HASHCARE SCHEDULE

This Schedule regarding the service "HashCare" ("Schedule") is part of the Agreement entered into by and between the Service Provider and the Customer. Unless otherwise defined herein, capitalized terms shall have the meaning ascribed to them in other documents of the Agreement. The Exhibit "Fees" to this Schedule, as amended from time to time by Service Provider in accordance with this Schedule, forms part of this Schedule.

1. Service Description
   
   

   1.1 Included Services
   
   The HashCare service ("Service") consists of providing Customer support and assistance with regard to the following software, services and other products ("Covered Products"):

   • All software, services and other products of Service Provider that Customer is using (= Category A products);

   • Selected software, services and other products within the Hedera network that Customer is using (= Category B products).

   These Categories are used to define the Service available for the corresponding product category; the applicable service levels and options are defined separately below. If Customer is interested in obtaining support or assistance in a product that falls in Category B, it shall request so from Service Provider, and Service Provider shall confirm its ability to support and assist it; if so, it becomes a Covered Product. 

   The Service for each such Covered Product shall include:

   • Base Support: Service Provider will help Authorized Users of Customers upon request to use the Covered Product, including overcoming technical and other end-user issues as well as incidents and including assistance with analyzing and interpreting transaction data on the Hedera DLT, and preparing corresponding regulatory reports, as per the terms and conditions and as per the multi-tier system described below. The Basic Support is provided either automated or by a human remotely supporting the Authorized Users. 

   Additionally, only for Covered Products of Category A, the Service shall include:

   • Proactive Monitoring and Alerting: Monitoring Covered Products for certain events, and alerting Customer based on defined triggers, as agreed between the Parties. 

   • Soft MAC (Move/Add/Change): Implementing changes, moves and additions of Covered Products, as per Customer's request. 

   • Incident Investigations: In case of security breaches concerning a Covered Product, the Service will include the investigation of such breach, and assistance in recovering from such breach (but excluding legal advice). 

   Furthermore, the Parties may agree on any other Professional Service, to be paid on a time & material basis. The rates and services are further described in the Exhibit.
   
   1.2 Excluded Services
   
   

   The Services expressly exclude:

   • Development and New Features: Any activity aiming at the creation of a particular Deliverable, including the creation or modification of software code, functional enhancements to existing systems, or the programming of new smart contracts and policies.

   • On-Site Support: Physical visits to Customer’s offices, manufacturing plants, or data centers. The Service is provided strictly through remote assistance.

   • Hardware and External Infrastructure: Maintenance or repair of customer-owned physical hardware (laptops, servers, mobile devices), on-premise local area networks (LAN), or third-party cloud hosting subscriptions (e.g., Azure, AWS) managed by Customer.

   • Protocol-Level Defects and Malfunctions: Any faults caused by inherent defects and malfunctions in the underlying Hedera DLT software, protocol-level Mainnet outages, or consensus failures. The Service only serves as a means to report such protocol issues to Hedera for and on behalf of Customer.

   • Incidents due to Customer Negligence: Remediation or recovery from incidents (e.g., security breaches) caused by Customer’s failure to follow reasonable security and other good industry practices, including the mismanagement of private keys or failure to implement multi-factor authentication ("MFA").

   • Third Party Software and Services: Support and assistance with regard to third-party software components and services used by Customer not being Covered Products, even where used for or in connection with Covered Products (e.g., cloud infrastructure, generic DLT libraries). 

   • Compliance Assurance, Legal Advice: While the Service may support Customers' operational resilience objectives and generate information that Customers may want to use for regulatory reporting, the Service is neither intended nor suitable to provide Customer with any form of compliance assurance or auditing under the legal and regulatory obligation applicable to it. The Service shall neither operate or be relied upon as legal or regulatory advice, even where such topics are discussed as part of the Service. Specialized counsel and auditors should be consulted or mandated for such purposes.

