Confidentiality Notice

This Master Services Agreement ("Agreement") contains proprietary and confidential information belonging to Triarch IT Business Solutions ("Triarch"). The contents of this Agreement are intended solely for the Client identified herein and may not be copied, disclosed, distributed, or used for any purpose other than evaluating or performing obligations under this Agreement without the prior written consent of Triarch.

Table of Contents

1. Master Services Agreement
2. Definitions
3. Interpretation
4. Appointment
5. Scope of Services
6. Statements of Work
7. Order of Precedence

MASTER SERVICES AGREEMENT

This Master Services Agreement ("Agreement") is entered into on the Effective Date by and between:

TRIARCH IT BUSINESS SOLUTIONS

A corporation duly organized and existing under the laws of the Republic of the Philippines with its principal office at:

hereinafter referred to as the "Service Provider", "Triarch", or "Company";

-and-

CLIENT

Company Name:

Address:

SEC/DTI Registration No.:

Represented by:

hereinafter referred to as the "Client".

Triarch and the Client may be referred to individually as a "Party" and collectively as the "Parties."

1. Purpose

The Parties desire to establish a long-term business relationship under which Triarch may provide information technology products and services through one or more Statements of Work, Service Orders, Quotations, or Project Agreements executed pursuant to this Agreement.

This Agreement establishes the general legal, commercial, and operational terms governing all present and future engagements between the Parties.

No services shall commence until a Statement of Work ("SOW"), Service Order, or Quotation has been accepted in writing by both Parties unless otherwise agreed.

2. Definitions

Unless the context otherwise requires, the following terms shall have the meanings set forth below.

2.1 Agreement

This Master Services Agreement together with all Schedules, Annexes, Statements of Work, Change Requests, Service Orders, and amendments executed by the Parties.

2.2 Affiliate

Any corporation or legal entity that directly or indirectly controls, is controlled by, or is under common control with a Party.

2.3 Business Day

Any day other than Saturdays, Sundays, or officially declared public holidays in the Republic of the Philippines.

2.4 Change Request

A written request modifying the scope, pricing, timeline, deliverables, or specifications of Services previously agreed upon.

2.5 Client Data

All information, records, databases, software, credentials, documents, electronic files, configurations, and digital assets owned or controlled by the Client.

2.6 Confidential Information

All information disclosed by either Party that is confidential by its nature or marked confidential, including but not limited to:

• business plans
• financial information
• customer information
• passwords
• system configurations
• pricing
• source code
• trade secrets
• technical documentation

2.7 Deliverables

Any reports, documentation, configurations, software, scripts, implementations, diagrams, or work products produced by Triarch under an approved Statement of Work.

2.8 Emergency

A critical event resulting in:

• complete service outage
• ransomware attack
• cybersecurity incident
• server failure
• network failure
• significant business interruption

2.9 Managed Services

Ongoing IT operational support provided under recurring subscription or managed service arrangements.

2.10 Professional Services

Project-based consulting, implementation, migration, engineering, advisory, or technical services.

2.11 Services

Collectively refers to all managed services, professional services, consulting, maintenance, implementation, technical support, procurement, software, hardware, subscriptions, cloud services, and related technology services provided by Triarch.

2.12 Statement of Work (SOW)

A separate document describing:

• scope
• deliverables
• pricing
• assumptions
• milestones
• service levels
• exclusions
• acceptance criteria

3. Interpretation

Unless otherwise required by context:

a. headings are for convenience only;

b. singular includes plural;

c. plural includes singular;

d. references to legislation include amendments and successor legislation;

e. references to writing include electronic communications;

f. references to "including" mean "including without limitation";

g. any ambiguity shall not be interpreted against the drafting Party.

4. Appointment

The Client appoints Triarch as a provider of Information Technology products and services.

Triarch accepts such appointment subject to the terms and conditions contained herein.

Nothing in this Agreement obligates the Client to purchase a minimum quantity of Services unless expressly stated in a Statement of Work.

Likewise, nothing herein obligates Triarch to provide services beyond those expressly accepted through an executed Statement of Work.

5. Scope of Services

Triarch shall provide professional Information Technology solutions, including but not limited to the following:

5.1 Managed IT Services

• Remote Help Desk
• On-site Technical Support
• Server Administration
• Network Administration
• Endpoint Management
• Patch Management
• Asset Management
• Preventive Maintenance

5.2 Cloud Services

• Microsoft 365
• Microsoft Azure
• Amazon Web Services (AWS)
• Google Workspace
• Cloud Migration
• Cloud Infrastructure Management
• Backup and Disaster Recovery

5.3 Cybersecurity

• Endpoint Protection
• Firewall Management
• Security Monitoring
• Vulnerability Assessments
• Security Hardening
• Incident Response
• Security Awareness Consulting

5.4 Infrastructure

• Network Design
• Structured Cabling
• Wireless Networks
• VPN
• Storage Solutions
• Virtualization
• Hypervisor Administration

5.5 Software Services

• Software Deployment
• Software Configuration
• Systems Integration
• Business Applications
• Licensing Management

5.6 Hardware Services

• Procurement
• Installation
• Configuration
• Maintenance
• Warranty Coordination
• Asset Lifecycle Management

5.7 Professional Services

• IT Consulting
• Digital Transformation
• Infrastructure Assessments
• Technology Roadmaps
• Project Management
• Solution Architecture
• Business Continuity Planning

5.8 Corporate Authority

Consistent with its Articles of Incorporation and applicable Philippine laws, Triarch is authorized to engage in Information Technology (IT) business solutions, including the development, sale, distribution, installation, maintenance, support, integration, consulting, and management of software, computer systems, hardware, networking equipment, cloud platforms, information technology products, and related professional services.

Specific Services shall be described in each applicable Statement of Work.

6. Statements of Work

Each engagement shall be governed by a written Statement of Work.

Every SOW shall contain, where applicable:

• Scope
• Objectives
• Deliverables
• Timeline
• Milestones
• Fees
• Payment Schedule
• Service Levels
• Client Responsibilities
• Assumptions
• Acceptance Criteria
• Exclusions

No Statement of Work shall modify this Agreement unless expressly stated.

