PRISM CORE HR — PLATFORM SUBSCRIPTION AGREEMENT

TERMS AND CONDITIONS OF SERVICE

Version 1.0 — Effective date: 14 October 2026 (for each Subscriber, from the date of its acceptance)

MERAKI HR SRL — Trade Register: J2024005188408 — CUI: 49743547 — VAT: RO49743547 — EUID: ROONRC.J2024005188408 — Registered office: Bucharest, Romania

You must scroll through this entire agreement before you can accept it. By clicking "I have read, understood, and accept this agreement," you enter into a legally binding contract with MERAKI HR SRL on behalf of yourself and the company you represent. Acceptance also requires you to tick the box in the section "Express acceptance of specific clauses" at the end of this agreement. If you do not agree with any provision, do not create an account.

ARTICLE 1 — DEFINITIONS

For the purposes of this Agreement, the following terms have the meanings set out below:

"Agreement" means this Platform Subscription Agreement, including all Schedules and any documents incorporated by reference.

"Platform" means the Prism Core HR software-as-a-service application, including all modules, features, updates, and associated documentation, accessible at https://prismclearpay.eu and operated by MERAKI HR SRL.

"ClearPay Module" means the optional pay transparency module of the Platform, also referred to as Prism ClearPay, subject to additional obligations set out in Schedule 2.

"Subscriber" or "you" means the legal entity, or the professional acting for business purposes, that registers with a valid CUI/VAT ID and accepts this Agreement. The Platform is not offered to consumers.

"Authorised Users" means the employees, contractors, or agents of the Subscriber who are permitted to access the Platform under the Subscriber's account, including HR Admins, Managers, and Employees as defined by the Platform's role system.

"Subscription" means the access rights granted to the Subscriber in exchange for the applicable fees, as selected at registration and as modified from time to time.

"Add-on" means any optional feature module purchased by the Subscriber in addition to the base Subscription tier.

"Subscriber Data" means all data, information, and content uploaded, entered, or processed by the Subscriber or its Authorised Users through the Platform, including employee personal data, organisational data, pay data, and HR records.

"Personal Data" has the meaning given to it in Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and applicable national data protection legislation.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates — in the context of this Platform, primarily the employees of the Subscriber.

"Processing" has the meaning given to it in GDPR.

"Service Level" means the availability and performance standards described in Schedule 1.

"Fees" means the subscription fees, add-on fees, and any other charges payable by the Subscriber as set out on the pricing page at https://prismclearpay.eu/pricing at the time of purchase.

"Confidential Information" means any information disclosed by one party to the other that is marked as confidential or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure.

"Intellectual Property Rights" means patents, rights to inventions, copyright and neighbouring rights, trade marks, trade names, domain names, rights in get-up, goodwill, rights in designs, rights in computer software, database rights, and all other intellectual property rights, whether registered or unregistered.

"Force Majeure Event" means any event beyond the reasonable control of the affected party, including but not limited to natural disasters, acts of government, war, terrorism, civil unrest, pandemic, widespread internet outages, or failures of third-party infrastructure providers.

ARTICLE 2 — ACCEPTANCE AND FORMATION OF CONTRACT

2.1 By clicking the acceptance button at the end of this Agreement, you confirm that:

(a) you have read and understood this entire Agreement;

(b) you have the legal authority to bind the company or organisation on whose behalf you are registering;

(c) the information you provide at registration is accurate, complete, and not misleading;

(d) you are at least 18 years of age;

(e) your use of the Platform will comply with all applicable laws and regulations in your jurisdiction.

2.2 If you are registering on behalf of a legal entity, you personally represent and warrant that you have the authority to bind that entity to this Agreement. If you do not have that authority, you must not accept this Agreement or create an account.

2.3 This Agreement takes effect on the date you click the acceptance button ("Effective Date") and constitutes the entire agreement between the parties with respect to the Platform, superseding all prior representations, negotiations, and understandings.

2.4 (a) MERAKI HR SRL may update the Platform and the documents listed in clause 2.5 to reflect new features, security needs, changes in law, or changes in its business. (b) Changes that do not materially reduce the Subscriber's rights, and changes required by law or a competent authority, take effect on publication or on the date required by law. (c) Any other change to the Product Terms, the Acceptable Use Policy, Schedule 1, Schedule 2 or Schedule 4 takes effect no earlier than 30 days after MERAKI HR SRL notifies the Subscriber by email and in the Platform. If the change materially reduces the Subscriber's rights, the Subscriber may terminate the affected Subscription by written notice before the change takes effect, and may request a refund of the prepaid Fees for the unused part of the term. The refund must be requested within 30 days after the termination takes effect, following the procedure in the Refund Policy (§7 How to Request a Refund) and naming the change concerned. Refunds are not calculated or issued automatically; requests are handled within the timelines in that procedure (through Link, where Link is merchant of record). (d) During a prepaid Subscription term, MERAKI HR SRL will not increase Fees, reduce the commitments in Article 11, reduce the data protection commitments in Article 6 or Schedule 3, move Subscriber Data outside the EEA without safeguards, or reduce the exit rights in Schedule 5. Such changes apply only from the next renewal, with at least 30 days' notice. (e) Where a change introduces or modifies a clause of the kind listed in Article 1203 of the Romanian Civil Code, it takes effect only after the Subscriber expressly accepts it in the Platform; until then the previous version applies. (f) MERAKI HR SRL keeps an archive of all versions of this Agreement, its Schedules and the Product Terms.

2.5 Documents that may change under clause 2.4: the Product Terms (https://merakihr.eu/legal/product-terms), the Acceptable Use Policy, and Schedules 1 to 5.

