MASTER SERVICE AGREEMENT

Between

FAMILY LABS PTY LTD ACN 688 034 988 470 St Kilda Road, Melbourne VIC 3004, Australia

and

MARSHALL TRADING {{client_registration_number}} {{client_registered_address}}

Effective Date: {{effective_date}} Agreement Reference: UGPENT0001 Version: 1.0

CONFIDENTIAL

1. DEFINITIONS AND INTERPRETATION

1.1 Definitions

In this Agreement, unless the context otherwise requires, the following terms have the meanings set out below:

“Agreement” means this Master Service Agreement, including all Schedules and Attachments, and any amendments agreed in writing between the Parties.

“Attachment” means any document attached to and forming part of this Agreement, including the Service Level Agreement (Attachment 1).

“Authorised Users” means those employees, agents, and independent contractors of the Client who are authorised by the Client to use the Platform, as specified in Schedule A.

“Business Day” means a day other than a Saturday, Sunday, or public holiday in the State of Victoria, Australia.

“Business Hours” means 09:00 to 18:00 AEST/AEDT on any Business Day.

“Client” means the party identified on the cover page of this Agreement.

“Client Data” means all data, information, and content uploaded, submitted, or generated by the Client or its Authorised Users through the Platform, including product data, supply chain information, sustainability metrics, and Digital Product Passport data.

“Commencement Date” means the Effective Date specified on the cover page of this Agreement.

“Confidential Information” means all information disclosed by one Party to the other in connection with this Agreement that is designated as confidential, or that ought reasonably to be considered confidential given the nature of the information or the circumstances of disclosure.

“Currency” or “$” means United States Dollars (USD), unless otherwise specified in Schedule B.

“DPP Credit” means a pre-allocated entitlement to create one Digital Product Passport through the Platform within a billing month, as specified in Schedule B.

“Digital Product Passport” or “DPP” means a unique, verifiable digital record created on the Protocol representing a physical product, containing product identity, material composition, environmental performance, repairability information, end-of-life instructions, supply chain data, and such other data fields as required under applicable Delegated Acts of the ESPR.

“Enterprise Dashboard” means the web-based application provided by Family Labs at app.universalgoods.org (or such successor URL as notified to the Client) through which the Client manages products, batches, Digital Product Passports, ownership, permissions, and related operations.

“ESPR” means the Ecodesign for Sustainable Products Regulation (EU) 2024/1781, as amended from time to time, and any Delegated Acts issued thereunder.

“Family Labs” or “Provider” means Family Labs Pty Ltd (ACN 688 034 988).

“Fees” means the Onboarding Fee, Subscription Fees, Overage Fees, and any other fees specified in Schedule B of this Agreement.

“Initial Term” means the period specified in Schedule A.

“Onboarding” means the process of integrating the Client’s systems with the Platform, including data mapping, connector configuration, governance framework setup, training, and go-live support, as scoped in Schedule B.

“Overage Fee” means the per-DPP fee payable by the Client for each Digital Product Passport created in a billing month in excess of the included monthly DPP Credit allocation, at the rate set out in Schedule B.

“Platform” means the Family Labs enterprise software-as-a-service platform built on the Universal Goods Protocol, comprising the Tokenisation Engine, Enterprise Dashboard, and associated APIs and integrations.

“Protocol” means the Universal Goods Protocol — the open set of standards, smart contracts, data schemas, and rules that enable the creation, management, and verification of Digital Product Passports.

“Renewal Term” means each successive period of 12 months following the expiry of the Initial Term or any preceding Renewal Term, unless terminated in accordance with this Agreement.

“Service Level Agreement” or “SLA” means the Service Level Agreement attached as Attachment 1, which sets out the availability targets, performance standards, support tiers, incident response times, and service credit remedies applicable to the Platform.

“Subscription Fee” means the recurring monthly or annual fee payable by the Client for access to the Platform and the included monthly DPP Credit allocation, as set out in Schedule B.