7. Order of Precedence

In the event of inconsistency between documents, the following order shall prevail:

1. Signed Amendment
2. Statement of Work
3. Master Services Agreement
4. Service Level Agreement
5. Policies
6. Quotations
7. Marketing Materials

SERVICE DELIVERY, MANAGED SERVICES, PROFESSIONAL SERVICES, CLIENT RESPONSIBILITIES, AND CHANGE MANAGEMENT

8. Service Delivery

8.1 General

Triarch shall provide the Services described in an executed Statement of Work ("SOW"), Service Order, or Quotation in a professional and workmanlike manner consistent with generally accepted information technology industry standards.

Services may be delivered remotely, on-site, through cloud platforms, or via a hybrid model depending on the requirements specified in the applicable SOW.

Unless otherwise agreed in writing, Triarch will determine the methods, personnel, tools, software, and technical processes used to deliver the Services.

8.2 Business Hours

Unless otherwise specified in an applicable Service Level Agreement (SLA), Triarch's standard support hours shall be:

Monday to Friday

8:00 AM – 5:00 PM Philippine Time

excluding Philippine national holidays.

Support requested outside standard business hours shall be considered After-Hours Support and may incur additional charges.

8.3 Authorized Contacts

The Client shall designate one or more Authorized Representatives who may:

• Request support;
• Approve work;
• Authorize changes;
• Receive reports;
• Accept deliverables;
• Escalate incidents.

Triarch may rely upon instructions provided by an Authorized Representative until notified otherwise in writing.

8.4 Remote Support

The Client authorizes Triarch to remotely access systems using commercially accepted secure remote management tools for purposes including:

• Troubleshooting;
• Monitoring;
• Maintenance;
• Configuration;
• Updates;
• Security remediation;
• Software deployment;
• Diagnostics.

Remote access shall be performed only by authorized Triarch personnel and protected by industry-standard authentication and encryption.

8.5 On-Site Services

Where on-site attendance is required:

• The Client shall provide safe and reasonable access to its premises.
• Suitable workspace, electricity, and internet connectivity shall be made available.
• Delays caused by site inaccessibility or unsafe working conditions may result in rescheduling and additional charges.

Travel, accommodation, parking, tolls, freight, and related expenses may be chargeable if not otherwise included in the applicable SOW.

9. Managed Services

9.1 Managed Service Scope

Managed Services may include, without limitation:

• IT Help Desk;
• Infrastructure Monitoring;
• Network Administration;
• Server Administration;
• Microsoft 365 Administration;
• Cloud Administration;
• Endpoint Management;
• Antivirus Management;
• Firewall Administration;
• Backup Monitoring;
• Patch Management;
• Preventive Maintenance;
• User Administration;
• Asset Inventory;
• Vendor Coordination;
• IT Documentation;
• Reporting.

Only Services expressly included within the applicable SOW shall be considered covered services.

9.2 Monitoring

Triarch may deploy monitoring software, remote management agents, security software, and automation tools on supported systems.

The Client grants Triarch permission to collect operational and diagnostic information necessary to:

• Monitor availability;
• Detect faults;
• Improve performance;
• Maintain security;
• Generate service reports.

Operational telemetry shall not be used for purposes unrelated to service delivery except where required by law.

9.3 Maintenance Windows

Triarch may schedule maintenance activities including:

• Security updates;
• Firmware upgrades;
• Patch deployment;
• Infrastructure optimization;
• Planned hardware replacement;
• Configuration improvements.

Where practicable, scheduled maintenance shall be communicated in advance.

Emergency maintenance may be performed without prior notice where necessary to protect the Client's systems, security, or business continuity.

9.4 Excluded Services

Unless expressly stated in the applicable SOW, Managed Services do not include:

• Software development;
• Website development;
• Data entry;
• Business process outsourcing;
• Hardware repair at component level;
• Recovery of permanently deleted data;
• Restoration of systems compromised by unsupported software;
• Services involving unsupported operating systems;
• Relocation of offices;
• Electrical work;
• Civil works;
• Third-party vendor warranties;
• Internet service provider responsibilities.

Additional work shall be quoted separately.

10. Professional Services

Professional Services may include:

• Technology consulting;
• Digital transformation;
• Cloud migration;
• Infrastructure design;
• Cybersecurity consulting;
• Network implementation;
• Microsoft 365 migration;
• Azure implementation;
• AWS implementation;
• Server deployment;
• Disaster recovery planning;
• IT assessments;
• Penetration testing coordination;
• IT governance consulting;
• Project management.

Professional Services are project-based and shall be governed by an approved Statement of Work.

10.1 Project Assumptions

Unless otherwise agreed:

• The Client shall provide timely approvals.
• Information supplied by the Client shall be accurate.
• Third-party vendors shall cooperate as reasonably required.
• Delays outside Triarch's control may extend project schedules.
• Project timelines are estimates unless expressly stated as fixed.

10.2 Acceptance of Deliverables

Deliverables shall be deemed accepted when:

• accepted in writing by the Client;
• placed into production by the Client;
• used in normal business operations by the Client; or
• no written rejection is received within ten (10) Business Days after delivery.

Any rejection shall include reasonable detail identifying the alleged non-conformity.

Triarch shall have a reasonable opportunity to remedy any verified deficiencies.

11. Service Requests

The Client may request Services through:

• Email;
• Ticketing System;
• Service Portal;
• Telephone;
• Authorized Account Manager.

Requests submitted by unauthorized persons may be declined.

Triarch reserves the right to verify the identity of requestors before performing work affecting security, infrastructure, user accounts, financial systems, or confidential information.

12. Incident Management

Triarch shall use commercially reasonable efforts to respond to incidents according to their assigned priority.

Illustrative priorities include:

Priority 1 – Critical

• Complete network outage
• Ransomware incident
• Production server failure
• Organization-wide email outage

Priority 2 – High

• Department-wide service disruption
• Firewall malfunction
• Major application failure

Priority 3 – Medium

• Individual user unable to perform core duties
• Printer failures
• VPN issues

Priority 4 – Low

• Software installation
• Password reset
• General assistance
• Routine requests

Target response and restoration times shall be defined in the applicable SLA.

13. Client Responsibilities

The Client acknowledges that successful delivery of the Services depends upon timely cooperation.

The Client agrees to:

13.1 Provide Accurate Information

Provide complete, current, and accurate information reasonably required by Triarch.

13.2 Maintain Licensing

Maintain valid licenses for all software not supplied by Triarch.

