a third party, or became public other than through breach.

(d) The Platform’s non-public functionality, SuppliAssure Methodologies, pricing, security information, product roadmaps and technical information are SmartAIConnect Confidential Information.

13 PRIVACY

(a) Each party must comply with applicable privacy and data protection laws in relation to personal information it handles under this Agreement.

(b) SmartAIConnect will handle personal information in accordance with its Privacy Policy, as updated from time to time.

(c) Each organisation is responsible for providing any required notices and obtaining any required consents before submitting personal information to the Platform or authorising it to be shared.

(d) Where required for a particular Customer, the parties may enter into a separate data processing agreement or privacy schedule.

14 THIRD-PARTY SERVICES AND INTEGRATIONS

(a) The Platform may interoperate with third-party systems, data sources, connectors or services. SmartAIConnect does not control and is not responsible for third-party services, their availability, security, accuracy, terms or changes.

(b) The organisation authorises SmartAIConnect to exchange Organisation Data with a third-party service where the organisation enables or requests the integration.

(c) Use of a third-party service may be subject to separate terms between the organisation and the third-party provider.

15 FEES, TRIALS AND TAXES

(a) A Customer must pay the fees and taxes stated in the applicable Order Form or invoice. Unless otherwise stated, fees are in Australian dollars, exclusive of GST and non-refundable except as required by law.

(b) Trials, pilots and free features may be limited, changed or withdrawn at any time. Data or configurations created during a trial may be deleted after the trial unless converted to a paid subscription or otherwise agreed.

(c) Supplier Accounts are free only while SmartAIConnect elects to provide them without charge under clause 3.2.

16 WARRANTIES AND DISCLAIMERS

16.1 Limited performance commitment

(a) SmartAIConnect warrants that, during a paid subscription, the Platform will perform materially in accordance with its then-current Documentation when properly used. SmartAIConnect’s obligation for a verified breach is to use reasonable efforts to correct the material non-conformity.

16.2 Disclaimers

(a) Except for express warranties in this Agreement and guarantees that cannot be excluded, the Platform is provided “as is” and “as available”. All other representations, conditions and warranties are excluded to the maximum extent permitted by law.

(b) SmartAIConnect does not warrant or represent that any Organisation Data, evidence, signal, certification, score, report or statement is authentic, complete, accurate, current, lawful, fit for purpose or sufficient for any decision.

(c) SmartAIConnect does not warrant that use of the Platform will prevent a cyber incident, identify every risk, detect fraud, ensure compliance or result in a particular procurement, commercial, audit or regulatory outcome.

17 LIMITATION OF LIABILITY

(a) To the maximum extent permitted by law, neither party is liable to the other for any indirect, special, exemplary, punitive or consequential loss, or for loss of profits, revenue, business, opportunity, anticipated savings, goodwill, reputation or data, arising out of or in connection with this Agreement, whether in contract, tort, equity, statute or otherwise.

(b) To the maximum extent permitted by law, SmartAIConnect is not liable for loss arising from:

• any decision, assessment, approval, rejection, procurement, contract award, supplier engagement or risk acceptance made using the Platform;

• false, fraudulent, forged, misleading, incomplete, inaccurate, expired or outdated Organisation Data, evidence, certification or signal;

• a Supplier’s or Customer’s act or omission, or any dispute between them;

• information shared, downloaded, exported, disclosed or used with the authorisation or credentials of an organisation or User;

• a cyber incident, control failure, compliance failure or business interruption affecting a Customer, Supplier or third party;

• a third-party service, integration, hosting provider, internet service or external data source; or

• loss or inability to restore data where the organisation failed to maintain its own copy of critical information.

(c) Subject to clause 17(d), SmartAIConnect’s aggregate liability arising out of or in connection with this Agreement is limited to:

(1) for a paid Customer, the fees paid or payable by that Customer to SmartAIConnect for the Platform during the 12 months immediately preceding the event giving rise to liability or as specified in contract; and

(2) for a Free Supplier Account, AUD $100.

(d) The limitations in this clause do not apply to liability that cannot be limited or excluded by law. Nothing in this Agreement excludes, restricts or modifies any consumer guarantee, right or remedy that cannot lawfully be excluded, restricted or modified.

18 INDEMNITY

(a) The organisation indemnifies SmartAIConnect and its officers, employees and contractors against third-party claims, losses, damages, penalties, liabilities and reasonable costs arising from:

• Organisation Data uploaded, submitted or shared by or on behalf of the organisation, including alleged infringement, breach of confidence, privacy breach, defamation or unlawful disclosure;

• unauthorised, unlawful, fraudulent or prohibited use of the Platform by the organisation or its Users;

• a breach of clauses 5, 6, 7, 8, 11, 12 or 13; or

• any representation, commitment or decision made by the organisation to another Customer, Supplier or third party based on the Platform.