   • General Training: Professional training on the general use of blockchain technology, scripting languages, or DLT fundamentals, Hedera products and services, Service Provider and The Hashgraph Group products and services. Accordingly, training for Covered Products is not part of the Service.

   Customer shall not provide Service Provider with information that Customer considers business critical information or client identifying information ("CID"), or that is otherwise subject to special regulatory and secrecy obligations. In the context of the Service, and unless set forth otherwise by Customer, the Parties agree that Service Provider is not a critical ICT third-party as per DORA and similar regulations concerning operational risk and resilience (in such case, additional charges may apply).
   
   
   

2. Service Delivery
   
   

   2.1 Implementation

   Once the Parties have agreed on the Service, Service Provider shall within four (4) weeks (but in any event prior to the Service Start Date) provide Customer with the necessary instructions and information to enable Customer to onboard those Authorized Users that Customer is eligible and intends to offer access to the Service. It is the responsibility of Customer to (a) register these Authorized Users within the Service Provider's system used for handling Trouble Tickets, (b) instructing them appropriately, and (c) managing Authorized Users within the system (changes, suspensions, etc.). Customer shall complete these activities on or before the agreed Service Start Date, if any.
   
   

   2.2 Provision of Service

   Should an Authorized User wish to obtain Base Support, or any other part of the Service that are provided upon Customer request (i.e. Soft MAC, Incident Investigations), the Authorized User shall create a corresponding Trouble Ticket through the Service Provider's designated online portal or submit a support request via a designated support email address (in the latter case, Service Provider will create a Trouble Ticket and any further interaction will occur through such Trouble Ticket) (each such request shall be a "Customer Ticket"). Customer shall ensure that Authorized Users follow Service Provider's guidelines for issuing and using Trouble Tickets.

   
   Upon creation, the Trouble Ticket will be logged, assigned a unique identifier, and classified by Severity Level. The Service Provider will then proceed with troubleshooting and resolution efforts and other provision of Service in accordance with the Support Levels and the applicable SLA. The Customer will be kept informed of the status of the Trouble Ticket through the portal.

   
   Furthermore, the Parties shall agree on the modalities, events and triggers of the Proactive Monitoring and Alerting Service component described above. 
   
   
   

   2.3 Support Levels

   Service Provider shall provide Service by way of tiered structure as follows, with Level 0-2 permitting the Authorized Users to escalate to the next level should their issue not be resolved in a reasonable manner or time:

   1. Level 0 (Self-Service Support): Authorized Users will receive automatically generated responses to their inquiry and follow-ups via an AI-powered system, with a view to efficiently handle and resolve routine questions in a self-service manner. Customer understands and accepts that while such a system can be very efficient, also from an end user perspective, it may produce errors or providing wrong advice. Therefore, Authorized User can at any time escalate the matter to a human operator and will do so where reliance on the response may have relevant negative effects.

      • Level 1 (End User Support): First level (human) support, with support operators being assisted in providing their support by the use of AI-powered system.

      • Level 2 (Technical Support): Second level support, deep-dive troubleshooting (e.g. verifying transactions on HashScan), handling of complex wallet connection issues, and validation of bugs. The support operators have technical knowledge ("Technical Bridge").

      • Level 3 (Engineering Support): Third level support. This is used to address confirmed system faults, API failures, infrastructure issues and other confirmed incidents, defects and malfunctions. The support operators are engineers ("Engineering Interface").
        
        

      Service Provider does not guarantee that it will be able to resolve a Trouble Ticket. If this is not possible in a particular case, or where it otherwise appears adequate, it may and shall pass along the request or issue to a third party technical support or ecosystem participants. Service Provider undertakes no responsibility for such third parties.

      Customer agrees that Service Provider may pass along to such third parties any information provided by Customer in connection with the Trouble Ticket at hand (or related Trouble Tickets by Customer) without further notice, approval or measures (e.g., NDA), unless expressly agreed otherwise between the Parties in each instance. Hence, Customer undertakes to only provide Service Provider with its Trouble Ticket information that may be shared with such third parties, and in particular no personal data where this would not be permitted on a controller-controller basis and to any country world-wide. Customer understands and accepts that any such third parties, including Hedera, are not processors or otherwise under control of Service Provider, and will process the information received and act upon it or not under their own responsibility. Service Provider is not in any way responsible for or supervise them.
      