“Tokenisation” means the process of creating a Digital Product Passport — converting a physical product’s data into a verifiable digital asset anchored to a secure network.

“Tokenisation Engine” means the backend system that creates Digital Product Passports at scale, connecting to the Client’s ERP/PLM systems and converting product data into digital assets.

1.2 Interpretation

In this Agreement, unless the context otherwise requires: (a) references to clauses and schedules are to clauses and schedules of this Agreement; (b) references to Attachments are to documents attached to and forming part of this Agreement; (c) headings are for convenience only and do not affect interpretation; (d) the singular includes the plural and vice versa; (e) a reference to legislation includes any modification or re-enactment of it; (f) a reference to a Party includes its successors and permitted assigns; and (g) where any word or phrase is given a defined meaning, any other grammatical form of that word or phrase has a corresponding meaning.

1.3 Order of Precedence

In the event of any conflict or inconsistency between the documents forming this Agreement, the following order of precedence shall apply (highest to lowest): (a) the body of this Master Service Agreement; (b) Schedule C (Data Processing Agreement); (c) Attachment 1 (Service Level Agreement); (d) Schedule B (Fees and Onboarding Scope); (e) Schedule A (Client Details and Agreement Parameters).

2. SERVICE DESCRIPTION

2.1 Platform Services

Family Labs shall provide the Client with access to the Platform, which enables the Client to:

(a) create, manage, and maintain EU ESPR-compliant Digital Product Passports for the Client’s physical products;

(b) integrate product and supply chain data from the Client’s existing ERP, PLM, and other enterprise systems via the Tokenisation Engine;

(c) manage product batches, ownership records, permissions, and lifecycle data through the Enterprise Dashboard;

(d) enable end consumers to verify product authenticity and claim ownership of Digital Product Passports;

• (e) access AI-powered supply chain intelligence and supplier data procurement capabilities; and

(f) utilise programmable settlement infrastructure for B2B cross-border payments, where applicable.

2.2 Nature of Service

The Client acknowledges and agrees that:

(a) Family Labs provides the Platform as a business-to-business software-as-a-service (SaaS) solution. Family Labs is an integrator and technology provider, and does not provide financial services, custody services, or act as a financial intermediary.

(b) The Client is solely responsible for authorising and signing all transactions relating to its Digital Product Passports. Family Labs does not sign, submit, or relay transactions on behalf of the Client. The Platform provides a passive interface through which the Client and its Authorised Users execute transactions directly.

(c) Digital Product Passports created through the Platform are anchored to a secure, distributed network. The availability of the underlying network infrastructure is subject to the terms set out in the Service Level Agreement (Attachment 1).

(d) The Platform is designed to support the Client’s compliance with the ESPR and applicable Delegated Acts. However, Family Labs does not provide legal, regulatory, or compliance advice, and the Client remains solely responsible for ensuring its own compliance with all applicable laws and regulations.

2.3 Service Levels

Family Labs shall deliver the Platform in accordance with the service levels, availability targets, support standards, and incident response commitments set out in the Service Level Agreement (Attachment 1). The Service Level Agreement forms an integral part of this Agreement.

2.4 Service Boundaries

The following are expressly excluded from the scope of this Agreement unless separately agreed in writing:

(a) legal, regulatory, or compliance advisory services;

(b) physical product labelling, tagging, or NFC/QR code procurement and application;

(c) supply chain auditing or physical verification of supplier claims;

(d) third-party system licences (ERP, PLM, or other enterprise software);

• (e) custom software development beyond the scope specified in Schedule B; and

(f) consumer-facing support for end users of the Client’s products.

3. ONBOARDING AND IMPLEMENTATION

3.1 Onboarding Scope

Family Labs shall perform the Onboarding services described in Schedule B, which include integration scoping, data mapping, ERP/PLM connector configuration, governance framework setup, DPP template creation, consulting services, training, and go-live support.

