MASTER SERVICES AGREEMENT

Slingshot by ProntoBPO — Call Center Services

Last Updated: September 11, 2026

Between Slingshot by ProntoBPO and Company (Client)

This Master Services Agreement (“Agreement”) sets forth the terms and conditions governing customer support, sales, call center, business process outsourcing, technology, and related services (the “Services”) provided by ProntoBPO USA Inc., operating under the trade name “Slingshot by ProntoBPO” (“Slingshot by ProntoBPO”).

Additional terms specific to an applicable Service may be established in a Purchase Order, Statement of Work, or other mutually executed service document. As used herein, the “Agreement” means this Master Services Agreement together with applicable Purchase Orders, Statements of Work, exhibits, schedules, and mutually executed addenda.

By executing a Purchase Order that incorporates this Agreement, Company (Client) agrees to be bound by the Agreement. If Company (Client) enters into this Agreement on behalf of another legal entity, the individual executing the Agreement represents that he or she has authority to bind that entity.

Slingshot by ProntoBPO and Company (Client) may each be referred to as a “Party” and together as the “Parties.”

1. Services, Generally

a. Purchase Orders

Subject to this Agreement, Company (Client) retains Slingshot by ProntoBPO to perform Services pursuant to one or more purchase orders (“Purchase Order” or “PO”).

Each Purchase Order shall identify the applicable Services, Fees, Term, and any service-specific requirements, including applicable Service Levels.

Company (Client) may request changes to the Services by written notice. No requested change shall be binding unless Slingshot by ProntoBPO confirms the change in writing, including any resulting adjustment to Fees, staffing, implementation requirements, Service Levels, or other applicable terms.

b. Dashboard Access

Slingshot by ProntoBPO may provide Company (Client) with access to Slingshot by ProntoBPO’s web-based customer software portal (“Dashboard”).

Slingshot by ProntoBPO grants Company (Client) a non-exclusive, non-transferable, non-sublicensable license to use the Dashboard solely for Company (Client)’s internal business purposes during the applicable Term.

Slingshot by ProntoBPO retains all right, title, and interest in the Dashboard and all related technology, software, improvements, and intellectual property (“Slingshot by ProntoBPO IP”).

c. Implementation and Support

Commencing on the Effective Date, Slingshot by ProntoBPO will provide up to three (3) one-hour implementation or support calls at no additional charge.

Additional support may be billed at Slingshot by ProntoBPO’s then-current support rate, unless otherwise stated in the applicable Purchase Order.

d. Order of Precedence

In the event of a conflict between documents comprising the Agreement, the following order of precedence applies:

1. mutually executed amendments;
2. the applicable Data Security Exhibit or Data Processing Addendum, solely regarding privacy, security, and handling of Customer Data;
3. the applicable Purchase Order or Statement of Work, solely regarding commercial terms and Services expressly addressed therein; and
4. this Agreement.

A Purchase Order shall not modify legal, confidentiality, intellectual property, indemnification, or limitation-of-liability provisions unless it expressly identifies the provision being modified and is signed by authorized representatives of both Parties.

2. Call Center Services

a. Inbound and Outbound Calls

Slingshot by ProntoBPO may receive inbound telephone calls on behalf of Company (Client) from Company (Client)’s customers and prospective customers.

If specified in a Purchase Order, Slingshot by ProntoBPO may place outbound calls on behalf of Company (Client).

The applicable Purchase Order shall establish the scope and requirements of each calling program.

b. Call Volume Forecasting

Where forecasting requirements apply, Company (Client) shall provide reasonable advance forecasts as specified in the applicable Purchase Order.

Forecasts are intended to assist staffing and capacity planning and are not guarantees of call volume.

No forecast-related surcharge shall apply unless expressly stated in the applicable Purchase Order.

c. Company (Client) Products and Materials

Company (Client) shall provide accurate and complete information regarding its products, services, pricing, policies, warranties, and other materials necessary for Slingshot by ProntoBPO to perform the Services.

Company (Client) is responsible for the legality and accuracy of Company (Client) Products, Company (Client) Materials, scripts, pricing, offers, claims, and instructions supplied by Company (Client).

