SYMBOTIC LLC Consulting Agreement This Consulting Agreement is effective as of the 31st day of October 2024 between George Dramalis, residing at 4 Priscilla Lane, Westford, MA 01866, (“Consultant”), and Symbotic LLC, a Delaware limited liability...
SYMBOTIC LLC Consulting Agreement This Consulting Agreement is effective as of the 31st day of October 2024 between ▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇, residing at ▇ ▇▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇, (“Consultant”), and Symbotic LLC, a Delaware limited liability company having a place of business at ▇▇▇ ▇▇▇▇▇▇▇▇ ▇▇▇▇▇, ▇▇▇▇▇▇▇▇▇▇, ▇▇▇▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇(“Symbotic”). Symbotic and Consultant desire to enter into a relationship wherein Consultant will provide certain services to, and perform certain work for Symbotic. The parties hereto agree as follows: 1. Terms of Work. Consultant agrees to provide the services set forth in Exhibit A attached hereto. Consultant will generally determine the methods, details and means of performing the services. Symbotic does not have the right to control the exact manner or determine the precise method of accomplishing the services. However, Consultant must observe Symbotic’s security and safety policies at all times, and Symbotic is entitled to exercise a broad, general right of supervision and control over the results of the services performed by Consultant to ensure satisfactory performance thereof. This power of supervision includes the right to inspect, stop work, make suggestions or recommendations as to the details of the work, and request modifications to the scope of the services. Symbotic will advise Consultant of the Symbotic employee or agent to whom Consultant will report. Consultant will perform the services at Symbotic’s premises or remotely, the parties mutually agree where the projects or tasks may be performed. Symbotic agrees to provide such working space or facilities as may be reasonably necessary for Consultant to perform the services at Symbotic’s premises. The time period from the date of this Agreement until the termination of the performance of consulting services hereunder pursuant to section 8 is referred to as the “Consulting Period.” 2. Payment Terms. As sole consideration for the services performed by Consultant pursuant to this Agreement, during the Consulting Period Symbotic shall allow and cause the continued vesting of the equity granted to Consultant pursuant to (a) that certain Incentive Unit Agreement dated as of May 15, 2020 by and between Consultant and Warehouse Technologies LLC and (b) that certain Incentive Unit Agreement dated as of March 3, 2021 by and between Consultant and Warehouse Technologies LLC (together, the “Incentive Unit Agreements”) pursuant to Section 3(b) of each Incentive Unit Agreement. Symbotic shall not pay cash consideration for the Consultant’s services, nor shall Symbotic pay a premium for services performed at night, during the weekend or for more than 8 hours of services performed by one person in one day or more than 40 hours of services performed by one person in one week. Symbotic will, however, reimburse Consultant at cost for reasonable, documented and pre-approved costs and expenses incurred by it in connection with performing such services. Consultant will submit receipts relating to any such expenses to Symbotic for reimbursement. 3. Independent Contractor. Symbotic and Consultant agree that Consultant is an independent contractor to Symbotic and not an employee, agent, joint venturer, or partner of Symbotic. Consultant acknowledges that, as an independent contractor, Consultant will not be entitled to make a claim for unemployment, worker’s compensation or disability, or receive any vacation, health, retirement or other benefits pursuant to this Agreement or Consultant’s relationship with Symbotic. Symbotic will not withhold FICA or state or federal income taxes Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF from its payments to Consultant, or make FICA or state or federal unemployment insurance contributions on behalf of Consultant. Consultant is not authorized to assume or create any obligation or responsibility, express or implied, on behalf of, or in the name of, Symbotic or to bind Symbotic in any manner. 4. Work for Hire. All inventions, discoveries, computer programs, data, technology, designs, innovations, and improvements (whether or not patentable and whether or not copyrightable) (“Inventions”) related to the business of Symbotic which are made, conceived, reduced to practice, created, written, designed, or developed by Consultant, solely or jointly with others, during the Consulting Period or thereafter if resulting or directly derived from Proprietary Information (as defined below), shall be the sole property of Symbotic. Consultant hereby assigns to Symbotic all Inventions and any and all related patents, copyrights, trademarks, trade names, and other industrial and intellectual property rights and applications therefor, in the United States and elsewhere, and appoints any officer of Symbotic as his/her duly authorized attorney to execute, file, prosecute, and protect the same before any government agency, court, or authority. Upon the request of Symbotic and at Symbotic’s expense, Consultant shall execute such further assignments, documents, and other instruments as may be necessary or desirable to fully and completely assign all Inventions to Symbotic and to assist Symbotic in applying for, obtaining, and enforcing patents or copyrights or other rights in the United States and in any foreign country with respect to any Invention. Consultant also hereby waives all claims to moral rights in any Inventions. Consultant shall promptly disclose to Symbotic all Inventions and will maintain adequate and current written records (in the form of notes, sketches, drawings, and as may be specified by Symbotic) to document the conception and/or first actual reduction to practice of any Invention. Such written records shall be available to and remain the sole property of Symbotic at all times. 5. Non-Exclusivity. This Agreement is non-exclusive. Consultant retains the right to perform work for others during the term of this Agreement. Symbotic may cause work of the same or a different kind to be performed by its own personnel or other contractors or consultants during the term of this Agreement. 6. Non-Solicitation. While Consultant is performing services under this Agreement and for a period of one year after the termination of the Consulting Period, Consultant will not directly or indirectly, either alone or in association with others (i) solicit, or permit any organization directly or indirectly controlled by Consultant to solicit, any employee of Symbotic to leave the employ of Symbotic, or (ii) solicit for employment, hire or engage as an independent contractor, or permit any organization directly or indirectly controlled by Consultant to solicit for employment, hire, or engage as an independent contractor, any person who was employed by Symbotic at the time of the termination of the Consulting Period; provided, that this clause (ii) shall not apply to any individual whose employment with Symbotic has been terminated for a period of six months or longer. 7. Proprietary Information. a. Consultant agrees that all information, whether in verbal, written, or electronic form, of a private, secret, or confidential nature concerning Symbotic’s technology, business, business relationships, or financial affairs (collectively, “Proprietary Information”) is and shall be the exclusive property of Symbotic. By way of illustration, but not limitation, Proprietary Information may include inventions, products, processes, methods, techniques, algorithms, projects, developments, plans, research data, financial data, Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF personnel data, computer software or hardware, customer and supplier lists, and contacts at or knowledge of customers or prospective customers of Symbotic. Consultant will not disclose any Proprietary Information to any person or entity other than employees or consultants of Symbotic or use the same for any purposes (other than in the performance of services under this Agreement) without written approval by an officer of Symbotic, either during or after the termination of the Consulting Period, unless and until such Proprietary Information has become public knowledge without fault by Consultant. b. Notwithstanding the foregoing, Consultant may disclose Proprietary Information to any of Consultant’s employees or contractors who have a need to know such Proprietary Information in order to accomplish the requirements of this Agreement and who are bound by contractual obligations of confidentiality and limitation of use sufficient to give effect to this Section 7. In no event shall Consultant disclose any such Proprietary Information to any competitors of Symbotic. Upon the written request of Symbotic, Consultant shall return all Propriety Information to Symbotic and shall certify that all such information has been so returned. c. Consultant agrees that all files, letters, memoranda, reports, records, data, sketches, drawings, laboratory notebooks, program listings, or other written, photographic, electronic, or other tangible material containing Proprietary Information, whether created by Consultant or others, which shall come into Consultant’s custody or possession, shall be and are the exclusive property of Symbotic to be used by Consultant only in the performance of services under this Agreement. All such materials or copies thereof and all tangible property of Symbotic in the custody or possession of Consultant shall be delivered to Symbotic, upon the earlier of (i) a request by Symbotic or (ii) termination of the Consulting Period. After such delivery, Consultant shall not retain any such materials or copies thereof or any such tangible property. d. Consultant agrees that Consultant’s obligation not to disclose or to use information and materials of the types set forth in paragraphs (a) and (c) above, and Consultant’s obligation to return materials and tangible property, set forth in paragraph (b) above, also extends to such types of information, materials, and tangible property of customers of Symbotic or suppliers to Symbotic or other third parties who may have disclosed or entrusted the same to Symbotic or to Consultant. 