ARTICLE 3 — ACCOUNT REGISTRATION AND SECURITY

3.1 To access the Platform, you must create an account by providing accurate and complete information, including your company's legal name, fiscal identification number, registered country, and a valid work email address.

3.2 You are responsible for maintaining the confidentiality of your account credentials. You must immediately notify MERAKI HR SRL at merakihr.ro@gmail.com if you become aware of any unauthorised access to your account.

3.3 You are responsible for all activities that occur under your account, including all actions taken by Authorised Users you invite. You must ensure that all Authorised Users comply with this Agreement and are aware of their obligations under it.

3.4 You must not share your account credentials with anyone who is not an Authorised User. You must not create accounts for the purpose of circumventing subscription limits, accessing features not included in your Subscription, or any other fraudulent purpose.

3.5 MERAKI HR SRL reserves the right to suspend or terminate any account that it reasonably believes has been compromised, is being used fraudulently, or is in material breach of this Agreement, with or without notice depending on the severity of the breach.

3.6 Employee users. Before inviting employees, the Subscriber must provide its employee privacy notice in the Platform. The Subscriber is responsible for informing its employees about the use of the Platform, including any internal rules on electronic leave requests. Employee Terms of Use are presented to each employee at first login.

ARTICLE 4 — SUBSCRIPTION, FEES, AND BILLING

4.1 Subscription tiers and add-ons. The Platform is offered in subscription tiers as described on the pricing page at https://prismclearpay.eu/pricing. Each tier grants access to a defined set of features for a defined maximum number of employees. Additional feature modules may be purchased as add-ons at the prices listed on the pricing page.

4.2 Pricing. Fees are stated in EUR, exclusive of VAT. VAT is added where due. Romanian customers are invoiced and charged in RON, as required for payments between Romanian companies, through e-Factura. The RON amount equals the EUR price multiplied by the MERAKI conversion rate shown on the pricing page on the invoice date. MERAKI HR SRL sets and may update this rate; it is never more than 5% above the National Bank of Romania (BNR) EUR/RON rate published on the day the rate is set. A new rate applies to monthly plans from the next billing period; for annual plans and the ClearPay Module, the rate on the invoice date applies for the whole prepaid term. Any increase beyond this limit is a price change under clause 4.8. Amounts are shown on the pricing page; the version shown at purchase applies until renewal.

4.3 Billing cycle. Subscriptions are billed monthly or annually, as selected at registration. Annual subscriptions are billed in full at the start of each annual period.

4.4 Payment — Subscribers established in Romania. Payment is processed by Stripe Payments Europe Ltd, a third-party payment processor, with MERAKI HR SRL as seller. By providing payment details, you authorise MERAKI HR SRL to charge the applicable Fees to your designated payment method at the start of each billing period. MERAKI HR SRL issues the invoice and transmits it through e-Factura. You agree to Stripe's terms of service, available at stripe.com/legal.

4.5 Renewal. Subscriptions renew automatically at the end of each billing period unless cancelled before the renewal date. Annual subscriptions renew at the then-current annual price, subject to clause 4.8. You will receive an email reminder 14 days before any annual renewal.

4.6 Add-on cancellation. The ClearPay Module is governed by Schedule 2, which prevails over this clause 4.6 for the ClearPay Module, including as to commitment term, cancellation and early exit. Other Add-ons may be cancelled at any time. Cancellation takes effect at the end of the current billing period. Access to cancelled add-ons continues until the end of the period for which they have been paid. No refunds are issued for partial periods.

4.7 Employee count and tier upgrades. If your active employee count exceeds the maximum permitted by your current tier, you will be notified via a dashboard notification. The next applicable tier is charged from the first billing period that starts at least 14 days after the notification, unless the active employee count is back within the limit by then.

4.8 Price changes. Monthly plans: MERAKI HR SRL may change prices with 30 days' written notice; the new price applies from the first billing period after the notice period. Annual plans and the ClearPay Module: price changes apply only from the next renewal, with at least 30 days' written notice before the renewal date.

4.9 Late payment. If payment fails and is not resolved within 7 days of notification, MERAKI HR SRL reserves the right to downgrade your account to read-only access and, if payment remains outstanding after a further 14 days, to suspend your account entirely. MERAKI HR SRL is not liable for any consequences arising from account suspension due to non-payment. Restrictions for unpaid Fees never affect the Subscriber's right to export Subscriber Data. Non-payment for the ClearPay Module is governed by Schedule 2.

4.10 Refunds. Fees paid are non-refundable, including when the Subscriber cancels, terminates or exits a Subscription or Add-on before the end of its term. The only exceptions are: (a) a refund requested under clause 2.4(c); (b) termination without cause by MERAKI HR SRL under clause 9.3(c), with a pro-rata refund of prepaid Fees for the unused period; (c) discontinuation of the Platform under clause 9.8; and (d) a refund required by applicable law or by Link as merchant of record (clause 4.13).

4.11 Free trial. Each legal entity (one CUI/VAT ID) may use one 14-day free trial of a Core HR tier. No payment details are required. The ClearPay Module is not included in the trial. Trial data is deleted 30 days after the trial ends unless the Subscriber subscribes; the Subscriber may delete it at any time.

4.12 Data Restoration Fee. If the Subscriber asks to reactivate its workspace during the Cold Vault period (Article 9.5, days 31–180), a Data Restoration Fee of €150 (Micro, Start, Grow) or €250 (Scale, Pro), excluding VAT, is payable in advance, together with any outstanding Fees. A data extract without reactivation is free of charge. The fee never applies to data export during the Grace Period.

