Partner Agreement

**AIRALO**

- **Company name:** AirGSM Pte Ltd - **Registered address:** 6 Raffles Blvd, #03-308 Justco, 039594, Marina Square, Singapore - **Airalo business contact:** Scott Long , scott.long@airalo.com - **Email for legal notices:** legal@airalo.com

**Partner**

- **Company name:** PT GOLDEN ORDER DIVISION LTD - **Registered address:** 200 - 6060 SILVER DRIVE,BURNABY,BRITISH COLUMBIA,CANADA,V5H 0H5 , Canada - **Partner business contact:** legal@ptgodpay.com - **Email for legal notices:** legal@ptgodpay.com

**Partner Agreement Details**

- **Initial term:** 12 months - **Renewal:** Automatic Renewal - **Start date:** Date of last signature of the Partner Agreement - **Partner program:** API Partner Program

---

By executing this Partner Agreement ("Agreement"), Partner and Airalo agree to Partner's participation in the Airalo Partner Program(s) listed above as of the Start Date and for the duration of the Term. Appointment is non exclusive. Participation to additional Partner Programs requires a written addendum to this Agreement and it is subject to Airalo's approval, which Airalo may deny for any reason or no reason.

This appointment is subject to the terms included in Schedule 1 - General Partnership Terms, which regulate all partnerships with Airalo, Schedule 2 - Partner Program Schedule, which is specific to the relevant partnership program, and Schedule 3 - DPA. By executing this Agreement, Partner confirms to have read, understood and accepted all such terms.

Airalo appoints Partner as a non exclusive resale and marketing partner, and grants Partner the non-exclusive, revocable, limited right to (a) purchase, distribute and resell the Services to End Users via an integration between Ancillary Software and Partner's app or website ("Integration"), as well as to (b) advertise and market the Services, in the Territory during the Term ("Partner Services"). "End Users" means customers of Partner.

**Services** covered by this Partner Program are the Airalo eSIMs as made available via the Partner Platform.

**Territory**, Partner may provide the Partner Services worldwide .

**Fees.** The Partner shall purchase Services at the Wholesale PrIce specified on the Partner Platform ("Fees"). The Partner acknowledges that Airalo may adjust the Wholesale Price from time to time due to factors such as market conditions, exchange rates, and operational costs.

**Payments.** Airalo will approve a monthly credit limit for the Partner based on anticipated purchases. Once the Partner reaches this limit, no further purchases can be made unless agreed upon with Airalo Partner Manager. Partner may request a modification to the credit limit, which will take effect in the month following Airalo's approval. Each month, Airalo will issue an invoice for the Services purchased in the previous calendar month, which shall be paid within 7 days from date of invoice.

**License to use Trademarks.** Partner grants Airalo a nonexclusive, nontransferable, non-sublicensable, royalty-free license to use Partner's marks, including Partner's company name, and any other marks or logos associated therewith for the sole purpose of identifying and promoting Partner's participation in Airalo's Partner Programs. Airalo shall comply with the branding guidelines for the use of such trademarks, as communicated by Partner.

**White-label eSIMs Sharing.** Partner is authorized to "white label" Airalo's Services and make them available to End Users under the Partner's marks. Additional terms shall apply, as specified in the Partner Program Schedule.

**AIRGSM PTE. LTD.**

- **Signatory:** Patrick Dowling - **Signatory email:** patrick.dowling@airalo.com - **Date/time:** _[empty signing timestamp]_

**PT GodPay**

- **Signatory:** GANIEVA ABADAN - **Signatory email:** legal@ptgodpay.com - **Date/time:** _[empty signing timestamp]_

---

1. Definitions

1.1. **Affiliates** means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control" means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

1.2. **App** means the mobile application developed, maintained and made available by Airalo to allow access and use to eSIMs by End Users, including any update, upgrade, successor or replacement, as released by Airalo in its sole discretion.

1.3. **Ancillary Software** means the Partner Platform, the App, and all technology and methodologies created by or for, or licensed to, Airalo (including software tools, algorithms, software) and made available to Partner for the purpose of supporting the provision of the Partner Services; and any updates, upgrades, improvements, configurations, extensions, and derivative works of the foregoing and related technical documentation or manuals.

1.4. **Confidential Information** means all information identified as confidential at the time of disclosure by the disclosing party or that reasonably should be understood by the receiving party to be confidential or proprietary due to the nature of the information disclosed and the circumstances surrounding the disclosure. For clarity, the terms and conditions of this Agreement will be deemed Confidential Information of Airalo without any marking or further designation. Confidential Information shall not, however, include information that the receiving party can demonstrate: (a) was rightfully in its possession or known to it prior to receipt of the Confidential Information; (b) is or has become public knowledge through no fault of the receiving party; (c) is rightfully obtained by the receiving party from a third party without breach of any confidentiality obligation; or (d) is independently developed by employees of the receiving party.

1.5. **Day** means a calendar day.

1.6. **eSIMs** means an eSIM data plan to be downloaded and activated on an embedded SIM card.

1.7. **End User** means an individual whom Partner wishes to make available Services to, as identified in the relevant Partner Program Schedule.

1.8. **Force Majeure Event** means any events outside a party's reasonable control, including but not limited to, acts or omissions of the other party, fire, storm, flood, earthquake, war, terrorist act or threat, transportation embargo or failure or delay in transportation.