Triarch shall not be responsible for failures arising from unlicensed, counterfeit, or unsupported software.

13.3 Provide Access

Provide administrative access, credentials, documentation, facilities, and permissions reasonably necessary to perform the Services.

13.4 Designate Representatives

Maintain at least one Authorized Representative capable of approving requests and decisions.

13.5 Maintain Supported Systems

Replace obsolete hardware or software that has reached manufacturer End-of-Life (EOL) or End-of-Support (EOS), where continued support materially affects the Services.

13.6 Data Backup

Unless backup services are expressly included in the applicable SOW, the Client remains solely responsible for maintaining complete, tested, and recoverable backups of all data.

13.7 Cybersecurity Cooperation

The Client shall:

• promptly report suspected security incidents;
• maintain strong passwords;
• implement multi-factor authentication where available;
• cooperate during investigations and remediation efforts.

14. Change Management

No material change to the agreed Services shall be binding unless documented through an approved Change Request.

A Change Request may affect:

• scope;
• deliverables;
• schedule;
• pricing;
• personnel;
• milestones;
• technical specifications;
• service levels.

Triarch shall assess the impact of each Change Request and provide the Client with an estimate of any resulting adjustments before implementation.

Emergency changes necessary to protect security, prevent data loss, restore critical operations, or address imminent operational risks may be implemented immediately. Triarch shall notify the Client of such changes as soon as reasonably practicable.

15. Service Suspension

Triarch may suspend all or part of the Services where reasonably necessary to:

• protect the security or integrity of systems;
• prevent unauthorized access;
• comply with applicable law or lawful government orders;
• respond to cybersecurity incidents;
• address non-payment in accordance with this Agreement; or
• prevent material harm to Triarch, the Client, or third parties.

Except in cases of emergency or legal prohibition, Triarch shall provide reasonable notice before suspension and shall restore Services once the underlying cause has been resolved.

COMMERCIAL TERMS, PRICING, PAYMENT, PROCUREMENT, THIRD-PARTY PRODUCTS, AND FINANCIAL PROVISIONS

16. Commercial Terms

16.1 Engagement Model

Services may be provided under one or more of the following commercial arrangements:

a. Monthly Managed Services Agreement (MSA)

b. Fixed-Fee Project

c. Time and Materials (T&M)

d. Block Hours

e. Retainer Services

f. Subscription-Based Services

g. Hybrid Engagements

The applicable commercial model shall be identified in the relevant Statement of Work ("SOW"), Quotation, Proposal, or Service Order.

16.2 Quotations

Unless otherwise stated:

• All quotations issued by Triarch are valid for thirty (30) calendar days from the date of issuance.
• Pricing is subject to product availability, supplier pricing, foreign exchange fluctuations, importation costs, and applicable taxes.
• Quotations become binding only upon written acceptance by the Client and confirmation by Triarch.

Triarch reserves the right to revise quotations after expiration or when supplier pricing materially changes before acceptance.

16.3 Statements of Work

Each Statement of Work shall include, where applicable:

• Scope of Services
• Deliverables
• Project Schedule
• Milestones
• Acceptance Criteria
• Pricing
• Payment Schedule
• Assumptions
• Exclusions
• Service Levels
• Dependencies

No work beyond the agreed scope shall be performed without an approved Change Request unless necessary to protect the Client's systems or maintain operational continuity.

17. Fees

The Client agrees to pay all fees specified in the applicable SOW, Service Order, or Invoice.

Fees may include:

• Managed Services Fees
• Professional Service Fees
• Project Fees
• Consulting Fees
• Cloud Subscription Fees
• Licensing Fees
• Hardware Costs
• Software Costs
• Third-Party Services
• Freight and Logistics
• Travel Expenses
• Emergency Support Charges
• After-Hours Support
• Training Services

Unless expressly stated otherwise, prices are exclusive of applicable Philippine taxes.

17.1 Hourly Rates

Where Services are billed on a Time and Materials basis, charges shall be calculated using Triarch's prevailing professional service rates.

Minimum billable time shall be one (1) hour, with subsequent billing in 30-minute increments, unless otherwise agreed.

17.2 After-Hours Services

Services requested outside normal business hours may be billed at premium rates.

Unless otherwise specified:

• Weekday after-hours: 150% of the standard hourly rate
• Saturdays: 150%
• Sundays: 200%
• Philippine Public Holidays: 250%

Emergency work requested by the Client shall be subject to the same rates.

17.3 Emergency Services

Emergency Services include responses to:

• Cybersecurity incidents
• Ransomware attacks
• Major infrastructure failures
• Production outages
• Critical data restoration
• Business continuity incidents

Emergency Services shall be prioritized over routine requests and billed in accordance with the applicable pricing schedule unless covered by a Managed Services Agreement.

18. Invoicing

Invoices may be issued:

• Monthly
• Upon project milestones
• Upon delivery
• Upon completion
• Upon shipment of goods
• Upon subscription renewal

Invoices shall include sufficient detail to identify the Services provided.

Electronic invoices shall constitute valid invoices where permitted by applicable law.

18.1 Payment Terms

Unless otherwise agreed in writing:

Invoices shall be payable within fifteen (15) calendar days from the invoice date.

Payments shall be made in Philippine Pesos unless another currency has been expressly agreed.

Accepted payment methods may include:

• Bank Transfer
• Online Banking
• Corporate Check
• Digital Payment Platforms approved by Triarch

Bank transfer charges imposed by the Client's financial institution shall be borne by the Client.

18.2 Late Payments

Amounts remaining unpaid after the due date shall accrue interest at the rate of two percent (2%) per month, or the maximum rate permitted by applicable Philippine law, whichever is lower.

Interest shall accrue daily until full payment is received.

Acceptance of partial payment shall not constitute a waiver of any outstanding balance.

18.3 Collection Costs

The Client shall reimburse Triarch for all reasonable costs incurred in collecting overdue accounts, including:

• Collection agency fees
• Legal fees
• Court costs
• Arbitration expenses
• Administrative costs

to the extent permitted by Philippine law.

19. Suspension for Non-Payment

If any undisputed invoice remains unpaid for more than thirty (30) calendar days after its due date, Triarch may, upon written notice:

• Suspend all or part of the Services;
• Disable access to managed systems where operationally necessary;
• Suspend software licensing administration;
• Suspend cloud administration services;
• Delay project work;
• Withhold Deliverables.

