General purchasing terms and conditions of Pon Holdings B.V.

Article 1 – Definitions

1.1. In these general purchasing terms and conditions, the following terms are defined as follows:

Article 2 – Applicability

2.1. These purchasing terms and conditions apply to all requests for information, quotations, assignments, orders, agreements, and other arrangements regarding the Performance.

2.2. Deviations from these purchasing terms and conditions are only valid if agreed in writing.

2.3. General terms and conditions of Supplier do not apply.

2.4. The rights accruing to Pon under these purchasing terms and conditions may also be invoked by the other Group Companies. A Group Company is not jointly and severally liable for the fulfilment of an obligation of another Group Company.

Article 3 – Formation of the Agreement

3.1. Quotations from Supplier are valid for a minimum of 60 days. All costs for drafting a quotation are for the account of the Supplier.

3.2. An Agreement is only concluded if Pon accepts an offer from Supplier in writing.

3.3. Verbal agreements are only binding after written confirmation from Pon.

3.4. Pon is not obliged to purchase a minimum quantity. The cooperation is non-exclusive.

Article 4 – Prices

4.1. All prices are in euros, excluding VAT and including all other costs, taxes, and levies.

4.2. The prices are fixed for the duration of the Agreement.

Article 5 – Invoicing and payment

5.1. Pon will pay within 30 days after receipt of the correct invoice, provided that the Performance has been delivered as agreed. If the law prescribes a shorter payment term, the shorter payment term applies.

5.2. Invoices from Supplier must comply with statutory requirements and Pon’s instructions.

5.3. Supplier must send the invoice within 90 days after delivery; if this does not happen, Pon is no longer obliged to pay.

5.4. If Pon does not pay an invoice due to a clear inaccuracy or due to defects in the Performance, this does not entitle Supplier to suspend fulfilment of the Agreement or terminate the Agreement.

5.5. Payment does not imply that Pon waives its rights.

5.6. Pon is entitled to set off outstanding claims of Supplier against Pon with amounts that Pon, for whatever reason, has to claim from Supplier.

Article 6 – Additional work

6.1. Pon will only pay for additional work if it has given written instructions for it or if circumstances are reasonably not for the account of the Supplier. Work that Supplier could have foreseen in order to correctly deliver the Performance does not count as additional work.

6.2. If Supplier foresees additional work, it must inform Pon as soon as possible. Supplier must provide a fixed price quote and an adjusted schedule or delivery date. Supplier will only carry out the additional work after written instruction from Pon. These purchasing terms and conditions also apply to the additional work.

Article 7 – Delivery of goods

This Article 7 only applies if the Performance consists of the supply of goods.

7.1. Delivery of goods takes place in the manner and at the time agreed in the Agreement. Delivery is Delivered Duty Paid (DDP) (Incoterms latest version).

7.2. Supplier must adequately package the goods in accordance with statutory and agreed requirements. A packing list must be included with every shipment.

7.3. Partial deliveries or deviations in quantity are not permitted without Pon’s prior written consent.

7.4. The delivery is only complete once Pon has received the goods. The receipt of the goods does not mean that Pon considers the goods to be approved.

7.5. Ownership of goods transfers to Pon upon receipt. If Pon has paid for the goods in advance, ownership transfers upon payment.

7.6. Until Pon has received the goods, the goods are at Supplier’s risk. If the delivery is rejected (see Article 9), the risk remains with Supplier.

7.7. Upon Pon’s request, Supplier will take back packaging material free of charge. Return of (loan) packaging will be at the expense and risk of Supplier to a location specified by Supplier.

Article 8 – Provision of services

This Article 8 only applies if the Performance consists of the provision of services.

8.1. Supplier must perform the services professionally and carefully, according to the latest state of the art and without interruptions.

8.2. Supplier is responsible for and will arrange all (auxiliary) resources, persons, and/or third parties necessary for the provision of the services.

8.3. The employees and/or third parties deployed by Supplier must have the right qualifications, experience, and knowledge and the required diplomas and accreditation. Pon may impose additional requirements, such as a Certificate of Conduct (VOG).

8.4. If an employee and/or third party is unavailable or, in Pon’s opinion, unsuitable, Supplier must arrange suitable replacement in time, without additional costs to Pon.