8. Termination. Consultant may terminate the Consulting Period at any time for any reason by giving written notice to Symbotic. Symbotic may terminate the Consulting Period only upon Consultant’s material breach of this Agreement by giving written notice to Consultant. Upon receipt of such notice from Symbotic, Consultant shall cease providing services, advise Symbotic of the extent to which Consultant has completed the services through such date, and collect and deliver to Symbotic whatever work product then exists. Symbotic shall make a final payment to Consultant of any outstanding and unreimbursed expneses through the date of such termination net 30 days. 9. Indemnification and Hold Harmless. a. Consultant agrees that any personal injury to Consultant or third parties or any property damage incurred in the course of performance of the services under this Agreement shall be the responsibility of Consultant. b. Consultant agrees to indemnify, defend, and hold harmless Symbotic and its affiliates, officers, employees and agents from and against any and all costs, losses, damages, Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF liabilities, expenses, demands, and judgments, including court costs and attorney's fees, which may arise out of Consultant's performance of the services under this Agreement, except to the extent such are caused by the gross negligence or willful misconduct of Symbotic. 10. Miscellaneous. a. Interpretation. If any restriction set forth in paragraphs 6 above is found by any court of competent jurisdiction to be unenforceable because it extends for too long a period of time or over too great a range of activities or in too broad a geographic area, it shall be interpreted to extend only over the maximum period of time, range of activities, or geographic area as to which it may be enforceable. b. Severability. The invalidity or unenforceability of any provision of this Agreement shall not affect the validity or enforceability of any other provision of this Agreement. c. Entire Agreement. This Agreement supersedes all prior agreements, written or oral, between Consultant and Symbotic relating to the subject matter of this Agreement. This Agreement may not be modified, changed, or discharged in whole or in part, except by an agreement in writing signed by Consultant and Symbotic. Consultant agrees that any change or changes in the services to be performed or payment terms after the signing of this Agreement shall not affect the validity or scope of this Agreement. d. Waiver of Rights. No delay or omission by Symbotic in exercising any right under this Agreement will operate as a waiver of that or any other right. A waiver or consent given by Symbotic on any one occasion is effective only in that instance and will not be construed as a bar to or waiver of any right on any other occasion. e. Equitable Remedies. The restrictions contained in this Agreement are necessary for the protection of the business and goodwill of Symbotic and are considered by Consultant to be reasonable for such purpose. Consultant agrees that any breach of this Agreement is likely to cause Symbotic substantial and irrevocable damage and therefore, in the event of any such breach, Consultant agrees that Symbotic, in addition to such other remedies which may be available, shall be entitled to specific performance and other injunctive relief. f. ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇. The Consultant acknowledges and accepts that it has received and read the ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ Policy (the “Policy”) of Symbotic Inc. (the “Company”) attached hereto as Exhibit B and understand its contents. The Consultant agrees to comply fully with the policies and procedures contained in the Policy and the Company’s related policies and procedures. Consultant understands that it has an obligation to report any suspected violations of the Policy that it become aware of to the General Counsel of the Company. The Consultant acknowledges that the Policy is a statement of policies and procedures that the Company has adopted in order to ensure compliance with ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ laws and related matters and does not, in any way, constitute an employment contract or an assurance of continued engagement, or assignment, as applicable. g. Information Security. Consultant acknowledges and accepts that they shall be subject to the terms set forth in the following exhibits: (a) the Information Resources Acceptable Use and Security Policy dated January 1, 2018 (the “Information Security Policy”) attached hereto as Exhibit C, and (b) the Information Security Policy which is attached hereto as Exhibit D. h. Governing Law. This Agreement is governed by and will be construed as a sealed instrument under and in accordance with the laws of the Commonwealth of Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF
Massachusetts (without reference to the conflicts of laws provisions thereof). Any action, suit, or other legal proceeding which is commenced to resolve any matter arising under or relating to any provision of this Agreement shall be commenced only in a court of the Commonwealth of Massachusetts (or, if appropriate, a federal court located within Massachusetts), and Symbotic and Consultant each consents to the jurisdiction of such a court. {Signature Page to Follow} SYMBOTIC LLC ▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇ By: Signature: Name: Title: Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF ▇▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇ Senior VP & General Counsel SYMBOTIC LLC Consulting Agreement Exhibit A – Services to be Performed Services to be performed by Consultant are personal and shall be performed by ▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇ and no other person. Consultant shall report to ▇▇▇▇ ▇▇▇▇▇ at Symbotic. Consultant shall perform the following services: Consultant agrees to make himself reasonably available upon reasonable notice to respond by telephone or email to inquiries from Symbotic or to assist Symbotic by telephone or email in any matters for which he had involvement This Agreement shall extend through May 30, 2025, unless terminated earlier pursuant to Section 8. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF 7 Exhibit B SYMBOTIC INC. ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ POLICY (Effective 4-12-2023) In the course of conducting the business of Symbotic Inc. (together with its subsidiaries, the “Company”), you may come into possession of material information that is not available to the investing public (“material, non-public information”) about the Company or other entities. You must maintain the confidentiality of material, non-public information and may not use it in connection with the purchase or sale of Company Securities (as defined below) or the securities of any other entity to which the information relates. The Company has adopted this ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ Policy (this “Policy”) in order to ensure compliance with the law and to avoid the appearance of improper conduct by any Covered Persons (as defined below). We have all worked hard to establish the Company’s reputation for integrity and ethical conduct, and we are all responsible for preserving and enhancing this reputation. 1. SCOPE OF POLICY This Policy applies to (i) all directors, officers, employees, independent contractors, temporary agency workers and consultants (in each case, as applicable) of the Company (collectively referred to as the “Insiders”), (ii) the spouses or equivalents, minor children and any individuals sharing the same household with any Insider (regardless of whether such individual is a family member), (iii) any other person or entity over whom any Insider exercises substantial control over his, her, their or its securities trading decisions, and (iv) any trust or other estate in which any Insider has a substantial beneficial interest or as to which he, she or they serves as trustee or in a similar fiduciary capacity (collectively, the “Covered Persons”). 2. PROHIBITION ON TRADING ON MATERIAL, NON-PUBLIC INFORMATION A. Prohibition This Policy prohibits, and the laws, rules and regulations of the United States and other countries may prohibit, any Covered Person from purchasing, selling or otherwise trading any securities of the Company, including common stock, any other common equity securities or any preferred equity, convertible or debt securities (“Company Securities”) while in possession of “inside information” about the Company. Inside information about the Company constitutes any material, non-public information about the Company. If you become aware of any inside information about the Company, you may not execute any trade in Company Securities and you should treat the information as confidential. Insiders may become temporary insiders of an entity other than the Company if such entity is an entity with which the Company has a contractual relationship or may be negotiating a transaction, or a competitor of the Company. Thus, the prohibition on trading while in possession of inside information also applies to transactions in the securities of any such other entity about which you acquire inside information in the course of your duties for the Company. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF 8 Gifts (which includes donations) are covered by this Policy’s prohibitions on trading. A Covered Person in possession of inside information about the Company is prohibited from making a gift of Company Securities. B. Definition of Inside Information (Material, Non-Public Information) Inside information about any entity constitutes “material, non-public information” about such entity. i. Material Information Under this Policy and United States laws, rules and regulations, information is material if there is a substantial likelihood that a reasonable investor would consider it important in deciding whether to buy, hold or sell an entity’s securities, or in making another investment decision involving an entity’s securities. Any information that could reasonably be expected to affect (either negatively or positively) the price of an entity’s securities is material for these purposes. In this regard, potential market reaction or sensitivity to the information is a key consideration. Moreover, although multiple pieces of information may not be material individually, if the aggregate effect of those pieces, when they become public, would alter the “total mix” of available information and result in a reevaluation of an entity’s securities, then such pieces of information are considered material. Information may be material even if it relates to future, speculative or contingent events and even if it is significant only when considered in combination with publicly available information. Examples of potentially material information about an entity include, depending on the particular circumstances: financial results; earnings announcements or estimates; changes to previously released earnings information; significant information regarding new products, technology or similar developments; developments regarding customers, suppliers or competitors; cybersecurity risks and incidents, including vulnerabilities and breaches; execution or termination of significant financing, management or customer agreements or other contracts with business entities; information relating to a pending or proposed merger, acquisition, tender offer, joint venture or changes in assets (even if preliminary in nature); changes in financial liquidity or solvency; extraordinary borrowings; changes in debt ratings; unpublished research reports or models; significant developments involving corporate relationships; events regarding the entity’s securities, e.g., defaults on senior securities, calls of securities for redemption, repurchase plans, stock splits or changes in dividends or dividend policy, changes to the rights of security holders and new equity or debt offerings; developments (whether positive or negative) in pending litigation; significant litigation exposure due to actual or threatened litigation; change in auditors or an auditor’s notification that the entity may no longer rely on such auditor’s audit report; major changes in accounting methods or policies; changes in control, in management or in the board of directors; and Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF
9 bankruptcies or receiverships. ii. Non-Public Information Information is considered to be non-public unless it has been adequately disclosed to the public, which means that the information must be publicly disseminated in a manner designed to reach investors generally and sufficient time must have passed for the capital markets to have absorbed the information. Information is not necessarily public merely because it has been discussed in the press, which will sometimes report rumors. You should presume that information is non-public unless you can point to its official release in at least one of the following ways: (i) regulatory filings; or (ii) issuance of press releases (including on an entity’s official website). You may not attempt to “beat the market” by trading simultaneously with, or shortly after, the official release of material information. Although there is no fixed period for how long it takes the market to absorb information, out of prudence, a person aware of material, non-public information should refrain from any trading activity for approximately two full trading days following its official release; shorter or longer waiting periods might be warranted based upon the liquidity of the security and the nature of the information. Notwithstanding these timing guidelines, it is illegal for you to trade while in possession of material, non-public information, including situations in which you are aware of major developments that have not yet been publicly announced. C. Exemptions The prohibitions in Sections 2.A and 4.C on purchases, sales or other transactions of Company Securities do not apply to: periodic contributions to, or the acquisition of Company Securities under, an employee stock purchase plan maintained by the Company, in each case, pursuant to the terms and conditions of the applicable plan; exercises of stock options or stock appreciation rights, or the surrender of shares to the Company in payment of the exercise price or in satisfaction of any tax withholding obligations in a manner permitted by the terms and conditions of the applicable plan, or vesting or settlement of equity-based awards, that in each case do not involve a market sale of Company Securities; or trading in exchange-traded index securities or derivatives linked to broad-based indices that may include securities of the Company or any other entity about which you acquire inside information in the course of your duties for the Company. For purposes of this Policy, a broad-based index investment strategy would not include an index or strategy if (i) more than 10% of the index or strategy were to be represented by a single issuer or (ii) the index or strategy were to be linked to a relatively narrow group of companies. Appropriate care should be taken in investing in index securities or industry-focused funds to ascertain the nature of the index or strategy and to avoid concerns over its being too narrowly focused. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF 10 3. PROHIBITION ON “TIPPING” MATERIAL, NON-PUBLIC INFORMATION In addition to trading while in possession of material, non-public information, it is illegal and a violation of this Policy to convey such information to another (“tipping”) if you know, have reason to believe or suspect that the person will misuse such information by trading in securities or passing such information to others who trade. This applies regardless of whether the “tippee” is related to the Covered Person or is an entity, and regardless of whether you receive any monetary benefit from the tippee. Trading on or conveying material, non-public information may also breach contractual obligations assumed by the Company to or on behalf of entities with which the Company has a contractual relationship or may be negotiating a transaction. Apart from contractual remedies (such as damages and injunctions), severe, and possibly irreparable, reputational damage to the Company can result from trading on, tipping or other improper use of material, non-public information. 4. STATEMENT OF PROCEDURES PREVENTING ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ The following procedures have been established, and will be maintained and enforced, by the Company to prevent ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇. Every director, officer and designated employee is required to follow these procedures. A. Pre-Clearance of All Transactions by All Directors, Officers and Designated Employees To provide assistance in preventing inadvertent violations of applicable laws, rules and regulations and to avoid the appearance of impropriety in connection with the trading of securities, all transactions in Company Securities and securities of entities with which the Company has a contractual relationship or may be negotiating a transaction, in each case, material to the other entity, by directors, officers and designated employees listed on Schedule I.A (as may be amended from time to time) (each, a “Pre-Clearance Person”) must be pre-cleared by the Company’s General Counsel or his, her or their designee. Gifts of Company Securities or other securities subject to this Section 4.A by Pre-Clearance Persons must be pre-cleared. Transactions in exchange-traded index securities or derivatives linked to broad-based indices are exempted from this pre-clearance requirement. Pre-clearance does not relieve anyone of his, her or their responsibility under U.S. Securities and Exchange Commission (“SEC”) rules and other applicable laws, rules and regulations. A request for pre-clearance must be in writing (including by e-mail), or pursuant to such other method required by the Company from time to time, should be made at least two business days in advance of the proposed transaction and should include the identity of the Pre-Clearance Person, the type of proposed transaction (for example, an open market purchase, a privately negotiated sale, an option exercise, etc.), the proposed date of the transaction and the number of shares or other securities to be involved. In addition, the Pre-Clearance Person will certify to the General Counsel or his, her or their designee, that such person is not aware of any relevant material non-public information. The General Counsel or his, her or their designee shall have discretion to decide whether to clear any contemplated transaction, provided that the Chief