Slingshot by ProntoBPO may assist with script development, training, calling strategy, and program execution based on Company (Client) Materials.

d. Script Changes

Company (Client) may request reasonable script changes. Unless otherwise specified in the Purchase Order, basic wording changes may be included in the Services while material revisions, new campaigns, new workflows, or substantial changes may be subject to additional Fees.

e. Outbound Calling Compliance

Company (Client) is responsible for ensuring that calling lists, customer information, consent records, and campaign instructions supplied to Slingshot by ProntoBPO are accurate and lawful.

Company (Client) shall obtain and maintain all consents, permissions, established business relationships, and other authorizations required for the applicable calls, texts, artificial or prerecorded voice communications, or autodialing activities.

Upon reasonable request, Company (Client) shall provide documentation supporting the legal basis for the applicable communications.

Slingshot by ProntoBPO shall maintain reasonable procedures for recording and honoring Company (Client)-specific do-not-call requests received during the Services.

Slingshot by ProntoBPO may suspend or refuse a campaign, call type, or instruction where it reasonably believes the requested activity presents material legal, regulatory, security, or reputational risk.

Company (Client) shall defend, indemnify, and hold harmless Slingshot by ProntoBPO from third-party claims and governmental actions arising from Company (Client)’s failure to obtain required consent or authorization, unlawful calling lists, inaccurate campaign instructions, or Company (Client)’s violation of applicable communications or consumer-protection laws, except to the extent caused by Slingshot by ProntoBPO’s gross negligence, willful misconduct, or material failure to follow Company (Client)’s documented instructions or applicable law.

Slingshot by ProntoBPO shall not use autodialing technology, artificial or prerecorded voice, or outbound text messaging on Company (Client)’s behalf unless expressly authorized in writing and performed in accordance with applicable law.

The Parties shall cooperate regarding call-recording disclosures and consent requirements.

3. Customer Data

a. Customer Data

All Customer Data remains the property of Company (Client).

Company (Client) grants Slingshot by ProntoBPO a limited, non-exclusive right to access, process, transmit, store, and use Customer Data solely as reasonably necessary to provide, secure, support, monitor, and improve the Services during the Term and as otherwise permitted by this Agreement or applicable law.

Slingshot by ProntoBPO shall not sell Customer Data or use Customer Data for unrelated advertising or marketing purposes.

Slingshot by ProntoBPO may use aggregated and de-identified information derived from the Services for legitimate business purposes, including analytics, quality assurance, operational improvement, benchmarking, and service development, provided such information does not identify Company (Client) or an individual.

b. Qualified Sales Leads

A Lead that purchases Company (Client)’s Products as a result of Slingshot by ProntoBPO’s Services is a “Qualified Sales Lead.”

Slingshot by ProntoBPO shall not use, solicit, or develop a Qualified Sales Lead for purposes unrelated to providing Services for Company (Client) and shall not sell or refer such Qualified Sales Lead to a third party without Company (Client)’s written authorization.

A Lead that does not purchase Company (Client)’s Products is an “Unqualified Lead.”

Slingshot by ProntoBPO shall not sell, transfer, or disclose Company (Client)’s Customer Data or consumer information to third parties except as authorized by Company (Client), permitted under this Agreement, or reasonably necessary to perform the Services.

c. Artificial Intelligence

Where AI-enabled tools, artificial intelligence systems, automated agents, transcription systems, quality-assurance tools, or similar technologies are used in connection with the Services (“AI Services”), Slingshot by ProntoBPO may use Customer Data as reasonably necessary to provide those Services.

Slingshot by ProntoBPO shall not use Customer Data to train a general-purpose AI model made available to unrelated third parties without Company (Client)’s prior written authorization.

AI Services may be provided using third-party technology providers subject to appropriate confidentiality and data-use restrictions.

Unless expressly stated otherwise in a Purchase Order, AI-generated outputs are not guaranteed to be error-free, complete, or appropriate for every circumstance.

Company (Client) remains responsible for business decisions, product representations, pricing, policies, and instructions supplied to Slingshot by ProntoBPO.

