Master Services Agreement

01Agreement overview

1.1. Services and definitions. The MSA governs provision of Synci account data services to the Customer. Account Information means aggregated information on one or more payment, investment or other financial accounts held by end users of the Customer's products (End Users) with banks, brokerages, exchanges or other account servicing providers (Institutions). The Services comprise programmatic access to Account Information through the Synci API, together with related functionality including transaction deduplication, optional transaction enrichment, webhook delivery, a hosted connection portal where applicable, and dashboard access. The Services are a data layer for the Customer's own products. An Order Form is a document signed by both Parties that identifies the Customer, the selected Services and the applicable customer-specific and commercial terms and expressly incorporates this MSA. The Agreement consists of this MSA, all Order Forms in force between the Parties, and the DPA where applicable under Clause 4.2.

1.2. Account Information is retrieved from Institutions through third-party connectivity providers with which Synci contracts (Upstream Providers), currently including GoCardless SAS for supported bank connectivity and SnapTrade (Passiv Inc.) for supported brokerage and crypto connectivity, and only with the relevant End User's consent through the consent journey required by the applicable Upstream Provider and Institution. Availability depends on the selected Services, territory, Institution and provider.

1.3. Regulatory status. Synci is a technical service provider. Synci is not a licensed payment institution, account information service provider or credit institution, and does not itself provide regulated account information services. Where a regulated account information service is involved, it is performed by the appropriate Upstream Provider under its own authorisation and supervision. The Customer shall not represent otherwise to any person. An attribution badge or other reference to Synci must not imply that Synci provides a regulated service.

1.4. Service model. The Order Form specifies which of the following models applies to the Customer's use of the Services and determines the data protection roles in Clause 4:

1.4.1. Managed Apps Model: the Customer registers End Users through the Managed Apps API; End Users connect Institutions through a Synci-hosted portal branded for the Customer's product, without opening a Synci subscription account; the Customer is controller, Synci is processor, and the DPA applies; or

1.4.2. Platform Model: the Customer integrates the Services into its own product under its own credentials and consent journey; Synci and the Customer act as independent controllers and the DPA does not apply solely by reason of this model.

1.5. Incorporation and eligibility. An Order Form may identify a specific MSA version or incorporate the MSA by reference to https://synci.io/msa, in which case the accepted version is the one published there on the date of its last signature. An Order Form is binding when signed by both Parties. An Order Form may cover one or more applications or a defined service scope. The Customer warrants that it is a registered business and that its signatory is authorised to bind it. This MSA does not govern self-serve subscriptions that do not expressly incorporate it.

1.6. Publication and versions. Synci publishes the current MSA at https://synci.io/msa and makes every published version available from a stable version-specific link shown on that page, together with its effective date and change log. Synci retains copies of prior versions. The version accepted on signature continues to govern until a later version takes effect in accordance with Clause 12.6.

1.7. Order of precedence. In the event of inconsistency, the following order applies: (a) the applicable signed Order Form, including an expressly negotiated deviation; (b) for the processing of personal data only, the DPA incorporated under Clause 4.2; and (c) this MSA. Despite that order, the express timing rule in Clause 4.8 prevails over the DPA's deletion timetable to the extent stated in Clause 4.8. An Order Form cannot waive mandatory data protection or international transfer requirements.

02The Services

2.1. Scope. The Order Form sets out the selected service model, applications, enabled options and Fees. The standard functionality and operational conditions of the Services are stated in this MSA. Customer-specific configurations and instructions are in the Order Form. Except as stated otherwise, capitalised terms have the meanings given in this MSA.

2.2. The Parties may agree by email to enable or disable supported optional services, including High-Frequency Sync, transaction enrichment and Business Support, or to adjust application settings. No express permission in the Order Form is required for these changes. Changes to prices, bands, minimums, price locks, negotiated deviations or other fixed commercial terms require mutual written acceptance as an Order Form amendment or replacement. A replacement Order Form does not restart the Agreement term unless expressly agreed.

2.3. The Customer acknowledges that the provision of the Services depends on the Institutions and the Upstream Providers. Synci cannot guarantee the availability or quality of data or features that are outside of Synci's control, including Institution downtime, changes to Institution interfaces, consent validity periods and data history limits set by Institutions, and changes imposed by Upstream Providers.

2.4. Access to the Services is provided through the Synci API, using authentication credentials (API tokens and/or OAuth client credentials) issued to the Customer. The Customer is responsible for keeping its credentials confidential and secure, and for all activity under its credentials.

2.5. Changes to the Services. Synci may modify or improve the Services from time to time. Synci gives the Customer at least 90 (ninety) days' written notice of any breaking change to, or deprecation of, an API version, endpoint, field or webhook event that the Customer uses, unless the change is required by law, by a regulator, by an Upstream Provider, or to address a security vulnerability, in which case Synci gives as much notice as circumstances permit.