Financial Officer shall have discretion to decide whether to clear transactions by the General Counsel, the General Counsel’s designee or persons or entities subject to this Policy as a result of their relationship with the General Counsel or designee, as the case may be. All transactions that are pre-cleared must be effected within five business days of receipt of the pre-clearance Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF 11 unless a specific exception has been granted by the General Counsel or his, her or their designee. A pre-cleared trade (or any portion of a pre-cleared trade) that has not been effected during the five business day period must be pre-cleared again prior to execution. Notwithstanding receipt of pre-clearance, if the Pre-Clearance Person becomes aware of material non-public information or becomes subject to a black-out period before the transaction is effected, the transaction may not be completed. B. Post-Transaction Notice Each Covered Person who is subject to reporting obligations under Section 16 of the Securities Exchange Act of 1934 (as amended, the “Exchange Act”) shall also notify the General Counsel (or his, her or their designee) of the occurrence of any purchase, sale or other acquisition or disposition, including any gift, of securities of the Company as soon as possible following the transaction, but in any event within one business day after the transaction. Such notification shall be in writing (including by e-mail) and should include the identity of the Covered Person, the type of transaction, the date of the transaction, the number of shares involved and the purchase or sale price. For purposes of this Section 4.B, a purchase, sale or other acquisition or disposition shall be deemed to occur at the time the person becomes irrevocably committed to it (for example, in the case of an open market purchase or sale, this occurs when the trade is executed, not when it settles). C. Black-Out Periods Additionally, no director, officer or employee listed on Schedule I.B (as may be amended from time to time) shall purchase, sell or otherwise transact in any Company Securities during the period beginning at 11:59 p.m. Eastern time on the fourteenth calendar day before the end of any fiscal quarter of the Company and ending upon the completion of the second full trading day after the public release of earnings data for such fiscal quarter or during any other trading suspension period declared by the Company, except for purchases and sales pursuant to a previously approved Rule 10b5-1(c) Trading Plan (as described below). For example, if the Company’s fourth fiscal quarter ends on September 30, the corresponding black-out period would begin at 11:59 p.m. Eastern time on September 16. For the purposes of this Policy, a “trading day” is a day on which national stock exchanges in the United States are open for trading. Exceptions to the black-out period policy may be approved only by General Counsel or his, her or their designee (or, in the case of an exception for the General Counsel, the General Counsel’s designee or persons or entities subject to this Policy as a result of their relationship with the General Counsel or the designee, as the case may be, the Chief Financial Officer, or, in the case of exceptions for directors, the Board of Directors). From time to time, the Company, through the Board of Directors or the General Counsel, may recommend that directors, officers, employees or others suspend trading in Company Securities because of developments that have not yet been disclosed to the public. Subject to the exceptions noted above, all of those affected should not trade in Company Securities while the suspension is in effect and should not disclose to others that the Company has suspended trading. The fact that there is a trading suspension may constitute material, non-public information or information that may lead to rumors in the public market and must be kept strictly confidential. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF 12 D. Post-Termination Transactions With the exception of the pre-clearance requirement, this Policy continues to apply to transactions in Company Securities, securities of an entity with which the Company has a contractual relationship or may be negotiating a transaction, and securities of a competitor of the Company, even after termination of service to the Company. If an Insider is in possession of material, non-public information when his, her or their service terminates, that individual and related Covered Persons may not trade in Company Securities or the securities of any other entity to which that information relates until that information has become public or is no longer material. 5. ADDITIONAL PROHIBITED TRANSACTIONS Insiders and Covered Persons, as applicable, shall comply with the following policies with respect to certain transactions in Company Securities: A. Short Sales Short sales of Company Securities by Covered Persons are prohibited by this Policy. In addition, Section 16(c) of the Exchange Act absolutely prohibits Section 16 reporting persons from making sales of shares of the Company’s equity securities that the insider does not own at the time of sale, or sales of shares against which the insider does not deliver the shares within 20 days after the sale. B. Derivative Transactions Transactions in puts, calls or other derivative securities involving Company Securities by Covered Persons are prohibited by this Policy. This prohibition on derivatives trading does not preclude Covered Persons from exercising any employee stock option or stock appreciation right which may be issued to such Covered Person by the Company from time to time. However, other factors, such as general ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ rules or this Policy, may prohibit employees from simultaneously selling shares obtained from the exercise of these options or stock appreciation rights at various times. C. Hedging Transactions No Covered Person may engage in hedging or monetization transactions or similar arrangements designed to limit the financial risk of ownership of Company Securities, such as through prepaid variable forwards, equity swaps, collars and exchange funds. D. Purchases of Company Securities on Margin Purchasing on margin means borrowing from a brokerage firm, bank or other entity in order to purchase Company Securities (other than in connection with a cashless exercise of stock options through a broker under the Company’s equity plans). Margin purchases of Company Securities by Covered Persons are prohibited by this Policy. E. Pledging Company Securities to Secure Margin or Other Loans Covered Persons are prohibited from entering into margin loans, or other transactions involving the pledging of Company Securities as collateral under this Policy. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF
13 F. Regulation BTR If the Company is required to impose a pension fund “blackout period” under Regulation BTR, each director and executive officer shall not, directly or indirectly purchase, sell or otherwise acquire or transfer during such blackout period any equity securities of the Company acquired in connection with his, her or their service as a director or officer of the Company, except as permitted by Regulation BTR. 6. RULE 10b5-1(c) TRADING PLANS Transactions in Company Securities made pursuant to a previously established and approved “Rule 10b-5-1(c) Trading Plan” are not subject to the pre-clearance requirements or the black- out period policy. A Rule 10b5-1(c) Trading Plan must comply with the requirements of Rule 10b5-1(c) under the Exchange Act, as may be adopted or amended from time to time by the SEC. Rule 10b5-1(c) Trading Plans do not exempt individuals from complying with Section 16 short-swing profit rules or liability. Furthermore, Rule 10b5-1(c) Trading Plans that meet the requirements of applicable laws, rules and regulations only provide an “affirmative defense” in the event there is an ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ lawsuit. A Rule 10b5-1(c) Trading Plan does not prevent someone from bringing a lawsuit. Although transactions effected under a Rule 10b5-1(c) Trading Plan will not require further pre- clearance at the time of the trade, any transaction (including the quantity and price) made pursuant to a Rule 10b5-1(c) Trading Plan of a Section 16 reporting person must be reported to the Company promptly on the day of each trade to permit the Company’s filing coordinator to assist in the preparation and filing of a required Form 4. However, the ultimate responsibility and liability for timely filing remains with the Section 16 reporting person. The Company reserves the right from time to time to suspend, discontinue or otherwise prohibit any transaction in Company Securities, even pursuant to a previously approved Rule 10b5-1(c) Trading Plan, if the General Counsel or the Board of Directors, in his, her, their or its discretion, determines that such suspension, discontinuation or other prohibition is in the best interests of the Company. Any Trading Plan submitted for approval hereunder should explicitly acknowledge the Company’s right to prohibit transactions in Company Securities. Failure to discontinue purchases and sales as directed shall constitute a violation of the terms of this Section 6 and result in a loss of the exemption set forth herein. 