4. Fees; Payment Terms; Taxes

a. Fees

Fees shall be set forth in the applicable Purchase Order.

Unless otherwise stated in the Purchase Order, invoices are due and payable within thirty (30) days after invoice date.

b. Payment Authorization

Where Company (Client) provides a payment method for recurring charges, Company (Client) authorizes Slingshot by ProntoBPO or its payment processor to charge amounts properly due under the Agreement.

Company (Client) may revoke payment authorization by written notice, provided Company (Client) supplies an alternative payment method acceptable to Slingshot by ProntoBPO.

c. Payment Delinquency

If an amount remains unpaid more than thirty (30) days after its due date, Slingshot by ProntoBPO may charge interest at 1.5% per month or the maximum rate permitted by law, whichever is lower.

Slingshot by ProntoBPO may suspend Services for materially delinquent accounts following reasonable notice.

d. Invoice Disputes

Company (Client) shall notify Slingshot by ProntoBPO in writing of any good-faith invoice dispute within thirty (30) days after receipt of the applicable invoice and shall identify the disputed amount and basis for the dispute.

Undisputed amounts remain payable when due.

e. Collection Costs

Company (Client) shall reimburse Slingshot by ProntoBPO for reasonable costs of collection, including reasonable attorneys’ fees, resulting from Company (Client)’s failure to pay amounts properly due, except to the extent caused by Slingshot by ProntoBPO’s invoicing error.

f. Taxes

Fees do not include applicable sales, use, value-added, withholding, or similar transaction taxes.

Company (Client) is responsible for taxes imposed on its purchases, excluding taxes based on Slingshot by ProntoBPO’s income, property, or employees.

5. Confidentiality

Each Party may receive confidential business, technical, financial, customer, operational, or proprietary information from the other Party (“Proprietary Information”).

The Receiving Party shall:

1. use reasonable precautions to protect Proprietary Information;
2. use Proprietary Information only as necessary to perform or receive the Services; and
3. not disclose Proprietary Information to third parties except as authorized by the Disclosing Party or permitted by the Agreement.

These obligations do not apply to information that the Receiving Party can demonstrate:

• is publicly available through no breach of the Agreement;
• was lawfully known before disclosure;
• was lawfully received from a third party without restriction;
• was independently developed without use of Proprietary Information; or
• is required to be disclosed by law.

If legally permitted, the Receiving Party shall provide reasonable advance notice of compelled disclosure and cooperate with reasonable efforts to obtain confidential treatment.

Upon termination or written request, each Party shall return or destroy Proprietary Information, subject to applicable law and reasonable backup-retention practices.

6. Term and Termination

a. Term

Unless otherwise stated in a Purchase Order, the Agreement begins on the Effective Date and continues for twelve (12) months.

It automatically renews for successive twelve-month terms unless either Party provides at least forty-five (45) days’ written notice of non-renewal.

b. Material Breach

Either Party may terminate the Agreement or applicable Purchase Order for material breach if the breach remains uncured for thirty (30) days after written notice.

If the breach reasonably requires more than thirty days to cure, the breaching Party shall have a reasonable additional period provided it promptly begins and diligently pursues the cure.

c. Insolvency

Either Party may terminate immediately upon written notice if the other Party becomes insolvent, enters bankruptcy proceedings, makes an assignment for the benefit of creditors, or substantially ceases business operations.

d. Convenience Termination

Either Party may terminate the Agreement or an applicable Purchase Order for convenience upon sixty (60) days’ written notice unless the applicable Purchase Order establishes a minimum committed term or early termination fee.

e. Effect of Termination

Upon termination:

1. Slingshot by ProntoBPO shall cease providing Services after the effective termination date;
2. Company (Client) shall cease using the Dashboard;
3. Company (Client) shall pay all Fees accrued through the effective termination date;
4. Company (Client) shall pay approved non-cancelable third-party costs or commitments; and
5. Customer Data shall be returned or deleted in accordance with Exhibit A.

Termination does not affect rights or obligations accrued before termination or provisions intended to survive termination.

7. Warranty and Disclaimer

Slingshot by ProntoBPO shall perform the Services in a professional and workmanlike manner consistent with commercially reasonable industry practices.