2.6. Standard support and service levels. Synci provides email and chat support on a reasonable-efforts basis during ordinary business hours in Norway. No guaranteed uptime or availability service level applies. Committed support response targets apply only when the paid Business Support add-on is enabled in the Order Form and are governed by Clause 2.7. Service status is published at https://status.synci.io.

2.7. Business Support add-on. The paid Business Support add-on applies only where expressly enabled in the Order Form and for the applications covered by that Order Form.

2.7.1. Synci targets a first response within one Business Day to a support request, and within four Business Hours for an outage-level incident materially preventing use of the contracted Services. A response target is not a resolution or uptime guarantee.

2.7.2. A Business Day is Monday to Friday, excluding Norwegian public holidays and announced closures, and a Business Hour is an hour from 09:00 to 17:00 Norwegian time (CET/CEST, Europe/Oslo) on a Business Day. Synci gives at least five Business Days' notice of planned closures, limited to 25 Business Days in a calendar year.

2.7.3. The add-on includes a named technical contact at Synci and direct notification of incidents materially affecting the Customer's users specifically, in addition to generally published service status.

2.7.4. For each missed response target, the Customer is entitled to a service credit equal to 25% of the Business Support fee payable for the affected calendar month, capped in aggregate at 100% of that month's fee. This credit is the sole contractual remedy for missing a response target, without affecting liability that cannot be excluded by law. Where the fee for a month is waived under Clause 5.9, no monetary credit accrues for that month, but a qualifying miss still counts under Clause 2.7.5.

2.7.5. If Synci misses three response targets in a rolling period of three calendar months, the Customer may terminate the Business Support add-on by written notice without terminating its other Services.

2.8. Standard functionality. Subject to the service model, supported Institutions and enabled options, the Services include REST API access to connections, accounts, balances, transactions and holdings, with available filtering, sorting and pagination; the Managed Apps API and hosted portal for the Managed Apps Model; signed webhook events and retries for supported transaction, account, balance, holdings and connection-lifecycle events; transaction deduplication and in-place updating of pending transactions as supported by Institutions; configurable End User consent-expiry notifications; and application configuration and connection-management dashboard access. Institution coverage can change and is described at https://synci.io/banks and in the documentation. These descriptions are not guarantees that every item or field is supplied by every Institution.

2.9. Sync and enabled options. Standard supported bank synchronization is scheduled at intervals generally no shorter than six hours, subject to Institution and Upstream Provider limits; brokerage and crypto reconciliation is generally daily. If High-Frequency Sync is enabled for an application in the Order Form, Synci schedules supported bank connections up to every two hours, subject to availability. High-Frequency Sync is an application-level option for usage and billing purposes under Clause 5.2.3. Transaction enrichment and other optional features apply only when enabled for the relevant application. None of these schedules constitutes an uptime or delivery-time SLA.

03Customer obligations

3.1. The Customer undertakes to:

3.1.1. use the Services only for its own products and only in accordance with the Agreement, the Synci documentation, and applicable law;

3.1.2. obtain and maintain all consents and authorisations necessary for the lawful use of the Services, including valid End User consent for the retrieval of Account Information;

3.1.3. ensure that all obligations to its End Users are fulfilled, and resolve all complaints or disputes directly with End Users;

3.1.4. comply with all legal and regulatory requirements applicable to its own activities, including the Data Protection Laws (as defined in Clause 4);

3.1.5. not commit actions that would endanger the security or integrity of the Services. If the Customer commits any acts or omissions that endanger the security of the Services, Account Information, or personal data forming part of Account Information, the Customer shall be responsible and liable for such acts and omissions and any losses and damages thereby caused to Synci.

3.2. End User notices. Before or upon collection of personal data from each End User via the Services, the Customer shall provide a written notice in clear and plain language, easily accessible to the End User, that:

3.2.1. identifies Synci and the relevant Upstream Providers by name as recipients of the End User's Account Information;

3.2.2. describes the services Synci and the Upstream Providers provide in connection with the Customer's product;

3.2.3. states that the Customer receives Account Information from every account the End User connects, without per-account selection by the End User;

3.2.4. describes the data protection rights available to the End User, including the right to object; and

3.2.5. includes links to Synci's privacy information applicable to the model in use (for the Managed Apps Model, the Synci Portal Privacy Notice at https://synci.io/portal/privacy) and to the privacy policies and end-user terms of the relevant Upstream Providers where they require this.