1.9. **IP Rights** means all intellectual property or other proprietary rights worldwide, including patents, copyrights, trademarks, moral rights, trade secrets, and any other intellectual or industrial property, including registrations, applications, renewals, and extensions of such rights.

1.10. **Partner Data** means any data uploaded or created by or on behalf of a Partner on the Ancillary Software within the context of a Partner Program. Partner Data is Confidential Information of Partner.

1.11. **Partner Platform** means a platform owned or operated by Airalo, its Affiliates or suppliers that supports the administration of the relevant Airalo Partner Programs.

1.12. **Partner Program** means, collectively, the rights and obligations of Partner and Airalo that are associated with a particular partnership program, as described in a Partner Program Schedule.

1.13. **Partner Program Schedule** means a Schedule to this Agreement describing a Partner Program.

1.14. **Partner Services** means the services to be provided by Partner in execution of a Partner Program, as described in the relevant Partner Program Schedule.

1.15. **Services** means the services listed in the Partner Agreement, including, as applicable, (a) Airalo eSIMs, (b) Airalo Vouchers, or (c) any other service or product provided by Airalo, each as listed and described in the Partner Agreement.

1.16. **Network Provider** means an Airalo's upstream mobile network operator or supplier of network and connectivity services.

1.17. **Term** means the Initial Term and any subsequent Renewal Terms (if any).

2. Participation to Partner Program

2.1. By executing the Agreement, Partner is approved for participation to the Partner Program(s) listed in the Agreement. Appointment is non exclusive. Participation to additional Airalo Partner Programs requires a written addendum to this Agreement and it is subject to Airalo's approval, which Airalo may deny for any reason or no reason.

2.2. The terms of each Partner Program are detailed in the relevant Partner Program Schedule. Airalo reserves the right to modify unilaterally the terms of a Partner Program Schedule, including, without limitation, where so required to comply with instructions from its Network Providers or to comply with changes in applicable laws. Any such modifications shall be notified in writing to Partner, and shall enter into effect 15 Days following notification. Partner may provide reasonable objections to the modification, and the parties shall negotiate in good faith to resolve such objection. If no agreement is reached, Partner shall have the right to terminate the Agreement upon notice.

2.3. Despite using the term "partner" throughout the Agreement, the parties will not (legally) form a partnership, general partnership, public partnership, joint venture or equivalent partnership by entering into the Agreement. Partner is acting hereunder as an independent contractor and has no express or implied right or authority to assume or create any agreement or obligation, or make any representation, guarantee or warranty, on Airalo's behalf with respect to the Services or otherwise. There will be no third party beneficiaries to this Agreement.

3. Airalo as an eSIM Aggregator

3.1. Partner acknowledges and agrees that Airalo operates as an eSIMs aggregator and marketplace, and relies on Network Providers to provide network access and connectivity. Airalo will use best efforts to ensure that its eSIMs are continuously available and to provide End User support in accordance with the Partner Program Schedule, however Airalo makes no guarantee that network quality, network capacity, connection availability or overall network conditions will exist to enable Partner and/or End Users to access the eSIMs at any given time, and shall not be liable for any loss or damage due to failures in or breakdowns of the network infrastructure, communication facilities and/or telecommunications equipment associated with providing the Services.

3.2. Airalo shall have the right to procure network access and connectivity from Network Providers of its own choice, in the manners and timing that it deems appropriate, as well as to discontinue the sale, provision or support of any eSIM at any time, without providing prior notice to the Partner.

4. Warranties

4.1. Each party hereby represents and warrants that it holds all necessary licenses, consents, registrations and permissions as may be necessary to fulfill its obligations hereunder.

4.2. Except for the warranties expressly stated in this Agreement, to the maximum extent allowed by law, Airalo disclaims all warranties of any kind (express, implied, statutory, or otherwise, oral or written, including warranties of merchantability, accuracy, title, non-infringement, or fitness for a particular purpose, and any warranties arising from usage of trade, course of dealing, or course of performance). In particular, eSIMs and Ancillary Software are provided on an "as is" and "as available" basis, and Airalo does not warrant their quality and availability, nor that they will operate without interruption or error.

5. Compliance with Laws and Ethics

5.1. Parties shall - and shall ensure their respective Affiliates, employees, officers, directors, and third parties performing activities on their behalf - comply with applicable laws, regulations and other legal requirements, including without limitation tax, import or export restrictions, data privacy and security, foreign exchange and consumer protection legislation. Each party will make reasonable efforts to notify the other as soon as possible if a change in laws or regulations affects its performance under the Agreement.

5.2. Without limiting the above, both parties represents and warrants that

5.2.1. neither party, nor their respective Affiliates or employees, officers, directors are (a) currently identified on any sanctions or export control list maintained by the U.S., EU, or UK, government; nor (b) located, organized or ordinarily resident in a U.S. embargoed country or territory. Neither party shall engage in any activity or transaction pursuant to this Agreement that would be in violation of any U.S., EU, UK or other applicable export or economic sanctions law or regulation or other applicable trade law or regulation.

5.2.2. Parties will at all times conduct itself according to the highest standard of business ethics. Parties have not offered and will not offer or provide money or anything else of value to any agent or representative of any government or government agency in order to obtain or retain business in connection with the Agreement, as prohibited under applicable anti-corruption laws and regulations. It is the intent of the parties that no offers, promises, payments or transfers of anything of value shall be made in connection with this Agreement that have the purpose or effect of public, commercial or other bribery, or acceptance of or acquiescence in extortion, kickbacks, or other unlawful or improper means of obtaining business or any improper advantage.