3.2 Onboarding Timeline

Family Labs shall use commercially reasonable efforts to complete Onboarding within the timeline specified in Schedule B. The Parties acknowledge that the Onboarding timeline is dependent on the Client’s timely provision of access, data, and cooperation as set out in Clause 4, and on the timely cooperation of any third-party systems or partners required for integration (including, where applicable, point-of-sale partners).

3.3 Deemed Performance

Family Labs' Phase 1 obligations under this Agreement shall be deemed performed upon delivery of the 45,000 DPPs comprising the Phase 1 allocation to the Client's designated environment (“Delivery”). The Client shall have 10 Business Days following Delivery to notify Family Labs in writing of any material defects in the delivered DPPs (“Defect Notice Period”). Family Labs shall use commercially reasonable efforts to remedy any notified defects within 10 Business Days of receipt of such notice. If the Client does not provide written notice of material defects within the Defect Notice Period, the Phase 1 allocation shall be deemed accepted as delivered.

3.4 Training

Family Labs shall provide the Client with reasonable training on the use of the Platform, as specified in Schedule B. Additional training beyond the initial scope may be provided at Family Labs’ then-current professional services rates.

4. CLIENT OBLIGATIONS

4.1 General Obligations

The Client shall:

(a) provide Family Labs with timely access to all systems, data, personnel, and information reasonably required for Onboarding and ongoing service delivery;

(b) ensure that Client Data is accurate, complete, and provided in the formats reasonably specified by Family Labs;

(c) ensure that all Authorised Users comply with any acceptable use policies communicated by Family Labs;

(d) maintain appropriate security measures for its own systems and access credentials;

(e) promptly notify Family Labs of any security incidents, unauthorised access, or suspected breaches affecting the Platform or Client Data;

(f) obtain and maintain all necessary consents, licences, and authorisations required for the processing of data through the Platform; and

(g) not use the Platform for any purpose that is unlawful, fraudulent, or in breach of any applicable laws or regulations.

4.2 Transaction Responsibility

The Client acknowledges and agrees that the Client and its Authorised Users are solely responsible for authorising, reviewing, and confirming all transactions executed through the Platform. Family Labs shall have no liability for any transaction authorised by the Client or its Authorised Users, including the creation, transfer, or modification of Digital Product Passports.

4.3 Data Accuracy

The Client is solely responsible for the accuracy and completeness of all product data, supply chain information, sustainability metrics, and other data submitted to the Platform. Family Labs does not verify or audit the truthfulness of Client Data, and shall have no liability for any regulatory non-compliance, inaccuracy, or loss arising from incorrect or incomplete Client Data.

5. FEES AND PAYMENT

5.1 Fee Structure

The Client shall pay the Fees specified in Schedule B, comprising:

(a) Onboarding Fee: A one-time fee payable upon execution of this Agreement, covering integration scoping, data mapping, connector configuration, consulting services, training, and go-live support as detailed in Schedule B.

(b) Subscription Fee: An optional recurring fee, commencing only upon written election by the Client, payable monthly in advance (or annually in advance, where annual prepayment is elected), covering Platform access, maintenance, support services (as per the applicable support tier in the SLA), AI-powered supply chain intelligence capabilities, programmable settlement infrastructure access, and the included monthly allocation of DPP Credits set out in Schedule B. The first Subscription Fee is payable on the first day of the calendar month following the Client's written election.

(c) Overage Fee: A per-DPP fee payable for Digital Product Passports created, at the applicable rate set out in Schedule B. Where the Client holds an active Subscription, the Overage Fee applies only to DPPs created in a billing month in excess of the included monthly DPP Credit allocation, at the rate of USD $0.03 per DPP. Where the Client does not hold an active Subscription, all DPPs created are charged at the standalone rate of USD $0.05 per DPP. Overage Fees are invoiced monthly in arrears based on actual DPP volume.

5.2 Invoicing and Payment Terms

(a) The Onboarding Fee shall be invoiced upon execution of this Agreement and is payable within 14 days of the invoice date.

(b) Subscription Fees shall be invoiced in accordance with the billing cadence elected by the Client in Schedule B (monthly in advance or annually in advance), within the first 5 Business Days of the relevant billing period.