4.13 Seller of record outside Romania. For Subscribers established outside Romania, subscriptions and Add-ons (including the ClearPay Module) are sold through Link (Sold through Link, LLC, a Stripe company) as merchant of record. Link charges the Fees, may charge them in the Subscriber's local currency, collects and pays VAT, issues the invoice, and handles payment support, refunds and disputes under its own terms; clauses 4.2 and 4.4 do not apply to these sales. MERAKI HR SRL remains the provider of the Platform, and this Agreement governs its use. Link processes the payment data it collects as an independent controller. Where Link refunds a payment, access ends at the end of the refunded period. If Link cancels a subscription following a data deletion request, the Subscriber's data remains subject to Article 9.5.

ARTICLE 5 — PERMITTED USE AND RESTRICTIONS

5.1 Permitted use. Subject to the terms of this Agreement and payment of the applicable Fees, MERAKI HR SRL grants you a non-exclusive, non-transferable, licence, revocable only as set out in this Agreement, to access and use the Platform during the term of your Subscription solely for your internal HR management and compliance purposes.

5.2 Restrictions. You must not:

(a) sublicense, resell, rent, lease, transfer, or assign access to the Platform to any third party without the prior written consent of MERAKI HR SRL;

(b) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Platform;

(c) use the Platform to develop a competing product or service;

(d) use the Platform to process Personal Data beyond what is necessary for legitimate employment management purposes;

(e) introduce malware, viruses, or any other harmful code to the Platform;

(f) use automated scripts or tools to access the Platform in a manner that places an unreasonable burden on its infrastructure;

(g) circumvent, disable, or interfere with any security features of the Platform;

(h) use the Platform to process Personal Data of individuals who are not current, former, or prospective employees, workers, contractors, or job candidates of your organisation;

(i) use the Platform in any manner that violates applicable law, including but not limited to employment law, data protection law, and anti-discrimination law.

5.3 Acceptable conduct. You are solely responsible for ensuring that your use of the Platform, and the use by your Authorised Users, complies with all applicable laws and regulations in your jurisdiction, including employment law, data protection law, and pay equity legislation.

5.A Acceptable Use Policy. The MERAKI HR Acceptable Use Policy, available at https://merakihr.eu/acceptable-use, is incorporated into this Agreement by reference and applies to the Subscriber and all Authorised Users. MERAKI HR SRL will notify Subscribers by email of material changes to the Acceptable Use Policy in accordance with clause 2.4.

5.B Other policies. The Product Terms (https://merakihr.eu/legal/product-terms), the Refund & Return Policy (https://merakihr.eu/refund-policy) and the Disclaimer (https://merakihr.eu/disclaimer) are incorporated into this Agreement by reference. The Privacy Policy (https://merakihr.eu/privacy) and Cookie Policy (https://merakihr.eu/cookies) are information notices. Where any of these conflicts with this Agreement, this Agreement prevails.

ARTICLE 6 — DATA PROTECTION AND PROCESSING

6.1 Roles under GDPR. The parties acknowledge and agree that:

(a) the Subscriber is the data controller in respect of all Personal Data of its employees and other data subjects entered into or processed through the Platform;

(b) MERAKI HR SRL is the data processor acting on the instructions of the Subscriber in respect of such Personal Data;

(c) this Article 6, together with Schedule 3 (Data Processing Agreement), constitutes the data processing agreement required by Article 28 GDPR.

6.2 Subscriber obligations as data controller. The Subscriber represents, warrants, and undertakes that:

(a) it has a lawful basis under GDPR Article 6 (and where applicable Article 9) for all Personal Data entered into the Platform;

(b) it has provided all required notices and obtained all required consents from data subjects prior to entering their Personal Data into the Platform;

(c) it will respond to data subject rights requests (access, rectification, erasure, portability, objection) in accordance with applicable law, using the data export and deletion tools provided by the Platform where available;

(d) it will not enter special categories of Personal Data under Article 9 GDPR, except health data strictly necessary to record sick leave and medical certificates under employment law (Article 9(2)(b) GDPR), with appropriate safeguards;

(e) it will maintain accurate records of processing activities as required by GDPR Article 30 and will include MERAKI HR SRL as a processor in those records.

6.3 MERAKI HR SRL obligations as data processor. MERAKI HR SRL undertakes to:

(a) process Personal Data only on documented instructions from the Subscriber, as set out in this Agreement and as configured through the Platform's features and settings;

(b) ensure that all MERAKI HR SRL personnel authorised to process Personal Data are bound by appropriate confidentiality obligations;

(c) implement and maintain technical and organisational security measures appropriate to the risk, as described in Schedule 3;

(d) the Subscriber gives general written authorisation for the sub-processors in Schedule 4. MERAKI HR SRL imposes on each sub-processor data protection obligations at least as protective as this Article, gives 30 days' notice of any addition or replacement — during which the Subscriber may object by terminating the affected Subscription under clause 2.4(c), with a refund available only on written request as set out there. The new sub-processor may be used once the 30-day notice period has passed. MERAKI HR SRL remains fully liable to the Subscriber for the performance of its sub-processors;

(e) assist the Subscriber in meeting its obligations with respect to data subject rights and security incidents, using the tools and processes built into the Platform;

(f) upon termination of this Agreement, delete or return all Subscriber Data as set out in Article 9;

(g) make available all information necessary to demonstrate compliance with this Article and permit audits by the Subscriber or a mandated auditor, at the Subscriber's cost and upon reasonable notice.