5.3. Airalo may request Partner to provide reasonable evidence of compliance with the above obligations. Partner shall immediately report any illegal, improper or corrupt requests identified in association with this Agreement to legal@airalo.com. Failure to report any such conduct, to cooperate with Airalo, as well as breaches of the obligations in the present section, shall constitute a material breach by Partner of its obligations and will entitle Airalo to terminate the Agreement and any underlying Service in accordance with Section 8.2.

6. Confidential Information

6.1. The receiving party of Confidential Information must: (a) use the same degree of care that it uses to protect the confidentiality of its own confidential information (but not less than reasonable care) to protect the Confidential Information of disclosing party; (b) use the disclosing party's Confidential Information only as permitted by or for the purposes of this Agreement, or to comply with obligations imposed on the Partner by law and/or to comply with directions and orders issued by a competent authority; and (c) except as otherwise authorized by the disclosing party in writing, limit access to Confidential Information of the disclosing party to those of its and its Affiliates' employees and contractors who need that access for purposes consistent with this Agreement and who have signed confidentiality agreements with the receiving party containing protections not materially less protective of the Confidential Information than those herein.

6.2. Either party may disclose Confidential Information of the other party to the extent required by applicable law or by a court order, provided that, prior to disclosing any such Confidential Information, the party making the disclosure has, where legally practicable, given the other party reasonable advance notice of such law or order and an opportunity to preclude or limit such disclosure.

6.3. Each party's obligations under this Section 6 will remain in effect during, and for 3 years after termination of, this Agreement. The receiving party will, at disclosing party's request, return all originals, copies, reproductions, and summaries of Confidential Information and other tangible materials and devices provided to receiving party as Confidential Information, or at disclosing party's option, certify destruction of the same.

7. Intellectual Property

7.1. Nothing in the Agreement transfers or assigns any of either Party's IP Rights to the other. In particular, each Party's trademarks or service marks (including those of their respective Affiliates) remain the sole property of that Party and may not be used by the other Party in any manner except to the extent required to (a) perform its obligations under the Partner Program, (b) with the prior written consent of the owning Party, or (c) where so explicitly agreed in this Agreement.

7.2. Without limiting the foregoing, Partner grants Airalo a nonexclusive, nontransferable, nonsublicensable, royalty-free license to use Partner Data (a) to comply with its duties and obligations under this Agreement, and (b) for the purpose of optimising, developing and improving the services offered to Partner, its End Users and its customer base, provided however that any data used for such purpose shall be anonymized or aggregated, so that it does not allow the identification of Partner or the End Users.

7.3. Partner may provide - and Airalo may encourage - suggestions or ideas for improving or otherwise modifying Airalo's products or services ("Feedback"). For clarity, nothing in this Agreement will restrict Airalo's right to use, profit from, disclose, publish, or otherwise exploit such Feedback, without compensating or crediting Partner or the individual providing such Feedback.

8. Term and Termination

8.1. The Agreement shall commence on the Start Date and continue in force until the expiry of the Initial Term. Thereafter, the Agreement shall automatically renew for consecutive 12 months periods (each a "Renewal Term") at the expiry of the Initial Term and each Renewal Term, unless either party provides 90 Days notice in writing to the other of its intention not to renew.

8.2. Either Party may terminate the Agreement (a) upon providing 90 Days prior written notice to the other Party; (b) upon notice if the other Party materially breaches any of its obligations under this Agreement and fails to cure such breach within 30 Days of notice from the non-breaching Party, or immediately upon notice if the material breach cannot be cured; (c) upon 30 Days prior written notice if the other Party ceases to conduct business in the normal course, seeks protection under any bankruptcy, receivership, trust deed, creditors' arrangement, composition, or comparable proceeding, or if any such proceeding is instituted against that party and is not dismissed within 60 Day (to the extent such termination is not prohibited by law).

8.3. Effects of termination. On termination or expiration of the Agreement:

8.3.1. (a) Partner's access to the Partner Platform will be revoked; (b) Partner shall stop providing Partner Services; (c) Services not yet assigned to - or redeemed by - End Users shall expire, (c) Airalo shall refund the value of Services pre-purchased and not yet assigned to End Users; (d) each party shall return to the other - or, where so instructed by the other party, destroy - all parties' Confidential Information and all copies thereof.

8.3.2. neither Party shall be relieved from any obligations accrued through the date of termination, including any payment obligations that have already accrued or arisen prior to the date of termination or expiration.

8.3.3. End Users will be entitled to continue using the assigned eSIMs until complete consumption or expiration of the relevant data plan.

8.4. The terms and conditions set forth in this Agreement which by their nature would continue beyond termination of this Agreement - including, without limitation, Sections 4 (Warranties), 5 (Compliance with laws and ethics), 6 (Confidential Information), 7 (Intellectual Property), 9 (Limitation of Liability), 10 (Indemnification) and 12 (Miscellaneous) - shall survive the expiration or earlier termination of this Agreement.

9. Limitation of Liability

9.1. In no event shall either Party, or its Affiliates, officers, directors, employees, and agents be liable to the other Party for any special, indirect, incidental, consequential, punitive or exemplary damages, including without limitation, loss of revenue, loss of profits, loss of data, loss to other carriers, goodwill, or anticipated savings arising in any manner from this Agreement and the performance or non-performance of business hereunder.