Except as expressly provided in this Agreement, the Services and Dashboard are provided “as is.”

To the maximum extent permitted by law, Slingshot disclaims implied warranties including merchantability, fitness for a particular purpose, and noninfringement.

Slingshot by ProntoBPO does not guarantee uninterrupted or error-free Services or that the Services will meet every Company (Client) requirement or expectation.

Slingshot by ProntoBPO is not responsible for failures resulting from Company (Client)’s systems, applications, instructions, third-party applications, telecommunications providers, internet services, or other matters outside Slingshot by ProntoBPO’s reasonable control.

Where Service Levels are expressly established in a Purchase Order, the remedies stated in that Purchase Order shall be Company (Client)’s exclusive remedies for failure to achieve those Service Levels.

8. Representations and Customer Obligations

a. Mutual Representations

Each Party represents and warrants to the other that:

1. it is duly organized and validly existing;
2. it has authority to enter into the Agreement;
3. execution and performance do not violate applicable law or binding agreements; and
4. the individual executing the Agreement has authority to bind the applicable Party.

b. Company (Client) Compliance

Company (Client) shall comply with applicable laws and maintain all licenses, permits, consents, and authorizations required for its business and Products.

Company (Client) represents that it has the right to market and sell its Products and provide Company (Client) Materials to Slingshot by ProntoBPO.

c. Company (Client) Cooperation

Company (Client) shall timely provide systems access, information, personnel, approvals, Company (Client) Materials, credentials, calling lists, training materials, and other resources reasonably necessary for Slingshot by ProntoBPO to perform the Services.

Slingshot by ProntoBPO shall not be responsible for delays, Service Level failures, increased costs, or other performance impacts caused by Company (Client)’s failure to satisfy its obligations or dependencies.

9. Indemnification

a. By Company (Client)

Company (Client) shall defend, indemnify, and hold harmless Slingshot by ProntoBPO and its officers, directors, employees, affiliates, contractors, and subcontractors from third-party claims arising from:

1. Company (Client)’s Products or Company (Client) Materials;
2. Company (Client)’s infringement of third-party intellectual property rights through materials supplied by Company (Client);
3. Company (Client)’s violation of applicable law;
4. Company (Client)’s failure to obtain required consent or authorization for Customer Data or outbound communications; or
5. Company (Client)’s gross negligence or willful misconduct;

except to the extent caused by Slingshot by ProntoBPO’s gross negligence, willful misconduct, or material breach.

b. By Slingshot by ProntoBPO

Slingshot by ProntoBPO shall defend, indemnify, and hold harmless Company (Client) and its officers, directors, employees, and affiliates from third-party claims arising from:

1. Slingshot by ProntoBPO’s infringement of third-party intellectual property rights through the Services, excluding Company (Client) Materials and third-party materials supplied by Company (Client);
2. a Security Incident caused by Slingshot by ProntoBPO’s material breach of its security obligations under Exhibit A; or
3. Slingshot by ProntoBPO’s gross negligence or willful misconduct.

c. Indemnification Procedures

The indemnified Party shall provide prompt written notice of an indemnifiable claim.

Failure to provide prompt notice shall not relieve the indemnifying Party except to the extent the delay materially prejudices its ability to defend the claim.

The indemnifying Party may control the defense with qualified counsel.

No settlement may impose liability, admission of wrongdoing, or non-monetary obligation on the indemnified Party without its written consent.

10. Limitation of Liability

10.1 General Limitation

Except for Excluded Claims, neither Party shall be liable for indirect, incidental, special, exemplary, punitive, or consequential damages, including lost profits, lost revenue, loss of business opportunity, or loss of goodwill, regardless of the theory of liability.

Except for Excluded Claims, each Party’s aggregate liability arising out of or relating to this Agreement shall not exceed the Fees paid or payable by Company to Slingshot during the twelve (12) months preceding the event giving rise to the claim.

10.2 Enhanced Cap

The aggregate liability of either Party arising from Excluded Claims described in Sections 10.3(c), (d), (e), and (f) shall not exceed three (3) times the Fees paid or payable during the twelve (12) months preceding the event giving rise to the claim.