Service suspension shall not relieve the Client of its obligation to pay outstanding amounts.

Triarch shall restore Services promptly after full payment has been received, subject to reasonable reactivation scheduling.

20. Annual Price Adjustments

To reflect increases in labor, technology, licensing, supplier costs, inflation, and foreign exchange fluctuations, Triarch may adjust recurring service fees upon at least thirty (30) days' written notice.

Unless otherwise agreed, annual adjustments shall not exceed the higher of:

• Five percent (5%); or
• The percentage increase in the Philippine Consumer Price Index (CPI) over the preceding twelve (12) months.

This limitation does not apply to third-party subscriptions, cloud services, software licenses, or products where supplier pricing changes independently.

21. Procurement of Products

Triarch may procure hardware, software, subscriptions, cloud services, and related products on behalf of the Client.

Unless otherwise agreed:

• Ownership transfers upon full payment.
• Delivery dates are estimates only.
• Supplier delays are beyond Triarch's reasonable control.
• Product availability is subject to manufacturer inventory.
• Special-order items are generally non-cancellable and non-returnable.

Risk of loss transfers to the Client upon delivery to the Client's nominated location or carrier.

21.1 Manufacturer Warranties

Hardware and software products supplied by Triarch remain subject solely to the warranties provided by their respective manufacturers or licensors.

Triarch shall reasonably assist the Client in processing warranty claims but shall not be responsible for a manufacturer's refusal, delay, or limitation of warranty coverage.

21.2 Software Licensing

The Client agrees to comply with all software license agreements issued by software publishers.

Triarch shall not be liable for:

• Software audits;
• Licensing violations;
• Unlicensed software;
• Pirated software;
• Misuse of software licenses.

The Client indemnifies Triarch against claims arising from the Client's unauthorized use of third-party software.

22. Cloud Services

Where Triarch resells or manages cloud services, including Microsoft 365, Microsoft Azure, Amazon Web Services (AWS), Google Workspace, or similar platforms:

• Service availability is subject to the cloud provider's own service commitments.
• Triarch does not guarantee uninterrupted availability of third-party cloud platforms.
• Maintenance performed by cloud providers shall not constitute a breach of this Agreement.
• The Client remains responsible for complying with the provider's acceptable use policies and licensing terms.

Triarch's role is limited to implementation, administration, and support as specified in the applicable SOW.

23. Third-Party Products and Services

Certain Services rely on products or services provided by third parties, including but not limited to:

• Internet Service Providers (ISPs)
• Telecommunications providers
• Cloud vendors
• Software publishers
• Hardware manufacturers
• Payment processors
• Security vendors

Triarch shall exercise reasonable care in selecting and managing third-party providers but shall not be liable for delays, outages, discontinuation, pricing changes, or performance failures attributable to such providers.

24. Taxes

Unless expressly stated otherwise, all fees are exclusive of:

• Value-Added Tax (VAT)
• Documentary Stamp Tax (DST), where applicable
• Withholding Taxes
• Customs Duties
• Import Taxes
• Regulatory Fees

The Client shall pay all applicable taxes imposed on the Services, except taxes based solely on Triarch's net income.

Where the Client is required by law to withhold taxes, the Client shall:

1. provide Triarch with the applicable Certificate of Creditable Tax Withheld at Source (BIR Form 2307 or its successor form) within the period prescribed by law; and
2. ensure that the withheld amount is properly remitted to the Bureau of Internal Revenue (BIR).

Failure to provide the required withholding tax certificate shall not reduce the Client's obligation to pay the invoiced amount.

25. Currency

Unless otherwise agreed in writing:

• All quotations;
• Statements of Work;
• Invoices; and
• Payments

shall be denominated in Philippine Pesos (PHP).

For products sourced internationally, Triarch reserves the right to adjust pricing prior to acceptance to reflect significant foreign exchange fluctuations, supplier price increases, tariffs, or import-related costs.

26. Financial Records

Triarch shall maintain commercially reasonable records supporting invoices issued under this Agreement.

Upon reasonable written request, and not more than once in any twelve (12)-month period, the Client may review relevant billing records solely to verify invoiced charges, subject to appropriate confidentiality obligations.

CONFIDENTIALITY, INTELLECTUAL PROPERTY, DATA PRIVACY, INFORMATION SECURITY, AND COMPLIANCE

27. Confidentiality

27.1 Confidential Information

For purposes of this Agreement, Confidential Information includes all non-public information disclosed by either Party, whether in written, oral, electronic, visual, or other form, including but not limited to:

• Business strategies and plans
• Financial information
• Customer and supplier information
• Pricing and quotations
• Technical documentation
• Network diagrams
• Source code
• Passwords and authentication credentials
• Security configurations
• Proprietary software
• Operating procedures
• Trade secrets
• Employee information
• Client Data

Confidential Information also includes information that a reasonable person would understand to be confidential based on its nature or the circumstances of disclosure.

27.2 Obligations of Confidentiality

Each Party agrees to:

• Protect Confidential Information using at least the same degree of care it uses to protect its own confidential information, and no less than reasonable care.
• Use Confidential Information solely for the performance of this Agreement.
• Restrict disclosure to employees, contractors, professional advisers, or subcontractors who have a legitimate business need to know and who are bound by confidentiality obligations.
• Not disclose Confidential Information to any third party without prior written consent, except as required by law.

27.3 Exclusions

Confidential Information does not include information that:

• Is publicly available through no fault of the receiving Party;
• Was lawfully known by the receiving Party before disclosure;
• Is independently developed without use of the disclosing Party's Confidential Information; or
• Is lawfully obtained from a third party without confidentiality restrictions.

27.4 Compelled Disclosure

If disclosure is required by law, court order, or lawful government directive, the receiving Party shall, where legally permissible:

• Promptly notify the disclosing Party; and
• Cooperate in seeking protective treatment or limiting disclosure.

27.5 Return or Destruction

Upon termination of this Agreement or upon written request, each Party shall return or securely destroy Confidential Information belonging to the other Party, except where retention is required by law, regulatory obligations, insurance requirements, disaster recovery policies, or legitimate archival purposes.

28. Intellectual Property

28.1 Ownership of Existing Intellectual Property

Each Party retains ownership of all intellectual property rights owned prior to the commencement of this Agreement.