7. SAFEGUARDING CONFIDENTIAL INFORMATION If material information relating to the Company or its business has not been disclosed to the general public, such information must be kept in strict confidence and should be discussed only with persons who have a “need to know” of the information for a legitimate business purpose, except when disclosure is authorized, legally mandated or made in cooperation with a government investigation. The utmost care and circumspection must be exercised at all times in order to protect the Company’s confidential information. The following practices should be followed to help prevent the misuse of confidential information: avoid discussing confidential information in places where you may be overheard by people who do not have a valid need to know of such information, such as on elevators, in restaurants and on trains, buses, taxis, rideshares or airplanes; Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF 14 do not discuss confidential information with relatives or social acquaintances; do not give your computer IDs and passwords to any other person; password protect computers and log off when they are not in use and use privacy screens; always put confidential documents away when not in use and, based upon the sensitivity of the material, keep such documents in a locked desk or office; do not leave documents containing confidential information where they may be seen by persons who do not have a need to know of the content of the documents; comply with the specific terms of any confidentiality agreements of which you are aware; upon termination of your employment, engagement or assignment with the Company you must return to the Company all physical (including electronic) copies of confidential information as well as all other material embodied in any physical or electronic form that is based on or derived from such information, without retaining any copies; you may not bring the confidential information of any former employer or other entity for which you were a contractor, advisor, consultant or similar role to the Company; and you must always respect the confidential information of third parties and never unlawfully use such information on behalf of the Company or otherwise. 8. RESPONDING TO REQUESTS FOR INFORMATION You may find yourself the recipient of questions concerning various activities of the Company. Such inquiries can come from the media, securities analysts and others regarding the Company’s business, rumors, trading activity, current and future prospects and plans, acquisition or divestiture activities and other similar important information. Under no circumstances should you attempt to handle these inquiries without prior authorization. Only executive officers of the Company are authorized to answer questions about or disclose information concerning the Company to the media or public. Refer requests for information regarding the Company from the financial community, such as securities analysts, brokers or investors, to the Chief Financial Officer or Vice President, Investor Relations & Corporate Development. Refer requests for information regarding the Company from the media or press to the Director, Marketing. Refer requests for information from the SEC or other regulators to the General Counsel. 9. REPORTING VIOLATIONS/SEEKING ADVICE You should refer suspected violations of this Policy or any policy applicable to the Company to the General Counsel. In addition, if you: receive material, non-public information that you are not authorized to receive or that you do not legitimately need to know to perform your employment, engagement or assignment responsibilities; or receive confidential information and are unsure if it is within the definition of material, non-public information or whether its release might be contrary to a fiduciary or other duty or obligation. In each case, you should not share such information with anyone or transact in any Company Securities or any other relevant securities based on such information. When in doubt, you should assume that such information is material, non-public information. To seek advice about Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF 15 what to do under those circumstances, you should contact the General Counsel. Consulting your colleagues can have the effect of exacerbating the problem. Containment of the information, until the legal implications of possessing it are determined, is critical. 10. PENALTIES FOR VIOLATIONS OF THE ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ POLICY AND LAWS In the United States and many other countries, the personal consequences to you of illegally trading securities using material, non-public information and/or tipping can be severe. Certain securities laws provide that an individual is subject to possible imprisonment and significant fines. Such penalties can be applied even to persons who do not personally profit from their activities. These laws apply to all employees—not just directors, officers, investment bankers and lawyers. The Company will not be responsible for the legal costs and expenses of any Covered Person who violates any ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ laws. Subject to applicable law, Covered Persons who violate this Policy may also be subject to discipline by the Company, up to and including termination of employment, engagement or assignment, even if the country or jurisdiction where the conduct took place does not regard it as illegal and such conduct by Covered Persons may be taken into account for determination of the compensation and bonuses of such Covered Person, if an Insider, or of the Insider which makes such person a Covered Person otherwise. If you are located or engaged in dealings outside the United States, be aware that laws regarding ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ and similar offenses differ from country to country. Covered Persons must abide by the laws in the country where located. However, you are required to comply with this Policy even if local law is less restrictive. If a local law conflicts with this Policy, you must consult the General Counsel. 11. COMPANY ASSISTANCE AND EDUCATION A. Education The Company shall take reasonable steps designed to ensure that all directors, officers and employees of the Company are educated about, and periodically reminded of, U.S. federal securities law restrictions and Company policies regarding ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇. B. Assistance The Company shall provide reasonable assistance to all directors and executive officers, as requested by such directors and executive officers, in connection with the filing of Forms 3, 4 and 5 under Section 16 of the Exchange Act. However, the ultimate responsibility, and liability, for timely filing remains with the directors and executive officers. C. Limitation on Liability None of the Company, the General Counsel, the Chief Financial Officer, the Company’s other employees or the Company’s directors will have any liability for any delay in reviewing or approving, or refusal of, a request for pre-clearance submitted pursuant to Section 4.A or a Rule 10b5-1(c) Trading Plan submitted pursuant to Section 6. Notwithstanding any pre-clearance of a transaction pursuant to Section 4.A or review of a Rule 10b5-1(c) Trading Plan pursuant to Section 6, none of the Company, the General Counsel, the Chief Financial Officer, the Company’s other employees or the Company’s directors assumes any liability for the legality or consequences of such transaction or Rule 10b5-1(c) Trading Plan to the person engaging in or Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF 16 adopting such transaction or Rule 10b5-1(c) Trading Plan. Any decision made or action undertaken by the General Counsel, the Chief Financial Officer, or the Company’s other employees in connection with implementing this Policy or maintaining or enforcing its procedures is made or undertaken in such person’s capacity as an employee of the Company and not in their individual capacity. Symbotic ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ Policy (Originally adopted June 7, 2022, as amended effective 4-12-2023) Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF
Acknowledgment Form I have received and read the ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ Policy (the “Policy”) of Symbotic Inc. (the “Company”) and understand its contents. I agree to comply fully with the Policy and the Company’s related policies and procedures. I understand that I have an obligation to report any suspected violations of the Policy that I become aware of to the General Counsel of the Company. I acknowledge that the Policy does not, in any way, constitute an employment contract or an assurance of continued employment, engagement or assignment, as applicable. NAME (PRINTED): SIGNATURE: DATE: Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF October 31, 2024 ▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇ SCHEDULE I A. Employees considered to be Pre-Clearance Persons: All employees that are Vice Presidents and above All employees in the Finance Department All employees in the Legal Department All employees in Sales that are Directors and above B. Employees subject to Black-Out Periods: All employees are subject to Black-Out Periods Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF EXHIBIT C: SYMBOTIC LLC Information Resources Acceptable Use and Security Policy Effective January 1, 2018 Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF SYMBOTIC LLC INFORMATION RESOURCES ACCEPTABLE USE AND SECURITY POLICY Effective January 1, 2018 I. PURPOSE AND SCOPE Symbotic LLC (“Symbotic”) has adopted this Information Resources Acceptable Use and Security Policy (“Policy”) to ensure that Symbotic’s network, computer, telecommunications, acquired licenses, and data are used appropriately, and that Symbotic’s assets and those of its customers, partners and employees are kept secure. This Policy applies to: All Symbotic employees, temporary workers, independent contractors, vendors, agents, and other users of Symbotic’s internal technology and information resources (“you” or “users” as the context requires). Symbotic’s computer and telecommunications network, including but not limited to fax machines, host computers, file servers, application servers, communication servers, mail servers, scanners, fax servers, Web servers, workstations, stand-alone computers, printers, laptops, smartphones, desk phones, conference phones, video conferencing systems, portable/handheld telecommunications devices (i.e., cell phones, pagers, and head set systems), cameras, software, applications, data files, all internal and external computer, communications and collaboration networks (such as intranet systems, extranets, Wireless network, Internet, FTP, file sharing services, commercial online services, value added networks, Instant Messaging/Chat, social media sites, and e-mail systems), and portable file storage devices (USB, hard drives, SD cards) accessed directly or indirectly from Symbotic’s computer network (collectively referred to as the “Resources”). All physical, virtual or cloud-based Resources are covered by this Policy. This Policy also applies to your use of (1) non- Symbotic owned devices for which you receive reimbursement of service or usage charges and (2) non-Symbotic or personally owned devices that connect to Symbotic’s networks or Resources described above (e.g., personal devices that access Symbotic’s wireless network and personal smartphones or tablet devices that access your Symbotic email account). All information that Symbotic holds, stores or accesses that is not generally known to the public, whether the information is owned by Symbotic or its customers, business partners, employees or other people or entities with which Symbotic does business, including but not limited to trade secrets, proprietary information and all other information, documents, and materials, owned, licensed, developed, or possessed by Symbotic or any employee or agent of Symbotic, whether tangible or intangible, relating in any way to Symbotic’s research and development, customers, prospective customers, employee lists, business plans, business relationships, products or processes, costs or profit information or data from which that information could be derived, business methods, databases, computer programs and non-public and sensitive information about Symbotic’s employees, in all cases whether or not marked as “confidential” or “proprietary” (collectively referred to as “Proprietary Information”). Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF
You are expected and required to use Symbotic’s Resources and Proprietary Information responsibly and in a professional, ethical and lawful manner and to ensure the security of Symbotic’s Resources and Proprietary Information. You are also expected and required to assist Symbotic in investigating any potential or actual violations of this Policy. A violation of this Policy may result in disciplinary action, up to and including termination, and potential civil and criminal liability. Use of Symbotic’s Resources is a privilege that may be limited or revoked at any time, with or without cause and without notice, in Symbotic’s sole discretion. II. USE OF RESOURCES. The Resources constitute a valuable business asset of Symbotic and may be used only for approved purposes relating to Symbotic’s business. You are permitted access to the Resources to assist you in the performance of your job. Your occasional, limited and appropriate personal use of the Resources is permitted so long as the use does not: (1) interfere with your work performance, (2) interfere with any other User’s work performance, (3) adversely impact the operation of the Resources, (4) result in any non-trivial expense to Symbotic, (5) violate any law or regulation of any jurisdiction, or (6) violate any other provision of this Policy or any other policy, guideline or standard of Symbotic. III. NO EXPECTATION OF PRIVACY Anything created on, transmitted by or stored on the Resources may be reviewed by others, and deleted files may be recovered. Symbotic may monitor and record your use of the Resources at any time. You have no expectation or right of privacy of any kind related to your use of the Resources. You expressly consent to the access, monitoring and recording of your use of the Resources and waive any right of privacy or similar right in your use of the Resources. IV. OWNERSHIP OF INFORMATION ASSETS AND RESOURCES Symbotic exclusively owns all information and communications created, received, transmitted from or stored on or passed through the Resources, including but not limited to all of your and other Users’ documents, files, programs, e-mails, and instant messages, as well as the Resources themselves. V. PROHIBITED ACTIVITIES a. Inappropriate or Unlawful Material. You are prohibited from sending by e-mail or other form of electronic communication, downloading from the Internet or other online service, or displaying on, viewing on or storing in the Resources any materials that are fraudulent, sexually explicit, profane, obscene, intimidating, defamatory, or otherwise inappropriate, including any inappropriate comments that would reasonably offend someone on the basis of race, age, sex, sexual orientation, religion, national origin, veteran status or disability. You are also prohibited from using the Resources to distribute or collect responses to chain letters or pyramid schemes. If you become aware of or receive any of the materials described in this paragraph, you must immediately report the incident to your supervisor or Symbotic’s Human Resources (“HR”) department. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF b. Use for Personal or Third-Party Benefit. You may not use the Resources for your personal financial gain or for the benefit of any third party, including but not limited to the sale of any non-Symbotic products or services except as specifically authorized. c. Destructive Activities. You are prohibited from using the Resources to create, store or distribute any form of malicious or manipulative software (such as viruses, worms or other destructive code); to breach or circumvent the security of any host, network or account; or to engage in activities, such as network sniffing, pinged floods, packet spoofing, denial of service or forged routing information, that intentionally or maliciously disrupt network communication. d. Automatic Forwarding of E-mails to Non-Symbotic Accounts. You are not permitted to set up automatic forwarding rules to non-Symbotic Accounts. e. Sending Proprietary or Customer Data to a Personal Email Account. Sending or forwarding Proprietary Information or customer data to a personal email account is strictly prohibited unless expressly authorized by Symbotic’s Legal or Information Technology (“IT”) departments. Examples of personal email accounts can include ▇▇▇▇▇▇▇@▇▇▇▇▇.▇▇▇ or ▇▇▇▇▇▇▇@▇▇▇▇▇▇▇.▇▇▇. In cases where you may be interested in sending reading materials to a New Hire prior to his/her start date, check in with HR or IT prior to sending the material to the New Hire’s personal email address. f. File synching on Non Approved Platforms. Symbotic subscribes to a File sharing/synching service. This service is available to all team members, and can be accessed from work or home. The use of other similar but unapproved services, such as Dropbox or Carbonite, or of other related file sharing or synching systems is not allowed unless authorized by the Legal and IT Departments. VI. USE OF E- MAIL AND OTHER ELECTRONIC COMMUNICATIONS a. Electronic Communications – In General. When you send an e-mail or other electronic communication from your Symbotic account, you are representing Symbotic to the outside world. Your communications must therefore be of the highest professional caliber, reflecting dignity and respect. b. Altering Attribution Information. Electronic forgery is prohibited. You may never use another person’s email account to misrepresent the identity of the sender of any message or alter the “From” line or other attribution of origin information in a Symbotic e-mail. You may, however, send e-mails on behalf of another User who has specifically granted you the right to do so. c. Electronic Communications of Proprietary Information. As described in more detail below in Section VII, you must at all times take the utmost care to ensure that Proprietary Information is not disclosed to unauthorized individuals or entities. E-mail and other electronic communications require particular attention because they can easily be intercepted by or forwarded to individuals and entities other than the intended recipients. Therefore, you must use extra care when sending Proprietary Information electronically. For example, consider whether it is necessary to transmit the Proprietary Information electronically at all, or whether a fax or hard copy mailing achieves the same goal as an electronic communication. If an electronic communication is necessary, then you must do everything reasonable to ensure Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF the security of the Proprietary Information, including (1) ensuring that the message is clearly labeled in the subject line and the body of the message as “Confidential,” “Proprietary” or another similar designation; (2) keeping the address list for the message to a minimum; (3) ensuring all recipients are aware of the obligation to maintain the confidentiality of the information contained in the message; (4) encrypting the message, if possible; and (5) ensuring that the transmission of information is in accordance with applicable Symbotic policies, guidelines or standards, including this Policy and applicable law. d. Electronic Communications of Personal Information. Personal