10.3 Excluded Claims

The foregoing limitations shall not apply to liability arising from:

• (a) fraud;
• (b) willful misconduct;
• (c) breach of confidentiality obligations;
• (d) infringement or misappropriation of the other Party’s intellectual property rights;
• (e) indemnification obligations expressly subject to the enhanced cap; or
• (f) a Security Incident caused by a Party’s material breach of its obligations under Exhibit A.

Nothing in this Section makes either Party liable for an event caused by the other Party, its systems, personnel, vendors, instructions, or acts or omissions.

10.4 Insurance

Slingshot by ProntoBPO shall maintain commercially reasonable insurance appropriate to the Services, which may include commercial general liability, workers’ compensation, professional/errors and omissions liability, and cyber/privacy liability coverage.

Upon reasonable written request, Slingshot by ProntoBPO shall provide certificates of insurance evidencing applicable coverage.

11. Independent Contractors

The Parties are independent contractors.

Nothing in this Agreement creates a partnership, joint venture, employment relationship, fiduciary relationship, or agency relationship.

Neither Party has authority to bind the other without express written authorization.

12. Non-Circumvention; Protected Vendors; Liquidated Damages

Non-Circumvention

During the Term of this Agreement and for a period of twelve (12) months following the expiration or termination of this Agreement for any reason, Company (Client) shall not, directly or indirectly, circumvent, bypass, avoid, or otherwise seek to evade Slingshot by ProntoBPO for the purpose of obtaining, purchasing, or receiving services, technology, support, personnel, or other services that are substantially similar to, related to, or competitive with the Services directly or indirectly from any third-party service provider, subcontractor, technology provider, supplier, or other vendor introduced, sourced, engaged, managed, or utilized by Slingshot by ProntoBPO in connection with the Services (each, a “Protected Vendor”).

Without limiting the foregoing, Company (Client) shall not, directly or indirectly, during the applicable restricted period:

1. enter into, negotiate, solicit, facilitate, or maintain any agreement, arrangement, or business relationship with a Protected Vendor for services substantially similar to, related to, or competitive with the Services;
2. contract directly with, purchase services from, or otherwise engage a Protected Vendor for the purpose of obtaining services that Slingshot by ProntoBPO provides, coordinates, or facilitates under this Agreement;
3. use an affiliate, subsidiary, parent company, related entity, agent, representative, intermediary, consultant, or other third party to accomplish indirectly what Company (Client) is prohibited from doing directly under this Section;
4. encourage, request, or induce a Protected Vendor to discontinue, reduce, or circumvent its business relationship with Slingshot by ProntoBPO for the purpose of providing services directly to Company (Client); or
5. use information, pricing, contacts, introductions, negotiated terms, processes, or other business relationships obtained through Slingshot by ProntoBPO to establish or facilitate a direct or indirect relationship with a Protected Vendor.

This restriction shall apply regardless of whether the direct or indirect relationship with the Protected Vendor is established during the Term or during the twelve (12) month period following expiration or termination of this Agreement.

Protected Vendor

For purposes of this Section, a Protected Vendor includes any vendor, subcontractor, service provider, technology provider, or other third party that Slingshot by ProntoBPO introduces to Company (Client), identifies to Company (Client), engages on Company (Client)’s behalf, utilizes in providing the Services, or whose services, capabilities, pricing, or relationship become known to Company (Client) through Slingshot by ProntoBPO in connection with the Services. Slingshot by ProntoBPO may identify specific Protected Vendors in writing, including by email, from time to time.

The initial Protected Vendor(s) are: NLPearl

Liquidated Damages

The parties acknowledge and agree that a breach of this Section would cause Slingshot by ProntoBPO substantial economic harm, including the loss of anticipated revenue, vendor relationship value, customer acquisition costs, implementation and onboarding investments, negotiated commercial benefits, and other damages that would be difficult to determine with precision at the time of contracting. Accordingly, the parties agree that the following amount represents a reasonable estimate of the damages Slingshot by ProntoBPO would incur as a result of such circumvention and is intended as liquidated damages and not as a penalty.