Nothing in this Agreement transfers ownership of pre-existing intellectual property.

28.2 Triarch Intellectual Property

Triarch retains exclusive ownership of:

• Methodologies
• Processes
• Templates
• Documentation formats
• Automation scripts
• Monitoring systems
• Internal tools
• Standard operating procedures
• Proprietary software
• Technical know-how
• Service frameworks
• Artificial intelligence prompts, workflows, and automations developed independently of the Client

Unless expressly stated in a Statement of Work, the Client receives only a non-exclusive, non-transferable license to use Deliverables for its internal business operations.

28.3 Client Intellectual Property

The Client retains ownership of:

• Business records
• Client Data
• Internal documentation
• Branding
• Logos
• Databases
• Proprietary applications owned prior to the engagement
• Business processes
• Customer information

Triarch shall acquire no ownership interest in Client Data by virtue of providing the Services.

28.4 Custom Development

Where Triarch develops custom software, scripts, integrations, reports, dashboards, or automation specifically for the Client:

• ownership shall be governed by the applicable Statement of Work; and
• unless otherwise agreed in writing, Triarch retains ownership of reusable code libraries, frameworks, utilities, templates, and generic components while granting the Client a perpetual, non-exclusive license to use the custom deliverables for its internal business purposes upon full payment.

29. Data Privacy

29.1 Compliance with Philippine Law

The Parties shall comply with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission ("NPC"), as amended from time to time.

Each Party shall implement appropriate organizational, physical, and technical security measures to protect Personal Information under its control.

29.2 Personal Information

For purposes of this Agreement:

• Personal Information
• Sensitive Personal Information
• Personal Information Controller (PIC)
• Personal Information Processor (PIP)

shall have the meanings assigned under the Data Privacy Act of 2012 and its implementing regulations.

29.3 Roles of the Parties

Depending on the Services provided:

• The Client is generally the Personal Information Controller (PIC).
• Triarch generally acts as a Personal Information Processor (PIP) when processing personal information solely on behalf of the Client.

Nothing in this Agreement prevents either Party from acting as a Personal Information Controller with respect to its own personnel, customers, suppliers, or business operations.

29.4 Processing Instructions

Triarch shall process Personal Information only:

• in accordance with documented instructions from the Client;
• as necessary to perform the Services; or
• as otherwise required by applicable law.

29.5 Security Measures

Triarch shall implement commercially reasonable safeguards appropriate to the nature of the Services, including, where applicable:

• Multi-factor authentication
• Role-based access controls
• Encryption of data in transit
• Secure password management
• Endpoint protection
• Logging and monitoring
• Security patching
• Backup procedures
• Secure disposal of electronic media

No security measure guarantees absolute protection against all cyber threats.

29.6 International Data Transfers

Where cloud platforms or third-party providers process data outside the Philippines, the Client acknowledges that cross-border processing may occur.

Triarch shall use commercially reasonable efforts to engage reputable service providers that maintain appropriate security controls.

30. Client Data

All Client Data remains the exclusive property of the Client.

Triarch shall not:

• Sell Client Data;
• Use Client Data for advertising;
• Share Client Data with unrelated third parties except as necessary to provide the Services or as required by law.

Triarch may generate anonymized or aggregated operational metrics that do not identify the Client or any individual for service improvement, capacity planning, or internal reporting.

30.1 Data Retention

Unless otherwise agreed:

• Client Data retained by Triarch shall be kept only for as long as reasonably necessary to perform the Services, comply with legal obligations, resolve disputes, or maintain business records.
• Upon termination, Triarch may delete operational copies of Client Data after providing the Client a reasonable opportunity to retrieve its information, subject to applicable law and any agreed transition period.

31. Information Security

Triarch shall maintain an information security program reasonably designed to protect systems used in delivering the Services.

Such program may include:

• Security awareness training
• Password policies
• Multi-factor authentication
• Endpoint security
• Access logging
• Backup procedures
• Change management
• Vulnerability remediation
• Secure remote access
• Asset inventory

Triarch may modify its security program from time to time to reflect evolving threats and industry practices.

32. Cybersecurity Responsibilities

32.1 Shared Responsibility

Cybersecurity is a shared responsibility.

The Client agrees to:

• Maintain current software licenses;
• Promptly install approved security updates where under its control;
• Use supported operating systems;
• Protect user credentials;
• Enforce password policies;
• Enable multi-factor authentication where reasonably available;
• Promptly report suspected security incidents.

32.2 Unsupported Systems

Triarch is not responsible for security incidents resulting primarily from:

• Unsupported operating systems;
• End-of-Life hardware;
• Pirated software;
• Deliberate circumvention of security controls;
• Unauthorized modifications made by the Client or third parties.

Triarch may recommend remediation measures but is not obligated to support unsupported environments.

33. Security Incident Response

A "Security Incident" includes any event that reasonably appears to compromise the confidentiality, integrity, or availability of systems or data managed under the Services.

Upon becoming aware of a Security Incident affecting Services under its control, Triarch shall:

1. Investigate the incident using commercially reasonable efforts.
2. Take appropriate measures to contain and mitigate the impact.
3. Notify the Client without undue delay where the incident materially affects the Client's systems or data.
4. Cooperate with the Client in remediation efforts consistent with the agreed scope of Services.

Nothing in this Agreement shall be interpreted as an admission of fault or liability solely because a Security Incident occurred.

34. Compliance

Each Party shall comply with all applicable laws and regulations relevant to its obligations under this Agreement, including laws relating to:

• Data privacy
• Intellectual property
• Electronic commerce
• Anti-corruption
• Employment
• Taxation
• Export controls (where applicable)

The Client is responsible for ensuring that its own business operations and use of the Services comply with applicable legal and regulatory requirements.

35. Audit Cooperation

Where reasonably necessary to demonstrate compliance with contractual obligations or applicable law, Triarch shall provide reasonable cooperation in responding to the Client's written requests for information regarding its service delivery and security practices, provided that:

• such requests are reasonable in scope;
• they do not compromise the security or confidentiality of other clients;
• they do not require disclosure of Triarch's trade secrets or proprietary methodologies; and
• any extraordinary costs incurred may be charged to the Client if agreed in advance.