(b) The indemnity is reduced to the extent the claim was caused by SmartAIConnect’s breach of this Agreement, negligence or wilful misconduct.

19 SUSPENSION, TERM AND TERMINATION

19.1 Term

(a) This Agreement commences when it is accepted and continues until terminated. A paid subscription continues for the term stated in the applicable Order Form and renews only as stated there.

19.2 Suspension

(a) SmartAIConnect may suspend access immediately where it reasonably believes there is a security risk, unlawful conduct, non-payment, material breach, infringement of SmartAIConnect’s rights or risk to the Platform or another user.

19.3 Termination

(a) Either party may terminate for material breach if the breach is not remedied within 14 days after written notice, or immediately if the breach is incapable of remedy, involves deliberate IP misuse, fraud, insolvency or serious security risk.

(b) SmartAIConnect may terminate a Free Supplier Account on reasonable notice or immediately for breach or risk. A Customer may terminate as stated in its Order Form.

19.4 Effect of termination

(a) On termination, the right to access the Platform ends. Each organisation must cease using SmartAIConnect IP and return or destroy SmartAIConnect Confidential Information on request, except where retention is required by law.

(b) SmartAIConnect may provide a reasonable opportunity for a paid Customer to export available Organisation Data before deletion, subject to payment of outstanding fees, technical feasibility, security and applicable retention requirements.

(c) SmartAIConnect may delete Organisation Data after termination in accordance with its retention practices and legal obligations. Organisations must arrange export and maintain their own copies before access ends.

(d) Clauses concerning ownership, IP restrictions, confidentiality, data rights, disclaimers, liability, indemnity, dispute resolution and any provision intended by its nature to survive will continue after termination.

20 AUDIT AND ENFORCEMENT OF USE RESTRICTIONS

(a) SmartAIConnect may use technical controls, logs and usage information to verify compliance with account limits and clauses 4, 5 and 6.

(b) Where SmartAIConnect reasonably suspects material misuse, the organisation must promptly provide information reasonably necessary to investigate the suspected breach, subject to appropriate confidentiality and security safeguards.

(c) SmartAIConnect may suspend the relevant access while investigating and may recover reasonable investigation and enforcement costs where a material deliberate breach is established.

21 DISPUTE RESOLUTION

(a) Before commencing court proceedings, a party must give written notice describing the dispute and the parties must use good-faith efforts to resolve it for at least 14 business days.

(b) If unresolved, either party may refer the dispute to mediation administered by the Australian Disputes Centre or another mediator agreed by the parties.

(c) This clause does not prevent either party seeking urgent interlocutory or injunctive relief, including to protect Intellectual Property Rights, Confidential Information, security or data.

22 NOTICES

(a) Notices under this Agreement must be in writing and may be sent by email to the address associated with the account or stated in an Order Form, and to SmartAIConnect at info@smartaiconnect.com or another notified address.

(b) An email is taken to be received 24 hours after sending unless the sender receives a delivery failure notice, or earlier when acknowledged.

23 GENERAL

23.1 Governing law

(a) This Agreement is governed by the laws of Queensland, Australia. The parties submit to the courts of Queensland and courts entitled to hear appeals from them.

23.2 Assignment

(a) The organisation must not assign, transfer, sublicense or novate this Agreement without SmartAIConnect’s prior written consent. SmartAIConnect may assign or novate this Agreement as part of a corporate restructure, financing, merger, acquisition or sale of all or substantially all of the relevant business or assets.

23.3 Subcontracting

(a) SmartAIConnect may use subcontractors and service providers to perform its obligations and remains responsible for their performance to the extent required by law and this Agreement.

23.4 Force majeure

(a) Neither party is liable for delay or failure caused by events beyond its reasonable control, excluding payment obligations, provided it takes reasonable steps to mitigate the effect.

23.5 Changes to this Agreement

(a) SmartAIConnect may update this Agreement by giving notice through the Platform, by email or by publishing an updated version. Material adverse changes will apply from the next renewal for paid Customers where reasonably practicable. Continued use after the effective date constitutes acceptance.

23.6 Severability and waiver

(a) If a provision is invalid or unenforceable, it is severed or read down to the minimum extent necessary. A failure or delay to exercise a right is not a waiver.

23.7 Entire agreement

(a) This Agreement, applicable Order Forms, special conditions and incorporated policies constitute the entire agreement regarding the Platform and supersede prior representations and understandings on that subject.

23.8 Electronic acceptance

(a) This Agreement may be accepted electronically, including by clicking an acceptance button, creating an account, signing an Order Form or using the Platform after being presented with these terms.

24 DEFINITIONS