(c) Overage Fees, if any, shall be invoiced monthly in arrears within the first 5 Business Days of each calendar month for the preceding month’s overage volume.

(d) All invoices are payable within 30 days of the invoice date unless otherwise specified in Schedule B.

(e) All Fees are stated exclusive of any GST, VAT, withholding tax, sales tax, or other taxes, duties, or levies. Where the Services qualify as GST-free exports under the A New Tax System (Goods and Services Tax) Act 1999 (Cth), no Australian GST will be charged. The Client is responsible for any taxes arising in its own jurisdiction, including any reverse-charge VAT obligations under the Norwegian Value Added Tax Act or equivalent legislation.

5.3 DPP Credits and Overage

The included monthly DPP Credit allocation set out in Schedule B is calculated on a per-billing-month basis. Unused DPP Credits do not roll over from one billing month to the next. Where the Client holds an active Subscription and the number of Digital Product Passports created in a billing month exceeds the included monthly allocation, the excess shall be charged at the applicable Overage Fee rate set out in Schedule B. Where the Client does not hold an active Subscription, all DPPs created are charged at the standalone Overage Fee rate set out in Schedule B.

5.4 Annual Prepayment Discount

If the Client elects to prepay the Subscription Fee on an annual basis, the discounted annual rate set out in Schedule B shall apply. Annual prepayments are non-refundable except as expressly provided in this Agreement.

5.5 Fee Review

Family Labs may increase Fees no more than once per 12-month period, by providing the Client with at least 90 days’ written notice prior to the commencement of any Renewal Term. Any increase shall not exceed the greater of: (a) 5% of the then-current Fees; or (b) the percentage increase in the United States Consumer Price Index (CPI-U) over the preceding 12-month period. The Client may terminate this Agreement without penalty within 30 days of receiving such notice if the Client does not accept the revised Fees.

5.6 Late Payment

If any amount payable under this Agreement remains unpaid for more than 14 days after the due date, Family Labs may: (a) charge interest on the overdue amount at a rate of 2% above the Reserve Bank of Australia cash rate, calculated daily and compounding monthly; and (b) suspend access to the Platform upon 7 days’ written notice, until all outstanding amounts are paid in full. Suspension of service does not relieve the Client of its obligation to pay outstanding Fees.

5.7 Disputed Invoices

If the Client disputes any invoice in good faith, the Client shall: (a) notify Family Labs in writing within 14 days of the invoice date, specifying the nature and basis of the dispute; and (b) pay all undisputed amounts by the due date. The Parties shall use commercially reasonable efforts to resolve any invoice dispute within 30 days. Family Labs shall not suspend service in respect of amounts that are subject to a bona fide dispute.

5.8 Marketplace and Protocol Fees

The Client acknowledges that secondary-market transactions involving Digital Product Passports created through the Platform are governed by the rules of the Protocol, which may from time to time include marketplace fees payable to Family Labs and protocol fees payable to the Universal Goods Foundation. Such fees are paid by transacting buyers at the point of transaction via the Protocol’s settlement mechanism, are independent of the Fees payable under this Agreement, and do not require the Client to fund or remit such fees from its own treasury.

6. DATA HANDLING AND SECURITY

6.1 Data Ownership

The Client retains all rights, title, and interest in and to Client Data. Family Labs acquires no ownership rights in Client Data by virtue of this Agreement. Family Labs shall process Client Data solely for the purpose of providing the Platform and performing its obligations under this Agreement.

6.2 Data Processing

Where Client Data includes personal data within the meaning of the Australian Privacy Act 1988 (Cth), the EU General Data Protection Regulation (EU) 2016/679, the Norwegian Personal Data Act, or any other applicable data protection legislation, the Parties shall comply with the Data Processing Agreement set out in Schedule C. Where there is any conflict between this Agreement and the Data Processing Agreement, the Data Processing Agreement shall prevail in respect of data protection matters.