WARRANTIES, LIABILITY, INDEMNIFICATION, INSURANCE, FORCE MAJEURE, AND RISK ALLOCATION

36. Representations and Warranties

36.1 Mutual Representations

Each Party represents and warrants that:

a. it is duly organized, validly existing, and in good standing under the laws governing its organization;

b. it has full legal authority to enter into and perform this Agreement;

c. the execution of this Agreement has been duly authorized;

d. entering into this Agreement does not violate any other agreement binding upon such Party; and

e. it shall comply with all applicable laws, regulations, and governmental requirements in connection with its obligations under this Agreement.

36.2 Triarch Warranty

Triarch warrants that:

• Services shall be performed in a professional, diligent, and workmanlike manner consistent with generally accepted industry standards;
• Personnel assigned to perform the Services shall possess appropriate skills, qualifications, and experience;
• Deliverables shall substantially conform to the specifications set forth in the applicable Statement of Work for a period of thirty (30) calendar days following acceptance, unless another warranty period is expressly stated.

If a covered defect is reported within the applicable warranty period, Triarch shall, at its option:

• re-perform the affected Services;
• repair the Deliverable; or
• provide a reasonable workaround.

These remedies constitute the Client's exclusive remedies for breach of this warranty.

36.3 Client Warranty

The Client warrants that:

• it owns or has lawful rights to all systems, software, equipment, and data made available to Triarch;
• it possesses all necessary permissions to authorize Triarch's access;
• information supplied to Triarch is accurate and complete to the best of its knowledge;
• it will not knowingly require Triarch to perform unlawful acts.

The Client shall be responsible for any losses resulting from inaccurate information or unauthorized instructions provided by its personnel.

37. Warranty Exclusions

Triarch's warranties shall not apply where issues arise from:

• misuse by the Client;
• unauthorized modifications by persons other than Triarch;
• failure to follow documented recommendations;
• unsupported or End-of-Life hardware or software;
• third-party products beyond Triarch's reasonable control;
• force majeure events;
• malware introduced by third parties after completion of the Services;
• internet outages caused by telecommunications providers;
• power interruptions;
• environmental conditions.

38. Disclaimer of Warranties

Except as expressly provided in this Agreement:

• all Services are provided on an "as available" and "as performed" basis;
• Triarch disclaims all implied warranties, including warranties of merchantability, fitness for a particular purpose, non-infringement, uninterrupted operation, and error-free performance, to the maximum extent permitted by Philippine law.

Triarch does not warrant that:

• every cybersecurity attack can be prevented;
• every system failure can be avoided;
• software is free from defects;
• third-party cloud providers will operate without interruption;
• data loss can never occur.

Technology inherently involves operational risks that cannot be entirely eliminated.

39. Limitation of Liability

39.1 Maximum Liability

To the fullest extent permitted by applicable law, Triarch's aggregate liability arising out of or relating to this Agreement, whether in contract, tort (including negligence), statute, or otherwise, shall not exceed the total fees actually paid by the Client to Triarch under the applicable Statement of Work during the twelve (12) months immediately preceding the event giving rise to the claim.

If the claim relates to a project of less than twelve (12) months, liability shall not exceed the total amount paid for that specific project.

39.2 Excluded Damages

Neither Party shall be liable for any indirect, incidental, consequential, exemplary, punitive, or special damages, including but not limited to:

• loss of profits;
• loss of revenue;
• loss of anticipated savings;
• business interruption;
• reputational damage;
• loss of goodwill;
• loss of production;
• loss of opportunity;
• loss of contracts;
• loss of use;
• corruption of data;
• procurement of substitute services.

This exclusion applies even if a Party has been advised of the possibility of such damages.

39.3 Exceptions

The limitations of liability set forth in this Agreement shall not apply to:

• fraud;
• willful misconduct;
• gross negligence;
• death or personal injury caused by negligence where liability cannot lawfully be excluded;
• violations of intellectual property rights committed by a Party;
• obligations expressly stated as unlimited by applicable law.

40. Cybersecurity Risk Allocation

The Client acknowledges that:

• No cybersecurity solution provides absolute protection.
• Threat actors continually evolve their methods.
• Zero-day vulnerabilities may exist.
• Social engineering cannot be entirely prevented through technical controls alone.

Accordingly, Triarch does not guarantee that:

• ransomware attacks will never occur;
• email compromise can be completely eliminated;
• malware infections will never happen;
• unauthorized access can always be prevented.

Triarch's responsibility is to exercise commercially reasonable care in implementing and managing the agreed security controls.

41. Backup and Disaster Recovery

Unless expressly included in the applicable Statement of Work:

• Triarch is not responsible for maintaining backups;
• the Client remains solely responsible for ensuring that its data is adequately backed up and recoverable.

Where Triarch provides managed backup services:

• backups shall be monitored in accordance with the applicable Service Level Agreement;
• restoration success depends upon the integrity of the available backup media, third-party platforms, and the condition of affected systems.

Triarch does not guarantee recovery of all data following catastrophic failure, malicious encryption, corruption, or physical destruction.

42. Indemnification

42.1 Client Indemnity

The Client shall indemnify, defend, and hold harmless Triarch, its directors, officers, employees, consultants, subcontractors, and affiliates from and against any third-party claims, liabilities, losses, damages, costs, or expenses (including reasonable legal fees) arising from:

• misuse of the Services by the Client;
• unauthorized or unlawful use of software;
• infringement arising from materials supplied by the Client;
• breach of this Agreement by the Client;
• negligent or wrongful acts of the Client or its personnel.

42.2 Triarch Indemnity

Subject to the limitations of liability contained herein, Triarch shall indemnify the Client against third-party claims alleging that Deliverables created solely by Triarch infringe a valid intellectual property right, provided that:

• the Client promptly notifies Triarch;
• Triarch controls the defense and settlement of the claim; and
• the Client reasonably cooperates.

Triarch shall have no obligation where infringement results from:

• modifications made by the Client;
• combination with products not supplied by Triarch;
• use outside the intended purpose;
• compliance with Client specifications.

43. Insurance

Triarch shall maintain commercially reasonable insurance appropriate to its business operations, which may include:

• Commercial General Liability;
• Professional Liability (Errors and Omissions);
• Cyber Liability Insurance;
• Workers' Compensation or applicable employee insurance;
• Property Insurance.

Evidence of insurance may be provided upon reasonable written request, subject to confidentiality obligations.

