Vendor Legal Center

Unless otherwise agreed, the following terms apply to the Agreements entered into on or after October 1, 2024. For Agreements entered into before October 1, 2024, please see the relevant terms here.

Atlantic Food Waste Partners LLC dba Choco (“Choco”) operates a cloud-based order management and communication platform for suppliers (e.g., wholesalers) and their customers (e.g., restaurants) in the food industry ("Cloud Service") and provides related Onboarding and Support Services as well as Integration Services s (collectively “Implementation Services” and, together with the Cloud Service, each a “Service” and collectively the “Services”). A description of each Service is available here.

This Main Services Agreement (“MSA”) governs the provision and use of the Services. Supplier agrees to be bound by the MSA by either executing an Order Form which incorporates the MSA or by accessing and/or making use of the Free Services (as defined in section 1.3 below). Capitalized terms not otherwise defined in the MSA shall have the meaning assigned to them elsewhere in the Agreement.

THEREFORE, in consideration of the foregoing, Choco and Supplier (each a "Party" and collectively the "Parties") agree as follows:

1. Scope of the Services

1.1 Access to Cloud Service. Choco hereby grants Supplier a non-exclusive, non-transferable, non sublicensable right to access and use the Cloud Service during the term of the Agreement, solely for its own business operations and in accordance with the terms and conditions of the Agreement. Supplier is responsible for arranging the necessary equipment and the internet connection to use the Cloud Service. Supplier will have no right to any specific design or specific functionalities beyond the scope of the Cloud Service agreed in the Order Form.

1.2 Choco Deliverables. While providing Services, Choco may create deliverables for Supplier (“Choco Deliverables”). Choco hereby grants Supplier a non-exclusive, non-transferable, non-sublicensable right to use the Choco Deliverables during the term of the Agreement and in accordance with the terms and conditions thereof. Supplier shall not make any modifications or use the Choco Deliverables for any other purposes than achieving the purpose of the Agreement without prior written approval of Choco.

1.3 Free Services. Choco may offer certain features of the Cloud ServicesService free of charge, such as trial periods, beta versions or delivery of orders from the restaurants using the Cloud Service in a digital form (the “Free Services”). An entity benefiting from the Free Services shall be deemed asto constitute a Supplier and shall be subject to the terms of the Agreement governing use of the Cloud Service as long as it benefits from the Free Services. Supplier acknowledges that Choco reserves the right to modify or terminate Supplier’s access to the Free Services or any part thereof, at any time and for any reason in its sole discretion without any notice or liability to Supplier.FreeSupplier. Free Services are provided as-is and, to the maximum extent permitted by applicable law, Choco shall not be liable for any damages, costs, or expenses resulting from the use of the Free Services. To the extent such full exclusion of liability is not enforceable, Choco’s (including its legal representatives’, employees’, agents’ and Vicarious Agents’ (as defined in section 12.3 below)) aggregate liability shall be limited to USD 100 (one hundred United States Dollars). In the event of a conflict between this section 1.3 and the rest of the Agreement, this section 1.3 shall take precedence.

1.4 Service Specific Terms. Some Services may be subject to additional terms specific to that Service, such as Integration GTCs, Onboarding GTCs and White-Label GTCs . Supplier agrees to be bound by the applicable Service Specific Terms by signing the Order Form or by accessing or using the Services covered by Service Specific Terms.

1.5 Availability. Choco will make commercially reasonable efforts to make the Cloud Service available 98% of the time, based on a monthly average. Excluded therefrom are necessary planned maintenance work as well as disruptions that are not within Choco’s sphere of influence (such as force majeure events, downtime that results from a third party’s equipment, software or technology or internet connectivity issues). If possible, Choco shall in a timely manner notify Supplier about planned maintenance work. Nevertheless, Choco expressly reserves the right to carry out unannounced maintenance work, if necessary, particularly where this is required for data and operational security.

1.6 Modifications. Supplier acknowledges and agrees that Choco may update the Cloud Service at its own discretion, provided that if any such update materially diminishes any of the features and functionality previously made available through the Software, the Supplier may object to the changes. In case of an objection by the Supplier, Choco may terminate the Agreement or offer the Supplier a reasonable remedy at its own discretion.

1.7 Third Party Components. Certain components of the Cloud Service may be provided through third party services. Any such components that Supplier could recognize as being subject to third-party rights, including open-source licences, will be subject to applicable third party and open-source software licences. Above all, any components that Choco discloses as third-party content in the Agreement, in the Cloud Service or in any Choco policies will be deemed recognizable within the meaning of the previous sentence. Supplier agrees that availability of the Cloud Service or certain features may be dependent on the corresponding availability of the third-party services. Choco is not responsible for any interruptions or issues with the Cloud Service caused by the third-party components.

1.8 AI-powered Services. The Cloud Service may encompass functionalities that are powered by artificial intelligence (“AI”). Supplier will retain ownership over the input it provides and the output generated by AI based on the input, both of which shall constitute Supplier Data (as defined in section 3.1 below). Choco does not guarantee the accuracy, completeness and reliability of the output generated by AI and, to the extent permitted by law, disclaims all warranties and liability for such output. To the extent such full exclusion of liability is not enforceable, Choco’s (including its legal representatives’, employees’, agents’ and Vicarious Agents’) aggregate liability shall be limited to one-hundred (100) USD. Output generated by AI may not be unique to Supplier and it does not represent Choco’s views. Supplier undertakes to comply with the fair use policies of Choco’s third party service providers when using AI-powered functionalities, available here. In the event of a conflict between this section and the rest of the Agreement, this section shall take precedence.

2. Access and Use of Cloud Service

2.1 Authorised Users. The licence granted to Supplier is limited to its employees, agents or contractors who are authorised by Supplier to use the Services (“Authorised Users”). Supplier is responsible for its Authorised Users’ compliance with the Agreement, including Choco’s policies on the use of the Cloud Service and for all of their acts and omissions. Supplier shall ensure that its Authorised Users keep the access data of their accounts confidential and shall inform Choco without undue delay if there is any suspicion that the access data may have become known to unauthorised persons. Supplier is solely responsible for all activities that occur under the accounts of its Authorised Users.

2.2 Use Restrictions. Supplier shall use the Cloud Service only for offering products that address food and hotel industry needs and comply with all laws applicable to its access and use of the Cloud Service. Supplier shall not (a) reproduce, copy, modify, adapt, or create derivative works, reverse engineer, decompile or engage in any action with the attempt to obtain the source code of the Cloud Service (except as permitted by mandatory law); (b) sublicense, sell, rent, distribute, transfer or provide a third party access to the Cloud Service or otherwise allow the use of the Cloud Service for the benefit of any third party; (c) engage in any conduct that interferes with or threatens the security, integrity or performance of the Cloud Service including any related systems; (d) send any malicious code (e.g., viruses, worms, Trojan horses or other malware) through Cloud Service; (e) attempt to interfere with or otherwise circumvent any security measures, authentication mechanisms or any functional restrictions on the Cloud Service intended to limit its use; (f) use the Cloud Service in order to build a product or service which competes with the Cloud Service; (g) use any software, devices, robots or any other means to scrape data from the Cloud Service; (h) use the Cloud Service for fraudulent purposes; (i) make unfair use of the Cloud Service or (j) use the Cloud Service to send unsolicited commercial communications.

2.3 The relationship with the Customers. Supplier is solely responsible for its use of the Cloud Service, such as for the contact it establishes with other companies, all communications sent via or in connection with the Cloud Service, the content and availability of the products and for the proper management of orders. By making the Cloud Service available, Choco merely provides the infrastructure for placing and managing orders and for communication. Choco itself will not directly or indirectly become a party to the relationship between Supplier and the restaurants who are placing orders from Supplier (the “Customer(s)”). Each order (individual sale and purchase of products) shall be concluded solely between Supplier and the relevant Customer. Choco

will have no liability whatsoever with regard to the performance of those orders and shall not be a party to disputes of any kind between Supplier and its Customers (such as disputes relating to incorrect deliveries or late payments).