3.3. No onward provision. Subject to the restriction in Clause 3.7.5, the Customer shall not resell, sublicense, or otherwise make the Services or Account Information available to any third party, except that the Customer may present Account Information relating to an End User to that End User within the Customer's own products, including to other individuals with whom that End User expressly chooses to share their data through ordinary sharing features of the Customer's product. Any further intermediation of the Services, including making the Services available as a data layer to another business, requires Synci's prior written consent. Disclosure of Account Information to the Customer's own processors, acting solely on the Customer's behalf and on its documented instructions to operate the Customer's product, under written agreements meeting Article 28 of the GDPR (and UK GDPR where applicable), with applicable transfer safeguards, and as described in the Customer's privacy notice, is not onward provision for this Clause 3.3.

3.4. The Customer shall implement and maintain appropriate technical and organisational security measures for Account Information in its possession, consistent with good industry practice.

3.5. The Customer warrants that the name and other details provided when registering to use the Services, or provided at Synci's request, are true, verifiable, and up to date, and that the Customer has the right to disclose such information. Synci may request additional information from the Customer where reasonably needed to satisfy requirements of an Upstream Provider or a regulator, and the Customer shall provide it without undue delay.

3.6. App review. Under the Managed Apps Model, the Customer's application is subject to Synci's review before it may serve End Users beyond the published testing limits. The Customer shall keep the developer name, homepage, privacy policy and portal return URL configured for its application accurate and current.

3.6.1. Before serving real End Users under the Managed Apps Model, the Customer must have in force its own public privacy notice and terms of service for its product, and must maintain the notices and links required by Clause 3.2.

3.7. Acceptable use. The Customer shall not, and shall not permit its personnel or End Users to, use the Services or Account Information to:

3.7.1. commit unlawful, deceptive or fraudulent acts, violate applicable sanctions, or infringe the rights of others;

3.7.2. access data without the applicable End User's authority or use data for purposes that have not been appropriately disclosed or otherwise lawfully authorised;

3.7.3. introduce malware, probe or disrupt security, or seek unauthorised access to Synci, an Upstream Provider, an Institution or another user;

3.7.4. evade usage limits or restrictions imposed under the Agreement or applicable law; or

3.7.5. Restricted verification and credit uses. Without Synci's prior written consent, use Account Information, or scores, signals, reports or other outputs derived from it, to assess an End User's creditworthiness or affordability for lending, eligibility or other third-party counterparty decisions, or to verify an End User's funds, balances or transactions for the benefit of a third party. Ordinary personal finance and household-sharing functionality, where the End User uses or shares their own information for personal purposes and not for a third-party eligibility, credit or funds-verification decision, is not prohibited solely by this Clause 3.7.5. An End User's consent to sharing does not replace Synci's required written consent under this clause.

04Information handling and data protection

4.1. Data Protection Laws means Regulation (EU) 2016/679 (the GDPR), applicable national data protection laws, and, where the Customer is established in the United Kingdom or processes personal data of End Users in the United Kingdom, the UK GDPR and the Data Protection Act 2018.

4.2. Roles under the Managed Apps Model. The Customer acts as controller and Synci as processor for End User personal data processed through the Services. The DPA means the Synci Data Processing Agreement as published at https://synci.io/dpa, incorporated by reference and forming part of the Agreement for the Managed Apps Model. The DPA governs the Parties' processing instructions and applicable data-protection and transfer measures in its published applicable version, including any provisions integrated in future versions under its amendment mechanism. Upstream Providers act as independent controllers for access under their own authorisations and end-user terms and are not Synci's sub-processors. The DPA prevails on personal-data processing as provided in Clause 1.7, subject to the express Clause 4.8 timing exception.

4.3. Roles under the Platform Model. Synci and the Customer are separate and independent controllers within the meaning of the Data Protection Laws. Once Account Information is transferred to the Customer, the Customer acts as an independent controller of that data.

4.4. Each Party shall comply with the Data Protection Laws applicable to it in respect of personal data processed under the Agreement.

4.5. Incident notification. Each Party shall notify the other without undue delay upon becoming aware that Account Information processed under the Agreement has been disclosed to an unauthorised third party or otherwise subject to a personal data breach, and shall reasonably cooperate with the other Party in addressing the incident. Under the Managed Apps Model, Synci's notification obligations are those of the DPA, and notifications are sent to the breach contact stated in the Order Form.

4.6. Synci processes personal data as described in its privacy policy (https://synci.io/privacy) and, for End Users under the Managed Apps Model, the Synci Portal Privacy Notice. The Customer is responsible for providing its End Users with its own privacy information as required by the Data Protection Laws and Clause 3.2.

4.7. Aggregated data. Synci may generate and use aggregated and anonymised data derived from the use of the Services (including for the purpose of improving deduplication, enrichment, and connectivity), provided such data does not identify the Customer or any End User.

