VERION-B2B-2026-10-17-v3 Framework agreement for VERION advisory and analysis services 1 Parties and individual order The provider is Giulio Focardi, trading as VERION GROUP, Maximilianstraße 2, 80539 Munich, Germany, email info@verion.group. The customer is the business identified in the order or individually agreed mandate. The person placing the order represents that business and confirms authority to do so. Taking part in a review does not make a participant liable for the order price. This agreement applies only to business customers under section 14 of the German Civil Code and public law entities or funds. A paid mandate requires separate confirmation of its project, participants and final total. An account or invitation alone does not create a paid mandate. 2 Services and deliverable VERION supports decisions about specific business changes by analysing participants, their collaboration and implementation risks supported by the available information. Each mandate identifies the context, decision question, participants and service scope. A full review includes the analyses specified for that scope, a decision brief with reasoned options, and risk and action guidance to the extent supported by the available information. VERION owes professional performance of the agreed services and delivery of the agreed outputs. No particular commercial outcome, certain prediction of future behaviour or accuracy of incorrect customer inputs is guaranteed. Statutory defect remedies applicable to an agreed deliverable remain intact. Legal, tax, investment and medical advice are outside the scope. Results are provided in the protected dashboard. A full review is scheduled for provision within 48 hours after all required participant inputs, verified payment and the necessary use and processing rights are available. VERION promptly communicates identified obstacles and a revised delivery time. Agreed binding dates and statutory delay remedies continue to apply. 3 Free test and paid mandate An expressly free test costs EUR 0. The number of participants within its confirmed scope does not by itself create a charge. Only the result areas specified for the test are released. There is no subscription, automatic conversion to a paid mandate or automatic card charge. Continuing a test as a full review, a direct full review and a new review each require a separate order. Any retained participants or data are shown before ordering. Extra services, workshops, ongoing advisory work and additional analyses require express agreement. 4 Cooperation and responsible use The customer appoints an authorised contact, verifies the project scope and provides accurate information necessary for the agreed purpose. Participants must be able to submit their own answers. Missing cooperation may delay delivery; VERION identifies the information needed and, where appropriate, sets a reasonable deadline. The customer establishes a lawful basis for employee and other participant data and fulfils its information duties and applicable employee representation requirements. A checkout declaration replaces neither individual information nor a data processing agreement where required. VERION remains responsible for its own legal obligations. A qualified authorised person must assess results in context. Results must not be the sole basis of an automated employment decision having legal or similarly significant effects. Covert monitoring, medical diagnosis and unlawful inference of specially protected personal characteristics are prohibited. 5 Confidentiality and results Both parties keep non-public business, project and participant information confidential. Access is limited to people and lawfully engaged providers who need it to perform the contract and are subject to appropriate confidentiality duties. Legally required disclosure is permitted, with notice to the other party where lawful. This duty does not cover information the recipient can demonstrate was lawfully public, independently developed or lawfully received from another source. It survives termination while a legitimate confidentiality interest remains. The customer retains its rights in supplied content. After full payment it receives a non-exclusive right of unlimited duration to use released deliverables for its internal business purposes, including disclosure to professional advisers bound by confidentiality. Participant rights and legal restrictions remain intact. VERION methods, software and general know-how are not transferred. Resale or public publication of personal assessments is not included. 6 Applicable documents and completion Individually negotiated terms prevail. Otherwise the confirmed order, this framework agreement, the incorporated general terms and supplementary platform terms apply. A separately concluded Article 28 GDPR data processing agreement takes priority within its scope. Privacy notices explain processing and do not constitute blanket consent. The United States, Australia, mainland China and Singapore supplement prevails to the extent its specified mandatory rules apply to the actual case. A mandate ends after the agreed services have been performed and does not renew automatically. Any separately agreed platform access lasts for the period and scope stated in the order. Indefinite hosting is not promised. Statutory termination and withdrawal remedies, and resulting payment or reimbursement entitlements, remain governed by applicable law. General terms and conditions for business customers 1 Scope and provider These terms apply to contracts expressly incorporating them with Giulio Focardi, trading as VERION GROUP, Maximilianstraße 2, 80539 Munich, Germany, info@verion.group. Services are offered exclusively to business customers as defined in the framework agreement. Conflicting customer terms apply only if expressly accepted by VERION. Individually agreed terms prevail. 2 Online ordering and contract formation Product descriptions and prepared projects invite the customer to submit an offer. Before a paid order the customer can review and correct the project, question, participants, billing identity and price using the provided editing steps. The details shown immediately before payment, including net price, tax and total in EUR, determine the order. By expressly accepting the contractual documents and finally submitting the paid order, the customer makes a binding offer. Opening the payment form alone does not conclude a contract. VERION accepts by confirming the paid and activated mandate or commencing the agreed paid services. A purely technical payment or access message without acceptance of the mandate is not acceptance. A free test is accepted through confirmation of its start or activation. Contract documents can be accessed and saved before the declaration. The stored acceptance receipt can be retrieved in the system; it records the declaration and is not by itself acceptance of a paid mandate. The contract language is German; an English reading version assists understanding. Another contract language may be individually agreed. 3 Fees and payment The fee is set by the individual quote displayed and confirmed. A stated minimum is not a flat fee for every mandate. The final total includes applicable tax or identifies the applicable tax treatment before payment. The price for an ordered scope is not unilaterally changed afterwards. The free test is not charged and creates no subscription. A full mandate requires a separate paid order. Payment uses the methods offered at checkout, currently a credit card without a wallet. Unless individually agreed otherwise, payment is due on contract formation; paid access requires successful verification. If the offer is not accepted, captured funds are refunded and unnecessary authorisations released. Payment does not waive objections or statutory remedies. Set-off is allowed for undisputed or finally adjudicated claims and claims arising from the same contract. Statutory retention rights remain intact. 4 Scope and changes The framework agreement and individual mandate define the services, limitations and cooperation duties. Findings without sufficient support are identified as uncertain or open, rather than promised as facts. The customer evaluates their suitability for its decision. Changing participants, the question or the project after ordering may require a new analysis and quote. Additional charges require express agreement. Maintenance and necessary security changes must not materially undermine the agreed service; significant planned restrictions are announced appropriately. A particular availability level requires separate agreement. 5 Complaints and statutory rights The customer should report identifiable errors or deviations to info@verion.group, including the project reference where possible. VERION investigates and remedies defects under the applicable statutory rules. Failure to report immediately does not create a blanket forfeiture of remedies. Mere use is not deemed acceptance of a defective deliverable and there is no blanket exclusion of refunds. 6 Liability VERION has unlimited liability for intent, gross negligence, culpable injury to life, body or health, assumed guarantees and mandatory statutory liability, including fraudulent concealment of defects. For ordinary negligence affecting an essential contractual obligation, liability is limited to the foreseeable damage typical for the contract at formation. Essential obligations enable proper contractual performance and are those the customer ordinarily relies on. Other ordinary negligence liability is excluded. Mandatory claims, particularly data subject claims under Article 82 GDPR, are not restricted. These rules also apply to legal representatives and persons used to perform the contract. 7 Duration and amendments The confirmed order determines duration. Use alone creates neither an automatic renewal nor a subscription. Statutory termination rights, especially for good cause, and the resulting fee and refund rules remain intact. New terms do not retroactively change existing orders. Amendments require a valid agreement; silence or continued use alone is not acceptance. Each online acceptance is recorded with the relevant document version and order reference. 8 Governing law and jurisdiction German law applies, excluding the UN Convention on Contracts for the International Sale of Goods, subject to mandatory applicable law. Exclusive jurisdiction at the provider’s place of business is agreed only where a jurisdiction agreement is valid under section 38 of the German Code of Civil Procedure. Otherwise statutory jurisdiction rules apply. Invalid terms have the consequences prescribed by section 306 of the German Civil Code. The remainder remains effective to the extent provided by law; an invalid term is not automatically replaced by the most economically expansive permitted term. Terms of use for the VERION platform 1 Access and roles These terms govern access by authorised customer representatives and invited participants. The provider is Giulio Focardi, trading as VERION GROUP, Maximilianstraße 2, 80539 Munich, Germany, info@verion.group. Use does not make a participant the paying customer. Participant access does not require an individual paid mandate. Credentials, invitation links and one-time codes are personal and confidential. They must not be shared with unauthorised people. Users may use only their assigned access and must answer personal questions themselves. Suspected unauthorised use should be reported promptly. 2 Permitted purpose and data Use is limited to the confirmed business purpose and assigned role. Users may enter only necessary data supported by a lawful basis. Unlawful content, deliberately false information, circumventing access restrictions, malicious software and extracting other customers’ projects are prohibited. Health information, diagnoses, intimate information, criminal offence data and other specially protected details must not be entered in free text without an expressly agreed lawful process. Declarations on behalf of another person require appropriate authority. 