9.2. With the exception of (a) obligations to pay fees or commissions, (b) the indemnification obligations set forth in Section 9.1 of this Agreement, (c) any claims resulting from a Party's gross negligence, fraud or intentional misconduct, and (d) any claims resulting from a breach of Section 6 "Confidential Information" of this Agreement, each Party's liability to the other Party in contract, tort or otherwise (including liability for negligence) under or in connection to this Agreement shall be limited to the lesser of (i) $10,000 USD; or (ii) the total Fees or Commissions paid or to be paid during the twelve months preceding the incident that gave rise to the claim.

10. Indemnification

10.1. Airalo shall defend Partner against any third party claim, suit, or proceeding initiated by a third party Airalo shall defend Partner against any third party claim, suit, or proceeding initiated by a third party alleging that the Ancillary Software infringes or misappropriates the IP Rights of such third party. Airalo will indemnify Partner from any damages, attorney fees and costs finally awarded against Partner as a result of such claim, or for amounts paid by Partner under a settlement approved by Airalo in relation to such claim, provided Partner (a) promptly gives Airalo written notice of such claim, (b) gives Airalo sole control of the defense and settlement of the claim, and (c) gives Airalo all reasonable assistance, at Airalo's expense. Airalo's obligations set forth in this Section do not apply to the extent that such claim arises out of (i) Partner's breach of this Agreement, or (ii) the use or combination of the Ancillary Software with software, hardware, data, or processes not provided by Airalo, if the Ancillary Software, or use thereof, would not have been infringing without such combination.

10.2. Airalo may, as a result of having received or being notified a claim of - or reasonably suspecting the infringement or misappropriation of a third party IP Right, in its sole discretion and at no cost to Partner (i) modify the Ancillary Software so that they are no longer infringing or misappropriating third party IP Rights, (ii) obtain a license for the continued use of such IP Rights; or (iii) terminate any of Partner's rights for the infringing component of the Ancillary Software upon 30 Days' written notice and refund Partner any prepaid fees covering the remainder of the term of the terminated Services (if any).

10.3. Partner shall defend Airalo against any third party claim, suit, or proceeding initiated by (a) End Users alleging a breach by Partner of their privacy rights, (b) a breach by Partner of the terms of the Partner Program Schedule. Partner will indemnify Airalo from any damages, attorney fees and costs finally awarded against Airalo as a result of such claim, or for amounts paid by Airalo under a settlement approved by Partner in relation to such claim, provided Airalo (a) promptly gives Partner written notice of such claim, (b) gives Partner sole control of the defense and settlement of the claim, and (c) gives Partner all reasonable assistance, at Partner's expense.

10.4. This "Indemnification" section states the indemnifying party's sole liability to, and the indemnified party's exclusive remedy against, the other party for any type of claim described in this section.

11. Personal Data Processing

11.1. The parties anticipate they will need to exchange business contact information of the parties' respective personnel in order to facilitate a normal and customary business relationship (e.g., communication, invoicing, etc.), such as name, email, and business function. Each party will independently control the purpose and means of processing for such Personal Data, and, as such, will be solely responsible for how it uses, collects, protects, and process them.

11.2. To the extent Partner Data include Personal Data, Airalo shall process such Personal Data in accordance with the Airalo Data Processing Addendum "DPA". The DPA is attached and included in this Partner Program Schedule via this reference.

12. Miscellaneous

12.1. Force Majeure. If a Force Majeure Event affecting a party precludes that party (precluded party) partially or wholly from complying with its obligations under this Agreement then (a) as soon as reasonably practicable after that Force Majeure Event arises, the precluded party must notify the other party of the Force Majeure Event; and (b) to the extent and for the period that the precluded party is precluded by the Force Majeure Event from complying with its obligations under this Agreement, those obligations will be suspended for the duration of the Force Majeure Event.

12.2. Governing Laws and Governing Courts. The Governing Laws, without reference to conflict of law rules, govern this Agreement and any dispute of any sort that might arise between Partner and Airalo. The UN Convention for the International Sale of Goods does not apply to this Agreement. Any dispute or claim relating in any way to Agreement will be adjudicated in the Governing Courts, and parties consent to the exclusive jurisdiction and venue in the Governing Courts.

- **Governing law:** England and Wales - **Governing courts:** London, United Kingdom

12.3. Notices. All notices hereunder shall be in writing and shall be deemed to have been given: (a) when received by the addressee if sent by a nationally recognized overnight courier (receipt requested); (b) on the date sent by electronic transmission if sent during normal business hours of the recipient, and on the next business day if sent after normal business hours of the recipient; (d) on the third Day after the date mailed, by certified or registered mail, return receipt requested, postage prepaid. Such communications must be sent to Airalo and Partner at the addresses indicated on the Agreement or at such other address as shall be specified in a notice given in accordance with this Section or on the Partner Platform.

12.4. Assignment. Neither party may assign the Agreement or any rights or obligations hereunder without the prior written consent of the other party, which consent must not be unreasonably withheld. Notwithstanding the foregoing, on notice and without the other's consent: (a) either party may in connection with a merger, reorganization, or sale of all or substantially all of such party's assets or equity, assign this Agreement in its entirety to such party's successor; and (b) Airalo may assign this Agreement in its entirety to any of its Affiliates.