Article 9 – Timely delivery and acceptance

9.1. If Supplier exceeds an agreed delivery time, it will be in default. If a delay threatens, Supplier must immediately notify Pon thereof in writing. This notification is without prejudice to any consequences or liability of Supplier. If the delivery period is exceeded by more than 10 calendar days, Supplier will immediately owe a penalty of 5% of the agreed price for the Performance, plus an additional 1% per week that the delay continues. This penalty does not replace Pon’s other rights. Statutory commercial interest is immediately due on the penalty.

9.2. If Pon so requests, Supplier must offer (parts of) the Performance for acceptance. Supplier must fully cooperate with this.

9.3. Rejected products or materials must be collected by the Supplier as soon as possible upon Pon’s first request. If Supplier does not collect them within a reasonable period, Pon may return or destroy them at Supplier’s expense and risk.

9.4. Pon is not bound by a period set by Supplier for reporting defects or complaints.

Article 10 – Materials and resources

10.1. Materials and resources supplied by Pon or paid for by Pon are the property of Pon. Supplier must manage them carefully, use them only for Pon, and provide them to Pon upon first request.

Article 11 – Confidentiality and use of information

11.1. Parties are obliged to maintain the confidentiality of all information they receive from each other whose confidential nature can reasonably be assumed. Pon Data is always considered confidential information of Pon. Only employees who require the information for the performance of the Agreement will be granted access to confidential information.

11.2. The confidentiality obligation does not apply to information if the receiving party can demonstrate that it:

• was already lawfully in its possession without a confidentiality obligation;
• was already public at the time of receipt, other than through the receiving party’s own actions;
• was lawfully obtained from a third party who is not bound by confidentiality;
• was developed independently without using confidential information of the other party; or
• must be shared pursuant to a statutory obligation (in which case the other Party must be informed in writing to the extent legally permissible).

11.3. Parties must ensure that everyone involved in the performance of the Agreement on their behalf complies with the confidentiality obligation under this article. Upon Pon’s request, Supplier must have involved employees and third parties sign a confidentiality agreement provided by Pon.

11.4. All information collected by Supplier in the context of the Performance may only be used for the performance of the Performance. Supplier must provide this information to Pon in the desired format upon Pon’s first request, must not share it with third parties, and must not change or destroy it without Pon’s consent. If this information is subject to intellectual property rights, Supplier must transfer them to Pon upon request.

Article 12 – Intellectual property

12.1. Intellectual property rights used in connection with the Performance and already vested in Supplier prior to the Agreement remain the property of Supplier.

12.2. Supplier grants Pon a non-exclusive, unlimited, and transferable right of use to use the Performance for anything related to Pon’s business operations.

12.3. Supplier warrants that the Performance (including use or resale thereof) does not infringe upon (intellectual property) rights of third parties.

12.4. Supplier indemnifies Pon against third-party claims due to infringement of the rights referred to in paragraph 2 of this article and compensates all resulting damage. All intellectual property rights and other rights, including rights to know-how, methods, Pon Data, reports, documentation, inventions, and improvements, arising from the cooperation between Parties accrue entirely to Pon. Supplier transfers these rights, to the extent necessary, to Pon in advance and free of charge, and grants all necessary cooperation with the transfer and registration. Supplier hereby irrevocably authorises Pon to perform all acts necessary to effect such transfer and registration.

12.5. Supplier may not use the name, trade name, and logo of Pon or a Group Company for marketing or promotional purposes. This also includes mentioning Pon as a reference or customer on websites or in other publication material. Deviation from this prohibition is only permitted with Pon’s prior written consent.

Article 13 – Privacy and personal data

13.1. Parties are obliged to treat personal data confidentially in accordance with the General Data Protection Regulation (GDPR) and related laws and regulations.

13.2. Parties acknowledge that they are both controllers for the processing of all personal data under the Agreement, unless Parties expressly agree that one of the parties is a processor for the benefit of the other. In that case, Supplier will strictly adhere to the provisions of the Pon Processor Agreement. The Pon Processor Agreement will, if applicable, be attached by Pon as an appendix to the Agreement.

13.3. Failure to comply with an obligation under the Pon Processor Agreement by Supplier entitles Pon to terminate or dissolve the Agreement with immediate effect.