      

3. SERVICE LEVEL AGREEMENT (SLA)
   3.1 Severity Levels

   The Customer shall, upon submission of a Trouble Ticket, propose a Severity Level for the matter. The Service Provider may, at its discretion and without notice, re-classify the Severity Level based on the definitions below.

3.2 Response Times

The Service Provider shall use commercially reasonable efforts to meet the Response Times set forth below, which are determined by the Velocity Overlay agreed by the Parties. Response Times are measured within the Customer's selected Operational Window (see below).

3.3 Resolution

The Service Provider aims at resolving Trouble Tickets in a timely manner, in view of the applicable severity. Where a resolution of an incident, issue, defect or malfunction is not possible or not within a reasonable time frame, Service Provider shall help Customer to find an acceptable workaround solution. Any resolution times communicated are good-faith estimations and are not contractually binding in any manner, even if documented in a Trouble Ticket or other communication.

Customer understands and accepts that Service Provider's ability to respond and resolve Trouble Tickets depends on third parties, their services and products, external networks, protocols, mirror nodes and wallets, and that they are outside of Service Provider's control. In particular, Service Provider will usually not be able to resolve issues related to protocol-level outages and third-party wallets.

3.4 Non-Compliance

In case of a repeated breach of the agreed service levels or subscription tiers within the sphere of responsibility of Service Provider, the Parties shall enter into good faith discussions with a view to resolve such breaches going forward. In case of material repeated breaches over a period of two consecutive months, Customer has a right to extraordinarily terminate the Service. Any other remedies for breach of service levels are excluded.

4. SUBSCRIPTION TIERS AND OVERLAYS
   
   4.1 Base Subscription Tiers

   The Customer shall select in the Order Form one of the following Base Subscription Tiers, which defines the Operational Window for the Service (if none is defined, "Silver" applies):

   • Bronze: 8x5 (09:00-17:00 CET on a Business Day).

   • Silver: 8x7 (09:00-17:00 CET on any Day).

   • Gold: 24x7x365, provided via a Follow-the-Sun model.

   • Managed: 24x7x365, including a Dedicated NOC and custom services as agreed in the Order Form.
     
     

   4.2 Velocity Overlays

   The Customer shall select in the Order Form in addition to the Base Subscription Tier one Velocity Overlay (if none is defined, "Standard" applies), which defines the Response Time commitments as per Section 3.2.

   • Standard Overlay: Standard response speed, Response Time as specified in Section 3.2.

   • Advanced Overlay: Accelerated response speed, Response Time as specified in Section 3.2.

   • Premium Overlay: Fastest available response speed, Response Time as specified in Section 3.2.

   • Managed Overlay (if applicable) Response Time as defined in the Order Form.

   
   

   
   

5. CUSTOMER RESPONSIBILITIES

In addition to the obligations set out in the GTC, the Order Form and otherwise in this Schedule, the Customer shall:

• Provide the Service Provider with all necessary information, documentation, and system access required to diagnose and resolve Trouble Tickets.

• Designate and maintain a qualified primary contact person for all communications related to the Services, including management of Authorized Users.

• Cooperate in a timely manner with the Service Provider's support personnel.

• Define up to three (3) Authorized Users that may raise Trouble Tickets in connection with the Service.
  
  

6. FEES AND TERM

   6.1 Fees

   Customer shall pay the Fees for the Service as agreed on the Order Form and, to the extent the Order Form provides no deviating agreement, as set out in the Exhibit (if applicable):

   • The fixed recurring fees for the Service in view of the agreed Base Subscription Tier and Velocity Overlay shall be paid by Customer monthly in advance, starting on the Service Start Date. They are due irrespective of whether the Service is actually consumed by Customer.