12.5. Survival. If a provision (or part of it) is held to be unenforceable or invalid, then: (a) the provision (or part of it) must be severed from this Agreement; and (b) the remaining provisions (and remaining part of the provision) are valid and enforceable.

12.6. Entirety. This is the entire agreement of the parties concerning the subject matter of this Agreement. There is no other agreement, understanding, warranty or representation, whether oral or written, binding the parties concerning any aspect of this Agreement.

12.7. Non Waiver. A party may exercise its rights at any time and does not waive those even if that party: (a) previously waived a breach or default of all or part of the same or other provision; or (b) delayed or omitted to exercise its rights. A waiver is only effective: (i) if it is signed by the party granting the waiver; and (ii) to the extent set out in the waiver.

12.8. Order of precedence. The following order of precedence will apply in the event of inconsistencies between documents: I. The Partner Agreement; II. Schedule 1 - General Partnership Terms. III. Schedule 2 - Partner Program Description; IV. Schedule 3 - DPA.

---

**API Integration Partner**

1. Provision and Use of the Services to End Users

1.1. Partner shall use the Partner Platform to purchase and assign eSIMs to End Users.

1.2. Airalo authorizes Partner to commercialize eSIMs under Partner's marks ("whitelabelling"). Access to eSIMs to End Users shall be provided via QR Code.

1.3. Partner acknowledges and agrees that, by white-labelling the eSIMs and distributing them under its own trademarks, they operate as service providers towards the End Users, will enter into contract directly with the End Users, and will therefore be responsible for compliance with all laws and regulations that apply to such transactions. Without limitation, Partner shall be responsible to (a) flow down to End Users terms consistent with the Airalo Online Terms of Use and Privacy Policy, in particular but not limited to with reference to the Acceptable Use Policy and (b) provide first level support to End Users and manage refunds to End Users, (c) complying with any regulation applicable to similar transactions, including consumer protection regulations.

1.4. Airalo shall make available documentation and access to second line support to Partner to allow Partner to provide support to End Users.

2. Limited License to Ancillary Software

2.1. Airalo grants Partner a limited, non exclusive license to access and use the Partner Platform for the duration of the Term. The Partner Platform is solely meant to facilitate the delivery - and track the performance - of the Partner Services, and shall be used exclusively for such purposes. Partner may provide access to the Partner Platform to its Affiliates or to its Third Party Service Providers, provided that (a) Partner shall remain responsible for their acts and omissions as if they were its owns; and (b) Partner shall remain the sole contractual counterparty to Airalo. Any claim from an Affiliate towards Airalo shall be brought by Partner and it shall be subject to the same limitations of liability and obligations set forth in the Agreement.

2.2. Airalo grants Partner a limited, non-exclusive license to use the API, plug ins and developer documentation, as provided by Airalo, to set up, test and deploy the Integration for the duration of the Term. The APIs provided by Airalo are subject to changes and modifications, and that Partner is solely responsible to ensure that the Integration is compatible with the then-current version. Partner shall be solely responsible for setting up, testing and maintaining the Integration in accordance with the documentation provided by Airalo and with any additional reasonable instructions Airalo may provide. Wrong or inaccurate orders generated due to misconfiguration of the Integration shall be the sole responsibility of Partner.

3. Marketing the Services to End Users

3.1. Partner will inform and advise the End Users it targets in its performance of Partner Services in an honest and sincere manner. Partner shall not provide information concerning Airalo or the Services that are false, misleading or would be difficult to prove. Partner shall provide Airalo with copies of marketing materials and advertising upon request and comply with Airalo's reasonable advertising directives.

3.2. Airalo grants Partner a limited, non exclusive royalty-free license right to use and reproduce Airalo trademarks and service marks, to the extent needed to perform the Partner Services. Partner shall comply at all times with the applicable Airalo brand guidelines, as communicated from time to time by Airalo.

3.3. Notwithstanding the above, Partner shall not, without prior written consent from Airalo: (i) register, use, or allow others to use any Airalo's marks or variations thereof (also including misspellings or symbols) in domain names, URLs, or subdomains; (ii) use Airalo's marks or variations in paid search advertising or other online advertising (e.g., banners, targeted ads); (iii) include Airalo's marks or variations thereof in the content or links of advertising from paid searches; (iv) bid on keywords with Airalo' marks or variations; or (v) present any website or page as an "official" Airalo website or suggest endorsement by Airalo using keywords in metadata or title tags, or by repeating Airalo's marks excessively to manipulate search results.

4. Other Partner Obligations

4.1. Partner shall conduct its operations so as not to impair the operation or reputation of Airalo. Airalo reserves the right to provide - and Partner agrees to use reasonable efforts to follow - recommendations and requests aimed at preserving the operations of Airalo, or the brand integrity and reputation of the Airalo brand.

4.2. Partner shall ensure that its personnel involved in the provision of the Partner Services is adequately prepared so as to be able to properly and reasonably respond to End Users' inquiries regarding the Services and this Partner Program.

4.3. Partner will promptly inform Airalo of any information known to Partner that could reasonably lead to a claim, demand or liability of or against Airalo by any third party.