44. Force Majeure

Neither Party shall be liable for delay or failure to perform obligations caused by events beyond its reasonable control, including but not limited to:

• natural disasters;
• typhoons;
• floods;
• earthquakes;
• fires;
• epidemics;
• pandemics;
• war;
• terrorism;
• civil unrest;
• labor disputes not limited to the affected Party;
• governmental actions;
• internet backbone failures;
• prolonged power outages;
• cloud platform failures;
• supplier embargoes;
• acts of God.

The affected Party shall:

1. promptly notify the other Party;
2. use commercially reasonable efforts to mitigate the effects; and
3. resume performance as soon as reasonably practicable.

If a Force Majeure Event continues for more than ninety (90) consecutive days and substantially prevents performance, either Party may terminate the affected Statement of Work upon written notice.

45. Business Continuity

Triarch shall maintain reasonable business continuity and disaster recovery procedures appropriate to the nature of its operations.

The Client acknowledges that business continuity planning is a shared responsibility and that effective recovery also depends upon:

• the Client's own continuity plans;
• available backups;
• third-party infrastructure;
• telecommunications providers;
• cloud vendors;
• hardware replacement availability.

46. Duty to Mitigate

Each Party shall use reasonable efforts to mitigate any loss, damage, or expense arising from a breach of this Agreement or other event giving rise to a claim.

Failure to take reasonable mitigation measures may reduce recoverable damages to the extent permitted by law.

47. Survival

The following provisions shall survive the expiration or termination of this Agreement to the extent necessary to give them effect:

• Confidentiality
• Intellectual Property
• Payment Obligations
• Limitation of Liability
• Indemnification
• Data Privacy
• Dispute Resolution
• Governing Law
• Audit Rights
• Any provision intended by its nature to survive termination.

TERM, RENEWAL, TERMINATION, TRANSITION ASSISTANCE, DISPUTE RESOLUTION, GENERAL PROVISIONS, AND EXECUTION

48. Term of Agreement

48.1 Effective Date

This Agreement shall become effective on the Effective Date stated on the Cover Page or on the date it is executed by both Parties, whichever occurs later.

48.2 Initial Term

Unless otherwise stated in an applicable Statement of Work ("SOW"), this Agreement shall remain in force for an initial term of one (1) year.

Any Statement of Work may specify a different project duration without affecting the overall validity of this Agreement.

48.3 Renewal

Unless otherwise provided in an applicable SOW, this Agreement shall automatically renew for successive one (1) year periods unless either Party provides at least thirty (30) calendar days' written notice of its intention not to renew.

Project-based engagements automatically expire upon completion of the applicable Statement of Work unless additional Services are contracted.

49. Suspension of Services

Triarch may suspend all or part of the Services upon written notice where:

• invoices remain unpaid beyond the applicable grace period;
• continued performance would violate applicable law;
• cybersecurity risks materially threaten the Client or Triarch;
• the Client repeatedly refuses reasonable security recommendations that materially increase operational risk;
• the Client breaches a material obligation under this Agreement.

During suspension:

• recurring service fees shall continue unless otherwise agreed;
• project timelines shall automatically extend by the duration of the suspension;
• Triarch shall not be responsible for delays caused by the suspension.

50. Termination

50.1 Termination for Convenience

Either Party may terminate this Agreement without cause by providing ninety (90) calendar days' prior written notice.

Termination shall not affect:

• completed Statements of Work;
• accrued payment obligations;
• obligations intended to survive termination.

50.2 Termination for Cause

Either Party may terminate this Agreement immediately upon written notice if the other Party:

• materially breaches this Agreement and fails to cure such breach within thirty (30) calendar days after receiving written notice;
• becomes insolvent, enters liquidation, or ceases business operations;
• commits fraud, willful misconduct, or other unlawful acts materially affecting the Agreement;
• repeatedly fails to perform its contractual obligations despite reasonable notice and opportunity to cure.

50.3 Immediate Termination

Triarch may immediately terminate Services where continued performance would:

• violate applicable law;
• expose Triarch to criminal or regulatory liability;
• facilitate fraudulent or illegal activity;
• materially compromise the security of Triarch's systems or personnel.

51. Effect of Termination

Upon termination:

The Client shall promptly:

• pay all outstanding invoices;
• reimburse approved expenses;
• return Triarch-owned equipment;
• discontinue use of licensed software or proprietary materials where required.

Triarch shall:

• discontinue Services;
• remove administrative access where appropriate;
• return Client-owned credentials and documentation;
• cooperate in an orderly transition in accordance with this Agreement.

Termination shall not extinguish liabilities accrued prior to the effective termination date.

52. Transition Assistance

Upon written request, Triarch may provide reasonable transition assistance to facilitate migration of Services to the Client or another provider.

Transition Services may include:

• documentation handover;
• credential transfer;
• system knowledge transfer;
• configuration exports;
• migration planning;
• coordination meetings;
• final backups (if included in the Services).

Unless expressly included in the applicable SOW, Transition Services shall be billed at Triarch's prevailing Professional Services rates.

Transition assistance shall generally be available for up to sixty (60) days following termination unless otherwise agreed.

53. Non-Solicitation

During the term of this Agreement and for twelve (12) months following its termination, neither Party shall knowingly solicit for employment any employee who was directly involved in providing or receiving the Services under this Agreement.

This provision shall not apply where:

• the employee independently responds to a public job advertisement;
• the employee initiates contact without prior solicitation;
• written consent is obtained from the other Party.

Where permitted by applicable law, a breach of this clause may entitle the non-breaching Party to recover reasonable damages resulting directly from the breach.

54. Independent Contractor Relationship

Triarch is an independent contractor.

Nothing contained in this Agreement shall create:

• a partnership;
• joint venture;
• agency;
• employer-employee relationship;
• fiduciary relationship.

Neither Party has authority to bind the other except as expressly authorized in writing.

55. Subcontracting

Triarch may engage qualified subcontractors, consultants, affiliates, or specialist vendors to perform portions of the Services.

Triarch shall remain responsible for the performance of subcontracted Services to the same extent as if performed by its own personnel.

Where subcontractors process Personal Information on behalf of the Client, Triarch shall require appropriate confidentiality and data protection obligations consistent with applicable law.

56. Assignment

Neither Party may assign this Agreement without the prior written consent of the other Party, which shall not be unreasonably withheld.