2.4 Cooperation. Supplier shall cooperate with Choco in good faith and provide all necessary information as reasonably required by Choco for the proper performance of the Services in a timely manner. All information provided by Supplier shall be up-to-date, complete, and accurate, and Supplier shall notify Choco in writing in case of any changes. Choco will not be liable for any delays in the provision of the Services caused by Supplier’s failure to provide Choco with the required information or cooperation.

2.5 Support and Maintenance: Choco shall offer standard support services to assist Supplier in using the Cloud Service during regular working hours. Choco will also provide maintenance services at its own discretion, including error corrections, updates, and upgrades, as deemed necessary to ensure the Cloud Service's continued functionality. Support and maintenance do not cover issues resulting from Supplier’s misuse, unauthorised modifications or third-party systems.

3. Supplier Data

3.1 Supplier Data. Supplier shall retain all right, title and interest in and to information, images, texts, data, files, Supplier Deliverables and other materials that is transmitted, submitted or otherwise made available by or on behalf of Supplier to Choco in the course of Supplier's access and use the Services ("Supplier Data"). Supplier grants Choco a non-exclusive, royalty-free and worldwide license to collect, process, reproduce, modify, host, store, disclose, display and perform all necessary acts on the Supplier Data for the purposes of operating the Cloud Service and providing the Services to Supplier. In particular, Choco shall be entitled to collect and use the Supplier Data about Supplier’s use of the Cloud Service for internal research, security, analytics and reporting purposes and for developing and improving its Services. Choco shall retain all rights in the aggregated or deidentified information and may use it at its own discretion during and after the term of this Agreement without being subject to any limitations (such as for distributing insights and reports), to the extent it does not identify Supplier, its Customers or any person. Choco may sublicense or transfer the rights granted herein to its Vicarious Agents for the purposes of this Agreement.

3.2 Limitations on the Supplier Data. Supplier represents, warrants and covenants that it will not upload, submit or otherwise make available to Choco through or in connection with the Cloud Service (i) Social Security numbers or other government-issued identification numbers; (ii) protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; (iii) health insurance information; (iv) biometric information; (v) passwords to any online accounts; (vi) tax return data; (vii) information subject to the Gramm-Leach-Bliley Act, Fair Credit Reporting Act or the regulations promulgated under either such law; (viii) information subject to restrictions under applicable privacy or data protection laws governing personal data of children, including, without limitation, all information about children under 16 years of age; or (xi) any information that falls within any special categories of data (as defined in the General Data Protection Regulation (Regulation (EU) 2016/679) and its UK analogue (collectively, “GDPR”)).

3.3 Supplier Warranties. Supplier warrants that (i) it owns or will obtain the necessary rights and permissions to share the Supplier Data with Choco and to authorize the use of the Supplier Data by Choco as contemplated in this Agreement; (ii) it will provide the required information notices and obtain necessary consents under data protection laws from the persons whose personal data may be included in the Supplier Data (such as its Authorized Users and its Customers’ employees) for sharing their data with Choco; (iii) the Supplier Data and its use by Choco as contemplated in this Agreement do not violate any third-party rights or applicable laws; (iv) the Supplier Data will not include any illegal, defamatory, inappropriate, offensive, hateful or violent content. Supplier shall solely be responsible for the Supplier Data and shall ensure its accuracy, integrity and reliability throughout the term of the Agreement.

3.4 Removal. Choco is not obliged to monitor the Supplier Data but reserves the right to do so at its own discretion. Choco may, without prior notice, remove or disable access to any Supplier Data (including the products offered via the Cloud Service) (i) if it violates the Agreement including Choco policies made available to Supplier, (ii) if it constitutes illegal content such as illegal hate speech, terrorist content, unlawful discriminatory content, or any content that the applicable laws render illegal or (iii) if it is likely to give rise to complaints by third parties or other Choco customers. Due account of the fundamental rights and freedoms and legitimate interests of all parties involved will be taken when making decisions about removal of the Supplier Data. Choco will comply with binding orders of courts and supervisory authorities to remove any illegal Supplier Data from the Cloud Service.

3.5 Backup. Choco will use commercially reasonable efforts to ensure integrity and availability of the Supplier Data. Notwithstanding the foregoing Supplier shall be solely responsible for the Supplier Data and shall take back-ups on a regular basis and commensurately with the risk.

3.6 Supplier Indemnity. Supplier shall indemnify and hold Choco, its employees, representatives and Vicarious Agents harmless from and against any claims, losses, liabilities, damages and expenses (including reasonable attorneys’ fees) asserted against them by a third party arising out of (i) Supplier's (including its Authorised Users’) use of the Services, (ii) the Supplier Data, (iii) performance of orders submitted to the Supplier, or (iv) Supplier’s (including its Authorised Users’) violation of applicable laws. Choco shall notify Supplier without undue delay about any claims asserted by third parties and shall, upon request, provide the information and documents required for the defence. Moreover, Choco at its own discretion will either surrender the right of defence to Supplier or undertake such defence in consultation with Supplier. In particular, Choco shall neither acknowledge nor dispute any claims asserted by third parties without consulting with Supplier, except where Supplier has not responded to Choco's notification of the claim within a reasonable time period.

3.7 Personal information. With respect to the personal information that Choco processes on behalf of Supplier for the provision of the Services, the Parties enter into a Data Processing Agreement available here ("DPA") and which is incorporated by reference into this MSA.

4. Fees and Payment

4.1 Fees. Supplier shall pay Choco the fees agreed to in the Order Form or elsewhere in writing for the provision of the Services (the “Fees”). Unless expressly agreed otherwise in the Order Form, the Fees consist of a recurring monthly fee for the use of the Cloud Service (“Subscription Fee”) and a monthly or one-time fee for the Implementation Services (“Implementation Fee”). If the Parties agree on a monthly Implementation Fee, the Implementation Fee shall be payable for a maximum period of five (5) months.

4.2 Payment. If the Parties agree on a monthly Implementation Fee, the Implementation Fee shall be payable at the beginning of each month of the Implementation Phase up to the maximum duration set forth in section 4.1 above. If the Parties agree on a one-time Implementation Fee, the Implementation Fee shall be payable at the Effective Date (as defined in section 8.1 below). The Subscription Fee shall be payable on the Subscription Start Date (as defined in section 8.1 below) and at the beginning of each subsequent month of the Subscription Term (as defined in section 8.1 below). Unless expressly agreed otherwise in the Order Form, all invoiced amounts shall be due within two weeks of the date on the invoice and paid by direct debit. In case of late payment, Choco reserves the right to charge interest at the maximum rate permitted by law as well as an appropriate penalty fee and any actual reasonable collection costs, upon presentation of supporting documentation. If such delay continues for more than two (2) weeks, Choco may block Supplier’s access to the Services until the outstanding amount is paid in full.

4.3 Taxes. Unless expressly agreed otherwise in the Order Form, all amounts are net amounts in US Dollars. The Fees are exclusive of all applicable sales, use, value-added and other taxes, and all applicable duties, tariffs, assessments, export and import fees, or other similar charges, and Supplier will be responsible for payment of all such taxes (other than taxes based on Choco’s income), fees, duties, and charges and any related penalties and interest, arising from the payment of the fees, the provision of the Services, or the license of the Cloud Service to Supplier. Supplier will make all payments of fees and commissions to Choco free and clear of, and without reduction for, any withholding taxes; any such taxes imposed on payments of fees and commissions to Choco will be Supplier’s sole responsibility, and Supplier will provide Choco with official receipts issued by the appropriate taxing authority, or such other evidence as the Choco may reasonably request, to establish that such taxes have been paid.

4.4 Discounts. Unless otherwise specified in the Order Form, any discounts are valid only for the relevant Subscription Term in which they are provided and do not automatically extend or apply to subsequent terms, renewals, or extensions.

4.5 Price Adjustments. Choco reserves the right to modify the Fees by providing Supplier with a written notice at least 30 days in advance. In the event that Supplier objects to the updated Fees within such 30-day period, Choco may terminate the Agreement or offer Supplier a reasonable remedy at its own discretion.

5. Intellectual Property

5.1 Reservation of Rights. Supplier acknowledges and agrees that Choco and/or its licensors own or otherwise have all the necessary intellectual property rights in the Choco Deliverables and the Cloud Service, together with any related technology any intellectual property rights related thereto or embodied therein such as any systems, application programming interfaces or Integrations developed by or on behalf of Choco together with any improvements or modifications to the foregoing. Supplier does not have any rights in or to the Cloud Service and the Choco Deliverables, except for the limited express rights granted in this Agreement.

5.2 Feedback. Both during and after the Term, Supplier allows Choco to use, copy, disclose and exploit any suggestions and other feedback provided by Supplier and its Authorised Users freely in order to improve and enhance the Services and for development of other services in any manner without any obligation, royalty, attribution or restriction based on intellectual property rights or otherwise.

5.3 Trademark License. Supplier grants Choco a non-exclusive, worldwide licence to use Supplier's trademarks for operating the Cloud Service and for the performance of the Agreement. Choco shall be specifically entitled to display the trademark on Supplier's supplier profile and to grant sublicenses to its Vicarious Agents to the extent necessary for the performance of the Agreement. Otherwise, the right of use may not be transferred or assigned.

5.4 Customer Reference. Choco may use Supplier’s name and logo in its marketing materials, presentations and similar communications to refer to Supplier as a customer. Supplier may revoke this consent any time by giving prior written notice.

6. Confidentiality

6.1 Duty of Confidentiality. The Parties undertake to keep confidential any information and documents of the disclosing party, which are either to be regarded as confidential due to the nature of the information or the circumstances of their disclosure or have been designated or marked as confidential by the disclosing party, such as business and/or trade secrets ("Confidential Information") and to use them exclusively for the purposes allowed under this Agreement. The technical components, documentation and the source code of the Cloud Service and the terms of the Order Form shall be considered as Confidential Information of Choco. The receiving party shall undertake reasonable technical and organizational measures to protect Confidential Information.

6.2 Disclosure of Confidential Information. The receiving party is entitled to disclose Confidential Information of the disclosing party solely (i) to its employees, contractors, Vicarious Agents or consultants on a need to know basis for the performance of this Agreement, provided that they are bound by the confidentiality obligations at least as protective as those contained herein, (ii) in a legal proceeding, (iii) where required by law, (iv) to third parties upon prior written approval of the disclosing party. Affiliated companies of the receiving party will not be considered third parties if the receiving party holds a majority of capital and voting rights. When requests are made by judicial or administrative authorities relating to the disclosure of Confidential Information, the receiving party shall without undue delay notify the disclosing party thereof in writing, to the extent permitted by law.

6.3 Exclusions from Confidentiality. Confidential Information does not include information that (i) was already known to the receiving party prior to disclosure, (ii) is generally known or becomes known to public through no fault of the receiving party, (iii) is independently developed by the receiving party itself without access to the Confidential Information of the disclosing party or (iv) was brought to the attention of or shared with the receiving party by a bona fide third party authorized to do so.

6.4 Duration of Confidentiality. The duty of confidentiality shall commence upon gaining knowledge of the Confidential Information and will continue for the entire term of this Agreement. In addition, the duty of confidentiality shall remain in place for a period of three (3) years after cessation of the Agreement, unless statutory provisions provide for a longer confidentiality obligation. In particular, any business secrets shall be treated confidentially for as long as they are business secrets.

7. Suspension

7.1 Suspension. Choco is entitled, but not obliged, to monitor Supplier’s and its Authorized Users’ use of the Services and may suspend Supplier's or its any of its Authorized Users’ access to the Cloud Service (i) if Choco reasonably believes a violation of the Agreement has occurred, (ii) if the suspension is necessary for technical or security reasons or to avert imminent damage to Choco, Supplier or third parties or (iii) if Choco is obliged to suspend access by law. Choco will use commercially reasonable efforts to provide advance notice of suspension, unless prohibited by law. Choco shall lift the suspension if the reason for the suspension no longer exists. Choco will have no liability for any damage, liabilities, losses (including any loss of data or profits), or any other consequences that Supplier may incur as a result of a suspension triggered by its Authorized Users’ own acts or omissions.

8. Term and Termination

8.1 Term. The Agreement shall commence on the date of the Parties’ last signature on the Order Form (“Effective Date”). The term of the Agreement comprises the “Implementation Phase” and the “Subscription Term”. The Implementation Phase starts with the Effective Date and ends on the date when integration is complete, meaning that an order’s expected delivery date, the Customers’ general information and their product information are successfully transmitted and integrated into Supplier's ERP or designated system (“Subscription Start Date”). Whilst additional components may be identified and assessed by the Parties depending on the specific functionalities of Supplier’s systems during the Implementation Phase, these will not be considered in determining the Subscription Start Date. The Subscription Term starts on the day after the Subscription Start Date and continues for a period of twelve (12) months or as otherwise indicated in the Order Form. The Subscription Term shall be renewed for successive periods of twelve (12) months if the Agreement is not terminated in writing by either Party with three (3) months' prior notice before the end of the respective Subscription Term.

8.2 Termination for Cause. Either Party may terminate the Agreement if the other Party materially breaches this Agreement, and such breach remains uncured for more than thirty (30) days after receipt of written notice of such breach. This clause shall not apply to breach of limited warranty provided by Choco as per section 8 and the exclusive remedies of Supplier are listed therein.

8.3 Termination by Choco. Choco may terminate this Agreement immediately upon written notice; if (i) Supplier has repeatedly placed Supplier Data or products that is not permissible under the Agreement; (ii) Supplier is in default of its payment obligations for more than two (2) weeks; (iii) Supplier becomes insolvent, files for or has filed against it, a petition of bankruptcy or (iv )if Supplier acts against use restrictions set out in section 2.2. Choco may terminate the Agreement for convenience without having to give any reasons any time with a notice period of one (1) month.

8.4 Effects of Termination. When the Agreement for the Services offered against remuneration is terminated Supplier shall lose its access to the Services, with the exception of the Free Services which may be still provided to the Supplier at Choco’s sole discretion. After termination, Choco will have no obligation to Supplier to continue storing Supplier Data and will delete the Supplier Data in its systems upon Supplier’s request or in line with its retention policy, whichever is earlier. Notwithstanding the foregoing, Choco will be entitled to retain the Supplier Data if Choco is obliged to do so by law or to the extent that the Supplier Data is required for accounting and documentation purposes or for the operation of the Cloud Service.

8.5 Survival. The sections 1.3 (Free Services), 3.6 (Indemnification), 4 (Fees and Payment), 6 (Confidentiality), 8.4 (Effects of Termination) and 10 (Limitation of Liability) and others which by their nature are intended to survive, shall survive after termination or expiration of this Agreement.

9. Warranty

9.1 Limited Warranty. Choco provides a limited warranty against defects in the Services. A defect is deemed to exist in case of any significant deviations from the functional scope of the Services as described in the Agreement that render the use of the Service impossible or greatly restricted. Supplier shall without undue delay notify Choco in writing of any defect and provide all information that is available to Supplier and is necessary for Choco to identify, reproduce, analyze and remedy the defect. Furthermore, Supplier shall assist Choco in remedying defects free of charge and in a reasonable manner. Choco will either rectify the defect or deliver the impacted Service once again at its discretion and within a reasonable period of time upon receiving written notification of the defect. The provision of instructions for use, with which Supplier can reasonably workaround the defects, will also be deemed to be a remedy of defects. If Choco is unable to reasonably implement the remedies, then unless Choco and Supplier agree on a reasonable alternative remedy (such as giving the Supplier a reasonable discount on the affected services), then Supplier’s sole and exclusive remedy shall be to terminate the Agreement. Choco's sole responsibility and Supplier's sole exclusive remedies against defects are set out in this section.

9.2 Exclusion from Warranty. This limited warranty does not apply (i) to any defects caused by unauthorized use, abuse, negligence or equipment of Supplier, (ii) to any defects not notified by Supplier within 30 days upon noticing the defect.

9.3 Limitation period. The limitation period for warranty claims is one year, unless they are based on intentional acts or omissions or gross negligence or relate to losses resulting from death, physical injury or impairment of health.

9.4 DISCLAIMER OF WARRANTY. EXCEPT AS EXPRESSLY PROVIDED IN THIS SECTION, AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICES ARE PROVIDED “AS IS,” AND CHOCO MAKES NO (AND HEREBY DISCLAIMS ALL) OTHER WARRANTIES, REPRESENTATIONS, OR CONDITIONS, WHETHER WRITTEN, ORAL, EXPRESS, IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, NONINFRINGEMENT, OR FITNESS FOR A PARTICULAR PURPOSE. CHOCO DOES NOT WARRANT THAT ALL ERRORS CAN BE CORRECTED, OR THAT OPERATION OF THE SERVICES SHALL BE UNINTERRUPTED OR ERROR-FREE, NOR DOES CHOCO GUARANTEE ANY SPECIFIC RESULTS IN CONNECTION WITH USE OF THE SERVICES.

10. Limitation of Liability

10.1 LIMITATION OF LIABILITY. TO THE FULLEST EXTENT PERMITTED UNDER APPLICABLE LAW, THE MAXIMUM AGGREGATE LIABILITY OF CHOCO (INCLUDING ITS LEGAL REPRESENTATIVES, EMPLOYEES, AGENTS AND VICARIOUS AGENTS) ARISING OUT OF OR IN ANY WAY CONNECTED TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID TO CHOCO IN CONNECTION WITH THE SERVICES DURING THE TWELVE (12) MONTHS PRECEDING THE ACT, OMISSION OR OCCURRENCE GIVING RISE TO SUCH LIABILITY. IN NO EVENT WILL CHOCO HAVE ANY LIABILITY ARISING OUT OF OR IN ANY WAY RELATED TO THE ACTS OR OMISSIONS OF ANY THIRD PARTY.

10.2 DISCLAIMER OF CONSEQUENTIAL AND RELATED DAMAGES. TO THE FULLEST EXTEND PERMITTED UNDER APPLICABLE LAW, IN NO EVENT WILL CHOCO (AND ITS LEGAL REPRESENTATIVES, EMPLOYEES, AGENTS AND VICARIOUS AGENTS) BE LIABLE TO SUPPLIER FOR ANY INCIDENTAL, INDIRECT, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, REGARDLESS OF THE NATURE OF THE CLAIM, INCLUDING, WITHOUT LIMITATION, LOST PROFITS, COSTS OF DELAY OR PROCUREMENT OF SUBSTITUTE SERVICES, ANY BUSINESS INTERRUPTION, IMPACT OF LOST OR DAMAGED DATA OR LIABILITIES TO THIRD PARTIES ARISING FROM ANY SOURCE, EVEN IF CHOCO HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION IS INTENDED TO APPLY WITHOUT REGARD TO WHETHER OTHER PROVISIONS OF THIS AGREEMENT HAVE BEEN BREACHED OR HAVE PROVEN INEFFECTIVE.

10.3 EXCLUSIONS FROM LIMITATION OF LIABILITY. NOTHING IN THIS AGREEMENT WILL LIMIT OR EXCLUDE EITHER PARTY’S LIABILITY FOR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT OF A PARTY.

11. Final Provisions

11.1 Amendments. Choco may amend this Agreement with effect for the future. Any amendments and side agreements to this Agreement must be made in writing. In case of minor or cosmetic amendments that do not affect Supplier, the amendments shall be posted on Choco's website. In other cases, Choco will provide Supplier with notice before the changes enter into force and allow Supplier a reasonable time to review. Amendments shall be deemed as agreed by Supplier if Supplier has not expressly objected to them by the time they take effect. In case of objection, unless the Parties mutually agree upon another resolution, either party may terminate this Agreement as its sole and exclusive remedy in connection with such amendment and/or objection. Notwithstanding the foregoing, Choco may amend its policies from time to time to make necessary

adjustments due to changes in its Services or laws without prior notice.

11.2 Assignment and Subcontracting. Supplier shall not, without the prior written consent of Choco, assign, transfer, charge, subcontract or deal in any other manner with all or any of its rights or obligations under this Agreement. Choco may at any time assign, transfer or deal in any other manner with all or any of its rights or obligations under this Agreement without Supplier’s consent. If Choco subcontracts any of its obligations to its subcontractors or affiliates (“Vicarious Agents”), Choco will remain responsible for their acts and

omissions.

11.3 Entire Agreement and Order of Precedence. This Agreement includes the Order Form, MSA (including DPA), applicable Service Specific Terms and Choco’s policies that are made available to the Supplier. It shall constitute the entire agreement between the Parties regarding the provision and use of the Services. The Agreement shall supersede any previous agreements, communications, representations and understandings between them, whether written or oral, relating to this subject matter. In case of any inconsistency or conflict between the provisions of this Agreement, the following order of precedence shall apply: Order Form, Service Specific Terms, DPA and the MSA.

11.4 Headings. Headings or titles used in this agreement are for convenience and reference purposes only and shall not be considered in the interpretation or construction of any provision of this Agreement.

11.5 Waiver and Severability. No failure or delay by a Party to exercise any right or remedy provided under this Agreement or by law shall constitute a waiver, nor shall it prevent or restrict the further exercise of any right or remedy. If any part of this Agreement is determined to be invalid or unenforceable by a competent court, that part shall be deemed deleted, but this shall not affect the validity and enforceability of the rest of the Agreement.

11.6 Force Majeure. Any delay in the performance of any duties or obligations of either party (except the payment of Fees owed) will not be considered a breach of this Agreement if such delay is caused by a labor dispute, shortage of materials, telecommunication or internet delays or failures, fire, earthquake, flood, pandemic or epidemic, or any other event beyond the control of such party, provided that such party uses reasonable efforts, under the circumstances, to notify the other party of the cause of such delay and to resume performance as soon as possible.

11.7 Governing Laws and venue. This Agreement and any action related thereto will be governed and interpreted by and under the laws of the State of New York, without giving effect to any conflicts of laws principles that require the application of the law of a different jurisdiction. The Parties hereby expressly consent to the exclusive personal jurisdiction and venue in the state and federal courts for New York, New York for any lawsuit arising from or related to this Agreement. The United Nations Convention on Contracts for the International Sale of Goods does not apply to this Agreement.

These Integration General Terms and Conditions (the "Integration-GTC") together with the Main Services Agreement (the “MSA”) govern Choco’s performance of Integration Services consisting of development of a technical infrastructure for digital transmission of information between the Cloud Service and Supplier’s enterprise resource planning (the “ERP”) system (the “Integration”) and the Parties’ obligations in relation to that.

These Integration-GTC, together with the Annex-1 attached thereto, constitute an integral part of the Agreement entered into between Choco and Supplier. Capitalised terms not otherwise defined in these Integration-GTC shall have the meanings assigned to them in the Agreement. In the event of any inconsistency between these Integration-GTC and the Agreement, the order of precedence prescribed in the MSA shall apply.

1. Subject Matter of the Integration-GTC

1.1 The subject matter of these Integration-GTC is the development of the Integration until its delivery to Supplier. Once accepted by Supplier, the Integration shall constitute a part of the Cloud Service.

1.2 Integrations built by or on behalf of the Supplier do not fall under the scope of these Integration GTC and Choco does not assume any responsibility for such integrations.

1.3 The services of Supplier’s ERP provider that are accessed through the Integration do not fall under the scope of the Agreement and are solely governed by the terms and conditions of the specific ERP provider.

2. Provision of the Integration Services

2.1 If the Parties agree on a minimum number of active Customers for the launch of the Integration Services in the Order Form, then Choco will start to perform the Integration Services only once that minimum number is reached. A Customer shall be deemed active if it has placed at least one order with Supplier using the Cloud Service in the relevant calendar month (“Active Customer”). If the minimum number is not reached within twelve months from the Effective Date of the Agreement, either Party shall be entitled to terminate the Integration Services, unless Choco has already commenced with the performance of the Integration Services.

2.2 The Parties shall mutually agree on the scope and channel of Integration, based on the standard content, channels and file formats supported by Choco as described in Annex-1. In case of any subsequent additions or changes to the agreed-upon scope, Choco reserves the right to adjust the timelines and charge additional Fees taking into consideration any extra efforts required to implement the changes. Supplier shall ensure that Choco only gets access and permissions to the agreed transmission content and not to any other information that is not necessary for the Integration.

2.3 Supplier shall provide Choco with a distinct technical contact person from its ERP provider who shall have sufficient technical knowledge and capacity to cooperate with Choco for the provision of the Integration Services.

2.4 Upon request, Supplier shall provide and shall ensure that its ERP provider provides Choco with all information required by Choco for the provision of the Integration Services in a timely manner, including sample catalog files, sample order files, API docs, documentation related to the system environment as well as with staging credentials and access rights to its ERP system and the test environment.

2.5 If Supplier cannot provide any test environment, then Supplier shall alternatively provide Customer information with which Choco can perform integration tests. Unless delivery of the test results is automated, Supplier shall provide Choco with the test results. Supplier shall ensure that the provided test environment corresponds to the same technical parameters as the live product environment. Supplier will provide Choco with (test) access data of the selected authentication method. Any Choco Deliverables provided by Choco for the Integration Services as well as instructions regarding their use shall be deemed Confidential Information of Choco and Supplier shall not be entitled to edit, distribute or post publicly the documentation or instructions for use.

2.6 Supplier shall inform Choco in a timely manner about any upcoming adjustments to its technical systems that could have an impact on the functionality of the Integration Services or the performance of Choco's obligations under the Agreement.

3. Acceptance Procedure

3.1 Choco shall submit the Integration to Supplier for inspection and acceptance and shall notify Supplier about such submission. Supplier shall test and inspect the Integration for its conformity with these Integration-GTC and shall do so within a reasonable period of time which shall not be longer than two (2) weeks. The Supplier shall notify Choco immediately of any defects in writing (email acceptable).

3.2 Supplier shall declare its formal acceptance in writing if the Integration is essentially in conformity with these Integration-GTC. Formal acceptance by Supplier may not be refused due to insignificant flaws or defects. Choco shall within a reasonable period of time use commercially reasonable efforts to remedy such insignificant defects after formal acceptance, provided Supplier has notified Choco in writing thereof during the inspection of conformity and prior to formal acceptance.

3.3 If, within a period of three (3) weeks after submission of the Integration, Supplier no longer reports any more significant defects or if Supplier agrees to deployment of the Integration into production environment, then the Integration shall be deemed formally accepted.

3.4 With respect to defects that were known to Supplier at the time of formal acceptance, defects that would have been obvious in the course of a proper inspection or defects that were otherwise not known to Supplier due to negligence or that were not reported by Supplier, Supplier will not be entitled to the rights related to defects as governed in section 9 of the MSA on Warranty, otherwise any defects that occur and notified to Choco after formal acceptance will be subject to section 9 of the MSA on Warranty.

3.5 If the Integration is delivered partially per component, the acceptance procedure shall apply mutadis mutandis to each part.

Annex 1 - Integration Services

This Annex sets out the standard scope of Integration, in particular the transmission content, transmission channels, file formats and technical procedures supported by Choco. Supplier-specific customizations may be possible subject to additional charges.

A. Transmission Content

It is possible to transmit different components through an Integration. At a minimum, an Integration will transmit orders from Cloud Service to Supplier and Product Catalogs from Supplier to Cloud Service.

In addition to this minimum content, Choco supports transmission of prices, order comments, order confirmation, images, customer lists, Order Guides of Customers, order updates and edits.

Parties will agree on the transmission content in the technical coordination meeting. After such meeting, there may be a possibility for adding more components to the scope subject to additional charges.

B. Data Transmission
Data transmission may consist of one or a combination of the following technical channels:

1. HTTP(s) API
2. (S)FTP Server
a) Hosting by Choco
b) Hosting by the Supplier or a third-party provider
3. Choco App for an ERP system (Connector)

More details on the transmission channels are given below:

1. HTTP(s) API
Choco supports the following authentication:

•Oauth 1.0 and 2.0
•Basic Auth
•Open ID

All other types of authentication (SAML, TLS, JWT,... ) require detailed technical review and may be subject to additional fees. Choco will keep all credentials strictly confidential and use them only for the purpose of Integration.

Choco supports all common methods (GET, POST, PUT, PATCH) with a transmission of orders placed via POST and a retrieval of product catalogs via GET. Supplier will ensure endpoint availability throughout the entire term of the contract. Choco will repeat erroneous transmissions, but cannot guarantee a transmission in the absence of available endpoints.

2. (S)FTP server

a) Hosting by Choco
Choco shall make a (S)FTP (SSH) server available and shall provide Supplier with username, password, URL and port. Supplier will be granted CRUD rights for the folders in question. Choco will provide separate (S)FTP servers for test and live operation.

b) Hosting by the Supplier
Supplier shall provide Choco with the username, password, URL and port of the (S)FTP server. Supplier shall ensure the availability of the endpoints throughout the entire term of the Agreement. Choco will repeat faulty transmissions but cannot guarantee a transmission in the absence of available endpoints.

3. Choco-App for an ERP system (Connector)

Choco provides system-side integration for selected ERP systems via an app or another standardized interface, whereby Choco builds a connector between the Cloud Service and Supplier’s ERP.

C. File Formats
Choco supports multiple file formats for the exchange: CSV, XML, JSON, TXT, Excel, EDI, X12. In the event there are unclear or missing specifications from the Supplier, Choco shall provide files in a standard format (including documentation).

D. Technical Procedure

1. Orders from Cloud Service to Supplier
After the Integration is delivered (deployed in the production environment), Choco will send the orders to Supplier in real time via one of the transmission channels or shall make them available on an (S)FTP server. The Supplier shall import the orders in real time into its own ERP system. The purchase orders will follow the prescribed format, but will at a minimum contain (if not explicitly defined otherwise):

•Order number (unique)
•Product numbers (as specified by Supplier)
•Supplier number

2. Product catalogs from Supplier to Cloud Service
Supplier shall regularly send a (complete and up to date) Product Catalog and/or Order Guides of its Customers to Choco or make them available via one of the selected transmission technologies. Choco shall import them in real time or at least every 24 hours (unless explicitly defined otherwise).

Technical procedure for transmission of other components shall be agreed by the Parties. Unless agreed otherwise, both Parties shall use commercially reasonable efforts to transmit all components through Integration in real time.

These Onboarding and Support General Terms and Conditions (the "O&S-GTC") together with the Main Services Agreement (the “MSA”) govern Choco’s performance of the Onboarding and Support Services as described in the Order Form or agreed elsewhere between the Parties (“O&S Services”) and the Parties’ obligations in relation to that.

These O&S-GTC constitute an integral part of the Agreement entered into by and between Choco and Supplier. Capitalized terms not otherwise defined herein shall have the respective meanings assigned to them in the Agreement. In the event of any inconsistency between these O&S-GTC and the Agreement, the order of precedence prescribed in the MSA shall apply.

1. Provision of the O&S Services

1.1 The Parties shall agree on a project plan for providing the O&S Services and Supplier shall appoint a project manager who will attend all the meetings and complete or arrange for completion of all Supplier activities as outlined in the project plan.

1.2 At the sole discretion of Choco, training may be given via workshops, training materials, dedicated point of contacts or any alternative methods. The Parties shall mutually agree on the time, duration, group of participants and location of such training. Unless otherwise agreed, training shall take place virtually. Both Parties shall be entitled to postpone agreed training dates with reasonable notice in advance of the agreed date.

1.3 Supplier asks Choco to onboard its Customers to the Cloud Service and Choco shall use commercially reasonable efforts to onboard them. Any contact with the Supplier’s Customers made by Choco for this purpose is made exclusively on behalf and in the name of Suppler, as well as in accordance with the instructions issued by Supplier. The Parties shall agree on when, how and to what extent Choco should contact Supplier’s Customers. In no case does Choco owe a duty to ensure a successful approach.

1.4 Subject to a respective agreement between the Parties, Choco shall create Choco Deliverables for the purpose of introducing the Cloud Service to Supplier’s Customers. Supplier shall use the Choco Deliverables only for the purpose they are created for and shall be solely responsible for the use of the Choco Deliverables, including the uses made by Choco upon Supplier’s instructions.

2. Supplier Obligations and Warranties

2.1 Supplier shall provide Choco with all information, documents and other materials required for onboarding Supplier and its Customers to the Cloud Service, setting up their accounts and implementing the Cloud Service (the “Supplier Deliverables”) in a timely manner upon Choco’s request. Such information includes, without limitation, Supplier’s delivery days, cut-off times and its product catalogue containing all the products in Supplier’s product range together with their designation, product number, name, ID, availability, order unit, list price and image (“Product Catalogue”), which will be displayed in Supplier’s account on the Cloud Service to its Customers.

2.2 Supplier Deliverables also include a list of all - or the number specified in the Order Form – of Customers to be onboarded to the Cloud Service, including at least the customer number, name, address, telephone number, email address of the Customer, as well as telephone number and email address of one contact person, and order history of those Customers for the last two hundred (200) days in order to be turned into individual shopping lists for the Customers (“Order Guide”). Unless explicitly requested by Supplier, any Customer related information provided throughout the Agreement may be used by Choco for onboarding purposes.

2.3 If there are Customers who are already registered with the Cloud Service, Supplier shall provide the Order Guides of such Customers immediately upon signing the Agreement. If a Customer registers for the use of the Cloud Service for the first time, then Supplier shall provide Choco with the Order Guides of such Customers without undue delay (but no later than within twenty-four (24) hours). Supplier shall ensure that the products reported in the Order Guides are also listed in the Product Catalogue and that the products in the Order Guide and in the Product Catalogue can be assigned to each other by means of a clear, identical product number.

2.4 Supplier warrants that its directives in relation to O&S Services do not violate any applicable legal requirements or third-party rights and that all legal requirements are fulfilled to allow Choco to provide the O&S Services. In particular, Supplier warrants that it has obtained all necessary consents for Choco to legally contact its Customers for the provision of the O&S Services.

2.5 Supplier warrants that the individuals who are contacted by Choco upon the Supplier’s directives are authorized to represent the respective Customer and make use of the Cloud Service on behalf of the respective Customer.

3. Indemnification

3.1 Supplier shall indemnify Choco, its employees, representatives, group companies against all third-party claims, demands, actions, proceedings, losses, fines, penalties, awards, liabilities, damages, compensation, settlements, charges and expenses (including legal costs) asserted against Choco in relation to performance of the O&S Services.

3.2 Choco shall inform Supplier without undue delay about any claims asserted by third parties and shall - upon request - provide the information and documents required for the defense. In addition, Choco shall at its own discretion either relinquish the defense to Supplier or engage in a defense in consultation with Supplier. In the absences of consultation with Supplier, Choco shall above all neither acknowledge nor dispute any claims asserted by third parties, except where Supplier has not responded to Choco's notification of the claim within a reasonable time period.

4. Warranty

4.1 Except as provided otherwise in an Order Form, all warranties, representations, conditions and all other terms of any kind whatsoever implied by law are, to the fullest extent permitted by applicable law, excluded from these O&S-GTC.

This White Label Terms and Conditions (the “WL-TC”) together with the Main Services Agreement (“MSA”) govern branding of the Choco's mobile app with Supplier’s name and logo (the “WL-App”), licensing of the WL-App to Supplier’s Customers and the operation and maintenance of the WL-App.

The WL-TC constitutes a Service Specific Term and is incorporated into the Agreement entered into by and between Choco and Supplier by reference. Capitalized terms not otherwise defined herein shall have the respective meanings assigned to them elsewhere in the Agreement. In the event of any inconsistency or conflict between the WL-TC and the MSA, WL-TC shall prevail.

1. License Grant. Choco hereby grants to Supplier a limited, revocable, non-exclusive, non-transferable license to use the WL-App, and grants Supplier the right to sublicense the WL-App to Supplier’s Customers during the term of the Agreement to access and use it solely for placing orders from Supplier and for communication with Supplier, subject to the Choco’s End-User Terms (as defined below) and the terms agreed herein. The WL-App may not be used on behalf of or for the benefit of a third party other than Supplier.

2. Branding. The WL-App will be branded with the Supplier's name and logo. It will include an acknowledgement as "Powered by Choco". Supplier is solely responsible for securing its own copyrights, trademarks and all other intellectual property rights for use of Supplier’s name and logo in the WL-App.

3. Hosting and support. The WL-App will be operated, hosted and maintained by Choco and any customer support to Supplier’s Customers will be provided by Choco in accordance with Choco’s standard support policies.

4. App submission. Where required by the respective mobile application store, the WL-App will be submitted to the mobile application store by Choco under Supplier’s development account. Supplier will be responsible for maintaining its developer accounts in good standing and will provide administrator access to Choco for publishing and maintenance of the WL-App. Choco shall be responsible for submitting the WL-App to be listed on the respective App Store(s).

5. Marketing. Supplier may market and promote the WL-App on any form of media, but shall not claim any ownership of the WL-App.

6 Use by Customers. Supplier’s Customers shall not further sublicense nor distribute the WL-App, and use of the WL-App by the Customers shall be subject to Choco’s “Terms of Service” or any other end user terms as determined by Choco (“Choco End-User Terms”). The WL-App will be provided to Supplier’s Customers and such individual end users who are personnel of the Customers, on a strictly “as is” basis, and for free (i.e. Supplier cannot charge its Customers for the WL-App licensed hereunder). Supplier will remain responsible and liable towards Choco for all of its Customers and their end users’ (whether authorized or not) use of the WL-App in accordance with Choco End-User Terms and for their acts and omissions. Choco reserves the right to suspend Suppliers’ Customers access to the WL-App in the event of any violation of Choco End-User Terms.

7. Functionality of WL-App. WL-App will enable Supplier’s Customers to communicate with the Supplier and place orders to Supplier. Choco may make additional functionalities available in the WL-App at its own discretion, but it makes no commitment or gives no guarantee to do so. Supplier acknowledges and accepts that not all of the functionalities available in the Choco's mobile app will be available in the WL-App and that Choco is under no obligation to make any additional functionalities available other than the ones indicated in the first sentence of this section.

8. Fees. The Fees for making the WL-App available will be agreed in the Order Form signed between the Parties or elsewhere in writing. 
9. Use by Supplier. The terms of the MSA will continue to govern the use of the WL-App by Supplier and its Authorized Users.

10. Limitation of liability. Choco’s warranties regarding use of the WL-App by Supplier’s Customers and its sole liability arising out of use of the WL-App by Supplier’s Customers are limited to those set out in the Choco End-User Terms. Specifically, Supplier understands that the WL-App is provided to Supplier’s Customers on an “as is” and “as available” basis without any warranties of any kind, whether express or implied, including, but not limited to, implied warranties of merchantability, fitness for a particular purpose, or non-infringement. Supplier shall be solely liable towards its Customers for any amounts and claims beyond what is undertaken in Choco End-User Terms.

11. Intellectual property. Supplier acknowledges and agrees that Choco and/or its licensors own or otherwise have all the necessary intellectual property rights in the WL-App and all derivative works thereto. Supplier does not have any rights in or to the WL-App, except for the limited express rights granted in this WL-TC.

12. Indemnification by Supplier. Supplier will indemnify, hold harmless, and defend Choco, its licensors, service providers, and their respective affiliates, directors, officers, agents, and employees, from and against any third party claim, suit, or proceeding arising out of or related to (i) any claims related to any infringement or violation of a copyright, trademark, trade secret, or confidentiality obligation by any Supplier branding and any other materials provided or published by Supplier on the WL-App, (ii) claims by Supplier’s Authorized Users or Customers, including claims related to unauthorized disclosure of personally identifiable or other private information, (iii) Supplier’s or its Customers’ and their users negligent acts or omissions in the operation of the WL-App, and their material breach of Supplier’s obligations, representations, warranties or covenants contained herein.

13. Miscellaneous. Unless specifically set forth in this WL-TC, all references to the Cloud Service in the Agreement shall include the WL-App as well.

This Data Processing Agreement (“DPA”) is entered into between the Supplier entity identified in the Order Form executed between the parties and Atlantic Food Waste Partners LLC d/b/a Choco(“Choco”), (each “Party” and together the “Parties”).

Recitals

Under an Order Form concluded by and between the Parties, which is governed by the Main Services Agreement (“MSA”) and Service Specific Terms (altogether, the “Agreement”), Choco has agreed to provide Supplier with the provision of the Onboarding and Support Services, Cloud Services, and Integration Services (the “Services”). For the purposes of providing the Services to Supplier, Choco may have access to, collect, or be provided with, Supplier Personal Data (defined below) in relation to which Supplier is subject to certain obligations.

This DPA enables Supplier to comply with its obligations when providing or allowing access to Supplier Personal Data by Choco. This DPA is supplemental to, and forms an integral part of, the Agreement. In case of any conflict or inconsistency with the terms of the Agreement, this DPA will take precedence over the terms of the Agreement to the extent of such conflict or inconsistency.

1. Definitions

For the purposes of this DPA:

“CCPA” means the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, as set forth in California Civil Code § 1798.100 et seq. and all other applicable laws or regulations relating to the processing of personal information promulgated thereunder. Other terms that have meanings ascribed to them in the CCPA, including but not limited to “business”, “business purposes”, “commercial purposes”, “collects”, “collected”, “collection”, “consumer”, “de-identified”, “personal information”, “sell”, “selling”, “sale”, “sold”, “service provider” or “third party” shall have the same meaning as in the CCPA.

“Consumer” means the California individual to whom Supplier Personal Data relates.

“Subcontractor” means any processor engaged by Choco or by any other Subcontractor of Choco, which agrees to receive from Choco, or from any other Subcontractor of Choco, Supplier Personal Data intended for processing activities to be carried out on behalf of Supplier and in accordance with its instructions, the terms of this DPA and the terms of the Services Agreement.

“Supplier Personal Data” means any personal data and/or personal information regarding a Consumer, as applicable, provided by Supplier to Choco in connection with the Services or in the course of Choco’s performance of the Services.

2. Status of Parties; Details of the processing activities

2.1 The Parties agree that with respect to the provision of Services, as applicable, as to processing of the personal information, Supplier is the “Business” and Choco is the “Service Provider”, as such terms are defined in the CCPA.

2.2 Choco and any person acting under its authority, including Subcontractors and those acting under the Subcontractor’s authority shall process Supplier Personal Data pursuant to the written instructions provided by Supplier to Choco, and attached hereto as Schedule 1, and only to the extent necessary to fulfil its obligations under this DPA. Any additional instructions outside of the scope of Schedule 1 shall be agreed upon, in writing, by both Parties.

2.3 Supplier warrants and represents that it has obtained all necessary consents and complied with all obligations required by CCPA for making available any Supplier Personal Data to Choco and for allowing collection of Supplier Personal Data by Choco on the Supplier’s behalf under the Services Agreement.

3. Obligations of Choco

3.1 Choco agrees:

(a)to process Supplier Personal Data only:

(i) on behalf of Supplier and/or the applicable Business and in accordance with Supplier's documented instructions unless otherwise required by the CCPA;

(ii) for the purpose of carrying out the Services or as otherwise instructed by Supplier; and

(iii) in compliance with this DPA and the CCPA.

(b) that it shall not process the Supplier Personal Data other than on Supplier’s documented instructions in the Agreement, which include processing to detect data security incidents, protecting against fraudulent or illegal activity, maintaining and improving the Services, managing Supplier’s account, creation of datasets of aggregate consumer information and deidentified information, appointing Subcontractors, and any other business purpose or operational purpose permissible under the CCPA for a service provider that does not cause Choco to lose its Service Provider status.

(c) that it shall not (i) sell the Supplier Personal Data, (ii) retain, use or disclose the Supplier Personal Data for any purpose other than for the business purposes, including retaining, using, or disclosing the personal information for a commercial purpose other than providing the Services or carrying out the instructions of Supplier, or (iii) retain, use, or disclose the Supplier Personal Data outside of the Business relationship between Supplier and Choco.

(d) that it shall promptly notify Supplier of any requests, complaints, messages, or any other notices received from any third party regarding the processing of the Supplier Personal Data under this DPA (including requests from Consumers to correct, or limit or restrict use of such Consumers’ personal information), and that it will reasonably assist Supplier with its obligations to reply to or comply with requests, provided that Choco reserves the right to reimbursement from Supplier for any reasonable costs incurred as a result of providing such assistance.

(e) that if it is legally required to process Supplier Personal Data otherwise than as instructed by Supplier, it shall notify Supplier before such processing occurs, unless the law requiring such processing prohibits Choco from notifying Supplier on an important ground of public interest, in which case it shall notify Supplier as soon as that law permits it to do so.

(f) that it will provide reasonable assistance to Supplier in fulfilling its legal obligations under the CCPA, and will not knowingly carry out, or omit, any act, that would cause the Supplier to be in breach of the CCPA.

(g) that it has implemented and will maintain reasonable technical, organisational, and security measures to protect Supplier Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, appropriate to the risks represented by the processing and the nature of Supplier Personal Data to be protected. It shall be incumbent upon Supplier to determine whether these measures are sufficient with respect to the circumstances surrounding the data processing that are not known by Choco.

(h) to take reasonable steps to ensure that its personnel who have access to the Supplier Personal Data have committed themselves to confidentiality or are under appropriate statutory obligation of confidentiality.

(i) to inform a Consumer making a request that it should submit the request directly to Supplier.

(j) To notify Supplier if it makes a determination that it can no longer meet its obligations under the CCPA.

(k) to allow for and contribute to audits and assessments, including inspections, conducted by Supplier or another auditor mandated by Supplier, upon terms mutually agreeable to the Parties, to the extent that such information is within Choco’s control and Choco is not precluded from disclosing such information by applicable law, a duty of confidentiality, or any other obligation owed to a third party.

4. Subcontractors

Supplier acknowledges that Choco may transfer Supplier Personal Data to Subcontractors and Supplier hereby authorizes Choco to engage and appoint such Subcontractors to process Supplier Personal Data. Supplier also permits each Subcontractor to appoint a Subcontractor on its behalf when necessary. Supplier understands and acknowledges that all Subcontractors authorized by Supplier are acting under the authority and subject to the direct instructions of Supplier. Choco may continue to use those Subcontractors already engaged by Choco, as listed on Schedule 2, or to engage new Subcontractors to process Personal Data. Choco will update the list of sub-processors in Schedule 2 when engaging with new Subcontractors. If Supplier wants to receive an individual notification of an update to the list of Subcontractors, it shall sign up to the notification mechanism available in Schedule 2. Choco shall impose substantially similar data protection obligations vis-à-vis its Subcontractors which are no less protective than those set forth in this DPA and will remain liable to Supplier for the performance of its Subcontractors under this DPA.

5. Allocation of costs

Except as otherwise specified in this DPA, each Party shall perform its obligations under this DPA at its own cost.

6. Return or Deletion of Supplier Personal Data

Upon Supplier’s or a Consumer’s request, Choco will delete any Supplier Personal Data at any time during the term of this DPA. Alternatively, upon written request of Supplier or Consumer after expiration or termination of this DPA, Choco will securely destroy all Supplier Personal Data for Supplier. Notwithstanding the foregoing, Choco may decline the deletion requests from Supplier or Consumer if any applicable laws prevent Choco or Subcontractors from doing so.

7. Liability

Each Party’s liability towards the other Party in connection with this DPA will be limited in accordance with the applicable terms of the Agreement. Supplier acknowledges that Choco relies on Supplier’s directions as to the processing of Supplier Personal Data on behalf of Supplier in connection with Choco’s provision of the Services. Consequently, Choco will not be liable under this DPA or the Agreement for any claim resulting from (a) any action or omission by Choco resulting from Choco’s compliance with Supplier’s instructions or (b) Supplier’s failure to comply with its obligations under the CCPA.

8. Miscellaneous

8.1 Schedule 1 and 2 constitute an integral and inseparable parts of this DPA. In the event of inconsistencies between the provisions of this DPA and other agreements between the Parties, the provisions of this DPA shall prevail. In cases of doubt, this DPA shall prevail, in particular, where it cannot be clearly established whether a clause relates to a Party’s data protection obligations.

8.2 Should any provision or condition of this DPA be held or declared invalid, unlawful or unenforceable by a competent authority or court, then the remainder of this DPA shall remain valid. Such an invalidity, unlawfulness or unenforceability shall have no effect on the other provisions and conditions of this DPA to the maximum extent permitted by law. The provision or condition affected shall be construed either: (a) to be amended in such a way that ensures its validity, lawfulness and enforceability while preserving the Parties’ intentions, or if that is not possible, (ii) as if the invalid, unlawful or unenforceable part had never been contained in this DPA.

8.3 Any amendments to this DPA shall only be effective in they are made in writing duly signed by authorised representatives of the Parties hereto.

Schedule 1

Data Processing Instructions

This Schedule forms part of the DPA.

Purposes

The Supplier Personal Data shall be processed for the provision of the Onboarding and Support Services, Cloud Service, and Integration Services.

Consumers

The personal data concerns the following categories of data subjects (please specify):

Personal Data relevant to the Services, the extent of which is determined and controlled by Supplier in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects:

• Employees or contact persons of Supplier’s prospects and customers
• Employees, consultants, agents, advisors, freelancers of Supplier (who are natural persons)
• Supplier’s users authorized by Supplier to use the Services

Categories of data

The personal data concerns the following categories of data (please specify):

Personal Data relevant to the Services, the extent of which is determined and controlled by Supplier in its sole discretion, and which may include, but is not limited to the following categories of Personal Data:

• First and last name
• Position
• Contact information (company, email, phone, physical business address)
• ID data
• Device data
• Onboarding messages statistics
• In-App Campaign message statistics
• Any other data provided directly or indirectly by Supplier, its Authorized Users and/or Personnel of its Customers

Special categories of data (if appropriate)

The personal data concerns the following special categories of data (please specify): None. The personal data processed will not include sensitive personal data including information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life, government issued identification numbers, health or medical records, financial information and criminal records.

Processing operations

The personal data will be subject to the following basic processing activities (please specify): Collect, store, and process Supplier Personal Data to perform, operate, maintain, support and improve the Services pursuant to the Agreement, including the activities such as detecting data security incidents, protecting against fraudulent or illegal activity, managing Supplier’s account, creating datasets of aggregate consumer information and deidentified information and appointing subcontractors.

Duration

The personal data will be processed by Choco for the duration of the Services Agreement.

Schedule 2

Subcontractors

Name	Entity Location	Purpose
Amazon Web Services, Inc.	USA Location of processing: EU West 1 (Ireland, EU)	Cloud Infrastructure
Google Cloud EMEA Limited	Ireland Location of processing: EU West 1 (Ireland, EU)	Cloud Storage
Salesforce.com Germany GmbH	Germany Location of processing: EU43 (Frankfurt, Germany; Paris, France)	CRM
Invisible Technologies Inc	USA	Back-office services
Iterable, Inc	USA	CRM
Mindbridge Private Limited	Pakistan	Back-office services
Lobster DATA GmbH	Germany	Integration tool
N8N GmbH	Germany	Integration tool
Salesloft Inc	USA	Communication tool
Twilio Ireland Limited	Ireland	Communication tool
The Mail Track Company, S.L.	Spain	Customer outreach tool
Segment.io, Inc.	US Location of processing: S3 AWS (Ireland, EU)	Customer data platform
Aircall SAS	France	Customer outreach tool
OpenAI, L.L.C.	USA	Generative AI services
Choco Communications DACH GmbH	Germany	Intra-group services
Choco Communications Espagna SL	Spain	Intra-group services
Choco Communications SAS	France	Intra-group services
Atlantic Food Waste Partners LLC dba Choco	USA	Intra-group services

We may need to add new Subcontractors to the list above. If you'd like to receive a notification of these new Subcontractors, you can subscribe to our emailing list on this link: https://choco.com/us/subprocessors.

The following contains a description of the Services. Supplier shall only receive the Services which are included in the signed Order Form or which are subsequently agreed to by the Parties in writing. Capitalised terms used in this Service Description shall have the meaning assigned to them elsewhere in the Agreement.

• Cloud Service:
  • Choco Order Management: Cloud-based web platform and mobile app (Choco App) featuring omnichannel order management and communication solutions which provide the ability to:

    • digitise order intake across a broad range of channels through Choco-App (in-app orders) and Choco-AI (email, text, WhatsApp, voicemail)

    • integrate orders seamlessly into Supplier’s ERP systems for simplified workflows

    • receive overviews of Customers’ order trends to better manage customer relationships,

    • offer a differentiated e-commerce ordering experience for Customers by bringing Supplier’s product catalogue to life in the preferred channel

    • gain control over order inflow by defining minimum order values, delivery days and cut-off time

    • easily promote products and run targeted marketing campaigns

    • easily set access rights and permissions to staff members based on their role

    • obtain access to product and tech support through Choco’s customer support

    • obtain access to support and advice from industry thought leaders with the Choco customer success team.

  • Choco White Label App: Obtain access to, and receive ongoing maintenance for, a bespoke version of the Choco-App which incorporates and operates under Supplier's logo and branding and thereby provides a premium brand experience for Supplier’s Customers when interacting online
    
    

• Implementation Services:
  
  
  • Onboarding and Support Services:

    • comprehensive support for account setup ensuring the digitization of product catalogs and tailoring the Choco App to specific needs

    • in-depth training sessions for Suppliers and their teams, guiding them on how to effectively use the Cloud Service

    • assistance for Suppliers in introducing the Cloud Service to Customers, executing joint promotional activities to drive adoption, and setting up Customer accounts for immediate use. This process ensures a smooth transition and maximises operational efficiency from day one

    • best practice advisory on operational questions ranging from IT infrastructure, to process enhancements and sales related optimization

    • pre-training for Choco-AI: Bespoke Supplier-specific optimisation of AI models using historical order information to ensure the highest level of accuracy
      
      

  • Integration Services:

    • comprehensive integration services connecting the Cloud Service with Suppliers’ ERP systems enabling seamless data synchronisation and process automation across both platforms

    • ensure real-time data flow and improve the overall efficiency of order management operations for all relevant ERP systems through Choco’s standard connectors or customer builds