4.8. Export Window and deletion. On termination or expiry of the Agreement, the Customer has 90 (ninety) days of read-only access without Fees to export Account Information relating to its End Users in the API's standard formats (the Export Window). No new connections or retrieval of new Account Information for the terminated Services takes place during that period. Synci deletes Account Information relating to the terminated Services from active systems within 30 (thirty) days after the end of the Export Window, except where and for as long as retention is required by law. Routine encrypted backup copies are deleted through the ordinary backup cycle. Where only part of an Order Form or service scope terminates, the Export Window and deletion apply to the affected scope, without preventing lawful continuation of unaffected Services or requiring premature deletion of data lawfully needed for those Services. A valid individual deletion instruction or mandatory erasure requirement is not postponed by the Export Window. Under the Managed Apps Model this Clause 4.8 constitutes the Customer's election under DPA Clause 9.2 and prevails over that clause solely as to timing: for the terminated Services the export period is followed by the 30-day deletion period under the DPA.

4.9. Data retained by the Customer. Account Information already retrieved and provided to the Customer is held by the Customer in its role as controller. The Customer may continue to retain that data after an End User's access or a connection ends, for the purposes and periods stated in the Customer's privacy notice and permitted by applicable law. The Customer must delete it where required by an End User's valid request or applicable law. The Customer may not retrieve new data through a connection after access to that connection has ended. This Clause does not require the Customer to delete all previously obtained data merely because Synci access ends.

4.10. Retention configuration. Under the Managed Apps Model, the Customer selects the retention period for data held by Synci per application, subject to a minimum configurable period of seven days and the applicable maximum. For a Business Order Form the standard initial retention instruction is 365 days unless a different period is recorded in the Order Form, and the maximum configurable period is 730 days measured from retrieval. The 730-day maximum is available whether or not High-Frequency Sync is enabled. A shorter deletion period or erasure instruction required by law or the DPA prevails. The Customer is responsible for the lawfulness and disclosure of its chosen retention period.

05Fees and payment

5.1. For the use of the Services, the Customer shall pay the fees set out in the Order Form (the Fees).

5.2. Usage metrics. Usage of the Services is tracked per calendar month (UTC) as follows:

5.2.1. Active Connection: a connection established through the Services between the Customer's product and a consenting End User's account(s) at a specific Institution, which is active on any day during the relevant calendar month. Each such connection counts once per calendar month, regardless of the number of accounts it covers at that Institution and without proration for partial months. A connection is not active while its authorisation is pending, rejected or failed, from the date its consent expires without renewal, from the calendar month following the month in which the Customer disables it, or after it is deleted. Renewing or re-authorising the consent of an existing connection continues the same connection and does not create a new one.

5.2.2. Enriched Transaction: a transaction in respect of which Synci performs enrichment processing during the relevant calendar month, where enrichment is enabled by the Customer. Each individual transaction is charged for enrichment at most once, regardless of subsequent re-synchronisation of the same transaction.

5.2.3. High-Frequency Sync: where enabled by the Customer for an application, all Active Connections of that application are invoiced at the high-frequency rate stated in the Order Form for each calendar month in which the setting was enabled on any day.

5.3. Graduated pricing. Where the Order Form states per-connection rates in volume bands, each band applies only to the Active Connections falling within it in the relevant calendar month, counted in ascending order.

5.4. Invoicing. Synci invoices Fees monthly in arrears for usage in the preceding UTC calendar month, with a statement of Active Connections counted. Invoices are sent electronically to the billing email in the Order Form, are valid without signature, and are payable within 30 (thirty) days of issue. Fees are in euros (EUR) and exclusive of VAT or equivalent taxes. Where a reverse-charge mechanism applies, the Customer accounts for VAT. The Customer must supply its VAT number or declare that it is not registered, and promptly notify Synci when its registration status changes. Payment may be made by bank transfer or, when made available and agreed, SEPA Direct Debit.

5.5. Minimums and other fees. A minimum monthly fee or connection count applies only if stated in the Order Form. Where a monthly minimum fee is stated, the Customer pays the greater of that minimum and the applicable usage Fees, with any shortfall invoiced as a minimum adjustment. Usage-based connection, High-Frequency Sync and transaction-enrichment Fees count towards a monetary minimum unless the Order Form expressly specifies otherwise. Paid Business Support is a separate monthly add-on charge and does not count towards that minimum. Unless stated in the Order Form, there is no setup fee, licence fee, minimum volume commitment or annual usage commitment.

5.6. Fee revisions. Synci may revise the Fees by giving at least 60 (sixty) days' written notice, no earlier than with effect from the first anniversary of the Effective Date, and the Parties shall in any event review the Fees in good faith against actual usage volumes before that anniversary. If the Customer does not accept the revised Fees, the Customer may terminate the Agreement by written notice with effect from the date on which the revised Fees would otherwise take effect; until then, the existing Fees continue to apply. Where the Order Form states a price lock period, no revision takes effect during that period except a pass-through of a documented increase in the fees charged to Synci by an Upstream Provider, at cost and on 90 (ninety) days' written notice.