4.4. Partner shall refrain from:

4.4.1. providing access to the Ancillary Software with any third party, other than as authorized under this Schedule;

4.4.2. sell Services to any third party for purposes of further resale by such third party;

4.4.3. performing Partner Services via websites (or other channels) of an unlawful or illegal nature;

4.4.4. performing Partner Services through electronic communication in a way that would constitute 'spam' and is in violation of applicable law, such as the unsolicited performance of promotional activities through e-mail, SMS or a similar medium;

4.4.5. distorting the tracking of the performance of the Partner Services;

5. Certifications and Registrations

5.1. In all jurisdictions in which providing the Partner Services require a certification and/or a registration, Partner warrants that it has obtained the necessary certifications/registrations from the appropriate governmental authorities. If required by Airalo, Partner agrees to provide reasonable proof of such certification. In the event Partner's authority is prohibited, either on a temporary or permanent basis, from conducting its operations in a given area, Partner shall notify Airalo as soon as reasonably possible and in any case no later than 15 Days.

6. Fees and Payments

6.1. The Partner shall use reasonable efforts not to charge End Users a price below the Recommended Reselling Price, as communicated by Airalo via the Partner Platform, being however understood that Partner is free to determine the reselling price autonomously. Airalo shall use reasonable effort to notify Partner in advance of price changes, however Partner remains ultimately responsible for monitoring the Partner Platform to ensure compliance with this Section.

6.2. Unless otherwise agreed with Airalo, the Fees will be paid in USD and are exclusive of VAT and/or any other applicable taxes. The Partner is solely responsible for any taxes that may apply to the Fees.

6.3. The Partner shall pay all undisputed amounts in an invoice in accordance with the payment terms in the Agreement. Late payments will incur interest at a rate of 1.5% per month or the maximum legal interest rate, whichever is lower, calculated from the due date until the date of payment.

6.4. If the Partner believes an invoice contains errors, they must dispute the invoice by notifying Airalo within 7 Days from receipt, providing reasonable evidence to support the claim. Both parties shall use best efforts to resolve such dispute within 30 Days from receipt of the objection.

6.5. Without limiting any other rights under this Agreement or applicable law, Airalo reserves the right to suspend access to Ancillary Software and the provision of additional Services immediately, without notice, if any undisputed amounts remain unpaid 15 business days from the date of the invoice. For clarity, this suspension will not affect Services that have already been purchased and assigned to End Users

6.6. Partner may allow its Affiliates to purchase Services at the same conditions agreed by Airalo with Partner. Any such purchase will be considered as a purchase by Partner, and Partner shall be responsible for it as if it was its owns.

---

This Data Processing Addendum ("DPA") forms part of the Agreement entered into by Partner and Airalo. Capitalized terms used but not otherwise defined in this DPA will have the meaning given to them in the Agreement.

1. Definitions

1.1. **Data Protection Laws** means any and all laws, rules and regulations related to privacy, security, data protection, and/or the Processing of Personal Data, in any relevant jurisdiction, each as amended, replaced or superseded from time to time.

1.2. **Personal Data** means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household.

1.3. **Partner Personal Data** means Personal Data included in Partner Data.

1.4. **Data Subject** means the identified or identifiable person to whom Personal Data relates.

1.5. **Breach** means the accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure of, or access to, Partner Personal Data.

1.6. **Processing** means any operation or set of operations that is performed upon Personal Data, whether or not by automatic means, such as access, collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, return or destruction. The terms "Process", "Processes" and "Processed" will be construed accordingly.

1.7. **Processor** means any person or entity which Processes Partner Personal Data, including as applicable any "Processor" or "contractor" as those terms are defined by applicable Data Protection Laws.

1.8. **Controller** means the natural or legal person which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

1.9. **Subprocessor** means any legal person engaged in the Processing of Personal Data by Processor.

2. Processing of Personal Data

2.1. With regard to the Processing of Partner Personal Data, Airalo acts as a Processor. Partner and the entities that Partner authorises to use the Ancillary Software in accordance with the relevant Partner Program, act as a Controller or Processor. For the purposes of this DPA, where Partner acts as a Processor, it does so under the instructions of its Controller(s).

2.2. In the event multiple entities are allowed by Partner to access the Ancillary Software under the Agreement, Partner shall act as a single point of contact to Airalo for the purpose of this DPA, including by obtaining and communicating instructions, authorizations, consents and permissions and communicating them to Airalo. Where Airalo informs or gives notice to Partner, such notice is deemed received by those Controllers permitted by Partner to use the Ancillary Software.

2.3. Airalo will process Personal Data only

2.3.1. in accordance with documented instructions from Partner. In entering into the Agreement, Partner instructs Airalo to process Personal Data to provide and support the Ancillary Software, as set out in the Agreement (including this DPA). Partner may issue additional instructions, provided that they shall be consistent with the scope of the Agreement and not require Airalo to modify the Ancillary Software. If any such additional instructions cannot be complied with, or if Airalo is of the opinion that it infringes Data Protection Laws, Airalo shall promptly notify Partner.

2.3.2. where required to do so by applicable laws or Data Protection Laws to perform its obligations under the Agreement. In such a case, Airalo shall inform Partner of that legal requirement before processing, unless legally prohibited from sharing such information. In particular, to the extent required for fraud prevention and risk management purposes, as well as to the extent required by applicable laws in order to obtain access to local networks, Airalo will process Partner Personal Data to perform eKYC checks on End Users.