   • The variable fees shall be paid by Customer monthly in arrears, upon a corresponding invoice of Service Provider, based on the number of Customer Tickets opened with regard to Customer in a particular month, as recorded by Service Provider, starting on the Service Start Date. The same shall to any time & material fees the Parties may agree for certain Services, such as Professional Services. 

   • Any one-time fees agreed are to be paid in advance of the performance of Service for which they have been agreed.

   
   6.2 Price Adjustment

   The Service Provider reserves the right to adjust the prices for the Services set forth in the Order Form and the Exhibit upon three (3) months prior written notice to Customer. If Customer disagrees to a price adjustment, and the price adjustment cannot be justified by factors beyond the control of Service Provider, Customer may terminate the Service within thirty (30) day written notice.

   
   

   6.3 Term

   The initial subscription term for the Services is twelve (12) months from the Service Start Date. The subscription shall automatically renew for successive twelve (12) month periods unless either Party provides written notice of non-renewal at least ninety (90) days prior to the end of the then-current term.
   
   
   

7. Data Protection And Data Usage
   
   

   7.1 Controller

   Service Provider shall act as a Controller with regard to the Trouble Tickets and any Personal Data contained therein or provided to Service Provider in connection with the Service. The Section on Controller-to-Controller Clauses contained in Annex C (Data Processing Addendum) of the GTC shall apply to relevant transfers of Personal Data from Service Provider to Customer as per that Section.

   Customer will inform Authorized Users and other Data Subjects (the Personal Data of which it discloses to Service Provider) of the identity of Service Provider and its privacy notice, and ensures that Service Provider is permitted to process their Personal Data in line with its privacy notice.

   
   7.2 Processor

   Service Provider shall act as a Processor on behalf of Customer with regard to the following activities, for which Annex C (Data Processing Addendum) of the GTC shall apply and govern:

   • The management of Authorized Users within the console operated by Service Provider for Customer; and

   • Any support- or assistance-related Personal Data Processing activities that Customer asks Service Provider to undertake, and Service Provider accepts.

   For the purposes of Annex C (Data Processing Addendum) of the GTC, the Processing is defined as follows:

   • Subject matter/purpose of the Processing: Provision of the Service in accordance with this Schedule and the Agreement.

   • Categories of Data Subjects: Customer's employees, contractors, agents, and other personnel designated as Authorized Users or as primary contact person, and any other individuals whose Personal Data is submitted by or on behalf of Customer to Service Provider in connection with the performance of the Agreement.

   • Categories of Personal Data: Contact and administration data (including name, email address, user ID, authentication credentials, and system usage logs) and support data (including the foregoing user administration data, and any other Personal Data contained within Trouble Tickets, correspondence, and other information provided by Customer to Service Provider in connection with the performance of the Agreement).

   • Special categories of Personal Data and any special measures: Not applicable. Processing of special categories of Personal Data is not planned.

   • Duration of the Processing: For the duration of the Agreement.

   • Nature of the Processing: Collection, recording, modification, structuring, storage, retrieval, consultation, disclosure, dissemination, combination, comparison, restriction, erasure and communication.

   • Approved Sub-Processors of Service Provider: The approved Sub-Processors engaged by Service Provider are listed at [URL link Sub-Processors List]. Customer hereby confirms that as of the date hereof, it is aware of this list and consents to the engagement of the Sub-Processors mentioned therein.

   Where the EU SCC apply, Annex I.A (in relation to the Processing activities relevant to the Personal Data transferred) and Annex I.B. shall consist of the following information:

   • Activities relevant to the data transferred under these Clauses: As specified in "Subject matter/purpose of the Processing" above.

   • Categories of Data Subjects whose Personal Data is transferred: As specified in "Categories of Data Subjects" above.

   • Categories of Personal Data transferred: As specified in "Categories of Personal Data" above.

   • Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: Not applicable. Processing of special categories of Personal Data is not planned.

   • Frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Continuous and ongoing basis.