5.7. Late payment. If any undisputed payment is overdue by more than 14 (fourteen) days after a written reminder, Synci is entitled to suspend the Customer's access to the Services until the outstanding amounts have been paid in full, and to charge statutory late payment interest.

5.8. Fee disputes. Where there is a good-faith dispute as to the amount of Fees invoiced, the Parties shall use reasonable endeavours to resolve the dispute within 30 (thirty) days of the invoice date. The Customer shall pay any undisputed portion when due.

5.9. Qualifying upstream suspension and monthly Fees. Where an Upstream Provider event under Clause 6.4 suspends or ends a connection, it ceases to be active from the effective time of that event for purposes of subsequent use, without reversing a charge already earned for a calendar month in which it was active. Restoration of the same connection in the same month does not create a second connection charge. If all contracted live retrieval under an Order Form is unavailable due to one or more events under Clause 6.4 for periods together exceeding half of a UTC calendar month, neither the minimum monthly fee nor the Business Support add-on fee applies for that entire month; usage Fees already earned remain payable without proration. Partial unavailability while contracted live retrieval remains available does not trigger this waiver unless the Order Form expressly provides otherwise. Availability of stored data, export, dashboard or support functions alone does not amount to live retrieval. An ordinary interruption not arising under Clause 6.4 does not by itself trigger this waiver. Business Support response targets continue during a waived month; credit and repeated-miss rights operate under Clause 2.7.

06Term and termination

6.1. The Agreement begins on the effective date of the first mutually signed Order Form (Effective Date) and remains in force for an initial 12 (twelve) months, then renews automatically for successive 12-month terms. The Customer may prevent renewal by giving at least two months' written notice before the end of the current term. Synci may prevent renewal by giving at least 90 (ninety) days' written notice before the end of the current term. Replacement Order Forms do not restart the Agreement term unless expressly agreed in writing.

6.2. Termination for convenience. The Customer may terminate the Agreement at any time for convenience by giving at least 2 (two) months' written notice to Synci. Synci may terminate the Agreement at any time for convenience by giving at least 90 (ninety) days' written notice to the Customer.

6.3. Either Party may terminate the Agreement with immediate effect by written notice if:

6.3.1. the other Party commits a material breach of the Agreement and (if such breach is remediable) fails to remedy that breach within 28 (twenty-eight) days of being notified of the breach; or

6.3.2. the other Party becomes insolvent, enters into liquidation, administration, or any analogous proceedings, or ceases to carry on business.

6.4. Synci may suspend or terminate the affected Services with immediate effect, upon written notice, to the extent this is:

6.4.1. required by a regulatory body or an Upstream Provider; or

6.4.2. necessary because an agreement between Synci and an Upstream Provider that is required to provide the Services is terminated or materially restricted, and no reasonable alternative is available. In that case, Synci shall where possible give the Customer as much advance notice as circumstances permit.

6.4.3. A suspension or termination under this Clause 6.4 is limited to the Services, territories, providers or applications reasonably affected. Unaffected Services continue under the Agreement where practicable.

6.4.4. Where a permanent partial termination leaves the remaining Services unable reasonably to fulfil the affected Order Form's commercial purpose, either Party may terminate that Order Form by written notice without the ordinary convenience notice, without affecting unrelated Order Forms. This does not waive accrued Fees or the export rights in Clause 4.8.

6.4.5. The Export Window and deletion rules in Clause 4.8 apply to the Services terminated under Clause 6.4.

6.4.6. Nothing in Clause 6.4 excuses an earlier breach by Synci of its own obligations under an Upstream Provider agreement or this Agreement. Any resulting Synci liability remains subject to Section 8 and applicable law.

6.5. Synci may temporarily suspend the provision of the Services where Synci has a reasonable indication of a security breach, until the circumstances are clarified. Synci shall inform the Customer of any such suspension, and of the restoration of the Services, without undue delay.

6.6. Shutdown and change of control. Synci gives the Customer at least 60 (sixty) days' written notice before discontinuing the Services, except where discontinuation is required under Clause 6.4.1 or results from the termination or restriction of an Upstream Provider agreement under Clause 6.4.2; those circumstances are governed by Clause 6.4. Synci notifies the Customer of any change of control of the Synci business at or promptly after completion, and gives at least 90 (ninety) days' written notice before any resulting change to the Agreement or the Services.

6.7. Effect of termination. On termination of the Agreement or an Order Form, access to the affected live Services ends subject to Clause 4.8; all accrued and unpaid Fees for the affected Services become payable and are included in the final invoice; each Party returns or deletes the other Party's Confidential Information on request subject to permitted or mandatory retention; and the relevant Account Information is handled under Clause 4.8. Clauses intended to survive, including Clauses 4, 5 as to accrued Fees, 7.3, 8, 9, 10 and 12, survive. Termination of one Order Form does not by itself terminate an unaffected Order Form.