3. Airalo's Personnel

3.1. Airalo will take reasonable steps to ensure that access to Partner Personal Data is limited to those of its Affiliates, employees, agents, and subcontractors who (a) have a need to know or otherwise access Partner Personal Data to enable Airalo to perform its obligations under the Agreement and this DPA, and (b) who are bound in writing by confidentiality obligations sufficient to protect the confidentiality of Partner Personal Data in accordance with the terms of this DPA.

4. Security

4.1. Airalo will establish and maintain sufficient controls to meet certification and attestation for the objectives stated in SOC 2 Type 2 (or equivalent standard) ("Certifications"). At least once per calendar year, an assessment against such standard by an independent third-party auditor will be obtained for environments where Partner Data is stored.

4.2. Airalo will implement and maintain industry standard technical and organizational safeguards, as specified in Schedule 2 attached to this DPA. Partner acknowledges that it is provided access to a shared infrastructure, and that Airalo applies the same technical and organisational safeguards to all partners receiving access to the Ancillary Software. Airalo will review and may change the technical and organisational safeguards to address new and evolving security technologies, changes to industry standard practices, and changing security threats. Partner agrees that Airalo may implement such changes at any time without prior notice, so long as such changes maintain an overall level of security that is comparable or better than the current level. Airalo will make available to Partner the new technical and organisational safeguards upon request or via the Partner Platform.

5. Personal Data Breach

5.1. In the event of a Breach, Airalo will notify Partner without undue delay after Airalo or any Subprocessor becomes aware of such Breach, and provide Partner with sufficient details of the Breach to allow Partner to meet reporting obligations under Data Protection Laws. Airalo may provide such details in phases as they become available. Such notification shall not be interpreted or construed as an admission of fault or liability by Airalo. Airalo shall cooperate, and require any Subprocessor to cooperate, with Partner in the investigation, mitigation, and remediation of any such Breach.

6. Subprocessors

6.1. Partner hereby authorizes the Subprocessors listed at https://trust.airalo.com/ or any successor website ("Trust Portal").

6.2. Partner provides Airalo a general authorisation to engage new Subprocessors, or to modify the scope of the engagement of an existing Subprocessor (both, a "Subprocessor Change"), provided that Airalo shall

6.2.1. enter into a written agreement with each Subprocessor containing the same obligations imposed on Airalo under this DPA and applicable Data Protection Laws with respect to Partner Personal Data; and

6.2.2. remain fully liable to Partner for the acts or omissions of its Subprocessors under the Agreement;

6.2.3. notify each Subprocessor Change at least 30 Days prior to the change becoming effective via the Trust Portal. Partner shall register on the Trust Portal in order to receive any such notification. Partner shall be entitled to object to such change within 15 Days from notification. If Airalo does not receive an objection within such term, the Subprocessor Change will be considered as accepted. If Partner objects, Airalo may choose (i) not to proceed with the Subprocessor Change; or (ii) take reasonable measures to remedy Partner's ground of objection. If neither is possible, or if Partner continues to have a legitimate objection even after either (i) or (ii) have been implemented, Partner shall have the right to terminate the Agreement.

6.3. Airalo shall provide notice of a Subprocessor Change at the email address provided by Partner or - if none is provided - to the Partner business contact responsible for the Agreement.

6.4. In the event a Subprocessor Change is required for urgent reasons outside of Airalo's control (e.g. to ensure the availability of the Services, for security reasons or to meet regulatory requirements), Airalo will execute the Subprocessor Change without prior notice, and notify the Partner as soon as possible thereafter. Section 6.2.3 shall apply accordingly.

7. Data Subject Rights

7.1. Airalo shall provide functionalities that support Partner's ability to correct, delete or anonymize Personal Data from Ancillary Software, or restrict its processing in line with Data Protection Laws. Where such functionality is not available, Airalo will perform the above actions for Partner, in accordance with Partner's instructions.

7.2. At Partner's request, Airalo shall cooperate with Partner in dealing with requests from Data Subjects or regulatory authorities regarding Airalo's processing of Personal Data. If Airalo receives a request from a Data Subject in relation to Personal Data processed by Airalo hereunder, Airalo will notify Partner (to the extent that Data Subject has provided information to identify the relevant controller) via email. Airalo shall not respond to such request but rather redirect the Data Subject to Partner.

8. Deletion or Return of Partner Personal Data

8.1. Unless prohibited from doing so under applicable laws, Airalo shall delete Partner Personal Data from the Ancillary Software within 90 Days from the termination or expiration of the Agreement for any reason. Partner shall be responsible for performing a data export of the Partner Personal Data prior to termination or expiration of the Agreement.

9. Compliance and Audits

9.1. Upon Partner's request, Airalo will provide such assistance as Partner reasonably requires in ensuring compliance with Partner's obligations under applicable Data Protection Laws, including but not limited to any data protection impact assessments and any prior consultations with any regulator where required.

9.2. Airalo will make available to Partner or to its third party auditors reasonable documentation necessary to demonstrate Airalo's compliance with this DPA, as well as any applicable Data Protection Laws. Airalo may make available such information via the Trust Portal. The Trust Portal shall include, without limitation, copy of the Certifications and results of Pen Testing carried out by Airalo on a yearly basis. To the extent Partner has not reasonably been able to satisfy its audit requirements by accessing the Trust Portal, Airalo and Partner will agree to the terms of additional audit atctivities, including pen testing, interviews of Airalo personnel, etc, in such a way as to limit to the maximum possible extent any disruptions to Airalo's operations. For clarity, Airalo is a fully remote company and does not own or manage any physical location that can be included in the scope of any audit.