   • Nature of the Processing: As specified in "Nature of the Processing" above.

   • Purpose(s) of the data transfer and further Processing: Service Provider will process the Personal Data to provide, maintain, and support the Service as set out in this Schedule and the Agreement.

   • Period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period: Personal Data is usually kept for the duration of the Agreement and for a subsequent period of ten (10) years (or longer if required for legal, compliance, evidential or archival reasons).

   • For transfers to (Sub-)Processors, also specify subject matter, nature and duration of the Processing: The subject matter, nature, and duration of the Processing by approved Sub-Processors are as set forth at [URL link Sub-Processors List]. Customer hereby confirms that as of the date hereof, it is aware of this list and consents to the engagement of the Sub-Processors mentioned therein.
     
     

   7.3 Further Use of Data

   Customer agrees that Service Provider may use Trouble Ticket and case-related information for improving and further developing its own systems, including AI systems and models it uses and including for the benefit of enhancing the Service, provided that Service Provider and its subcontractors and suppliers are bound by confidentiality with regard to such confidential information.
   
   

8. DEFINITIONS

   1. "Business Day" means any day from Monday to Friday, excluding public holidays in Pfäffikon SZ, Switzerland.

   2. "Follow-the-Sun" means a service model where support responsibilities are passed between Service Provider's global service centers with an aim to provide continuous 24x7 coverage.

   3. "NOC" means Network Operations Center.

   4. "Operational Window" means the hours during which Provider undertakes commercially reasonable efforts to make available the Service to Customer, as determined by the selected Base Subscription Tier.

   5. "Resolution Time" means the time elapsed from the initial acknowledgement of a Trouble Ticket by Service Provider until the issue is resolved.

   6. "Response Time" means the time elapsed from the submission of a Trouble Ticket by the Customer until Service Provider provides an initial acknowledgement and begins work on the issue.

   7. "Severity Level" means the classification of a reported issue according to its business impact, as defined in Section 2.1 of this Schedule.

   8. "Trouble Ticket" means a record created in Service Provider's helpdesk system to document and track a reported issue.

Exhibit: Fees

All prices are in USD and exclusive of any applicable taxes (e.g., VAT).

Recurring Fees

The monthly recurring fees are composed of a Base Subscription Tier fee and a Velocity Overlay fee:

• Base Subscription Tiers

The Customer pay the monthly fee as set out on the Order Form for the selected Base Subscription Tiers, which defines the Operational Window for the Service.

• Velocity Overlays

The Customer pay the monthly fee as set out on the Order Form for the selected Velocity Overlays, which defines the Response Time commitments.

Variable Fees (Per-Ticket Pricing)

Variable fees are based on the monthly volume of Customer Tickets. The price per ticket is determined by the committed monthly volume, as set out on the Order Form:

• Minimum Commitments:

• Bronze Tier: 250 Customer Tickets per month.

• Silver Tier: 500 Customer Tickets per month.

• Gold Tier: 1,500 Customer Tickets per month.

• Managed Tier: ≥ 1,500 Customer Tickets per month.

Overage Uplift: Customer Ticket volumes exceeding the monthly commitment by up to 20% in a given month shall treated as a permitted tolerance band and shall not trigger any surcharge. A surcharge of +10% to the applicable band price applies if Customer Ticket volumes exceed the monthly commit by more than 20% without 30-day prior notice (the surcharge on the price per Customer Ticket of the relevant band only applies to those tickets that are above the 20% committed volume). If overage consistently exceeds the monthly commit for three consecutive months and falls into a new band, the monthly commitment and price band will be adjusted accordingly going forward. 

• AI Deflection Rider: If the use of AI and other self-service channels accounts for less than 50% of the total Customer Ticket volume in a given month, a surcharge of $1.50 per ticket will be applied, and Service Provider is entitled to a corresponding adjustment of the fees, which the Parties will agree in good faith.

Additional Services

For professional services, the following rates apply on a per-day basis as set out on the Order Form: