Partner data access schedule

Definitions

• Referred Client: a customer of BG-Demo introduced by Mossbrook, with its own order form and its own Snowflake account.
• Client Data: all data connected to, indexed by or returned from the Referred Client's B-Viz.
• Written Consent: a signed or emailed statement from an authorised person at the Referred Client, naming the Mossbrook consultants and the purpose of the access.
• Named Account: an individual login for one named Mossbrook consultant, never shared and never generic.
• Go-live: the day BG-Demo confirms to the Referred Client that its implementation is complete and its connectors are live.

Access principles

• Consent first. Mossbrook consultants may reach a Referred Client's B-Viz only with that client's Written Consent. A referral, a commercial relationship or a prior engagement does not count as consent.
• Named accounts only. Access is granted through Named Accounts. Shared logins, service accounts and generic mailboxes are not permitted for Mossbrook access.
• Removed at go-live. Every Named Account created for Mossbrook is removed at go-live. If the Referred Client wants Mossbrook to keep helping after go-live, it must give fresh Written Consent and BG-Demo will create new Named Accounts for that purpose.
• Least privilege. Access is limited to what the Written Consent describes. Mossbrook consultants do not receive administrator rights unless the consent says so in terms.
• No carry-over. Knowledge or access gained on one Referred Client's account must not be used for another client, including another Mossbrook client.

Obligations of Mossbrook

Mossbrook will:

• keep the list of consultants who hold Named Accounts accurate and tell BG-Demo promptly when one of them leaves or changes role;
• make sure each consultant understands this schedule before access begins;
• use Client Data only for the purpose in the Written Consent;
• not copy, export or retain Client Data outside the Referred Client's Snowflake account;
• report any suspected misuse or unauthorised access to BG-Demo without delay, and in any case in line with the notification terms of the main agreement;
• cooperate with any reasonable review of access that the Referred Client or BG-Demo asks for.

Obligations of BG-Demo

BG-Demo will:

• check that Written Consent exists before creating any Named Account for a Mossbrook consultant;
• keep a record of each consent, each Named Account, the day it was created and the day it was removed;
• remove all Mossbrook Named Accounts at go-live and confirm the removal to the Referred Client;
• give the Referred Client, on request, the access record for its own environment;
• treat Mossbrook's own B-Viz environment separately from any Referred Client's environment.

Roles for data protection

The Referred Client is the controller of Client Data. BG-Demo processes it on the client's instructions under that client's own agreement. Mossbrook consultants act only on the Referred Client's instructions while they hold a Named Account and have no independent purpose of their own for Client Data. Nothing in this schedule makes Mossbrook a controller of a Referred Client's data.

Security and review

Named Accounts follow the same authentication standards that apply to the Referred Client's own users. Mossbrook's Security and Compliance Lead is the contact for this schedule and for any security question that arises from it. BG-Demo's VP Sales is the commercial contact. The parties will review the schedule if the way Mossbrook is involved in implementations changes materially.

Consent withdrawal

A Referred Client may withdraw Written Consent at any time. BG-Demo will then suspend the affected Named Accounts promptly and remove them. Mossbrook will not treat withdrawal as a breach by the client or as a reason to change any referral arrangement.

Term and changes

This schedule takes effect on 28 Oct 2025 and continues for as long as Mossbrook is a referral partner of BG-Demo or the order form dated 29 Aug 2025 remains in force, whichever ends later. Any change must be in writing and signed by both parties. If this schedule conflicts with a Referred Client's own agreement with BG-Demo on how that client's data is handled, the client's agreement prevails.

Signatures

Signed on 28 Oct 2025.