(h) inform the Subscriber immediately if, in its opinion, an instruction infringes data protection law;

(i) assist the Subscriber with data protection impact assessments and prior consultations, taking into account the information available to it.

6.4 Data transfers. Subscriber Data is stored on servers located in the European Union (EU), except for transactional email data (such as recipient details and message content), which is processed and stored by Resend, Inc. in the USA under Standard Contractual Clauses, as listed in Schedule 4. MERAKI HR SRL will not otherwise transfer Subscriber Data outside the European Economic Area without adequate safeguards as required by GDPR Chapter V.

6.5 Security incidents. MERAKI HR SRL will notify the Subscriber without undue delay, and in any event within 48 hours of becoming aware, of any personal data breach affecting Subscriber Data, providing sufficient information to enable the Subscriber to meet its own notification obligations under GDPR Article 33 and Article 34.

6.6 Data accuracy. The Subscriber is solely responsible for the accuracy, completeness, and legality of all Subscriber Data entered into the Platform. MERAKI HR SRL does not verify, audit, or validate the accuracy of Subscriber Data. The Platform performs calculations and generates outputs based on the data provided — the quality of outputs is directly dependent on the quality of inputs. MERAKI HR SRL is not liable for any consequences arising from inaccurate, incomplete, or unlawfully obtained Subscriber Data.

ARTICLE 7 — DIAGNOSTIC FEATURES AND LIMITATIONS

7.1 Nature of diagnostic features. The diagnostic features of the Platform, including the ClearPay Module, are informational and operational tools designed to assist the Subscriber in managing its compliance obligations. They are not legal advice. They do not constitute a guarantee of compliance with any applicable law, regulation, or regulatory guidance.

7.2 Not a substitute for professional advice. The Subscriber acknowledges that:

(a) employment law, data protection law, and pay equity legislation vary by jurisdiction and change over time;

(b) the Platform's diagnostic features are designed around the EU Pay Transparency Directive (2023/970) and its national transpositions as understood at the time of the Platform's development;

(c) the Subscriber is solely responsible for ensuring its compliance with all applicable laws in its jurisdiction and must seek independent legal advice for its specific situation;

(d) outputs generated by the Platform, including pay gap reports, diagnostic checklists, and, once available, AI-generated narrative content, are not legal opinions and should not be relied upon as such without independent legal review.

7.3 Legislative changes. MERAKI HR SRL will make reasonable efforts to update the Platform's diagnostic features to reflect changes in applicable legislation. However, MERAKI HR SRL does not warrant that the Platform will at all times reflect the most current state of the law in all supported jurisdictions, and is not liable for any compliance failures arising from legislative changes that have not yet been incorporated into the Platform.

7.4 AI-generated content. Where the Platform provides AI-generated content, the Subscriber acknowledges that:

(a) AI-generated content may contain errors, omissions, or inaccuracies;

(b) all AI-generated content is clearly labelled as such within the Platform;

(c) AI-generated content must be reviewed by a qualified person before being relied upon for any legal, compliance, or employment decision;

(d) MERAKI HR SRL is not liable for any consequences arising from reliance on AI-generated content without appropriate human review.

7.5 Report generation and submission. Where the Subscriber uses the Platform to generate pay equity reports for submission to regulatory authorities, the Subscriber is solely responsible for:

(a) verifying the accuracy and completeness of all data underlying the report;

(b) confirming that the report meets all requirements of the applicable national authority;

(c) the act of submission and any consequences thereof.

The data stewardship confirmation required within the Platform before report generation does not transfer any liability from the Subscriber to MERAKI HR SRL — it records the Subscriber's acknowledgment of their own responsibility.

ARTICLE 8 — INTELLECTUAL PROPERTY

8.1 Platform ownership. MERAKI HR SRL retains all Intellectual Property Rights in the Platform, including its software, design, algorithms, compliance logic, report templates, and documentation. Nothing in this Agreement transfers any Intellectual Property Rights in the Platform to the Subscriber.

8.2 Subscriber Data ownership. The Subscriber retains all rights in Subscriber Data. By using the Platform, the Subscriber grants MERAKI HR SRL a limited, non-exclusive licence to process Subscriber Data solely for the purpose of providing the Platform services as described in this Agreement.

8.3 Aggregated data. As instructed by the Subscriber through acceptance of this Agreement, MERAKI HR SRL may create aggregated statistics from Subscriber Data to improve the Platform and produce benchmarks. Statistics are built only from groups of at least 5 individuals and at least 5 Subscribers, never identify any individual or Subscriber, and are never published for a single company. Pay benchmarks use only data at least 3 months old, and no single Subscriber may account for more than 25% of any statistic. The Subscriber may opt out at any time in the Platform settings.

8.4 Feedback. If the Subscriber provides feedback, suggestions, or ideas relating to the Platform, MERAKI HR SRL may freely use such feedback without restriction or compensation to the Subscriber.

ARTICLE 9 — TERM, TERMINATION, AND DATA RETENTION

9.1 Term. This Agreement commences on the Effective Date and continues until terminated in accordance with this Article.

9.2 Termination by the Subscriber. The Subscriber may terminate this Agreement at any time by cancelling the Subscription through the Platform's billing settings. Cancellation takes effect at the end of the current billing period. Access to the Platform continues until the end of the paid period.

9.3 Termination by MERAKI HR SRL. MERAKI HR SRL may terminate this Agreement:

(a) immediately, by written notice, if the Subscriber materially breaches this Agreement and fails to remedy the breach within 14 days of written notice;

(b) immediately, without notice, if the Subscriber is in breach of Article 5.2, Article 6.2, or if MERAKI HR SRL reasonably believes the Platform is being used for unlawful purposes;

(c) by giving 30 days' written notice, for any reason, in which case MERAKI HR SRL will provide a pro-rata refund of any prepaid Fees for the unused period.