Information, which is defined in Section XIX below, and financial information must be protected from unauthorized access. Storage and transmission of such data are often subject to local and federal laws. Similar to Proprietary Information, you should consider whether it is necessary to transmit the Personal Information using Symbotic Resources. Transmission of such data will require encryption and/or password protected access to all systems involved. If electronic transmission of Personal Information is necessary, then you must ensure that the system housing the Personal Information is encrypted, the transmission of the message is encrypted, and any files used in the transmission of Personal Information is password protected and/or encrypted. In the event a fax machine is used, special care must be made to delete any stored log of transmitted files, and physical copies be removed from the fax machine area and stored in a secured physical location. VII. PROTECTION OF SYMBOTIC’ S RESOURCES AND PROPRIETORY INFORMATION Symbotic’s Resources and Proprietary Information are valuable assets of the company, and you are responsible for taking steps to ensure that these assets are not lost, damaged, or compromised. a. Disclosure of Proprietary Information – In General. It is each User’s responsibility to ensure that Proprietary Information is not disclosed to unauthorized individuals and entities, both within and outside the company. This includes but is not limited to complying with the following: (1) Do not disclose Proprietary Information to another party unless the party has signed a non-disclosure agreement. Even with a non-disclosure agreement in place, you should disclose to the party only the Proprietary Information that is strictly necessary for Symbotic’s business or relationship with that party. (2) Do not send Symbotic’s software to another party, or provide another party with access or download rights to Symbotic’s software, unless the party has signed a license agreement, software evaluation agreement or other appropriately protective agreement approved by the Legal department. (3) Do not upload or transmit Proprietary Information via the Internet, to your personally owned computer or to any other third party system except for legitimate business-related purposes. (4) Do not allow Symbotic employees or contractors to access the source code to Symbotic’s software unless they absolutely need it to perform their duties for Symbotic; and never disclose Symbotic’s source code to anyone outside of the Symbotic organization. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF (5) In some circumstances, it is illegal to share certain kinds of information with certain parties. For example, sharing Symbotic’s pricing or customer information with competitors may be considered a violation of United States and European antitrust laws. In general, it is against the law to collude with a competitor to set pricing in the marketplace or to divide customers or territories, and even a casual conversation with a competitor in which these kinds of information are shared could be construed as participating in illegal anti-competitive activities. b. Third Parties’ Proprietary Information. Symbotic often receives Proprietary Information belonging to its customers, business partners and other third parties. You may never disclose a third party’s Proprietary Information to another party without the consent of the owner of the Proprietary Information. Third party Proprietary Information should be maintained in a secure location, segregated from Symbotic’s information whenever possible to avoid inadvertent disclosure, and kept only as long as necessary to fulfill Symbotic’s obligations and comply with applicable laws. As soon as Symbotic is no longer required to keep a third party’s Proprietary Information, the Proprietary Information should be returned to the third party or destroyed in accordance with Symbotic’s non-disclosure agreement with the third party. c. Access to Resources. (1) Access Control. Symbotic’s HR and IT departments determine who is granted access to the Resources and how and when that access is terminated, including ensuring that each User’s access is terminated immediately after the User’s relationship with Symbotic ends. (2) Access within the Firewall. You may use and access Symbotic’s network from within Symbotic’s firewall so long as the system accessing the network is a Symbotic- owned system, or a special exception is granted to use a personal device; the system has current and functional anti-virus software and follows the IT department’s policies for securing personal computer resources; the system is patched in accordance with the IT department’s policies; and the system has not had its Symbotic-installed system fundamentally altered such that it poses a risk to any other computer system. The IT department has the authority to determine, in its sole discretion, compliance with these requirements, may require that all files and folders on the system accessing the Symbotic network be scanned, and may deny access or remove any computer from the network. At no time is a non-Symbotic computer permitted onto Symbotic’s core network without express permission from the IT department. Plugging in an external router or switch to the Symbotic network can bring down Symbotic’s network, and is not allowed without the approval of IT. (3) VPN Access. When accessing Resources from outside Symbotic’s firewall, you must use a method approved by the IT department, such as a virtual private network (“VPN”) with a VPN client approved by the IT department. Machines accessing Symbotic’s network, whether or not owned by Symbotic, are de facto extensions of the Symbotic network and thus are subject to this Policy and the IT department’s policies for securing computer resources. Dual (split) tunneling is not permitted; only one network connection is allowed via VPN. Only the IT department has authority to provide VPN or other outside-the-firewall access; no other department may implement remote access services. (4) Wireless Access. All wireless access points and base stations connected to Symbotic’s network must be registered with and approved by the IT department. All local Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF
area network (LAN) wireless access must use vendor products and security configurations approved by the IT department, including but not limited to a VPN configured to drop all unauthenticated and unencrypted traffic. The SSID must be configured in a manner that is consistent with the IT department’s naming conventions, and all SSID names must be approved by the IT department. (5) Use of IP Addresses. If you require an IP address range to support a Symbotic’s system, you will need to work with IT to define the appropriate IP address range before using an available IP address range. d. Passwords. You are encouraged to change your passwords to access Resources at least once every 90 days and to choose passwords that meet the standards of complexity suggested by the IT department. You must change default passwords in new applications and hardware (e.g., laptop, smartphones, and tablet devices) upon their installation for use in or with the Resources. You are responsible for safeguarding your passwords for access to the Resources and should avoid printing them, writing them down, storing them on-line, or giving them to others. You are responsible for all transactions made using your passwords. You may not access any Resources using another User’s password or account. IT’s current standards of complexity for network passwords are as follows: Passwords should contain at least eight characters. A password should not be reused until there have been at least twenty-four password change cycles. Passwords must be alphanumeric and should contain at least three out of the following four character types: o Upper case alphabetical character o Lower case alphabetical character o Numeric character o Symbol or punctuation (for example, @, #, *, etc.) Additionally, an account will be locked after 5 failed login attempts. Once an account is locked, it can not be reactivated for 15 minutes. This lockout duration is set up to buffer an account from being accessed through a brute force password hacking method. e. Anti-Virus Protection. Anti-virus software is installed on all Symbotic employee workstations running Microsoft or Mac operating systems. You are prohibited from turning off or disabling any Symbotic-installed anti-virus software without express permission from the IT department. Guests, contractors and remote Users connecting to Symbotic’s network, via a VPN or otherwise, are required to run updated anti-virus software on their systems, and the IT department reserves the right to review such systems to ensure compliance with this requirement. f. Unattended System Control. All systems with a local copy of email, or Proprietary Information or customer data will need to be secured through a password secured automatic lock-out feature when the system is not in use. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF g. Mobile Devices that Access Symbotic Email. All mobile devices that access or download from Symbotic’s email servers must be password protected. Each device will need to be protected with a passcode at least 4 characters long, Auto-Lock turned on, and Data Wipe after failed login attempts also turned on. Any mobile device that accesses Symbotic’s email system will be wiped if it is reported to be lost, or if employment for an individual ends without the device being disconnected from Symbotic’s email network. h. Building Security. Symbotic’s Facilities, HR and IT departments are responsible for issuing keys and access cards to Users for Symbotic’s offices and for collecting them when a User’s relationship with Symbotic terminates. Your key and access card are for your use only; do not give or lend them to anyone. Do not allow unauthorized people to enter or move around Symbotic’s offices unattended; all guests and visitors must be signed in according to each individual office location’s policies and procedures. Report all lost card keys so that we can disable the missing key and issue you a new key card. VIII. COMPLIANCE WITH LAWS AND LICENSES a. Compliance with Laws and Licenses – In General. In your use of the Resources, you must comply with all software licenses and all state, federal and international laws, including but not limited to export laws and restrictions. You also must comply with all other Symbotic policies and procedures in your use of the Resources, in addition to this Policy. b. Unlicensed Use. You must comply with all licenses associated with all software and other applications that you use on the Resources. Unless you have express permission from the IT department, you are prohibited from sharing user names, passwords and other log- in information or copies of third party software with other Users or third parties. If you have an evaluation copy of an application, then you may use the application only for limited evaluation purposes, as permitted by the evaluation license, and must delete the application from the Resources when the evaluation period has ended. If there is any doubt about whether you are authorized to install, log into or use an application on the Resources, check with the IT department. Both hardware and software related purchases, especially software purchases and renewals, need to be reviewed and approved by the IT department before the transaction is finalized. Any contract or expenditure that is not vetted through this process may result in either the vendor not being paid, or you not being reimbursed. c. Illegal Use of Copyrighted Material. You are prohibited from using, installing, downloading, copying or distributing on or from the Resources any copyrighted, trademarked or patented material of third parties except as permitted by legal principles of “fair use” or as authorized by a contract or license that an authorized manager has approved and executed. This includes but is not limited to “pirated” or other software products for which Symbotic or you do not have an active license, digitization and distribution of photographs from magazines, books, or other copyrighted sources, and copyrighted music, such as MP3 music files. If you have any questions about what copying is permitted, immediately contact the IT or Legal departments. IX. PROTECTION OF PERSONAL INFORMATION. Under Massachusetts law, “personal information” is a person’s last name and either first initial or first name, coupled with any of the following: (1) Social Security Number, (2) driver’s license number, (3) credit card number, or (4) account or debit card number with the password or code permitting access. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF You may not save any personal information to your laptop or desktop computer or to any CD, memory stick, portable or removable hard disk or other removable data storage medium unless the personal information is encrypted. In addition, if you become aware of any actual or potential unauthorized access or security breach involving personal information – for example, if you were registering for an Symbotic event with a credit card and noticed that you could view other registrants’ credit card information in addition to your own, or if you were to find a list of Symbotic employees and their Social Security Numbers lying unshredded in a trash bin – then notify the Legal and IT departments immediately. Symbotic is required by law to notify individuals of any unauthorized access or security breach involving the individuals’ personal information. X. AMENDMENT OF THIS POLICY. Symbotic may modify or terminate this Policy at any time. Modifications to this Policy become effective when the revised Policy is communicated to everyone. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF EXHIBIT D: 3rd Party Symbotic Network Access Request and Usage Agreement Protecting Symbotic information and Symbotic Information Systems Every vendor, consultant, or partner with access to the Symbotic network plays a critical role in protecting Symbotic information assets just as our employees do. Any 3rd party requesting access to the Symbotic network or information resources must read and sign this acknowledgment form before accessing Symbotic data or other information, systems, and/or networks. Information Security Policies Any applicable information security policies, procedures, and standards will be provided with this form. If explicit guidance is not provided and there is any uncertainty regarding what activities are allowed or not allowed on the Symbotic network or information resources, please consult with the Information Security team to confirm whether the activities are permissible. Vendor/Consultant Responsibility All vendors/consultants who work for Symbotic are responsible for protecting our Company’s information to ensure its availability, integrity, and confidentiality. Information can take many forms, and includes information that is stored or transmitted electronically, on paper, or even orally. To this end, all contractors, vendors, and contractual business partners must always be aware of their responsibilities for protecting company information and adhere to the Symbotic Information Security Policies, Standards and Procedures as they relate to the following: Access Requests All access to Symbotic networks, systems, or applications must be requested and authorized through the Symbotic Service Desk ticketing system (JIRA) and include the approval of the Symbotic employee sponsoring your network access. Logon ID and Passwords Logon IDs are necessary to control individual access to information on a computer. Passwords verify that the individual accessing the computer is, in fact, who they claim to be. You are responsible for any access made using your logon ID and password. You must not share your login account, each vendor that needs access will be given a unique login. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF
Keep your password confidential and do not share it. Do not use auto logons or similar procedures that contain your password. Make your password 8 characters and change your password when prompted or every 90 days. If your password has been compromised, change it immediately and notify the Symbotic security team. General Security Requirements In the event you are permitted onsite or remote access to any internal Symbotic systems you agree to: Only Connect to Symbotic systems in the manner and through the means authorized by Symbotic Not connect to, access, or use any Symbotic systems without prior authorization Not attempt to gain unauthorized access to any systems, infrastructure, or another user’s account. Restrict duration of access to only such period as when access is required. Lock workstations when leaving them unattended. Security Incident Reporting Requirements A Security Incident is any activity that ▇▇▇▇▇ or represents a potential or actual threat to a Symbotic System, facility, or data. Security Incidents typically meet one or more of the following criteria: The successful unauthorized access, use, disclosure, modification, or destruction of Symbotic data or systems The successful malicious interference of system operations in any information system processing information on behalf of Symbotic The loss of data through theft, device misplacement, or misplacement of hardcopy documents Any unauthorized access to a Symbotic facility If you feel you have observed a Security Incident, you must report it to the Symbotic employee sponsoring your network access, who will report it to the Information Security team. Symbotic Information Security Policies, Standards, and Procedures Please read the attached Policies, Standards, and Procedures which may be applicable to your access. Symbotic Information Resources Acceptable Use and Security Policy Technical Security Requirements The following security requirements must be met: Vendor/Consultant PC’s must only be connected to the Symbotic network via an authorized connection (Cisco AnyConnect with Multifactor Authentication) Vendor/Consultant PC’s must have up to date anti-virus software installed. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF Vendor/Consultant PC’s must have up to date anti-virus signatures. Vendor/Consultant PC’s must have up to date operating system patches. Vendor/Consultant PC’s must have their network access restricted to only that which is necessary using the appropriate firewall rules I certify that I have read and agree to the terms in this document and the Symbotic Information Security Policies, Standards, and Procedures. I fully understand and agree to comply with all requirements and obligations *: Consultant Name (print): __________________________________________ Consultant (Signature): __________________________________________ Consultant Address: __________________________________________ Consultant Address: __________________________________________ Consultant Phone: __________________________________________ Consultant Email Address: __________________________________________ * Note: E-mail confirmation is acceptable. This agreement does not affect, modify, amend, or supersede existing agreements. It should be read consistent with, not replacing any other agreements your or your company have in place with Symbotic. Docusign Envelope ID: FD90F766-54D7-4AB6-A207-111E47EF9EAF ▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