If Company (Client), directly or indirectly, enters into or facilitates a business relationship with a Protected Vendor in violation of this Section, Company (Client) shall pay Slingshot by ProntoBPO, as liquidated damages, an amount equal to the greater of:

• twelve (12) months of the fees, charges, commissions, or other amounts that Slingshot by ProntoBPO reasonably would have received from Company (Client) in connection with the applicable Services or Protected Vendor relationship; or
• twelve (12) months of the amounts paid or payable by Company (Client), or on Company (Client)’s behalf, to the Protected Vendor pursuant to the circumventing arrangement,

calculated using the applicable rates, volumes, fees, or charges in effect immediately prior to the circumvention.

The liquidated damages shall become immediately due and payable upon discovery of the prohibited relationship or arrangement and shall be in addition to, and not in lieu of, Slingshot by ProntoBPO’s right to seek injunctive or other equitable relief to prevent or terminate the prohibited relationship.

Continuing Obligations; Additional Remedies

Company (Client) acknowledges that monetary damages alone may be inadequate to remedy a breach of this Section. Accordingly, in addition to the liquidated damages described above, Slingshot by ProntoBPO shall be entitled to seek temporary, preliminary, and permanent injunctive relief, specific performance, and any other remedies available at law or in equity to prevent, restrain, or terminate any prohibited conduct, without the requirement to prove actual damages or, to the extent permitted by applicable law, post a bond.

If Company (Client) has already entered into a prohibited direct or indirect relationship with a Protected Vendor, Slingshot by ProntoBPO may, in addition to the remedies above, require Company (Client) to cease such relationship for the remainder of the applicable twelve (12) month restricted period.

Pre-Existing Relationships

This Section shall not prohibit Company (Client) from maintaining or entering into a relationship with a vendor that Company (Client) can demonstrate through contemporaneous written documentation was an established business relationship of Company (Client) prior to Slingshot by ProntoBPO’s introduction of, engagement with, or involvement with such vendor, provided that Company (Client) does not use Slingshot by ProntoBPO’s confidential information, pricing, negotiated terms, or other proprietary information to expand or modify such pre-existing relationship in a manner that circumvents Slingshot by ProntoBPO.

No Waiver

Slingshot by ProntoBPO’s failure to immediately enforce any provision of this Section shall not constitute a waiver of its right to enforce such provision in the future. The obligations contained in this Section shall survive the expiration or termination of this Agreement for the full twelve (12) month restricted period.

13. Miscellaneous

a. Force Majeure

Neither Party shall be liable for delay or failure caused by events beyond its reasonable control, including natural disasters, war, terrorism, government restrictions, telecommunications outages, internet outages, utility failures, labor disruptions, or similar events.

The affected Party shall use reasonable efforts to mitigate the effects of the event.

Force majeure does not excuse payment obligations for Services already performed or obligations that can reasonably be performed despite the event, including applicable confidentiality and data-security obligations.

b. Severability

If any provision is found invalid or unenforceable, it shall be limited to the minimum extent necessary and the remainder of the Agreement shall remain effective.

c. Assignment

Neither Party may assign the Agreement without the prior written consent of the other Party, except to an affiliate or in connection with a merger, acquisition, reorganization, or sale of substantially all assets, provided the assignee assumes the applicable obligations.

d. Entire Agreement; Amendments; Termination

This Agreement and all applicable Purchase Orders, Statements of Work, exhibits, schedules, and mutually executed addenda constitute the complete agreement between the Parties regarding the Services.

No amendment or modification shall be effective unless in writing and signed by authorized representatives of both Parties.

Neither Party may amend the Agreement through unilateral website posting or general notice.

Either Party may terminate the Agreement or applicable Purchase Order for convenience upon sixty (60) days’ written notice, subject to any minimum committed term or early termination fee expressly stated in the applicable Purchase Order.

e. Headings

Headings are for convenience only and shall not affect interpretation.

f. Attorneys’ Fees

In an action to enforce rights under this Agreement, the prevailing Party may recover reasonable attorneys’ fees and costs to the extent permitted by applicable law.

g. Notices

Notices required under this Agreement shall be in writing and may be delivered by email, recognized overnight courier, or certified mail.