6.8. Misuse suspension. Synci may suspend access to the Services to the extent reasonably necessary where the Customer materially breaches Clause 3 or 9.4. Synci shall give notice and a reasonable opportunity to remedy where feasible. It may act immediately if necessary to prevent material harm, unlawful activity, compromise of data or systems, or a material breach of an Upstream Provider requirement. Synci shall inform the Customer of the reason and scope as soon as reasonably practicable, review the suspension promptly and restore access when the grounds cease. This right does not remove the cure period applicable to termination under Clause 6.3.1, or alter the separate conditions for non-payment suspension in Clause 5.7.

07Warranties

7.1. Synci warrants that:

7.1.1. it will provide the Services with reasonable skill and care;

7.1.2. subject to Synci's suspension and termination rights under Clause 6.4, it will maintain the Upstream Provider agreements necessary to provide the Services while they remain available to Synci, and comply with its obligations under those agreements relevant to the Services. An Upstream Provider's independent withdrawal, termination or restriction does not of itself constitute a breach of this warranty, but Synci remains responsible for its own breach of those agreements, subject to Section 8;

7.1.3. it will comply with applicable laws in its provision of the Services; and

7.1.4. the Customer's use of the Services in accordance with the Agreement will not infringe the intellectual property rights of any third party.

7.2. The Customer warrants that it will comply with its obligations under the Agreement, including Clauses 3 and 4.

7.3. Disclaimer. Except as expressly set out in the Agreement, the Services are provided "as is". Synci does not warrant that the Services will be uninterrupted or error-free, and does not warrant the accuracy, completeness, or timeliness of Account Information, which depends on the Institutions and Upstream Providers. Synci shall not be held liable for any decisions or outcomes of decisions that the Customer or its End Users make based on information provided through the Services.

08Limitations of liability

8.1. Subject to Clauses 8.4 and 8.6, neither Party nor its affiliates, employees, officers, directors, agents or subcontractors is liable to the other, whether in contract, tort (including negligence or breach of statutory duty) or otherwise, for loss of profits, income, revenue or business opportunities; loss or corruption of data or information; failure to realise expected revenue or savings; loss of goodwill; or indirect, special or consequential damage, or punitive, exemplary or incidental damages arising from the Agreement, even if warned of the possibility. This exclusion does not prevent recovery of covered third-party amounts or reasonable external defence costs expressly indemnified under Clause 8.6.

8.2. Subject to Clauses 8.4 and 8.6, each Party's total aggregate liability to the other for all losses under or in relation to the Agreement, including contract, misrepresentation, tort, negligence and statutory duty, is capped at the greater of (a) the total Fees paid and payable by the Customer during the 12 (twelve) calendar months preceding the first event giving rise to liability and (b) EUR 1,000.

8.3. The limitations in Clauses 8.1 and 8.2 do not apply to the Customer's obligation to pay the Fees.

8.4. Nothing in the Agreement excludes or limits either Party's liability for: death or personal injury resulting from negligence; fraud, deceit, or fraudulent misrepresentation; or any other liability which cannot be limited or excluded by law.

8.5. Except for claims under Clause 8.6 and liabilities that may not lawfully be restricted, a claim for damages under the Agreement must be submitted within six months after the claimant learns of its basis, and in any event within 12 months after expiry or termination of the Agreement. Claims under Clause 8.6 are subject to applicable statutory limitation periods.

8.6. Customer indemnity for specified third-party claims.

8.6.1. The Customer shall indemnify Synci against amounts Synci is legally required to pay to third parties in damages or under a settlement approved under Clause 8.6.4, and reasonable, documented external legal and defence costs incurred in responding to a third-party claim, to the extent that claim arises from: (a) the Customer's unlawful, negligent or otherwise wrongful operation of its own product or relationship with End Users; (b) the Customer's breach of Clauses 3.2, 3.3, 3.7.5 or 4.9; or (c) the Customer's breach of Data Protection Laws applicable to it.

8.6.2. The indemnity does not apply to the extent a claim, loss or cost is caused by Synci's own breach of the Agreement, negligence, wilful misconduct or violation of applicable law, or by an Upstream Provider's separate conduct for which the Customer is not responsible. It does not transfer a regulatory fine imposed on Synci for Synci's own violation, and applies to penalties or fines only to the extent recovery is permitted by mandatory law and the DPA.

8.6.3. Synci shall notify the Customer of a claim without undue delay after becoming aware of it, give the Customer reasonable information and cooperation, and take reasonable steps to mitigate covered loss. A late notice reduces the indemnity only to the extent the delay materially prejudices the Customer's defence.

8.6.4. Subject to conflicts of interest and legal or regulatory duties, the Customer may participate in and, where appropriate, conduct the defence of a covered claim through competent counsel acceptable on reasonable grounds to Synci. Neither Party may agree a settlement admitting fault or imposing non-monetary obligations on the other without that Party's prior written consent, not to be unreasonably withheld or delayed. Synci retains control of its own communications with regulators and its response to an investigation directed at Synci.