13.4. Pon processes personal data in accordance with the privacy statement, which can be found at www.pon.com/privacyverklaring-pon.

Article 14 – Deployment of artificial intelligence

14.1. If Supplier uses artificial intelligence (AI) in the performance of the Performance, Supplier bears responsibility for the operation and transparency of these technologies.

14.2. Supplier must ensure that these AI solutions:

• do not produce unwanted biases, discriminatory outcomes, or unlawful decisions;
• are regularly evaluated for accuracy, ethics, and transparency;
• are adjusted if necessary or upon Pon’s request; and
• provide sufficient insight into their operation, so that Pon can understand them.

14.3. Supplier declares that the data provided by Pon or processed through the AI solutions:

• are only used for the agreed purpose and in accordance with applicable legislation on the protection of (personal) data (such as the GDPR);
• are only used within a controlled, closed environment where third-party access is not allowed; and
• are not used for further development or training of AI algorithms of Supplier or third parties without Pon’s prior written consent.

All content generated by or with the help of AI in the context of the Agreement is the exclusive property of Pon. This also applies to the underlying prompts and interim results developed specifically for Pon.

14.4. Supplier warrants that it has all necessary rights and licences for the use of the deployed AI solutions and tools. Pon may use the generated output thereof freely and without restriction for commercial purposes.

14.5. Supplier indemnifies Pon against third-party claims arising from the use of these AI solutions and tools or the output generated thereby.

Article 15 – Warranty

15.1. Supplier warrants that:

• the Performance complies with the promised and reasonably expected properties, the agreed specifications and/or approved drawings, samples, or models;
• the Performance has no defects and is free of third-party rights;
• the Performance is suitable for the purpose for which the Performance is intended and complies with applicable industry regulations, applicable laws and regulations, and safety requirements; and
• it has the right expertise, certifications, and resources to perform the Performance professionally.

15.2. If the Performance does not comply with the warranties in paragraph 1 of this article, Supplier must immediately repair or replace it at its expense and at Pon’s direction. If Supplier fails to do so within a reasonable period, Pon may arrange for repair or replacement itself at Supplier’s expense. Pon retains all its other rights.

15.3. Pon may invoke the warranty in paragraph 1 of this article up to at least two years after delivery and acceptance of the Performance. Section 6:89 of the Dutch Civil Code does not apply.

Article 16 – Liability

16.1. Supplier is liable for all damage suffered by Pon as a result of a breach, tort, or negligence of Supplier, its employees, or third parties engaged.

16.2. Supplier indemnifies Pon against all third-party claims in connection with the performance of the Agreement.

16.3. Supplier has taken out adequate liability insurance with a minimum coverage of € 5,000,000 per claim. Upon Pon’s request, it must provide a copy of the insurance certificate. This insurance obligation also extends to auxiliary resources used in the performance of the Agreement.

16.4. Pon is not liable for damage suffered by Supplier, unless the damage is the result of intent or wilful recklessness of Pon’s executives.

Article 17 – Force majeure

17.1. In the event of force majeure within the meaning of Section 6:75 of the Dutch Civil Code, obligations under the Agreement will be suspended as long as the force majeure continues, without the parties being mutually obliged to compensate for damage caused thereby. The party that is of the opinion that a force majeure situation is occurring must inform the other party thereof in writing as soon as possible. If the force majeure continues for more than thirty (30) days, the other party may terminate or dissolve the Agreement (in whole or in part) with immediate effect, without thereby becoming liable for damages towards the party invoking force majeure.

17.2. In any case, the following will not be regarded as force majeure on the part of Supplier: (i) staff shortages or internal strikes, (ii) failure of third parties engaged by Supplier, (iii) breakdown of auxiliary materials, (iv) liquidity/financial problems of Supplier, or (v) government measures specifically aimed at Supplier or its business situation. For clarification: the foregoing is a non-exhaustive list of circumstances that do not constitute force majeure as referred to in Section 6:75 of the Dutch Civil Code.

17.3. If a force majeure situation has adverse consequences for Pon, Pon has the right to renegotiate and/or suspend its obligations, without liability for resulting damage to Supplier.

17.4. If a suspension pursuant to paragraph 1 of this article lasts longer than 90 days, either Party may terminate or dissolve the Agreement with immediate effect without any liability for damages.

Article 18 – Cybersecurity

18.1. Supplier must take appropriate technical and organisational measures to secure its systems and Pon Data. These measures must guarantee an appropriate, risk-based security level, taking into account the state of the art and costs of implementation of the measures. The measures must be based on a risk assessment and comply with customary market standards.

18.2. In the event of a cyber incident that may affect Pon, Supplier must immediately inform Pon and cooperate in the recovery and limitation of damage.

18.3. Supplier must regularly evaluate its security measures and adjust them where necessary to counter new threats. Pon has the right to inspect these measures and check compliance upon request.

Article 19 – Secondment and prevention of false employment structures

19.1. Supplier must comply with all relevant laws and regulations regarding terms of employment, collective labour agreements, and tax obligations and clearly record all agreements on terms of employment.

19.2. Upon request, Supplier must grant competent authorities and/or Pon access to these agreements on terms of employment and cooperate with checks, audits, or wage validation if a competent authority requests this and with due observance of privacy legislation.

19.3. Supplier must impose the obligations in paragraphs 1 and 2 of this article in full on all parties it engages for the performance of the Agreement.

19.4. Supplier indemnifies Pon against third-party claims (including the Tax Authorities) due to non-compliance with employment law or tax obligations by itself or by third parties it engages for the performance of the Agreement.

19.5. Upon Pon’s request, Supplier must provide a copy of a current “statement regarding payment behaviour” provided to it by the Tax Authorities.

19.6. If Pon runs the risk of being held liable for wage tax, premiums, or the income-related healthcare insurance contribution, Pon has the right to deposit at least 25% of the invoice amount into a blocked G-account of Supplier as referred to in the Collection Act 1990. Payment by Pon into this account counts as discharge.

Article 20 – Non-solicitation clause

20.1. During the term of the Agreement and up to one year after its expiry, Supplier must refrain from approaching, recruiting, or employing Pon’s employees.

Article 21 – Termination and consequences

21.1. Pon may terminate the Agreement at any time with a notice period of 3 months, without being liable for damages.

21.2. Both Parties may terminate or dissolve the Agreement with immediate effect, without being liable for damages, if:

1. the other Party breaches an obligation, and this breach is not rectified within 30 days after receipt of a written notice of default;
2. there is a suspension of payment or bankruptcy (filed or pronounced) of the other Party.

21.3. Pon may also terminate or dissolve the Agreement with immediate effect, without being liable for damages, if:

1. Supplier’s or Pon’s business activities are terminated;
2. a person or entity other than Supplier’s current parent company directly or indirectly acquires (i) more than 50% of the shares in Supplier’s capital, or (ii) acquires or exercises more than 50% of the voting rights in Supplier’s general meeting.

21.4. In the event of (partial) termination of the Agreement, Supplier is obliged to:

1. provide Pon with all data and materials developed under the Agreement free of charge, as well as information and data that Pon reasonably requires for the continuation or completion of the Performance;
2. transfer all Pon Data, in a format prescribed by Pon, to Pon free of charge;
3. grant full cooperation free of charge for a smooth transfer to Pon or a third party designated by Pon;
4. continue the Performance for a maximum of six months at Pon’s request under the same conditions as laid down in the Agreement.

21.5. Pon’s claims against Supplier become immediately due and payable upon termination of the Agreement.

Article 22 – Environmental, social & governance

22.1. Environmental, Social & Governance (ESG) means all statutory and/or internationally recognised standards and requirements in the field of environment, society, and good governance, including the standards and requirements arising from the EU Corporate Sustainability Reporting Directive.

22.2. Supplier declares and warrants that it will comply with applicable legislation, ESG standards, and (other) ethical and responsible codes of conduct. More specifically, Supplier declares and warrants to act in accordance with Pon’s Business Partner Code of Conduct.

22.3. Upon Pon’s first request, Supplier must provide all (reasonable) cooperation, support, information, and documents that Pon requires to comply with all requirements and standards for reporting and disclosure under applicable legislation or ESG standards.

22.4. Supplier must ensure that it imposes the provisions of this article on any subcontractors it engages and all parties in Supplier’s supply chain in connection with the Performance to be delivered to Pon.

22.5. Pon may terminate or dissolve the Agreement with immediate effect if Supplier does not comply with the provisions of this article in full.

Article 23 – Engagement of third parties

23.1. The engagement of third parties by Supplier for the performance of the Performance is only permitted after Pon’s prior written consent. Even after consent, Supplier remains fully responsible and liable for the correct and timely fulfilment of its obligations.

Article 24 – Miscellaneous provisions

24.1. If Pon has the right to impose a penalty on Supplier, this penalty will never replace any of Pon’s other rights, such as the right to compensation for damages or the right to fulfilment.

24.2. Pon may unilaterally amend these purchasing terms and conditions in the event of changes in laws and regulations or internal policy changes. Pon will inform Supplier of this in writing and observe a reasonable period before the changes take effect. If the change demonstrably has far-reaching consequences for Supplier, Parties will consult.

24.3. Supplier may not transfer its rights and obligations under the Agreement in whole or in part without Pon’s prior written consent. This prohibition does not apply to the transfer or pledge of monetary claims by name as referred to in Section 3:83 of the Dutch Civil Code.

24.4. Pon may transfer the Agreement and the rights and obligations belonging thereto (in whole or in part) to another company. Pon does not require Supplier’s consent for this.

Article 25 – Applicable law and competent court

25.1. Dutch law exclusively applies to the legal relationship between Parties. The applicability of the Vienna Sales Convention is excluded.

25.2. All disputes between Parties will be submitted in the first instance to the Central Netherlands District Court, Utrecht location.

Article 26 – Access to and use of the Performance

26.1. Pon will be granted access to the Performance for the period stated in the Agreement. If no period is stated in the Agreement, access is not limited in time (perpetual). Access to the Performance is non-exclusive and non-transferable to third parties.

26.2. If the Performance is made available in the form of IaaS, PaaS, or SaaS, Supplier must provide:

1. a Pon-wide licence with an unlimited number of users; or
2. a flexible licence model whereby expansion or limitation of the number of users is determined on a monthly basis and can be changed upon Pon’s request.

26.3. The use of the Performance is not limited to specific users, locations, or systems. Pon may use the Performance within its own organisation (including the dealer organisations) and have it used by third parties working for Pon.

26.4. If Supplier structurally fails to comply with its obligations, Pon may take technical or organisational measures at the expense of Supplier to safeguard the continuity of the Performance or the availability of Pon Data, insofar as this is reasonably possible.

Article 27 – Warranty and service level agreement

27.1. Up to three months after delivery, or after acceptance if a test has been agreed, the Supplier will resolve errors in the Performance reported by Pon during that period. The Supplier will immediately address reported errors. If the Supplier fails to do so in a timely manner, even after a written warning from Pon, Pon may have the errors repaired itself or via third parties at the expense of the Supplier.

27.2. A service level agreement is part of the Agreement. Supplier must cooperate in recording arrangements in the service level agreement.

Article 28 – Quality

28.1. Supplier must deliver the Performance expertly, carefully, and in accordance with the agreed specifications, performance, and service levels. The Performance must function as promised, without defects and without unwanted code or security risks.

28.2. Supplier warrants that the Performance complies with common standards and guidelines within the sector, including security standards such as ISO 27001, SOC 2, or an equivalent level. Upon Pon’s request, Supplier must provide current certificates, audit reports, or statements demonstrating compliance with these standards.

28.3. When developing software, Parties must carefully lay down the specifications in the Agreement. Supplier must carry out the development carefully and comply with the Pon standards (see: https://pondigitalsolutions.github.io/restful-api-quidelines/#). The following principles apply to the choice of standards to be used:

1. interoperability with systems used by Pon;
2. simple management; and
3. cost reduction.

28.4. Supplier must regularly adjust the Performance to improve quality, security, or usability. Supplier must inform Pon in a timely manner of relevant changes that may impact use.

28.5. Supplier warrants that the Performance remains stable and reliable even during peak load.

Article 29 – Security

29.1. In addition to the requirements mentioned in Article 28, Supplier must comply with the Pon security guidelines.

29.2. Supplier must evaluate itself for safeguarding and, where necessary, improving compliance with the applicable security obligations.