Notices to Company (Client) shall be sent to the designated contact identified in the applicable Purchase Order.

Notices to Slingshot by ProntoBPO shall be sent to the designated Slingshot by ProntoBPO contract contact identified in the applicable Purchase Order.

h. Company (Client) Systems

If Slingshot by ProntoBPO is required to use Company (Client)’s systems, software, applications, or platforms, Company (Client) grants Slingshot by ProntoBPO the limited right to access and use those systems solely as necessary to provide the Services.

Company (Client) represents that it has the right to provide such access and shall be responsible for obtaining necessary third-party permissions.

i. Subcontractors

Slingshot by ProntoBPO may use subcontractors in performing the Services.

Slingshot by ProntoBPO shall remain responsible for its subcontractors’ performance of obligations applicable to the Services and shall require subcontractors with access to Customer Data to comply with appropriate confidentiality and security requirements.

j. Electronic Signatures

Electronic signatures, counterparts, and electronically transmitted copies of this Agreement and applicable Purchase Orders shall be deemed originals and shall have the same legal effect as original signatures.

k. Waiver

Failure to enforce a provision shall not constitute a waiver of that provision or any other provision.

l. Governing Law and Venue

This Agreement shall be governed by the laws of the State of Delaware, without regard to conflict-of-law principles.

The state and federal courts located in Utah shall have exclusive jurisdiction over disputes arising from this Agreement, and each Party consents to such jurisdiction and venue.

EXHIBIT A

Data Security Requirements

1. Definitions

a. Customer Data. “Customer Data” means information provided by or on behalf of Company (Client), or collected, received, or generated by Slingshot by ProntoBPO in performing the Services, including Personal Information and applicable customer, claim, vehicle, policy, appraisal, or related information.

b. Personal Information. “Personal Information” means information that identifies, relates to, or could reasonably be linked with an identified or identifiable natural person.

c. Security Incident. “Security Incident” means confirmed unauthorized access to, acquisition, use, disclosure, alteration, loss, or destruction of Customer Data within Slingshot by ProntoBPO’s systems or control that materially compromises the confidentiality, integrity, or security of Customer Data.

A suspected security event that has not been reasonably determined to constitute a Security Incident shall be handled under Slingshot by ProntoBPO’s incident-response procedures.

d. Required Security Safeguards. “Required Security Safeguards” means the safeguards described in Sections 2 and 3 of this Exhibit.

2. Information Security Program

Slingshot by ProntoBPO shall maintain a written information security program containing administrative, technical, and physical safeguards appropriate to the nature and sensitivity of Customer Data and aligned with a recognized industry framework such as SOC 2, ISO/IEC 27001, or the NIST Cybersecurity Framework.

Upon Company (Client)’s reasonable written request, no more than once during any twelve-month period, Slingshot by ProntoBPO shall provide its most recent available third-party security report or certification, or a reasonable security questionnaire.

3. Required Security Safeguards

Slingshot by ProntoBPO shall maintain commercially reasonable safeguards, including:

• least-privilege access;
• prompt access revocation following role changes or separation;
• multi-factor authentication for remote access;
• encryption of Customer Data in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent;
• controls designed to prevent unauthorized local retention of Company (Client) Data;
• network security controls and logging;
• vulnerability management and timely patching;
• physical access controls at applicable delivery centers;
• background screening to the extent permitted by applicable law;
• written confidentiality obligations;
• security and privacy training at onboarding and at least annually;
• appropriate security obligations for subcontractors and subprocessors; and
• secure disposal of Customer Data when no longer required.

4. Security Incident Notification

Slingshot by ProntoBPO shall notify Company (Client) without undue delay and, where reasonably practicable, within seventy-two (72) hours after becoming aware of a Security Incident.

The notice shall include, to the extent then known:

• the nature and scope of the incident;
• categories of Customer Data affected;
• approximate volume of affected data;
• containment and remediation measures; and
• a contact for follow-up.