9.4 In-app archival during active subscription. While the Subscriber maintains an active paid Subscription, Subscriber Data is never deleted without an explicit authorised action. The Platform operates a two-tier Active / Archived model:

(a) Current employees and active contracts remain in standard active views throughout employment. Upon contract termination they are automatically moved to the Archived Register and are accessible via the "Include Archived" toggle.

(b) Leavers, closed contracts, and related decisions are retained in standard views for five (5) years from the date of archival by default; the Subscriber, as controller, may set a different period, after which they may be permanently deleted by an authorised HR Admin or Super Admin with a recorded reason. The Subscriber is responsible for setting retention periods that meet its statutory obligations (for example, for payroll records).

(c) Leave records and timesheets are retained for three (3) years from archival, after which they may be hard-purged on authorised request.

(d) Performance reviews and goals are retained for three (3) years from archival, after which they may be hard-purged on authorised request.

(e) Change history (audit log) is retained for five (5) years in a read-only, tamper-proof log; security and login logs for twelve (12) months. They may not be selectively edited and are purged only as stated here, on full company exit, or on a verified GDPR erasure request.

(f) Hard purge on GDPR request: Any Subscriber Data category may be permanently deleted at any time on a verified request submitted by an authorised HR Admin or Super Admin (e.g. to fulfil a Data Subject erasure request under GDPR Article 17). All hard purges are recorded in the audit log with the requesting user's identity and stated reason.

(g) HR Handover Notice: When records are archived, the Platform displays a prominent status notice identifying the number and type of archived records, so that successor HR staff are immediately aware of the archive and do not assume records are missing.

9.5 Effect of subscription termination — post-cancellation data lifecycle. Upon termination of the Subscription, the following three-phase lifecycle applies:

Phase 1 — Days 0 to 30: Active Grace and Export Period

(a) All Subscription rights and licences terminate at the end of the final paid billing period.

(b) The Subscriber retains standard read and export access for thirty (30) calendar days from the termination date ("Grace Period").

(c) During the Grace Period, the Subscriber may download their complete company data archive using the Platform's self-service export tools (Employee register, Contract histories, Leave records, Performance reports, Audit log).

(d) The Platform displays a prominent warning banner throughout the Grace Period: "Your subscription has ended. Please download your complete company archive before the date shown in the banner. After that date, active access will be suspended."

(e) Unpaid Fees do not affect the Subscriber's right to export Subscriber Data during the Grace Period. MERAKI HR SRL may restrict all other Platform access until outstanding Fees are paid, and may recover them through legal channels.

(e1) Before the end of the Grace Period the Subscriber may choose, in the export area of the Platform, either permanent deletion or the Cold Vault period below. Permanent deletion may be chosen at any time during the Grace Period, after an on-screen warning and confirmation with an MFA code; the choice is timestamped and deletion runs after 23:59 Europe/Bucharest time on calendar day 30 counted from the subscription termination date (day 0), so export access continues until then. If the Subscriber makes no choice by the last day of the Grace Period, the Cold Vault period applies, and the Subscriber confirms that this is its documented instruction to MERAKI HR SRL as processor under clause 6.3(a). During the Cold Vault period the Subscriber may at any time request immediate permanent deletion by email to merakihr.ro@gmail.com. Do not send employee personal data by email; use the Platform’s tools. MERAKI HR SRL will use reasonable efforts to act on a verified request within five (5) business days.

Phase 2 — Days 31 to 180: Cold Vault

(f) On Day 31 post-termination, active workspace access is suspended. All team logins, employee self-service portals, and public-facing URLs associated with the account are disabled.

(g) All Subscriber Data — including database records, audit logs, and configuration — is frozen, encrypted, and isolated in secure cold storage in the European Union (EU) for one hundred and fifty (150) further calendar days.

(h) During the Cold Vault period the Subscriber may request a free data extract, or reactivate its workspace on payment of outstanding Fees and the Data Restoration Fee in Article 4.12. MERAKI HR SRL will use reasonable efforts to act within five (5) business days.

(i) The Cold Vault period provides the Subscriber with a five-month safety net in the event of an unexpected audit, regulatory inquiry, or change of decision.

Phase 3 — Day 181 onwards: Permanent Hard Purge

(j) On Day 181 post-termination, all Subscriber Data is irrevocably and permanently deleted from all PRISM CORE HR production systems and isolated storage environments by automated CASCADE DELETE of all tenant records, employee data, audit logs, and configuration.

(k) Backup copies, including encrypted offline copies, are deleted within 30 days. After that, data recovery is technically impossible.

(l) MERAKI HR SRL automatically sends the Subscriber a Data Destruction Certificate after permanent deletion.

9.6 Survival. Articles 1, 6.6, 7, 8, 9.5, 9.9, 10, 11, 12, and 13 survive termination of this Agreement. Article 6 and Schedule 3 survive for as long as MERAKI HR SRL holds any Subscriber Data.

9.7 Diagnostic Questionnaire data. Data submitted through the Prism ClearPay Diagnostic Questionnaire is subject to a separate retention policy: data is retained for 12 months from the date of submission and then permanently deleted, unless the Subscriber has created a Platform account linked to that questionnaire submission.