8.6.5. The obligations under this Clause 8.6 are not subject to the general exclusion of losses under Clause 8.1, the financial cap in Clause 8.2 or the claim deadlines in Clause 8.5, subject always to Clause 8.6.2 and mandatory law. The indemnity survives expiry or termination of the Agreement. It does not create a reciprocal Synci indemnity.

09Intellectual property

9.1. As between the Parties, Synci is the exclusive owner of, and retains all right, title, and interest in and to, the Services and all intellectual property related to the Services, including without limitation the Synci API, the hosted portal, deduplication engine, enrichment pipeline, documentation, and all improvements thereto.

9.2. Synci grants the Customer a limited, non-exclusive, non-transferable, revocable right to use the Services in accordance with the Agreement, for the purpose of operating the Customer's own products, during the term of the Agreement and the Export Window.

9.3. As between the Parties, the Customer retains all right, title, and interest in and to the Customer's own products, its trade marks displayed in the hosted portal, and its relationships with its End Users.

9.4. The Customer shall not, and shall not permit or authorise any third party to:

9.4.1. reverse engineer, disassemble, decompile, or otherwise attempt to derive source code from the Services (to the extent such restriction is permitted by law);

9.4.2. reproduce any portion of the Services other than as necessary to use them in accordance with the Agreement;

9.4.3. use the Services to store or transmit infringing or otherwise unlawful material, or malicious code;

9.4.4. interfere with or disrupt the integrity or performance of the Services or third-party data contained therein;

9.4.5. attempt to gain unauthorised access to the Services or related systems or networks;

9.4.6. circumvent any usage-based billing, rate limit or contractual usage limit; or

9.4.7. access the Services in order to build a competitive product or service.

9.5. The Customer acknowledges that the Services incorporate services and intellectual property of Upstream Providers, and agrees to abide by any additional restrictions imposed by an Upstream Provider that Synci notifies to the Customer in writing.

9.6. Publicity. Neither Party shall use the other Party's name or logo in marketing materials or public statements without the other Party's prior written approval (email sufficient), such approval not to be unreasonably withheld or delayed. The display of the Customer's name and logo to its own End Users in the hosted portal is part of the Services and requires no separate approval.

10Confidentiality

10.1. Each Party undertakes to treat the other Party's Confidential Information as confidential, to use it only for the purposes of the Agreement, and not to disclose it to any third party in whole or in part without the other Party's prior written consent.

10.2. Confidential Information means proprietary non-public economic, technical, business or other information disclosed by or obtained from one Party in connection with the Agreement, regardless of form. The negotiated commercial terms in an Order Form, including Fees, bands, minimums, price locks and negotiated deviations, are Confidential Information of both Parties. The fact and standard terms of this publicly published MSA or DPA are not confidential merely because they form part of the Agreement, but non-public negotiations and customer-specific terms remain confidential.

10.3. Disclosure will not be considered a breach of the Agreement where:

10.3.1. the information has become publicly known or available other than as a result of a breach by the receiving Party;

10.3.2. the information is lawfully disclosed to the receiving Party by a third party without restrictions on disclosure;

10.3.3. the information is independently developed by the receiving Party, as shown by written evidence;

10.3.4. the disclosure is required to comply with applicable law, a court order, or a regulator, in which case, where lawful and practicable, the disclosing Party shall be given prior notice;

10.3.5. the information is disclosed to a Party's professional advisers, or to entities in the same group as the receiving Party, bound by confidentiality obligations; or

10.3.6. the information is disclosed by Synci to an Upstream Provider to the extent required to provide the Services or to comply with Synci's obligations to that Upstream Provider.

10.4. The confidentiality obligations apply during the term of the Agreement and for 3 (three) years after its termination, except in respect of Account Information and personal data, for which the obligations apply without time limit.

11Force majeure

11.1. Neither Party shall be held responsible if performance of the Agreement is rendered impossible or is delayed by circumstances beyond the reasonable control of the affected Party which could not have been foreseen at the time of signing and could not have been prevented by reasonable means (including natural or man-made disasters, war, civil unrest, widespread failure of telecommunications infrastructure, or acts of public authorities). Contractual deadlines are automatically extended by the duration of the force majeure event.

11.2. The Party relying on force majeure must notify the other Party in writing as soon as reasonably possible, and no later than 5 (five) working days after the occurrence of the event, indicating the expected duration where possible.

12Other rules

12.1. The Agreement shall be governed by and construed in accordance with the laws of Norway, without regard to its conflict of law provisions, without prejudice to the mandatory application of the Data Protection Laws.

12.2. If a dispute arises between the Parties in connection with the Agreement, the Parties shall first make every effort to resolve it through good-faith negotiations. Written answers to any claims from a Party shall be provided within 5 (five) working days of receiving the claim.