Slingshot by ProntoBPO shall provide material updates as additional information becomes available.

Slingshot by ProntoBPO shall reasonably cooperate with Company (Client) concerning legally required notifications.

To the extent caused by Slingshot by ProntoBPO’s material breach, gross negligence, or willful misconduct, Slingshot by ProntoBPO shall investigate, contain, and remediate the Security Incident at its expense.

Slingshot by ProntoBPO shall be responsible for reasonable, documented third-party notification and credit-monitoring costs to the extent required by applicable law and directly resulting from a Security Incident for which Slingshot by ProntoBPO is responsible, subject to the applicable liability limitations in Section 10.

Slingshot by ProntoBPO shall not be responsible for incidents caused by Company (Client), Company (Client) systems, Company (Client) vendors, Company (Client) instructions, or third parties outside Slingshot by ProntoBPO’s reasonable control.

5. Data Location and Access

Customer Data shall be accessed, processed, and stored only within the United States, Guatemala, El Salvador, and Honduras, unless Company (Client) provides prior written approval for another jurisdiction.

Slingshot by ProntoBPO may use approved cloud, telecommunications, software, and other technology providers in connection with the Services, provided such providers are subject to appropriate contractual data-protection obligations.

6. Use Limitation

Slingshot by ProntoBPO shall process Customer Data solely as reasonably necessary to perform the Services and in accordance with Company (Client)’s documented instructions.

Slingshot by ProntoBPO shall not sell Customer Data or use it for unrelated advertising or marketing.

Slingshot by ProntoBPO shall not use Customer Data to train a general-purpose AI model made available to unrelated third parties without Company (Client)’s written authorization.

Slingshot by ProntoBPO may process aggregated and de-identified information for legitimate service improvement, analytics, benchmarking, security, and operational purposes.

7. Return and Deletion

Within thirty (30) days after expiration or termination, or upon Company (Client)’s earlier written request where reasonably practicable, Slingshot by ProntoBPO shall return Customer Data in a commonly used machine-readable format.

Slingshot by ProntoBPO shall thereafter securely delete Customer Data in accordance with its applicable secure-deletion procedures.

Customer Data contained in routine disaster-recovery or backup systems that cannot reasonably be individually deleted may remain until overwritten in accordance with Slingshot by ProntoBPO’s normal backup-retention schedule, provided such information remains protected and is not actively processed except as necessary for disaster recovery or legal compliance.

Upon reasonable request, Slingshot by ProntoBPO shall certify completion of deletion.

8. Subprocessors

Slingshot by ProntoBPO may use subcontractors and subprocessors in connection with the Services.

Slingshot by ProntoBPO shall remain responsible for its subprocessors’ compliance with applicable confidentiality and security obligations.

Upon reasonable written request, Slingshot by ProntoBPO shall identify material subprocessors that have access to Customer Data.

Slingshot by ProntoBPO may add or replace subprocessors in the ordinary course provided that each applicable subprocessor is subject to appropriate contractual data-protection obligations.

9. Business Continuity

Slingshot by ProntoBPO shall maintain commercially reasonable business continuity and disaster recovery procedures appropriate to the nature of the Services and Customer Data.

Unless expressly stated in a Purchase Order, business continuity procedures do not constitute a guarantee of uninterrupted Services or a specific recovery time or recovery point objective.

10. Audit and Security Review

Upon reasonable written request and subject to appropriate confidentiality and security requirements, Slingshot by ProntoBPO shall reasonably cooperate with Company (Client)’s security review concerning Slingshot by ProntoBPO’s handling of Company (Client) Data.

Company (Client) shall not conduct an audit more than once in any twelve-month period unless a material Security Incident or regulatory requirement reasonably requires additional review.

Any audit shall be conducted in a manner designed to minimize disruption to Slingshot by ProntoBPO’s operations and shall not provide access to unrelated customer information, security-sensitive information, or Slingshot by ProntoBPO’s confidential information.

11. Survival

Sections relating to confidentiality, Customer Data, security, use restrictions, intellectual property, indemnification, limitation of liability, payment obligations, and other provisions that by their nature should survive shall survive expiration or termination of the Agreement.