6.3 Security Measures

Family Labs shall implement and maintain industry-standard technical and organisational security measures appropriate to the nature and sensitivity of Client Data, including:

(a) encryption of Client Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);

(b) access controls, including role-based access, multi-factor authentication for administrative access, and the principle of least privilege;

(c) regular security assessments, vulnerability scanning, and penetration testing;

(d) secure software development practices, including code review and dependency management;

(e) incident detection, logging, and monitoring;

(f) business continuity and disaster recovery measures, including regular backups with a recovery point objective (RPO) of 24 hours and a recovery time objective (RTO) of 4 hours; and

(g) staff training on information security and data protection.

6.4 Data Location

Client Data shall be hosted on Microsoft Azure infrastructure located in EU West. Family Labs shall not transfer Client Data outside the agreed hosting region without the Client’s prior written consent, except where necessary for the provision of the Platform (for example, anchoring DPP data to the underlying distributed network).

6.5 Data Portability and Deletion

Upon termination or expiry of this Agreement, or upon reasonable written request during the term, Family Labs shall: (a) make available to the Client a complete export of Client Data in a standard, machine-readable format (JSON or CSV) within 30 days; and (b) delete all Client Data from Family Labs’ systems within 90 days of termination, unless retention is required by law. For the avoidance of doubt, Digital Product Passport records anchored to the distributed network cannot be deleted from the network, but the Client’s Platform account and associated off-chain data shall be deleted in accordance with this clause.

6.6 Security Breach Notification

Family Labs shall notify the Client without undue delay and in any event within 72 hours of becoming aware of any security breach that affects Client Data. The notification shall include: (a) the nature of the breach; (b) the categories and approximate number of records affected; (c) the likely consequences; and (d) the measures taken or proposed to address the breach.

7. INTELLECTUAL PROPERTY

7.1 Family Labs IP

Family Labs retains all rights, title, and interest in and to the Platform, the Tokenisation Engine, the Enterprise Dashboard, all associated software, documentation, APIs, algorithms, user interfaces, and all intellectual property rights therein. Nothing in this Agreement transfers ownership of any Family Labs intellectual property to the Client.

7.2 Protocol

The Universal Goods Protocol is open infrastructure governed separately from the Family Labs commercial Platform. The Client’s use of the Protocol is subject to the applicable open-source licence terms. Nothing in this Agreement restricts the Client’s rights under any applicable open-source licence.

7.3 Client IP

The Client retains all rights, title, and interest in and to Client Data, the Client’s trademarks, product designs, and all intellectual property provided by the Client in connection with this Agreement. The Client grants Family Labs a non-exclusive, royalty-free, worldwide licence to use Client Data solely for the purpose of providing the Platform and performing its obligations under this Agreement.

7.4 Digital Product Passports

Digital Product Passports created through the Platform are owned by the Client (or, following transfer, by the applicable transferee in accordance with the Protocol rules). Family Labs acquires no ownership interest in any Digital Product Passport created by or on behalf of the Client.

7.5 Feedback

If the Client provides feedback, suggestions, or improvement ideas regarding the Platform, Family Labs may use such feedback without restriction or obligation. For the avoidance of doubt, feedback does not include Client Data or the Client’s Confidential Information.

8. CONFIDENTIALITY

8.1 Obligations

Each Party shall: (a) keep the other Party’s Confidential Information strictly confidential; (b) not disclose Confidential Information to any third party without the prior written consent of the disclosing Party; and (c) use Confidential Information solely for the purposes of this Agreement. Each Party may disclose Confidential Information to its employees, officers, advisors, and subcontractors who have a genuine need to know, provided that such persons are bound by obligations of confidentiality no less restrictive than those in this Agreement.

8.2 Exceptions

The obligations in Clause 8.1 do not apply to information that: (a) is or becomes publicly available other than through a breach of this Agreement; (b) was known to the receiving Party before disclosure; (c) is independently developed by the receiving Party without reference to Confidential Information; or (d) is required to be disclosed by law, regulation, or order of a court or regulatory authority, provided that the receiving Party gives the disclosing Party reasonable prior notice where legally permitted.