10. International Data Transfers

10.1. To the extent the Processing includes the transfer of Personal Data from the European Economic Area ("EEA"), the United Kingdom or Switzerland to a country located outside of the EEA which is not subject to an adequacy decision (a "Data Transfer"), such transfer will be subject to the standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as annexed to Commission Implementing Decision 2021/914 ("SCCs"), which are incorporated into this DPA by this reference. The following shall apply:

10.1.1. Module Two (Data Controller to Data Processor) will apply to a Data Transfer when Partner is a Data Controller. Module Three (Data Processor to Data Processor) will apply to a Data Transfer when Partner is a Data Processor. Optional provisions. Where the SCCs identify optional provisions:

10.1.2. in Clause 7 (Docking Clause) – the optional provision applies;

10.1.3. in Clause 9(a) (Use of sub-processors) – Option 2 applies (and the parties will follow the process and timings agreed in the DPA to appoint sub-processors);

10.1.4. in Clause 11(a) (Redress) – the optional provision does not apply;

10.1.5. in Clause 17 (Governing law) – option 1 applies, and where the Agreement is governed by the laws of an EU Member State, the laws of that EU Member State apply; otherwise, Dutch law applies; and

10.1.6. in Clause 18(b) (Choice of forum and jurisdiction) – where the Agreement is subject to the jurisdiction of the courts of an EU Member State, the courts of that EU Member State have jurisdiction; otherwise, the courts of Amsterdam, Netherlands have jurisdiction.

10.1.7. Annexes of SCCs.

10.1.7.1. In Annex 1A: the data exporter(s) is the Partner and its Affiliates making the Data Transfer (the "Data Exporter") and the data importers are Airalo entities receiving the Data Transfer (the "Data Importer"). The full name, address and contact details for the Data Exporter and the Data Importer are set out in the Agreement, or can be requested by either party.

10.1.7.2. In Annex 1B: The: relevant details are those set out in the Agreement, including Appendix 1 "Details of Processing" of this DPA.

10.1.7.3. In Annex 1C: The competent supervisory authority is the supervisory authority applicable to the Partner (or, where relevant, applicable to the Partner's representative).

10.1.7.4. In Annex 2: the security provisions contained in the DSA or other security related provisions in the Agreement apply.

10.2. TRANSFERS SUBJECT TO SWISS DATA PROTECTION LAW. If there is a Data Transfer subject to Data Protection Laws of Switzerland, then the SCCs will apply with the following modifications: the competent supervisory authority in Annex 1.C under Clause 13 will be the Federal Data Protection and Information Commissioner; references to a "Member State" and "EU Member State" will not be read to prevent data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland); and references to "GDPR" in the SCCs will be understood as references to Data Protection Laws of Switzerland.

10.3. TRANSFERS SUBJECT TO UK DATA PROTECTION LAW. If there is a Data Transfer subject to Data Protection Laws of the United Kingdom, then the International Data Transfer Addendum to the SCCs ("UK IDTA"), as issued by the Information Commissioner in the United Kingdom will apply and is incorporated by reference into this DPA. The information needed to complete the Tables to the UK IDTA is set out in the Agreement, including Schedule 1 "Details of Processing" of this DPA.

---

Schedule 1 — Details of Processing

**Subject matter of Processing**

The subject-matter of Processing of Partner Personal Data by Airalo is the provision of the Services pursuant to the Agreement.

**Nature and purpose of Processing**

Partner Personal Data will be Processed as necessary to perform the Services pursuant to the Agreement and will be subject to the processing activities described therein.

**Duration of Processing**

Subject to section 8 of the DPA, Airalo will Process Partner Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.

**Categories of Data Subjects**

The Personal Data Processed concern the categories of Data Subjects identified as "End Users" in the relevant Partner Program Schedule.

**Types of Personal Data**

- Names; - Emails; - IP address; - Log Data; - Other Personal Data requested by Airalo in order to complete eKYC checks, where so required;

**Special categories of Personal Data**

(not applicable)

**List of Subprocessors**

The list of Subprocessors is available on the Trust Portal.

Schedule 2 — Description of Technical and Organization Security Measures

Airalo will implement and maintain technical and organizational measures consistent with relevant industry standards, and to meet its obligations under applicable Data Protection Laws. For example, Airalo will:

1. inform all employees that Partner Personal Data is confidential and subject to contractual and legal protections; 2. instruct employees to access or display Partner Personal Data only in secure locations; 3. require that all devices used to store or transfer Partner Personal Data are encrypted and subject to a strong password policy that requires a password at initial startup and upon waking from sleep; 4. require multi-factor authorization and other account protection as available; 5. prohibit employees from using portable drives to hold Partner Personal Data; 6. protect servers behind a firewall and perform vulnerability tests at least biannually, remediating every 60 Days; 7. use reasonable technical and organizational measures to ensure that Partner Personal Data is (i) encrypted when in transit and at rest in a manner designed to prevent access by third parties without appropriate credentials (including government agencies); and (ii) anonymized or pseudonymized where appropriate in light of the purposes of the relevant Processing activities; and 8. only transfer Partner Personal Data using unique and randomly generated links for sharing files, which automatically expire at a maximum of 10 Days.