29.3. Supplier must ensure that third parties do not have access to the Pon Data. Only employees for whom this is necessary for the provision of the Performance will be granted access based on the need-to-know principle. Upon Pon’s request, Supplier must immediately provide all information about the authorisations granted and access rights.

29.4. Supplier must ensure that the security risks associated with the Performance are known, assessed, and recorded. Based on the assessment and inventory of the aforementioned security risks by Supplier, the latter must draw up a security plan that is periodically renewed.

29.5. This security plan must be shared with Pon upon Pon’s first request. Supplier must designate a contact person for all communication about all aspects of Supplier’s information security.

29.6. Supplier must immediately, but no later than within 24 hours of discovering an information security incident, report all information security incidents relating to the Performance to Pon.

29.7. Processing of Pon Data will always take place within the EEA, unless Parties have made additional arrangements about this.

29.8. If the contracting Group Company falls under European cyber security regulations, such as the NIS2 Directive, Supplier must take additional measures and provide information necessary to enable the contracting Group Company to comply with its obligations.

Article 30 – Inspection and updates

30.1. Supplier must ensure timely and correct maintenance of the Performance, including fixing errors, resolving malfunctions, and performing updates and improvements.

30.2. Maintenance work must be carried out in a manner that causes as little inconvenience as possible to Pon. If the Performance is temporarily unavailable, Supplier must inform Pon of this in a timely manner, and in the event of emergency maintenance, as soon as possible.

30.3. Updates and new versions may not negatively impact the operation, security, or functionalities of the Performance agreed upon at the start of the Agreement. Previous versions must remain available for as long as reasonably possible.

30.4. All maintenance work and updates are included in the fee paid by Pon for the Performance.

Article 31 – Divestments

31.1. If Pon sells, privatises, or transfers part of its activities, Pon may demand that Supplier continues to provide the Performance to the entity concerned or its acquirer for a maximum of twelve (12) months under unchanged conditions.

31.2. Supplier must deliver the Performance under at least equivalent conditions as agreed with Pon, provided that the acquiring party conforms to the relevant provisions of the Agreement in writing.

31.3. Supplier must fully cooperate with a smooth transition of the Performance to the acquirer, including transfer of the Pon Data, documentation, access, and support, in a manner that ensures the continuity of the business operations of the entity concerned.

31.4. Parties must consult in a timely manner about whether and how the services will be independently continued by the acquirer after the period referred to in paragraph 1 of this article has ended.

31.5. If applicable, the volume of the Performance at Pon will be adjusted accordingly without claim for payment or compensation for Supplier.

Article 32 – Continuity and BCM

32.1. Supplier must take appropriate measures to ensure the continuity of the Performance and to be able to recover quickly in the event of disruptions. Upon Pon’s request, Supplier must ensure the drafting, implementation, and maintenance of a BCM plan.

32.2. If Pon so requests, Supplier must deposit essential parts of the Performance (such as source code, configurations, or key information) with an independent third party. Supplier must ensure that this third party provides these materials to Pon free of charge and without additional conditions in the event of a serious breach, bankruptcy, or suspension of payment of Supplier.

32.3. Supplier must regularly back up Pon Data and test its recoverability. The back-up and recovery procedures must be integrated into any BCM plan. Supplier must demonstrate upon request that these procedures are effective.

32.4. Supplier must periodically test the BCM plan and have this plan assessed at its own expense by an independent external party, such as an IT auditor or accountant. Supplier must provide the test report to Pon and immediately rectify deficiencies.

Article 33 – Exit for an ICT Performance

33.1. Upon termination or expiry of the Agreement, Supplier must grant full cooperation with the technical transfer of the Performance to Pon or a third party designated by Pon.

33.2. This cooperation must include at least:

1. access to help desk and change requests, backups, documentation, configurations, and settings;
2. deployment of employees with relevant technical knowledge; and
3. transfer of digital components or settings that are essential for the continuation of the Performance.

33.3. Upon Pon’s request, Supplier must cooperate in drafting and implementing a transfer plan that includes timelines, responsibilities, and practical arrangements.

33.4. If parts of the Performance are supplied by third parties (such as licences or platforms), Supplier must make every effort to enable transfer or continuation thereof for Pon or a successor party, without additional costs or restrictions.