8.3 Duration

The obligations of confidentiality under this Clause 8 shall survive termination or expiry of this Agreement for a period of 3 years.

9. WARRANTIES AND REPRESENTATIONS

9.1 Mutual Warranties

Each Party warrants and represents that: (a) it has the legal right, power, and authority to enter into and perform this Agreement; (b) the execution of this Agreement does not breach any other agreement to which it is a party; and (c) it shall comply with all applicable laws and regulations in the performance of its obligations.

9.2 Family Labs Warranties

Family Labs warrants that: (a) the Platform will perform materially in accordance with its documentation; (b) Family Labs will provide the services with reasonable skill and care; and (c) Family Labs will use commercially reasonable efforts to ensure the Platform is free from viruses, malware, and other malicious code at the point of delivery.

9.3 Disclaimer

Except as expressly stated in this Agreement, all warranties, conditions, and terms (whether express or implied by statute, common law, or otherwise) are excluded to the maximum extent permitted by law. Family Labs does not warrant that the Platform will be uninterrupted or error-free, that all defects will be corrected, or that the Platform will meet the Client’s specific requirements beyond the functionality described in the documentation. Family Labs does not warrant the continued availability, performance, or functionality of any third-party network or infrastructure on which the Platform depends.

10. LIMITATION OF LIABILITY

10.1 Cap on Liability

Subject to Clause 10.3, each Party's total liability under this Agreement (including the SLA) shall not exceed the Fees paid by the Client in the 12 months preceding the claim.

10.2 Excluded Losses

Subject to Clause 10.3, neither Party shall be liable to the other for any: (a) indirect, special, incidental, or consequential loss or damage; (b) loss of profit, revenue, business, goodwill, anticipated savings, or data (whether direct or indirect); or (c) punitive or exemplary damages, in each case however arising and whether or not such loss was foreseeable.

10.3 Unlimited Liability

Nothing in this Agreement excludes or limits either Party’s liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any liability that cannot be excluded or limited by applicable law; or (d) breaches of Clause 8 (Confidentiality) or Clause 7 (Intellectual Property).

10.4 Essential Basis

The limitations in this Clause 10 reflect the allocation of risk between the Parties and form an essential basis of the bargain between them. The Fees payable under this Agreement reflect this allocation of risk and would be substantially higher without these limitations.

10.5 SLA Remedies

The Service Credits set out in the Service Level Agreement (Attachment 1) are the Client’s sole and exclusive remedy for any failure by Family Labs to meet the service levels specified therein. Service Credits do not reduce the liability cap in Clause 10.1.

11. TERM AND TERMINATION

11.1 Term

This Agreement commences on the Commencement Date and continues for the Initial Term specified in Schedule A. Upon expiry of the Initial Term, this Agreement shall automatically renew for successive Renewal Terms of 12 months each, unless either Party gives written notice of non-renewal at least 90 days before the expiry of the then-current term.

11.2 Termination for Cause

Either Party may terminate this Agreement immediately by written notice if the other Party: (a) commits a material breach of this Agreement and fails to remedy such breach within 30 days of receiving written notice specifying the breach; (b) becomes insolvent, enters into liquidation, has a receiver or administrator appointed, or makes an assignment for the benefit of creditors; or (c) ceases or threatens to cease carrying on business.

11.3 Termination for Convenience

After the Initial Term, either Party may terminate this Agreement for convenience by providing 90 days’ written notice to the other Party. The Client may not terminate for convenience during the Initial Term. Where this Agreement is terminated for convenience following the Initial Term, any prepaid Subscription Fees for the unused portion of the term shall be refunded on a pro-rata basis. For the avoidance of doubt, the Onboarding Fee is non-refundable upon execution of this Agreement, regardless of any subsequent termination.

11.4 Termination under SLA

The Client’s right to terminate this Agreement under the chronic failure provisions of the Service Level Agreement (Attachment 1) shall be in addition to, and without prejudice to, the Client’s rights under this Clause 11.