12.3. If it proves impossible to resolve a dispute through negotiation, the dispute shall be settled by the courts of Norway, with Bergen District Court (Bergen tingrett) as the agreed legal venue.

12.4. Each Party shall inform the other in writing of any changes in its invoicing and/or contact details as soon as possible, and within 3 (three) calendar days.

12.5. Each Party confirms that it has the appropriate powers to sign the Agreement and to assume the obligations derived from it.

12.6. MSA updates and Order Form amendments. The following provisions govern changes to the MSA and to customer-specific Order Forms:

12.6.1. Synci may update this MSA by publishing a dated new version at https://synci.io/msa and giving the Customer written notice at least 30 days before it takes effect.

12.6.2. If the change materially reduces the Customer's rights under this MSA, Synci must give at least 60 days' written notice. Notice must reasonably describe the material changes and their effective date.

12.6.3. The Customer may reject a notified MSA change by terminating the affected Order Form or the Agreement without penalty by written notice effective before the new version takes effect. The existing version remains in force until termination. Fees accrued before termination remain payable, and the Export Window applies.

12.6.4. A change required by applicable law, a competent regulator or an Upstream Provider may take effect sooner than the ordinary 30- or 60-day notice period where necessary, with as much advance written notice as circumstances permit. The Customer retains an exit right to the extent legally and operationally possible, without a promise that a prohibited Service can continue during a notice period.

12.6.5. No MSA update alters a price, band, minimum, price lock, enabled option, agreed processing instruction or expressly negotiated deviation fixed in an Order Form during that Order Form's term, except under an express fee or upstream pass-through mechanism already agreed in the Order Form and this MSA. An Order Form's reference to an MSA clause does not, by itself, fix the wording of that standard clause against future MSA amendments.

12.6.6. Changes to fixed Order Form terms or negotiated deviations require mutual written acceptance by both Parties. An email acceptance suffices for service-option changes expressly allowed under Clause 2.2; a new Order Form is signed where the change materially revises the agreed scope or commercial schedule. A later Order Form that expressly replaces an earlier one supersedes it for the scope and effective date stated.

12.6.7. Versions are archived as described in Clause 1.6. The amended MSA is effective for an existing Customer only under this Clause 12.6, not merely by making a new document publicly accessible.

12.7. Neither Party may assign the Agreement without the prior written consent of the other Party, except that Synci may assign the Agreement, upon written notice to the Customer, to a legal entity formed to carry on the Synci business (including any incorporation or reorganisation of the current sole proprietorship), provided that entity assumes all of Synci's obligations under the Agreement.

12.8. If any provision of the Agreement is held invalid or unenforceable, the remaining provisions remain in force, and the Parties shall replace the invalid provision with a valid one that best reflects its original intent.

12.9. A failure by a Party at any time to require performance of any provision shall not affect its right to enforce it later, and a waiver of any breach shall not be construed as a waiver of any other or subsequent breach.

12.10. Notices and contacts. Each Party shall send formal notices and other material communications under the Agreement in writing to the notice email in the signed Order Form for the Customer and to matias@synci.io for Synci, unless updated by written notice under Clause 12.4. Notices by email are deemed received on dispatch unless an error or non-delivery notice is received. The Party sending a termination or material amendment notice must retain a copy of the notice and relevant delivery record.

12.11. Signatures. Order Forms and amendments requiring signature may be executed by handwritten or electronic signature, which have equal validity to the extent permitted by applicable law. Electronic signatures conforming to Regulation (EU) No 910/2014 (eIDAS), or equivalent applicable UK law, are accepted.

12.12. Each Order Form forms part of the Agreement and may be amended or replaced separately under Clause 12.6.6. Termination or replacement of one Order Form does not affect unrelated Order Forms unless expressly agreed.

12.13. Relationship with standard Terms. The standard Terms of Service at https://synci.io/terms do not supplement or fill gaps in this Agreement for the ordered business Services. The MSA and applicable signed Order Forms govern those Services. Separate self-serve subscriptions and personal accounts not covered by a signed Order Form remain subject to the applicable Terms of Service. End Users under the Managed Apps Model accept the Synci Portal Terms at https://synci.io/portal/terms for use of the hosted portal, but do not become parties to the Customer's business Agreement or Synci subscription customers solely by using that portal.

12.14. Legacy agreements. Any agreement signed before the public MSA model was introduced remains governed by its own signed terms and is not amended by publication of this MSA or a later version. It migrates to this MSA only if both Parties sign an Order Form expressly incorporating this MSA and specifying the scope and effective date of the migration.

Version history

Publication record. The current version, its first-publication date, and stable links to all previous versions are maintained at https://synci.io/msa. No signed customer agreement is retroactively changed merely by publication.