SPECIFIC TERMS IN THIS EXHIBIT HAVE BEEN REDACTED BECAUSE SUCH TERMS ARE NOT MATERIAL AND WOULD BE COMPETITIVELY HARMFUL IF PUBLICLY DISCLOSED. SUCH TERMS HAVE BEEN MARKED AT THE APPROPRIATE PLACE WITH THREE ASTERISKS (***)

(1)

SWIVEL SECURE LIMITED a company incorporated in England with company number 04068905 whose registered office is at ▇▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇, ▇▇▇▇ ▇▇▇ ("Swivel"); and

(2)

SWIVEL SECURE EUROPE S.A., a company incorporated under the laws of Spain (Company No. ES A87886347) with its principal place of business at Av. ▇▇▇▇ ▇▇▇▇▇▇ I, n°13 - 12° planta (Torre Garena), ▇▇▇▇▇▇ ▇▇ ▇▇▇▇▇▇▇, ▇▇▇▇▇ ▇▇▇▇▇▇, ▇▇▇▇▇ ("SSE") (the "Distributor")

1.

DEFINITIONS

1.1

In this Agreement the following expressions have the following meanings:

1.2

In interpreting this Agreement:

1.2.1

references to clauses and schedules are to Clauses and schedules of this Agreement unless stated otherwise;

1.2.2

references to the singular include the plural and vice versa and references to a gender include both genders;

1.2.3

references to a "person" include an individual, firm, unincorporated association or body corporate;

1.2.4

the headings to this Agreement shall be ignored;

1.2.5

where reference is made to a statutory provision this includes all prior and subsequent enactments, amendments and modifications relating to that provision and any regulations made under it;

1.2.6

general words introduced by the word "other" shall not be given a restrictive meaning because they are preceded by words indicating a particular class of acts, matters or things; and

1.2.7

general words shall not be given a restrictive meaning because they are followed by particular examples intended to be embraced by the general words.

2.

APPOINTMENT

2.1

Swivel appoints the Distributor and the Distributor agrees to serve Swivel as its non­ exclusive distributor of the Products within the Territory. Swivel grants to the Distributor the non-exclusive right, for the Term, to market, sell and distribute the Products in the Territory. On the Commencement Date, the Distributor shall, unless otherwise agreed by Swivel in writing, pay to Swivel the accreditation fee of Swivel.

2.2

This Agreement will start on the Commencement Date and, subject always to the provisions for earlier termination contained in this Agreement, shall continue in force for an initial term of one year and shall automatically continue in force for further terms of one year commencing on the anniversary of the Commencement Date unless either Party has given to the other written notice that it does not wish the Agreement to continue beyond the end of the then current term of one year no later than 30 days before the end of such term.

2.3

Swivel reserves the right at its sole discretion upon at least 30 days' notice to:

2.3.1

add new products to schedule 1 by providing to the Distributor a copy of schedule 1 reflecting such additions or other changes; and

2.3.2

modify, alter, improve or change any or all of the Products by amending schedule 1 to reflect such changes.

2.4

The Distributor hereby acknowledges and agrees that Swivel has the right at all times in the Territory to itself market, sell, distribute and otherwise deal in any manner whatsoever in or with the Products and all other of its products.

2.5

Subject to the other provisions of this Agreement Swivel shall supply the Distributor with such Products as the Distributor shall order in accordance with the provisions of this Agreement.

3.

PROVISIONS RELATING TO THE TRADE MARKS AND INTELLECTUAL PROPERTY RIGHTS

3.1

Swivel grants to the Distributor the right to use the Trade Marks in marketing, promoting and selling Products provided that, when using the Trade Marks, the Distributor shall comply with the following conditions:

3.1.1

the Distributor shall use the appropriate Trade Marks in referring to a Product in any advertisement or publication or in the use, marketing, distribution or sale of the Products;

3.1.2

the Distributor shall follow the directions of Swivel concerning the presentation and manner of use of the Trade Marks including directions concerning the representation of marks as registered;

3.1.3

all goodwill generated in any Trade ▇▇▇▇ by virtue of the Distributor's use shall be deemed to accrue to Swivel and the Distributor shall if so requested execute appropriate documents to transfer the goodwill to Swivel and shall upon termination of this Agreement cease to use the Trade Marks and to refer to itself as associated with Swivel in any way;

3.1.4

the Trade Marks shall not be used in association with any products other than the Products;

3.1.5

the Distributor shall not act in any manner which may cause the Trade Marks to be adversely affected or come into disrepute or lose goodwill;

3.1.6

the Distributor shall use the Trade Marks in accordance with and as set out in any brand manual supplied by Swivel.

3.2

The Distributor shall not alter or remove any copyright notices or other proprietary notices in or on the Products.

3.3

The Distributor acknowledges and agrees that at all times Swivel shall own the originals and all copies of the Products, all improvements, adaptations, updates and other modifications howsoever made to the Products and all Intellectual Property Rights relating to the Products and the Distributor shall not acquire any rights of any kind in relation thereto.

3.4

If requested and at Swivel's expense, the Distributor shall execute all documents and do all further acts and things requested by Swivel in any relevant country within the Territory to protect, record and enforce Swivel's Intellectual Property Rights in the Products.