11.5 Effect of Termination

Upon termination or expiry of this Agreement: (a) the Client’s access to the Platform shall cease; (b) Family Labs shall comply with its data portability and deletion obligations under Clause 6.5; (c) each Party shall return or destroy the other Party’s Confidential Information; and (d) all Fees accrued prior to termination shall remain payable. Clauses 1, 5.8, 6.5, 7, 8, 10, 12, and 13 shall survive termination or expiry.

11.6 Transition Assistance

Upon request, Family Labs shall provide reasonable transition assistance for a period of up to 90 days following termination, at Family Labs’ then-current professional services rates. Transition assistance may include data export, migration support, and documentation handover.

12. FORCE MAJEURE

Neither Party shall be liable for any failure or delay in performing its obligations under this Agreement to the extent that such failure or delay results from a Force Majeure Event. A “Force Majeure Event” means any event beyond the reasonable control of the affected Party, including natural disaster, fire, flood, epidemic, pandemic, war, terrorism, civil unrest, government action, power failure, internet or telecommunications failure, or cyberattack (provided that reasonable security measures were in place). The affected Party shall: (a) notify the other Party as soon as reasonably practicable; (b) use commercially reasonable efforts to mitigate the impact; and (c) resume performance as soon as the Force Majeure Event ceases. If a Force Majeure Event continues for more than 60 consecutive days, either Party may terminate this Agreement upon written notice.

13. DISPUTE RESOLUTION

13.1 Good Faith Negotiation

In the event of any dispute arising out of or in connection with this Agreement, the Parties shall first attempt to resolve the dispute by good faith negotiation between senior representatives of each Party. Either Party may initiate this process by written notice to the other. The Parties shall meet (in person or by video conference) within 14 days of such notice.

13.2 Mediation

If the dispute is not resolved within 30 days of the notice under Clause 13.1, either Party may refer the dispute to mediation administered by the Australian Disputes Centre (ADC) in accordance with its mediation rules. The mediation shall be held in Melbourne, Victoria, or by video conference where the Parties agree.

13.3 Litigation

If the dispute is not resolved within 30 days of the commencement of mediation, either Party may commence court proceedings. Nothing in this clause prevents a Party from seeking urgent interlocutory or injunctive relief from a court of competent jurisdiction at any time.

14. GENERAL PROVISIONS

14.1 Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of Victoria, Australia. The Parties submit to the exclusive jurisdiction of the courts of Victoria and the Federal Court of Australia.

14.2 Notices

All notices under this Agreement shall be in writing and delivered by email to: (a) for Family Labs: james@universalgoods.org; and (b) for the Client: markus@marshalltrading.no. Notices are deemed received on the Business Day following the date of transmission.

14.3 Assignment

Neither Party may assign or transfer this Agreement or any of its rights or obligations without the prior written consent of the other Party, except that Family Labs may assign this Agreement to any successor entity in connection with a merger, acquisition, or sale of all or substantially all of its assets.

14.4 Subcontracting

Family Labs may engage subcontractors to perform any of its obligations under this Agreement, provided that Family Labs remains responsible for the performance of such obligations and ensures that any subcontractor is bound by obligations no less restrictive than those in this Agreement.

14.5 Entire Agreement

This Agreement, including all Schedules and Attachments, constitutes the entire agreement between the Parties with respect to its subject matter and supersedes all prior agreements, understandings, negotiations, and discussions, whether oral or written.

14.6 Amendment

This Agreement may only be amended by a written instrument signed by both Parties.

14.7 Waiver

No failure or delay by a Party in exercising any right or remedy under this Agreement shall constitute a waiver of that right or remedy. A waiver is effective only if given in writing and signed by the waiving Party.

14.8 Severability

If any provision of this Agreement is found to be invalid or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.

14.9 No Partnership or Agency

Nothing in this Agreement creates a partnership, joint venture, or agency relationship between the Parties. Neither Party has authority to bind the other or incur obligations on behalf of the other.