3 Understanding results and human review VERION may use rule-based and AI-supported processing for analyses and text. Results depend on submitted information, the confirmed context and available evidence. They may be incorrect, incomplete or context-dependent; uncertainty and open questions must be considered. Results support qualified human decisions. They must not be used as a medical diagnosis, a certain prediction or the sole basis for automated decisions significantly affecting individuals. Employment, privacy, equality and applicable employee representation requirements must be assessed before such use. 4 Visibility and disclosure Customer representatives and participants see only the areas released for their roles and scope. Participation does not promise anonymity from all other project participants. Participants must receive information about the actual recipients and purpose before submitting data. Results may be disclosed only to people authorised for the project purpose. Personal profiles must not be published, sold or reused for another purpose without a lawful basis. Software and method rights remain protected, without excluding mandatory statutory user rights. 5 Security and suspension Where there are concrete signs of serious misuse or a security incident, VERION may temporarily restrict affected access to the extent necessary and proportionate. Affected users are informed of the reason and available remedies unless security or law prevents this. Permanent restriction requires a valid reason; existing contractual and statutory rights remain intact. The framework agreement and general terms govern the customer’s service rights. These platform terms create no additional fees and do not limit participants’ statutory rights, particularly privacy rights. Silence or use alone does not accept amendments. Privacy notice for project and contract administration 1 Contact and roles Giulio Focardi, trading as VERION GROUP, Maximilianstraße 2, 80539 Munich, Germany, info@verion.group is the controller for its own contract, communications and account administration. No data protection officer is designated in this notice. Privacy enquiries can be sent directly to that address. Roles for participant data processed for the customer’s project purpose must be established before processing. Where VERION acts on the customer’s documented instructions, the customer is controller and VERION is processor, requiring a separate Article 28 GDPR agreement with the actual operational annexes. Joint determination of purposes and essential means requires a separate appropriate arrangement. Acceptance of commercial terms does not establish these roles. 2 Data and purposes Business and contact information, permissions, project descriptions, participant assignments, billing information, price and payment references and necessary security and acceptance records are processed to establish, perform and document contracts. An acceptance receipt records the account and order, time, business representation declaration, document version and its content. It contains no full card details. Reviews may process answers, role descriptions and derived assessments relating to identifiable people solely for the previously established lawful project purpose. Acknowledging this notice does not authorise marketing, sale of participant data or independent training of general models. Specially protected data is not intended to be entered without an expressly agreed lawful process. 3 Lawful bases and necessary information Processing necessary for VERION’s own contract with an individual is based on Article 6(1)(b) GDPR. For business representatives who are not personally the contracting party, Article 6(1)(f) ordinarily supports business communication and administration. Statutory bookkeeping and retention duties rely on Article 6(1)(c). Necessary security and legal records serve legitimate interests in secure operation and exercising legal claims under Article 6(1)(f). The controller establishes the lawful basis for employee and other participant data in light of the actual use, including section 26 of the German Federal Data Protection Act where applicable. The customer is not deemed to consent on behalf of all participants. Without information necessary for administration or analysis, the relevant service may be unavailable or limited. 4 Recipients and technical services Access is restricted to authorised provider personnel and customer representatives released for the confirmed project purpose. Participants are not promised blanket anonymity. The customer must explain the actual purpose and authorised recipients before participation. The VERION application runs on a DigitalOcean Droplet located in Frankfurt am Main. This confirmed application location does not establish that all providers, support access, backups and downstream processing remain exclusively in Germany or the EU. OpenAI is used for AI-supported processing and text generation. Brevo is used for invitation and transactional messages. Only information needed for the relevant processing step should be transmitted. Actual contractual data regions, subprocessors and retention settings require separate documentation; this notice does not promise a specific residency arrangement or zero-day retention. Stripe provides payment processing and the invoice creation implemented in the system. Lexware is used for bookkeeping and invoice administration; MiracleSync transfers invoices from Stripe to Lexware. Relevant information includes business and billing recipient details, necessary contacts, amounts, tax information and payment and invoice references. Confidential participant answers and individual analytical reports are outside this billing purpose. Stripe may act as an independent controller for certain processing, including its own statutory payment and security duties. Provider roles must be assessed per activity and contractual relationship. Apollo and FullEnrich are used to find, verify and enrich business contact information for prospecting. Matching may involve names, business roles, companies, domains and public professional profiles and return business contact information. Querying, matching, transferring and enriching personal data are processing activities; these services are not categorically recipients that process no data. Prospecting is separate from analysis of confidential participant answers. Depending on the service and its own databases, a provider may act as processor or independent controller. Actual roles require documentation against the applicable contracts and settings. The actual contracting entities, data regions, other recipients, relevant provider agreements and transfer safeguards must be fully documented, including in a data processing agreement where required. Confirmation that a service is used does not prove execution of a particular DPA. Third-country transfers must meet Articles 44 onwards GDPR; acknowledging this notice does not replace the necessary safeguards. 