However, Triarch may assign this Agreement without consent:

• to an Affiliate;
• in connection with a merger;
• acquisition;
• corporate restructuring; or
• sale of substantially all of its assets,

provided the assignee assumes the obligations under this Agreement.

57. Notices

All notices required under this Agreement shall be in writing and delivered by:

• personal delivery;
• recognized courier service;
• registered mail;
• electronic mail to the designated representatives of each Party.

A notice shall be deemed received:

• upon actual delivery;
• upon courier confirmation;
• three (3) Business Days after mailing by registered mail;
• or upon successful transmission by electronic mail, unless a delivery failure notice is received.

Each Party shall promptly notify the other of any change to its contact details.

58. Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the Republic of the Philippines, without regard to conflict of laws principles.

59. Dispute Resolution

The Parties shall first attempt to resolve any dispute through good-faith negotiations between authorized representatives.

If the dispute is not resolved within thirty (30) calendar days, the Parties may agree to submit the matter to mediation.

Should mediation fail or not be pursued, either Party may commence proceedings before the courts of competent jurisdiction in Makati City, Metro Manila, unless another venue is required by applicable law or mutually agreed in writing.

Nothing in this section prevents either Party from seeking urgent injunctive or equitable relief where necessary to protect confidential information, intellectual property, or prevent irreparable harm.

60. Compliance with Laws

Each Party shall comply with all applicable Philippine laws and regulations relevant to its obligations under this Agreement, including those relating to:

• taxation;
• labor;
• data privacy;
• intellectual property;
• anti-corruption;
• electronic commerce;
• cybersecurity; and
• consumer protection, where applicable.

61. Entire Agreement

This Agreement, together with all executed Statements of Work, Schedules, Amendments, and Annexes, constitutes the entire agreement between the Parties concerning its subject matter and supersedes all prior negotiations, discussions, proposals, understandings, and agreements, whether oral or written.

62. Amendments

No amendment, modification, or waiver of this Agreement shall be effective unless:

• made in writing; and
• signed by authorized representatives of both Parties.

Email approval may constitute written approval where expressly agreed by the Parties.

63. Severability

If any provision of this Agreement is held invalid, illegal, or unenforceable by a court of competent jurisdiction, the remaining provisions shall remain in full force and effect.

The Parties shall negotiate in good faith a valid replacement provision that most closely reflects the original commercial intent.

64. Waiver

Failure or delay by either Party to enforce any provision of this Agreement shall not constitute a waiver of that provision or any other right.

Any waiver must be in writing and signed by the Party granting the waiver.

65. Counterparts and Electronic Signatures

This Agreement may be executed:

• in counterparts;
• by electronic signature;
• through secure electronic signature platforms; or
• by scanned PDF signatures exchanged electronically,

each of which shall be deemed an original and together constitute one instrument.

Electronic signatures shall have the same legal effect as handwritten signatures to the extent permitted under Philippine law, including the Electronic Commerce Act of 2000 (Republic Act No. 8792).

SERVICE LEVEL AGREEMENT (SLA)

1. Support Hours

Standard Business Hours

Monday – Friday

8:00 AM – 5:00 PM

Philippine Time

excluding holidays.

2. Incident Priorities

Response time is the time to acknowledge and begin work. Restoration targets will depend on the nature of the incident, availability of third-party vendors, replacement parts, and client cooperation.

3. Coverage

Covered Services include:

• Help Desk
• Desktop Support
• Network
• Server
• Microsoft 365
• Azure
• Backup Monitoring
• Antivirus
• Endpoint Protection
• Firewall
• VPN

4. Exclusions

Not covered:

• ISP outages
• Power failures
• Flood
• Fire
• Lightning
• Cyber attacks caused by unsupported systems
• User negligence
• Acts of God
• Third-party cloud outages

5. Escalation

Level 1 – Help Desk

↓

Level 2 – Systems Engineer

↓

Level 3 – Senior Engineer

↓

Level 4 – Solutions Architect

↓

Management Escalation

6. Planned Maintenance

Scheduled maintenance may occur outside business hours with prior notice whenever reasonably practicable.

Emergency maintenance may be performed immediately where necessary to protect systems or restore critical services.

DATA PROCESSING ADDENDUM (DPA)

1. Purpose

This Data Processing Addendum supplements the Master Services Agreement whenever Triarch processes Personal Information on behalf of the Client.

2. Processing Activities

Triarch may process:

• Employee information
• Customer information
• Contact information
• User accounts
• Email
• Documents
• Cloud data
• Backup data

solely for the purpose of providing the agreed Services.

3. Confidentiality

Triarch personnel with access to Personal Information shall be bound by confidentiality obligations.

4. Security Measures

Triarch shall implement commercially reasonable safeguards, which may include:

• MFA
• Encryption
• Firewalls
• Endpoint Protection
• Logging
• Backups
• Least-Privilege Access
• Vulnerability Management

5. Subprocessors

Triarch may engage reputable subprocessors, including cloud providers, software vendors, hosting providers, and technology partners, where necessary to perform the Services.

Triarch shall take reasonable steps to ensure such subprocessors are subject to appropriate contractual confidentiality and data protection obligations.

6. Data Breach Notification

Where Triarch becomes aware of a confirmed security incident affecting Personal Information processed on behalf of the Client, Triarch shall notify the Client without undue delay and provide information reasonably available to assist the Client in meeting its legal obligations.

7. Return of Data

Upon termination, the Client may request return of available Client Data in a commercially reasonable format before deletion, subject to any agreed transition period and applicable legal retention requirements.

APPENDIX A

CLIENT ONBOARDING CHECKLIST

• Initial Discovery Meeting
• Business Requirements Review
• Asset Inventory
• User List
• Network Diagram
• Administrator Credentials
• Domain Information
• Microsoft 365 Tenant
• Firewall Configuration
• Backup Verification
• Antivirus Review
• Patch Status Review
• Cybersecurity Assessment
• Documentation Handover
• Service Desk Orientation

APPENDIX B

CLIENT OFFBOARDING CHECKLIST

• Return Credentials
• Export Documentation
• Backup Transfer
• Domain Transfer
• Microsoft 365 Handover
• Firewall Configuration Export
• Asset Inventory Export
• VPN Credentials
• DNS Transfer
• Cloud Administration Transfer
• Final Invoice
• Client Acceptance