14.10 Counterparts

This Agreement may be executed in any number of counterparts, each of which is deemed an original, and all of which together constitute one agreement. Electronic signatures shall have the same legal effect as original signatures.

EXECUTION

This Agreement has been executed by the Parties on the date first written above.

Family Labs Pty Ltd· ACN 688 034 988

Name: James Albarracin

Title: Founder & CEO

Date: —

Family Labs Pty Ltd is bound by this Agreement upon issuance to the Client through the Family Labs signing platform.

Marshall Trading

Awaiting signature

Name: Markus Olsen

Title: Commercial Director

Date: —

SCHEDULE A — CLIENT DETAILS AND AGREEMENT PARAMETERS

SCHEDULE B — FEES AND ONBOARDING SCOPE

B.1 Fee Summary

All amounts are stated in United States Dollars (USD) and are exclusive of any applicable taxes (refer to Clause 5.2(e)).

B.2 Onboarding Scope (Phase 1)

The Onboarding Fee covers the design, build, configuration, and delivery of the Phase 1 implementation, comprising:

For the avoidance of doubt: the 45,000 DPPs delivered as part of Phase 1 are bundled into the Onboarding Fee and do not draw down from the monthly DPP Credit allocation under the Subscription Fee.

B.3 Production Subscription — Volume Credits and Overage

From Subscription Fee commencement, the Client receives a recurring monthly allocation of DPP Credits as set out below. The Subscription Fee is payable monthly in advance, or annually in advance at the discounted annual rate.

B.4 Out of Scope

The following items are expressly out of scope of the Onboarding Fee and, if required, will be quoted separately at Family Labs’ then-current professional services rates:

Custom development of new Coop-side ERP/POS connectors (assumed to be delivered by Coop or its integrator).

White-label re-skinning of the Consumer Wallet beyond standard branding configuration.

Onboarding of additional sub-brands, sub-clubs, or membership hubs beyond the initial scope agreed in writing.

Migration of historical product data predating the Phase 1 batch.

SCHEDULE C — DATA PROCESSING AGREEMENT

This Schedule sets out the terms on which Family Labs (as data processor) processes personal data on behalf of the Client (as data controller) in connection with the Platform.

C.1 Scope of Processing

Family Labs shall process personal data only to the extent necessary to provide the Platform. The categories of personal data, data subjects, and purposes of processing are as follows:

C.2 Processor Obligations

Family Labs shall: (a) process personal data only on documented instructions from the Client; (b) ensure that persons authorised to process personal data have committed to confidentiality; (c) implement appropriate technical and organisational security measures; (d) assist the Client with data subject rights requests and data protection impact assessments; (e) notify the Client of any personal data breach in accordance with Clause 6.6 of the MSA; (f) make available to the Client all information necessary to demonstrate compliance; and (g) delete or return all personal data upon termination in accordance with Clause 6.5 of the MSA.

C.3 Sub-processors

The Client provides general authorisation for Family Labs to engage sub-processors. Family Labs shall: (a) maintain a list of current sub-processors and make it available to the Client upon request; (b) notify the Client at least 30 days before engaging a new sub-processor; (c) ensure each sub-processor is bound by data protection obligations no less stringent than those in this Schedule; and (d) remain fully liable for the acts and omissions of its sub-processors.

C.4 International Transfers

Family Labs shall not transfer personal data outside the jurisdiction specified in Clause 6.4 of the MSA without appropriate safeguards in place, such as the Standard Contractual Clauses approved by the European Commission or equivalent transfer mechanisms recognised under the GDPR and Norwegian data protection law.

C.5 Audit Rights

The Client may, upon 30 days’ written notice and no more than once per 12-month period, audit Family Labs’ compliance with this Schedule. Audits shall be conducted during Business Hours and shall not unreasonably interfere with Family Labs’ operations. Alternatively, the Client may accept a third-party audit report (SOC 2 Type II or equivalent) as evidence of compliance.