3.5

The Distributor shall not copy, modify, alter, enhance, decompile, disassemble, or reverse engineer the Products.

3.6

The Distributor agrees that it shall not contest the validity of any Intellectual Property Rights of Swivel nor their applicability to the Products. In the event that the Distributor breaches this condition then Swivel may at its discretion terminate this Agreement forthwith.

3.7

In the event of any infringement of any third party's intellectual property rights Swivel at its option, shall be entitled to replace the relevant Product or any infringing part thereof with a compatible, functionally equivalent and non-infringing product, or to modify such Product or take any other action so that it becomes non-infringing. Should such option not be reasonably available within 30 days of the notification of the proven infringement to Swivel, then this Agreement may be terminated at the option of either Party upon 30 days written notice.

3.8

Swivel shall indemnify the Distributor in respect of any proven claim that the normal use or possession of any Product infringes the intellectual property rights of any third party, provided that:

3.8.1

the Distributor notifies Swivel immediately it becomes aware of any claim or threatened claim that the Product infringes the intellectual property rights of that third party;

3.8.2

Swivel is given immediate and complete control of such claim;

3.8.3

the Distributor makes no admissions or statements without Swivel's prior written consent except where Distributor is legally required to do so;

3.8.4

the Distributor gives Swivel all reasonable assistance at Swivel's expense with such claim; and

3.8.5

the Distributor does not enter into any settlement of any such claim without the prior written consent of Swivel.

4.

PROVISIONS RELATING TO THE ORDERING, DELIVERY AND SALE OF PRODUCTS

4.1

The Distributor shall give orders and make forecasts of its requirements for Products and each order when accepted by Swivel shall constitute a separate contract.

4.2

All purchase orders from the Distributor for Products shall be accepted by Swivel at its office at ▇▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇, ▇▇▇▇ ▇▇▇ or such other location as Swivel shall notify to the Distributor from time to time upon the terms and conditions contained herein. A purchase order is considered as accepted by Swivel unless Swivel has notified the Distributor in writing within 3 Business Days that that order has not been accepted as placed. Each order when accepted by Swivel will constitute a separate contract.

5.

PRICES, PAYMENT AND REVENUE TARGETS

5.1

The price of Products to the Distributor is the then current applicable standard retail price from Swivel's price list, less the applicable discount percentage set out in schedule 2. The Distributor hereby acknowledges and agrees that it has received a copy of Swivel's current price list as at the date of this Agreement and Swivel agrees to provide the Distributor with updated price lists promptly following their production. The prices set out in the price list of Swivel in existence on the date of this Agreement shall apply until the Distributor receives another price list from Swivel.

5.2

All prices in Swivel's price list are exclusive of any taxes and duties.

5.3

All payments to be made by the Distributor under or in connection with this Agreement shall be made by no later than 30 days following receipt of the relevant invoice, in full, in immediately available funds and free of any set-off or counterclaim or any other deduction whatsoever. If the Distributor fails to pay any sum payable by it to Swivel under this Agreement on its due date, it shall pay interest on the unpaid sum at a rate per annum equal to ten per cent from the due date until the date of actual payment as well after as before judgement.

5.4

The Distributor is required to meet certain revenue targets (each a "Revenue Target") with respect to the sale of Products in the Territory during certain quarterly periods during the Term. The Revenue Targets for the 12 month period commencing on the Commencement Date are set out in schedule 4. If the Revenue Targets for the 12 month period commencing on the Commencement Date are for any reason not set out in schedule 4, the Parties shall agree such Revenue Targets within 30 days of the Commencement Date and if they fail to agree such Revenue Targets within such period, Swivel shall be entitled to terminate this Agreement by giving to the Distributor not less than 14 days written notice.

5.5

The Parties shall agree the Revenue Targets for each 12 month period which follows the initial 12 month term of this Agreement by no later than the final day of the then current 12 month period. If the Parties fail to agree such Revenue Targets by such date, Swivel shall be entitled to terminate this Agreement by giving to the Distributor not less than 14 days written notice.

5.6

If any Revenue Target is not satisfied in respect of a quarterly period, Swivel shall be entitled to terminate this Agreement by giving to the Distributor not less than 14 days written notice.

5.7

The Distributor shall provide such information as Swivel shall request for the purpose of enabling Swivel to determine whether a Revenue Target has been met.

6.

DUTIES AND OBLIGATIONS OF SWIVEL

6.1

Swivel shall during the period of twelve months following the Commencement Date make available (at the Distributor's cost, unless otherwise agreed) employees of Swivel at either Swivel's or the Distributor's premises for a period of not more than five days for the purpose of training selected employees of the Distributor in the promotion, sale and operation of Products.

6.2

Swivel shall make available to the Distributor at no cost, in the English language, in electronic format such sales and technical literature and documentation as is made generally available by Swivel in respect of the Products.

6.3

Any technical consultancy and technical or marketing support provided by the Swivel which is requested by the Distributor outside of the agreed standard support and maintenance arrangements between the Parties will be provided by Swivel at its then current consultancy rates plus expenses.

6.4

Swivel shall provide with its software Products a standard end-user licence agreement.

6.5

Swivel shall ensure that Distributor is provided with all of the benefits set out in Part B of schedule 6.

6.6

Swivel shall, while this Agreement is in existence, provide each of the services set out in schedule 3 for the benefit of the Distributor.

7.

DUTIES AND OBLIGATIONS OF THE DISTRIBUTOR

7.1

The Distributor shall at all times while this Agreement is in existence:

7.1.1

ensure that one of its staff is made responsible for the overall relationship between Swivel and the Distributor,

7.1.2

provide a comprehensive service (either directly or through sub-contractors) for the implementation and support of the Products in the Territory to standards reasonably acceptable to Swivel.

7.1.3

not hold Itself out or permit itself to be held out as Swivel's agent or representative and the Distributor acknowledges it has no authority to legally bind Swivel in any way (including any action resulting in Swivel becoming liable to any party),

7.1.4

not without Swivel's prior written approval make any representation in respect of any of the Products except such representations as are contained in Swivel's current user manuals or standard product literature,

7.1.5

in the meeting of its obligations set out in this Agreement at all times (i) use reasonable skill and care, (ii) ensure services provided are to a satisfactory quality, (iii) do (or omit to do) nothing which causes or is likely to cause the reputation of Swivel (and its products and services) to be adversely affected, and (iv) avoid making any false representations as to Swivel's current or future products or services (and to check in advance with Swivel in the case of any doubt),

7.1.6

contact Swivel promptly with written details of any complaints or difficulties experienced by customers which are not or cannot be readily solved by the Distributor, and ensure that any reasonable requests for information made by Swivel relating to the Distributor's business pursuant to this Agreement are promptly and accurately answered,

7.1.7

provide a summary of sales achieved within 14 days of the beginning of each month, together with sales forecasts for the following 12 months,

7.1.8

maintain adequate facilities with which to demonstrate the Products to VARs and potential VARs,

7.1.9

comply with each of the obligations of the Distributor set out in Part A of schedule 6,

7.1.10

recognize and apply the price discounts granted by Swivel to its duly appointed VARs.

7.2

Within 30 days of the execution by both Parties of this Agreement, the Distributor shall, with Swivel's assistance, develop a marketing plan (the "Marketing Plan") and the Parties shall agree the Marketing Plan.

7.3

The Distributor shall within 7 days of the Commencement Date complete and return to Swivel the Distributor Main Contacts List in the form set out in schedule 5.

8.

TERMINATION

8.1

Either Party may terminate this Agreement forthwith by notice in writing if the other is in breach of this Agreement and shall have failed to remedy the breach within 30 days (7 days in the case of a failure by the Distributor to pay any amount due to Swivel) of the receipt of a request in writing from the Party not in breach that the breach be remedied.

8.2

In addition to other rights of termination contained herein, either Party (the "non Defaulting Party") shall be entitled to terminate this Agreement forthwith by notice in writing to the other (the "Defaulting Party") if:

8.2.1

any judgment or order of a court of competent jurisdiction made against the Defaulting Party is not stayed or complied with within 7 days or an encumbrancer takes possession of the whole or any part of the assets, rights or revenues of the Defaulting Party or a distress or other process is levied or enforced upon any of the assets, rights or revenues of the Defaulting Party and is not discharged within 7 days; or

8.2.2

the Defaulting Party stops or suspends payment of its debts or is, or is deemed to be, unable to, or admits inability to, pay its debts as they fall due or commences negotiations with one or more of its creditors with a view to the general rescheduling of all or any of its debts or proposes or enters into any composition or other arrangement for the benefit of its creditors generally or any class thereof; or

8.2.3

the Defaulting Party is adjudicated or found bankrupt or insolvent or any step is taken or bona fide proceedings are commenced for the winding-up, administration or dissolution of the Defaulting Party or for the appointment of a liquidator, administrator, receiver or similar officer in respect of the Defaulting Party or of the whole or any part of its assets, rights or revenues (other, in any case, than a voluntary winding-up in connection with a solvent corporate restructuring); or

8.2.4

any ,event occurs or proceeding is taken with respect to the Defaulting Party in any jurisdiction to which it is subject which has an effect equivalent or similar to any of the events mentioned in paragraphs 8.2.1, 8.2.2 or 8.2.3.

8.3

The termination of this Agreement however arising will be without prejudice to the rights and duties of the Parties accrued prior to termination. The clauses in this Agreement · which expressly or impliedly have effect after termination will continue to be enforceable notwithstanding termination.

9.

FORCE MAJEURE

Neither Party shall be liable to the other Party in any manner whatsoever for any failure or delay in performing its obligations under this Agreement due to force majeure which expression for the purposes of this Agreement means any cause beyond the reasonable control of the Party in question including, but not limited to, governmental actions, war, riots, civil commotion, fire, flood, epidemic, labour disputes (including labour disputes involving the work force or any part thereof of the Party in question), restraints or delays affecting shipping or carriers, inability or delay in obtaining supplies of adequate or suitable materials, currency restrictions and act of God provided that:-

9.1.1

the date for performance of the contractual obligation which has been delayed by the force majeure event shall be deemed suspended only for a period equal to the delay caused by such event;

9.1.2

the Party seeking to exempt itself from liability by virtue of the provisions of this clause shall give written notice to the other Party within 7 days of becoming aware of the force majeure event and shall at all times use all reasonable endeavours to mitigate the effect of the force majeure event.

10.

CONFIDENTIALITY

Neither of the Parties shall at any time during the continuance of this Agreement, or for a period of two years after its termination, disclose to any person other than its officers, employees and professional advisers, on a needs to know basis, any of the terms and conditions of this Agreement and/or any agreement entered into pursuant to or in connection with it and/or any information relating to the other Party's affairs or business or method of carrying on business. This obligation of non-disclosure shall not apply to any information which:

10.1.1

was, prior to the date of this Agreement, in the public domain or which falls into the public domain other than by breach of this Agreement by the Party to whom such information has been disclosed; or

10.1.2

is lawfully received by the Party to whom the information is disclosed from a third party which is not subject to an obligation of confidentiality owed to the Party disclosing such information or in respect of which such information is confidential; or

10.1.3

is required to be disclosed by any applicable law or regulation or by any judicial authority.

If, in compliance with this clause 10, a Party shall disclose any information, the disclosure of which is restricted by this clause 10, to any of its officers, employees and/or professional advisers, it shall notify them of the obligations contained in this clause 10 and cause them to comply with such obligations.

11.

DATA PROTECTION

11.1

The Parties shall each comply with the data protection provisions as set out in Schedule 7.

12.

LIMITATION OF LIABILITY

12.1

Neither Party excludes or limits liability to the other Party for fraud (including fraudulent misrepresentation) or for death or personal injury arising from its negligence.

12.2

Neither Party shall be responsible or liable to the other Party for, and shall not pay, any amount of special, incidental, consequential or other indirect damages whatsoever, including, but without limitation, damages based on lost revenue, loss of business profits, loss of business information, business interruption, loss of goodwill, loss of anticipated savings or otherwise, regardless of whether advised of the possibility of such losses in advance.

Subject to clause 12.1 and without prejudice to clause 12.2, the aggregate liability of Swivel under or in connection with this Agreement shall not exceed the aggregate amounts paid by the Distributor to Swivel under this Agreement in the twelve months immediately prior to the date of the relevant claim or the date of the first of a number of connected claims.

12.4

Each Party shall use its reasonable endeavours to mitigate any loss for which the other Party is responsible.

12.5

The provisions of this clause 12 will survive termination of this Agreement.

13.

SEVERABILITY

The illegality, invalidity or unenforceability of any clause shall not affect the legality, validity or enforceability of the remainder. If any such clause is found by any competent court or authority to be illegal, invalid or unenforceable the Parties agree that they will substitute provisions in a form as similar to the offending provisions as is possible without thereby rendering them illegal, invalid or unenforceable but without imposing on either Party any obligation greater than is contained in the offending provision.

14.

RELATIONSHIP OF PARTIES

14.1

Each of the Parties hereto is an independent contractor and nothing contained in this Agreement shall be construed to imply that there is any relationship between the Parties of partnership or of principal/agent or of employer/employee nor are the Parties hereby engaging in a joint venture and accordingly neither of the Parties shall have any right or authority to act on behalf of the other nor to bind the other by contract or otherwise, unless expressly permitted by the terms of this Agreement.

14.2

Each of the Parties shall bear its own costs in connection with preparation and negotiation of this Agreement and any agreement entered into pursuant to this Agreement.

15.

ASSIGNMENT

The Distributor may not assign and/or transfer all or any of its rights and/or obligations under this Agreement without the prior written consent of Swivel.

16.

ENTIRE AGREEMENT

16.1

Each Party acknowledges that this Agreement together with all documents entered into or to be entered into under its terms (a) together constitutes the entire agreement and understanding between the Parties with respect to the subject matter of this Agreement and (b) in relation to such subject matter supersedes all prior discussions, understanding and agreements between the Parties and their agents.

16.2

Each Party also agrees that in entering into this Agreement and the documents referred to in it is not relying on any statements, warranties, or representations given or made (whether negligently or Innocently and whether express or implied), or any acts or omissions by or on the part of any other Party or by or on the part of any other person not a Party to this Agreement in relation to the subject matter of this Agreement, except those expressly set out in this Agreement and any other documents referred to above and it shall have no rights or remedies with respect to such subject matter otherwise than under this Agreement and the documents executed at the same time as it or referred to in it.

17.

REPRESENTATIONS AND WARRANTIES

Swivel represents and warrants to the Distributor on the date of this Agreement that:

17.1.1

this Agreement constitutes its legal, valid and binding obligations enforceable in accordance with its terms;

17.1.2

it has the power to execute this Agreement and to perform its obligations under this Agreement and all necessary corporate, shareholder and other action has been taken to authorize the execution of this Agreement by it and the performance of its obligations under this Agreement.

17.2

the Distributor represents and warrants to Swivel on the date of this Agreement that:

17.2.1

this Agreement constitutes its legal, valid and binding obligations enforceable in accordance with its terms;

17.2.2

it has the power to execute this Agreement and to perform its obligations under this Agreement and all necessary corporate, shareholder and other action has been taken to authorize the execution of this Agreement by it and the performance of its obligations under this Agreement; and

17.2.3

employees and representatives of the Distributor have the proper skill, training and background to perform the services to be performed by the Distributor pursuant to this Agreement in a competent and professional manner.

17.3

Product warranties

Swivel warrants to the Distributor that the Products delivered under this Agreement will be free from defects in materials and workmanship effective for ninety days, beginning on the date of Swivel's original shipment of the Products to the Distributor and ending on the ninety­ first day or upon resale to a Customer by the Distributor, whichever first occurs. Provided that (i) the Distributor has notified Swivel of a defect in the Products during the applicable warranty period and (ii) Swivel has confirmed such Products to be defective after the Distributor has returned them to Swivel, as Swivel's exclusive remedy for breach of warranty, Swivel will replace any such Product at no charge to the Distributor.

18.

VARIATIONS

No amendment or variation to this Agreement shall be effective unless in writing and signed by a director or other duly authorized officer of each of the Parties hereto.

19.

WAIVER

19.1

A failure by a Party to exercise, or a delay in exercising, any right or remedy under this Agreement shall not constitute a waiver of the right or remedy or a waiver of any other rights or remedies which that Party may otherwise have and no single or partial exercise of any right or remedy under this Agreement :shall prevent any further exercise of the right or remedy or the exercise of any other right or remedy.

19.2

Any waiver of a breach of any of the terms of this Agreement or of any default under this Agreement shall not be deemed a waiver of any subsequent breach or default and shall not affect the other terms of this Agreement.

20.

NATURE OF RIGHTS

The rights and remedies provided by this Agreement are additional to and do not exclude any rights or remedies provided by law

21.

NOTICES

21.1

Any notice or other communication under or in connection with this Agreement shall be in writing in the English language and sent marked for the attention of the CEO or Managing Director and shall be delivered personally or sent by pre-paid registered or recorded delivery post (and air mail if overseas) or by facsimile or other electronic media, to the Party intended to receive the notice or communication at its address set out in this Agreement or such other address as that Party may specify by notice in writing to the Party giving the notice.

21.2

In the absence of evidence of earlier receipt, any notice or other communication shall be deemed to have been duly given:-

21.2.1

if delivered personally, when left at the address referred to in clause 21.1

21.2.2

if sent by mail, other than air mail, two days after posting it;

21.2.3

if sent by air mail, seven days after posting it; and

21.2.4

if sent by facsimile or other electronic media, when clearly received in full provided that a copy of the notice or communication is also put into the post in accordance with clause 21.1 within 24 hours following the despatch of the initial version.

22.

GOVERNING LAW

The Parties agree that any disputes arising under or in any way connected with the subject matter of this Agreement (whether of a contractual or tortious nature or otherwise) shall be subject to English law and to the exclusive jurisdiction of the English courts.

23.

THIRD PARTY RIGHTS

A person who is not a party to this Agreement shall have no rights pursuant to the Contracts (Rights of Third Parties) ▇▇▇ ▇▇▇▇ to enforce any term of this Agreement.

1

Swivel Authentication Appliance

2

Swivel Software

3

Swivel Maintenance

4

Swivel Professional Services

1.

Provide at least three ongoing commercialised reference customers that the Distributor can openly have communications access with.

2.

Respond within a period of one Business Day to any referral to it from the Distributor which arises as a result of any failure of a Swivel product sold by Swivel to the Distributor to perform in accordance with Swivel's product documentation, provided that Swivel shall not be obliged to respond to and/or take any action in response to any referral from the Distributor where another party, for example a VAR, is contractually obliged to take any remedial action required in connection with the circumstances giving rise to such referral and/or the referral arises as a result of any person (a) modifying any Swivel product, or (b) operating a Swivel product in an operating environment not approved by Swivel, or (c) using a Swivel product improperly, or (d) the improper installation of any Swivel products.

3.

Ensure that its products continue to operate under all operating environments and conditions specified in Swivel's product documentation.

4.

Ensure that Swivel's product documentation is kept current and is updated on an annual basis.

Quarterly Period

REVENUE TARGET

Aggregate revenues within the stated Quarterly Period to be achieved by the Distributor from sales of Products

_________ 2019 to (and including)

 2019

€ _________

_________ 2019 to (and including)

 2019

€ _________

_________ 2019 to (and including)

 2019

€ _________

_________ 2020 to (and including)

 2020

€ _________

•

provide a comprehensive service (Levels 1 and 2) of technical support to its clients to standards reasonably acceptable to Swivel

•

establish sales objectives and a detailed business plan within 30 days of the Commencement Date

•

ensure that two systems engineers are fully trained and certified by Swivel within 30 days from the Commencement Date

•

ensure that sales training offered by Swivel is undertaken by the majority of its sales force

•

provide monthly a sales pipeline report, a monthly sales forecast report and a monthly sales out report

•

AuthControl Sentry all company NFR (not for resale) license

•

Receive a Distribution Partner Plaque

•

Sales and Marketing collateral, soft and hard copies (hard copy limits apply)

•

Use of Swivel Secure Distribution Partner logo (guidelines apply)

•

Regular partner updates

•

Swivel Secure field sales support available for 5 days at no cost to help with customer and prospect installations. Distributor will be responsible for travel costs.

•

Co-funded field marketing programs

•

Initial 2-day technical training course for 10 people at no charge

•

Initial 1-day sales training at no charge

•

Priority inclusion in beta testing (subject to availability)

•

Joint participation in conferences, tradeshows, seminars (advance booking)

1.

DEFINITIONS AND INTERPRETATION

1.1

Definitions

In this Schedule 7 (Data Processing Provisions), the following terms shall have the following meanings:

"Data Controller", "Data Processor", "Data Subject", "Personal Data" and "processing" all have the meanings given to those terms in DP Laws (and related terms such as "process" shall have corresponding meanings);

"DP Laws" means any applicable law, enactment, regulation, regulatory policy, by law, ordinance or subordinate legislation relating to the processing, privacy, and use of Personal Data, as applicable to the Distributor and/or the Supplier, including:

(a)

the Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR");

(b)

the Data Protection ▇▇▇ ▇▇▇▇;

(c)

the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as may be amended by the proposed Regulation on Privacy and Electronic Communications);

(d)

any legislation that, in respect of the United Kingdom, replaces, or enacts into United Kingdom domestic law, the GDPR, the proposed Regulation on Privacy and Electronic Communications or any other law relating to data protection, the processing of personal data and privacy as a consequence of the United Kingdom leaving the European Union; and/or

(e)

any judicial or administrative interpretation of them, any guidance, guidelines, codes of practice, approved codes of conduct or approved certification mechanisms issued by any relevant Supervisory Authority.

"Personal Data Breach" means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Personal Data;

"Special Categories of Personal Data" means personal data described in Article 9(1) of the GDPR; and

"Supervisory Authority" means any local, national or multinational agency, department, official, parliament, public or statutory person or any government or professional body, regulatory or supervisory authority, board or other body responsible for administering DP Laws.

2.

DATA CONTROLLER STATUS

2.1

The Parties acknowledge that each Party may disclose or make available to the other Party Personal Data for the of selling Products to Customers.

3.

DATA CONTROLLER STATUS

3.1

Each Party is a Data Controller in respect of the Personal Data it discloses or makes available to the other Party and each Party will process Personal Data as a separate and independent Data Controller for the purposes of this Agreement.

4.

SHARED PERSONAL DATA

4.1

The following types of Personal Data will be shared between the Parties during the Term of this Agreement:

name, address, telephone number, mobile telephone number, email address, work job title (the "Shared Personal Data").

4.2

Special Categories of Personal Data will not be shared between the Parties.

4.3

The Shared Personal Data must not be irrelevant or excessive with regard to the agreed purpose of the Agreement

5.

DATA SHARING PROVISIONS

5.1

Each Party shall be individually and separately responsible for complying with the obligations that apply to it as a Data Controller under any applicable DP Laws in relation to the Personal Data processed under this Agreement, in particular but without limitation:

5.1.1

ensuring that there is a lawful basis on which Personal Data is processed by it (including its transfer of the Personal Data to the other Party under this Agreement);

5.1.2

ensuring that the transparency disclosure requirements of applicable DP Laws are satisfied by providing the required information to Data Subjects where applicable (including its transfer to the other Party of the Personal Data under this Agreement); and

5.1.3

ensuring that it keeps Personal Data secure at all times, including by implementing and maintaining at its cost and expense, appropriate technical and organisational measures in relation to its processing of the Personal Data so as to ensure a level of security appropriate to the risks that are presented by the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.

Notwithstanding paragraph 5.1, each Party shall ensure all Personal Data are accurate prior to any sharing with the other Party under this Agreement, and shall take reasonable steps to ensure such Personal Data remains accurate on an ongoing basis, notifying the other Party within a reasonable time in the event it receives updates or corrections to any of such Personal Data, where it is reasonable to do so.

5.3

Each Party shall provide reasonable assistance, information and co-operation as regards data protection matters where requested by the other Party in respect of Personal Data shared between them pursuant to this Agreement, including:

5.3.1

In respect of any matter which in the reasonable opinion of the other Party is required for ensuring that Party's continued compliance with DP Laws;

5.3.2

in respect of any claim and/or exercise or purported exercise of rights by a Data Subject under the DP Laws or any investigation or enforcement activity by any lawful data protection Supervisory Authority, which relates to or is connected with the other Party's processing of Personal Data pursuant to this Agreement;

5.3.3

in respect of any Personal Data Breach, without undue delay provide such information as the other Party may require under DP Laws in order to report such Personal Data Breach to the Supervisory Authority;

5.3.4

if it is contacted or approached in relation to any claim and/or exercise or purported exercise of rights by a Data Subject under DP Laws; and/or

5.3.5

in the event of any investigation or enforcement activity by any Supervisory Authority.

5.4

Neither Party shall do or permit anything to be done through any act or omission that would cause the other Party to incur any liability under DP Laws.

5.5

If the Parties determine that it is necessary to transfer Personal Data to a country outside the European Economic Area, the Parties shall be responsible for ensuring that such transfer is effected by way of a legally enforceable mechanism for transfers of Personal Data as may be permitted under DP Laws from time to time, including where appropriate the model clauses as set out in Annexure 1 to this Agreement.

(1)

SWIVEL SECURE LIMITED a company incorporated in England and Wales with registered number 04068905 whose registered address is at ▇▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇, ▇▇▇▇ ▇▇▇ 'data exporter'; and

(2)

SWIVEL SECURE EUROPE S.A., a company incorporated under the laws of Spain (Company No. ES A87886347) with its principal place of business at Av. ▇▇▇▇ ▇▇▇▇▇▇ I, n°13 - 12° planta (Torre Garena), ▇▇▇▇▇▇ ▇▇ ▇▇▇▇▇▇▇, ▇▇▇▇▇ ▇▇▇▇▇▇, ▇▇▇▇▇ ("SSE") 'data importer' 

1.

DEFINITIONS

1.1

For the purposes of the clauses:

"personal data", "special categories of data/sensitive data", "process/processing", "controller", "processor", "data subject" and "supervisory authority/authority" shall have the same meaning as in Directive 95/46/EC of 24 October 1995 (whereby "the authority" shall mean the competent data protection authority in the territory in which the data exporter is established);

the "data exporter" shall mean the controller who transfers the personal data;

the "data importer" shall mean the controller who agrees to receive from the data exporter personal data for further processing in accordance with the terms of these clauses and who is not subject to a third country's system ensuring adequate protection;

"clauses" shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial arrangements.

1.2

The details of the transfer (as well as the personal data covered) are specified in Annexure 3, which forms an integral part of the clauses.

The data exporter warrants and undertakes that:

The personal data have been collected, processed and transferred in accordance with the laws applicable to the data exporter.

It has used reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses.

It will provide the data importer, when so requested, with copies of relevant data protection laws or references to them (where relevant, and not including legal advice) of the country in which the data exporter is established.

It will respond to enquiries from data subjects and the authority concerning processing of the personal data by the data importer, unless the parties have agreed that the data importer will so respond, in which case the data exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the data importer is unwilling or unable to respond. Responses will be made within a reasonable time.

It will make available, upon request, a copy of the clauses to data subjects who are third party beneficiaries under clause (Ill), unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the data exporter shall inform data subjects in writing of the reason for removal and of their right to draw the removal to the attention of the authority. However, the data exporter shall abide by a decision of the authority regarding access to the full text of the clauses by data subjects, as long as data subjects have agreed to respect the confidentiality of the confidential information removed. The data exporter shall also provide a copy of the clauses to the authority where required.

The data importer warrants and undertakes that:

It will have in place appropriate technical and organisational measures to protect the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.

It will have in place procedures so that any third party it authorises to have access to the personal data, including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the data importer, including a data processor, shall be obligated to process the personal data only on instructions from the data importer. This provision does not apply to persons authorised or required by law or regulation to have access to the personal data.

It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the data exporter (which will pass such notification on to the authority where required) if it becomes aware of any such laws.

It will process the personal data for purposes described in Annexure 3, and has the legal authority to give the warranties and fulfil the undertakings set out in, these clauses.

It will identify to the data exporter a contact point within its organisation authorised to respond to enquiries concerning processing of the personal data, and will co­ operate in good faith with the data exporter, the data subject and the authority concerning all such enquiries within a reasonable time. In case of legal dissolution of the data exporter, or if the parties have so agreed, the data importer will assume responsibility for compliance with the provisions of clause (l)(e).

At the request of the data exporter, it will provide the data exporter with evidence of financial resources sufficient to fulfil its responsibilities under clause (Ill) (which may include insurance coverage).

Upon reasonable request of the data exporter, it will submit its data processing facilities, data files and documentation needed for processing to reviewing, auditing and/or certifying by the data exporter (or any independent or impartial inspection agents or auditors, selected by the data exporter and not reasonably objected to by the data importer) to ascertain compliance with the warranties and undertakings in these clauses, with reasonable notice and during regular business hours. The request will be subject to any necessary consent or approval from a regulatory or supervisory authority within the country of the data importer, which consent or approval the data importer will attempt to obtain in a timely fashion.

It will process the personal data, at its option, in accordance with:

the data protection laws of the country in which the data exporter is established; or

the relevant provisions of any Commission decision pursuant to Article 25(6) of Directive 95/46/EC, where the data importer complies with the relevant provisions of such an authorisation or decision and is based in a country to which such an authorisation or decision pertains, but is not covered by such authorisation or decision for the purposes of the transfer(s) of the personal data; or

the data processing principles set forth in Annexure 2.

Data importer to indicate which option it selects: (h)(iii)

It will not disclose or transfer the personal data to a third party data controller located outside the European Economic Area (EEA) unless it notifies the data exporter about the transfer and:

the third party data controller processes the personal data in accordance with a Commission decision finding that a third country provides adequate protection; or

the third party data controller becomes a signatory to these clauses or another data transfer agreement approved by a competent authority in the EU; or

data subjects have been given the opportunity to object, after having been informed of the purposes of the transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards; or

with regard to onward transfers of sensitive data, data subjects have given their unambiguous consent to the onward transfer.