9.8 Discontinuation. If MERAKI HR SRL decides to stop providing the Platform, it will give Subscribers at least 90 days' notice, keep the export tools available free of charge during that period, refund prepaid Fees for any period after the service ends, and delete Subscriber Data with a Data Destruction Certificate.

9.9 MERAKI HR SRL's own records. Records of acceptance of this Agreement, billing and payment records, and correspondence with the Subscriber (excluding any Subscriber Data it contains) are MERAKI HR SRL's own records, kept as evidence of the contract and for its legal obligations; they are not Subscriber Data and are not deleted under Article 9.5. They are kept for five (5) years after the Subscription ends, or after the free trial ends where no Subscription followed; invoices and accounting records are kept for the period required by accounting law. After that period, only the CUI/VAT ID and the dates of any free trial are kept, to apply the one-trial rule in clause 4.11, for as long as free trials are offered. Records subject to an open dispute, claim or inspection are kept until it is closed.

ARTICLE 10 — WARRANTIES AND DISCLAIMERS

10.1 Subscriber warranties. The Subscriber represents and warrants that:

(a) it has the full legal right, power, and authority to enter into this Agreement;

(b) its use of the Platform will comply with all applicable laws and regulations;

(c) it will use the Platform only for lawful HR management and compliance purposes;

(d) all information provided at registration and during use of the Platform is accurate and not misleading.

10.2 MERAKI HR SRL warranties. MERAKI HR SRL warrants that:

(a) it will use reasonable skill and care in providing the Platform;

(b) the Platform will be available in accordance with the Service Level described in Schedule 1;

(c) it will maintain appropriate security measures to protect Subscriber Data.

10.3 Disclaimer. EXCEPT AS EXPRESSLY SET OUT IN ARTICLE 10.2, THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE." MERAKI HR SRL MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. MERAKI HR SRL DOES NOT WARRANT THAT THE PLATFORM WILL BE ERROR-FREE, UNINTERRUPTED, OR FREE FROM VULNERABILITIES.

ARTICLE 11 — LIMITATION OF LIABILITY

11.1 Neither party's liability to the other is limited for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any liability that cannot be excluded or limited by applicable Romanian law; (d) intent or gross negligence.

11.2 Exclusion of consequential loss. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MERAKI HR SRL SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA (EXCEPT WHERE CAUSED BY MERAKI HR SRL'S INTENT, GROSS NEGLIGENCE OR BREACH OF THE SECURITY MEASURES IN SCHEDULE 3), LOSS OF GOODWILL, REGULATORY FINES, PENALTIES, OR SANCTIONS, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE PLATFORM, EVEN IF MERAKI HR SRL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

11.3 Cap on liability. MERAKI HR SRL's total aggregate liability to the Subscriber arising out of or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed the total Fees paid or payable by the Subscriber for the Platform (including Fees collected by Link under clause 4.13) in the 3 months (Micro, Start, Grow) or 6 months (Scale, Pro) immediately preceding the event giving rise to the claim.

11.4 Specific exclusions. Subject to Article 11.1 and without limiting the generality of Article 11.2, MERAKI HR SRL is not liable for:

(a) any inaccuracy in outputs resulting from inaccurate, incomplete, or unlawfully obtained data entered by the Subscriber;

(b) any compliance failure resulting from legislative changes not yet reflected in the Platform;

(c) any decision made by the Subscriber based on Platform outputs without independent legal review;

(d) any regulatory fine, penalty, or enforcement action taken against the Subscriber;

(e) any employment dispute, discrimination claim, or legal proceedings arising from the Subscriber's HR practices, whether or not the Platform was used in connection with those practices;

(f) any loss arising from the Subscriber's failure to export data before the expiry of the 30-day Grace Period described in Article 9.5(b);

(g) any loss arising from Force Majeure Events.

11.5 Mitigation. Each party has a duty to take reasonable steps to mitigate any loss it suffers.

11.6 Indemnity. The Subscriber will indemnify MERAKI HR SRL against third-party claims, fines and reasonable costs arising from Personal Data the Subscriber entered without a lawful basis or required notice, or from the Subscriber's unlawful instructions.

ARTICLE 12 — CONFIDENTIALITY

12.1 Each party agrees to keep the other party's Confidential Information confidential and not to disclose it to any third party without prior written consent, except as required by law or as necessary to perform obligations under this Agreement.

12.2 Confidential Information does not include information that: (a) is or becomes publicly available other than through breach of this Agreement; (b) was already known to the receiving party; (c) is independently developed by the receiving party without use of the Confidential Information.

12.3 MERAKI HR SRL's personnel who have access to Subscriber Data are bound by confidentiality obligations at least as protective as those in this Article.

12.4 These obligations continue for 2 years after termination. Obligations relating to Personal Data and trade secrets continue for as long as the information remains personal data or secret.

ARTICLE 13 — GENERAL

13.1 Governing law. This Agreement is governed by the laws of Romania, without regard to its conflict of law provisions.

13.2 Jurisdiction. Any dispute arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the courts of Bucharest, Romania. The parties irrevocably submit to the jurisdiction of those courts.

13.3 Entire agreement. This Agreement, together with its Schedules, constitutes the entire agreement between the parties regarding the Platform and supersedes all prior representations, negotiations, understandings, and agreements.

13.4 Severability. If any provision of this Agreement is found to be invalid, illegal, or unenforceable, the remaining provisions continue in full force and effect. The invalid provision shall be modified to the minimum extent necessary to make it enforceable.

13.5 Waiver. No failure or delay by either party in exercising any right under this Agreement constitutes a waiver of that right.