5 Retention and deletion Accounts, project data and contract records are processed only while necessary for their purpose or required by statutory retention rules or valid legal defence needs. Accounting records follow the applicable tax and commercial retention periods. Participant data is deleted or returned under the project’s separately established instructions and periods; this notice does not permit unlimited retention. The actual deletion, backup and return process must be established against operational practice before processing begins. Statutorily restricted retention must be separated from further analytical use. 6 Rights and complaints Subject to statutory conditions, people may request access, correction, deletion, restriction and portability and object on grounds of their particular situation to processing based on Article 6(1)(f). Actual consent may be withdrawn prospectively at any time. Requests concerning customer-controlled processing are directed to the relevant controller or handled on its instructions. People may complain to a competent supervisory authority, particularly where they habitually live, work or where an alleged infringement occurred. The Bavarian State Office for Data Protection Supervision is a possible contact for private-sector controllers in Bavaria. VERION results are intended for human review; decisions based solely on automation with legal or similarly significant effects are outside the agreed purpose. Mandatory local provisions for the United States Australia China and Singapore 1 Applicability and priority These provisions override conflicting general terms only to the extent the relevant mandatory law applies to the actual mandate or processing activity. A billing address or nationality alone does not establish a person’s location or the application of every privacy law. The provider remains responsible for its own duties; a blanket provider declaration does not replace the customer’s statutory obligations. 2 United States The agreed use is advisory support for business changes. Supplying or using personal reports to evaluate individuals for hiring, promotion, reassignment or termination is outside this mandate. Such a change of purpose is a different service scope and requires the procedures then mandated before that use begins. Calling a service advisory does not determine the legal treatment of a different actual use. Non-waivable rights under applicable federal and state law remain intact. This supplement does not assert that every state privacy statute applies to every customer or that its applicability conditions have already been established. 3 Australia Where mandatory guarantees and remedies under the Australian Consumer Law apply, business-customer status, German governing law, limitations on results and the general liability clause do not exclude or restrict them. The provider owes the legally required care and skill, legally required fitness and timely supply. Statutory remedies, cancellation, refunds and damages remain available to their statutory extent. A business may qualify for these protections. Coverage depends on the statutory conditions, including the applicable AUD 100,000 monetary threshold including GST and other statutory grounds. If a customer subject to the Australian Privacy Act discloses personal information to VERION overseas, that disclosure must meet the applicable APP 8 requirements. The provider assists the necessary safeguards and supplies the relevant recipient and processing information. Accepting this agreement is not consent to waive the exporter’s statutory accountability. 4 Mainland China For processing of people located in mainland China within PIPL scope, understandable advance information about controllers, purposes, data, retention and rights must be provided. The business customer’s acceptance does not replace a required individual’s separate consent to an overseas transfer; statutory exceptions depend on their actual conditions. Where prescribed, the impact assessment and applicable export requirements must be completed before processing. Statutory exemptions effective since 2024 from security assessment, standard contracts or certification must be considered. Neither a universal filing requirement nor an exemption without its conditions is asserted. If VERION falls within Article 3(2) PIPL’s extraterritorial scope, VERION must designate the local entity or representative and make the notification required by Article 53. This supplement appoints no unconfirmed representative and replaces no actual export documentation. Required entrusted-processing agreements and onward-delegation permissions must be in place. 5 Singapore A transfer of personal data out of Singapore subject to the PDPA must ensure the prescribed, at least comparable protection at the overseas recipient under a permitted basis. Where contractual safeguards are relied on, VERION undertakes at least comparable protection for the relevant data; processing countries and territories and permitted onward transfers must be identified in the actual transfer documentation. A confirmed server location alone does not supply that documentation. When acting as the customer’s Data Intermediary for this processing, VERION processes for the purpose documented in writing, provides appropriate protection, ends retention that is no longer required and informs the customer of known data breaches without undue delay. The customer retains its own statutory responsibilities. The Business Contact Information exception applies only to the business contact details covered by the statute. It does not turn participant answers, behavioural analyses or profiles into exempt contact information merely because the customer is a business.