Each party shall be liable to the other parties for damages it causes by any breach of these clauses. Liability as between the parties is limited to actual damage suffered. Punitive damages (i.e., damages intended to punish a party for its outrageous conduct) are specifically excluded. Each party shall be liable to data subjects for damages it causes by any breach of third-party rights under these clauses. This does not affect the liability of the data exporter under its data protection law.

The parties agree that a data subject shall have the right to enforce as a third party beneficiary this clause and clauses (l)(b), (l)(d), (l)(e), (ll)(a), (ll)(c), (ll)(d), (ll)(e), (ll)(h), (ll)(i), (lll)(a), (V), (Vl)(d) and (VII) against the data importer or the data exporter, for their respective breach of their contractual obligations, with regard to his personal data, and accept jurisdiction for this purpose in the data exporter's country of establishment. In cases involving allegations of breach by the data importer, the data subject must first request the data exporter to take appropriate action to enforce his rights against the data importer; if the data exporter does not take such action within a reasonable period (which under normal circumstances would be one month), the data subject may then enforce his rights against the data importer directly. A data subject is entitled to proceed directly against a data exporter that has failed to use reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses (the data exporter shall have the burden to prove that it took reasonable efforts).

These clauses shall be governed by the law of the country in which the data exporter is established, with the exception of the laws and regulations relating to processing of the personal data by the data importer under clause (ll)(h), which shall apply only if so selected by the data importer under that clause.

In the event of a dispute or claim brought by a data subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.

The parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.

Each party shall abide by a decision of a competent court of the data exporter's country of establishment or of the authority which is final and against which no further appeal is possible.

In the event that the data importer is in breach of its obligations under these clauses, then the data exporter may temporarily suspend the transfer of personal data to the data importer until the breach is repaired or the contract is terminated.

In the event that:

the transfer of personal data to the data importer has been temporarily suspended by the data exporter for longer than one month pursuant to paragraph (a);

compliance by the data importer with these clauses would put it in breach of its legal or regulatory obligations in the country of import;

the data importer is in substantial or persistent breach of any warranties or undertakings given by it under these clauses;

a final decision against which no further appeal is possible of a competent court of the data exporter's country of establishment or of the authority rules that

there has been a breach of the clauses by the data importer or the data exporter; or

a petition is presented for the administration or winding up of the data importer, whether in its personal or business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the data importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs.

then the data exporter, without prejudice to any other rights which it may have against the data importer, shall be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases covered by (i), (ii), or (iv) above the data importer may also terminate these clauses.

Either party may terminate these clauses if (i) any Commission positive adequacy decision under Article 25(6) of Directive 95/46/EC (or any superseding text) is issued in relation to the country (or a sector thereof) to which the data is transferred and processed by the data importer, or (ii) Directive 95/46/EC (or any superseding text) becomes directly applicable in such country.

The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause (Vl)(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred.

The parties may not modify these clauses except to update any information in Annexure 3, in which case they will inform the authority where required. This does not preclude the parties from adding additional commercial clauses where required.

The details of the transfer and of the personal data are specified in Annexure 3. The parties agree that Annexure 3 may contain confidential business information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under clause (l)(e). The parties may execute additional annexes to cover additional transfers, which will be submitted to the authority where required.

1.

Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annexure 3 or subsequently authorised by the data subject.

2.

Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.

3.

Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as information about the purposes of processing and about the transfer}, unless such information has already been given by the data exporter.

4.

Security and confidentiality: Technical and organisational security measures must be taken by the data controller that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the data controller.

5.

Rights of access, rectification, deletion and objection: As provided in Article 12 of Directive 95/46/EC, data subjects must, whether directly or via a third party, be provided with the personal information about them that an organisation holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the data exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm the interests of the data importer or other organisations dealing with the data importer and such interests are not overridden by the interests for fundamental rights and freedoms of the data subject. The sources of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about them rectified, amended, or deleted where it is inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organisation may require further justifications before proceeding to rectification, amendment or deletion. Notification of any rectification, amendment or deletion to third parties to whom the data have been disclosed need not be made when this involves a disproportionate effort. A data subject must also be able to object to the processing of the personal data relating to him if there are compelling legitimate grounds relating to his particular situation. The burden of proof for any refusal rests on the data importer, and the data subject may always challenge a refusal before the authority.

6.

Sensitive data: The data importer shall take such additional measures (e.g. relating to security) as are necessary to protect such sensitive data in accordance with its obligations under clause (II).

7.

Data used for marketing purposes: Where data are processed for the purposes of direct marketing, effective procedures should exist allowing the data subject at any time to 'opt­ out' from having his data used for such purposes.

8.

Automated decisions: For purposes hereof 'automated decision' shall mean a decision by the data exporter or the data importer which produces legal effects concerning a data subject or significantly affects a data subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc. The data importer shall not make any automated decisions concerning data subjects, except when:

(i)

such decisions are made by the data importer in entering into or performing a contract with the data subject, and

(ii)

the data subject is given an opportunity to discuss the results of a relevant automated decision with a representative of the parties making such decision or otherwise to make representations to that parties.

where otherwise provided by the law of the data exporter.

•

ICO Data Protection Register, Registration number: N/A