13.6 Assignment. The Subscriber may not assign, transfer, or subcontract any of its rights or obligations under this Agreement without the prior written consent of MERAKI HR SRL. MERAKI HR SRL may assign this Agreement to an affiliate or in connection with a merger, acquisition, or sale of all or substantially all of its assets, with 30 days' notice to the Subscriber.

13.7 Notices. Notices under this Agreement shall be given by email. Notices to MERAKI HR SRL shall be sent to merakihr.ro@gmail.com. Notices to the Subscriber shall be sent to the email address registered to their account. Notices take effect on the business day following sending.

13.8 No partnership or agency. Nothing in this Agreement creates a partnership, joint venture, employment, or agency relationship between the parties.

13.9 Language. This Agreement is made available in Romanian and English. For Subscribers registered in Romania, the Romanian version prevails in the event of conflict; for all other Subscribers, the English version prevails.

13.10 Force Majeure. Neither party is liable for any delay or failure to perform its obligations under this Agreement to the extent caused by a Force Majeure Event, provided that the affected party: (a) notifies the other party promptly; (b) takes reasonable steps to minimise the impact; and (c) resumes performance as soon as reasonably practicable.

SCHEDULE 1 — SERVICE LEVEL AGREEMENT

Availability target: MERAKI HR SRL will use commercially reasonable efforts to ensure the Platform is available 99% of the time in any calendar month, excluding:

• Scheduled maintenance (notified at least 24 hours in advance by in-app notification or email)

• Force Majeure Events

• Outages caused by the Subscriber's own systems or actions

• Outages caused by third-party infrastructure providers (Supabase, Amazon Web Services, Stripe, Resend, Lovable) outside MERAKI HR SRL's reasonable control

Remedies: If monthly availability falls below 99% (excluding notified maintenance, Force Majeure and the listed third-party outages), the Subscriber may claim, within 30 days of month end, a service credit of 5% of that month's Fee per full percentage point below 99%, up to 15%. Credits apply to the next invoice, are not paid in cash, (for Subscriptions sold through Link, the credit is given as an equivalent extension of the paid period) and are the Subscriber's sole remedy for unavailability.

Support: MERAKI HR SRL provides email support at merakihr.ro@gmail.com. Do not send employee personal data by email; use the Platform’s tools. Response time target: within 2 business days for standard queries, within 1 business day for issues affecting core functionality.

SCHEDULE 2 — CLEARPAY MODULE — ADDITIONAL TERMS

These additional terms apply where the Subscriber has activated the ClearPay Module.

S2.1 The ClearPay Module assists the Subscriber in managing obligations under the EU Pay Transparency Directive (2023/970) and applicable national transposition legislation. It is an operational tool — not a compliance guarantee and not a substitute for legal advice.

S2.2 The Subscriber acknowledges that:

(a) compliance with pay transparency legislation is the Subscriber's sole legal responsibility;

(b) the Platform's pay equity calculations are based on data entered by the Subscriber — the accuracy of outputs depends entirely on the accuracy of inputs;

(c) the Subscriber must review all generated reports with a qualified employment lawyer before submission to any regulatory authority;

(d) the Subscriber's electronic confirmation before each report generation constitutes a binding acknowledgment of responsibility for the data and the output.

S2.3 MERAKI HR SRL will use reasonable efforts to keep the ClearPay Module updated to reflect changes in applicable national legislation. The Subscriber accepts that there may be a delay between a legislative change and its incorporation into the Platform.

S2.4 ClearPay is available on Scale and Pro tiers and is activated in the Platform when the Subscriber expressly accepts the commitment term at checkout, for a commitment of 3, 6 or 12 months. The Fee for the full committed term (3, 6 or 12 months) is paid in full, in advance, at the start of the term. Paid Fees are non-refundable, except as set out in clause 4.10. Outside Romania, ClearPay is purchased through Stripe Checkout with Link as merchant of record (clause 4.13). Prices and discounts are shown on the pricing page.

S2.5 Early exit. The Subscriber may end a ClearPay commitment before its term on up to two months' written notice. Access then ends at the end of the notice period, and no refund is given for the unused part of the prepaid term (clause 4.10). No other early-termination fee applies. Data export rights under Schedule 5 are unaffected.

S2.6 Intended purpose. ClearPay provides analytical, explanatory outputs on pay structures. It does not recommend or make decisions about recruitment, pay, promotion, performance or termination of any individual. All outputs must be reviewed by the Subscriber before use.

S2.7 Failed payment. If payment for a new or renewed prepaid term fails, generation of new ClearPay analyses and reports is suspended immediately until payment. Reports already generated and all data export remain available.

SCHEDULE 3 — DATA PROCESSING AGREEMENT

This Schedule sets out the specific terms required by GDPR Article 28 for the processing of Personal Data by MERAKI HR SRL on behalf of the Subscriber.

Subject matter: The provision of the Prism Core HR platform and associated services.

Duration: For the term of the Agreement plus the Grace Period, plus the Cold Vault period if chosen, plus up to 30 days until backup copies, including encrypted offline copies, are deleted.

Nature and purpose of processing: Storage, organisation, calculation, reporting, and display of employee HR data for the purpose of HR management and compliance.

Type of Personal Data: Name, contact details, date of birth, nationality, employment details, contract terms, salary and pay data, gender, leave records, performance ratings, sick-leave and medical certificate data (health data, Article 9(2)(b) GDPR); system-generated unique IDs and/or identifiers assigned by the employer; COR/ISCO occupation codes; pay-clarity requests and responses (ClearPay); and any other Personal Data entered by the Subscriber.

Categories of Data Subjects: Current, former and prospective employees, workers and contractors, and job candidates of the Subscriber.

Retention: As set out in Articles 9.4 and 9.5.

Technical and organisational security measures:

• Data stored in the European Union (EU), on infrastructure from providers certified to ISO/IEC 27001 and holding SOC 2 Type II reports (Lovable, Supabase, Amazon Web Services), except transactional email data (see clause 6.4).

• Encryption at rest (AES-256) and in transit (TLS 1.2+)

• Row-level security policies restricting data access to the Subscriber's own company account

• MFA is mandatory for Super Admin, HR Admin and Manager accounts. HR Admin may require MFA for all other users. The Subscriber is responsible for the security settings it chooses for its Authorised Users.

• Daily automated backups

• Access logging and audit trails

• AI processing (future feature, not yet available): when released, AI-generated narratives will be produced through Lovable AB's AI gateway, using EU-hosted models (Google Cloud Vertex AI, AWS Bedrock or Microsoft Azure AI Foundry, EU regions). Only aggregated group statistics are sent. Groups of fewer than 5 people are suppressed; no names, identifiers or individual salaries are sent. Data is not used to train AI models.

SCHEDULE 4 — SUB-PROCESSOR LIST

MERAKI HR SRL uses the following sub-processors to provide the Platform. Stripe Payments Europe Ltd and Link act as independent controllers for payment data and are listed for transparency; they do not process Subscriber Data. All sub-processors are bound by data processing agreements at least as protective as this Agreement.

Supabase, Inc. and Amazon Web Services are US companies; Subscriber Data stays hosted in the EU, and any access from outside the EEA is covered by Standard Contractual Clauses in their data processing agreements.

MERAKI HR SRL will maintain an up-to-date version of this list at https://merakihr.eu and will notify Subscribers of any changes with 30 days' notice. Lovable's AI sub-processors are listed at https://trust.lovable.dev/subprocessors.

SCHEDULE 5 — SWITCHING AND EXIT

S5.1 The Subscriber may switch to another provider or to its own systems at any time, on up to two months' notice.

S5.2 Exportable data: employee register, contracts and contract history, leave records and timesheets, performance records, ClearPay analyses and reports, change history (audit log) and configuration, in CSV/JSON and, where applicable, PDF.

S5.3 Data can be retrieved free of charge for at least 30 days after termination (the Grace Period), regardless of any outstanding Fees.

S5.4 MERAKI HR SRL will reasonably assist the switch and keep the service available during a transition of up to 30 days.

S5.5 After the retrieval period, and any Cold Vault period chosen, all Subscriber Data is erased as set out in Article 9.5 and a Data Destruction Certificate is sent.

S5.6 No switching or data-extraction charges apply. The Data Restoration Fee applies only to reactivating a workspace.

S5.7 The Agreement terminates, and MERAKI HR SRL confirms this by email, when the switch is completed or, where the Subscriber does not wish to switch but to have its data erased, at the end of the notice period.

S5.8 No data or digital assets are excluded from export. During the switch MERAKI HR SRL will inform the Subscriber of any known risk to continuity of service and support its exit plan with all relevant information.

ACCEPTANCE

A. Express acceptance of specific clauses (Article 1203 of the Romanian Civil Code)

Some clauses of this Agreement are standard terms prepared in advance by MERAKI HR SRL. They are effective against you only if you accept them expressly. Please read them and tick the box below. The Agreement cannot be accepted until the box is ticked.

• Limitation and exclusion of liability: clauses 4.9 (no liability for suspension for non-payment), 6.6, 7.3, 7.4(d), 7.5, 10.3, 11.2, 11.3, 11.4 and 11.6, and Schedule 1 (service credits as sole remedy).

• Right of MERAKI HR SRL to terminate or suspend performance unilaterally: clauses 3.5, 4.9, 9.3, 9.5(e) and S2.7.

• Automatic renewal, price changes, non-refundable Fees and commitment terms: clauses 4.5, 4.6, 4.7, 4.8, 4.10, 4.12, S2.4 and S2.5 (commitment period, upfront payment, no refund on early exit).

• Time limits and loss of rights: clauses 2.4(c) (30-day deadline to request a refund), 9.5 (30-day export period, Cold Vault and permanent deletion on Day 181), 11.4(f) and Schedule 1 (service credit claims within 30 days).

• Unilateral changes to this Agreement and the documents incorporated in it: clauses 2.4, 2.5, 5.A and 5.B.

• Restrictions on your rights and on contracting with others: clauses 5.2(a), 5.2(c) and 13.6.

• Governing law and exclusive jurisdiction of the courts of Bucharest: clauses 13.1 and 13.2.

☐ I have read and I expressly accept each of the clauses listed above (Article 1203 of the Romanian Civil Code).

B. Confirmations

By clicking "I have read, understood, and accept this Agreement," you:

1. Confirm that you have scrolled through and read this entire Agreement.

2. Confirm that you have the authority to bind the company named in your registration.

3. Enter into a legally binding contract with MERAKI HR SRL on the terms set out above.

4. Acknowledge that this electronic acceptance is a valid expression of your consent and that its legal effect cannot be denied solely because it is in electronic form, under Romanian law (Law No. 214/2024 on the use of electronic signatures) and EU law (eIDAS Regulation 910/2014/EU), and that MERAKI HR SRL records it as evidence.

Company name: [company name entered at registration]

Accepted by: [full name entered at registration]

Date and time: [UTC timestamp recorded at acceptance]

IP address: Recorded on acceptance (retained as evidence)

Previous versions are kept in the version archive at https://prismclearpay.eu/agreement/versions.