AMENDED AND RESTATED MASTER SERVICE AGREEMENT

Standard Pay-As-You-Go Terms

Between

FAMILY LABS PTY LTD ACN 688 034 988 470 St Kilda Road, Melbourne VIC 3004, Australia

and

MARSHALL TRADING AS 992 317 795 Mjåvannssvingen 11, 4628 Kristiansand S, Norway

Effective Date: {{effective_date}} Agreement Reference: UGPAYG0001 Version: 5.0 - Amended and Restated (Family Labs Draft)

CONFIDENTIAL

Note on this Agreement. The body is Family Labs' standard Pay-As-You-Go (PAYG) template. The same terms apply to every PAYG client; deal-specific values (initial product line, dates, registration details) are carried in the Schedules. PAYG is a low-friction, self-serve tier covering Digital Product Passport creation, document-based supplier intelligence (Scout), stablecoin settlement activation, and core platform access, each priced as set out in Schedule B. Fully bespoke capabilities (automated end-to-end supplier data procurement, bespoke retail or point-of-sale integrations, consumer membership-hub builds) remain enterprise-tier and are provided only under a separate enterprise agreement.

1. DEFINITIONS AND INTERPRETATION

1.1 Definitions

In this Agreement, unless the context otherwise requires, the following terms have the meanings set out below:

"Agreement" means this Master Service Agreement, including all Schedules and Attachments, and any amendments agreed in writing between the Parties.

"Attachment" means any document attached to and forming part of this Agreement, including the Service Level Agreement (Attachment 1).

"Authorised Users" means those employees, agents, and independent contractors of the Client who are authorised by the Client to use the Platform, as specified in Schedule A.

"Business Day" means a day other than a Saturday, Sunday, or public holiday in the State of Victoria, Australia.

"Business Hours" means 09:00 to 18:00 AEST/AEDT on any Business Day.

"Client" means the party identified on the cover page of this Agreement.

"Client Data" means all data, information, and content uploaded, submitted, or generated by the Client or its Authorised Users through the Platform, including product data, supply chain information, sustainability metrics, and Digital Product Passport data.

"Commencement Date" means the Effective Date specified on the cover page of this Agreement.

"Confidential Information" means all information disclosed by one Party to the other in connection with this Agreement that is designated as confidential, or that ought reasonably to be considered confidential given the nature of the information or the circumstances of disclosure.

"Currency" or "$" means United States Dollars (USD), unless otherwise specified in Schedule B.

"DPP Credit" means a pre-paid credit, denominated in US Dollars, purchased by the Client through the Top-Up Facility and drawn down against the Platform Fees set out in Schedule B (including Product Registration Fees, Batch Fees, Item-Level DPP Fees, Scout Parsing Fees, and Supplier Connection Fees). For the avoidance of doubt, under this Agreement a DPP Credit is a pre-paid monetary balance and is not a one-to-one entitlement to a single Digital Product Passport.

"Digital Product Passport" or "DPP" means a unique, verifiable digital record created on the Protocol representing a physical product, containing product identity, material composition, environmental performance, repairability information, end-of-life instructions, supply chain data, and such other data fields as required under applicable Delegated Acts of the ESPR.

"Enterprise Dashboard" means the web-based application provided by Family Labs at app.universalgoods.org (or such successor URL as notified to the Client) through which the Client manages products, batches, Digital Product Passports, ownership, permissions, and related operations.

"ESPR" means the Ecodesign for Sustainable Products Regulation (EU) 2024/1781, as amended from time to time, and any Delegated Acts issued thereunder.

"Family Labs" or "Provider" means Family Labs Pty Ltd (ACN 688 034 988).

"Fees" means the Onboarding Fee, PAYG Fees, and any other fees specified in Schedule B of this Agreement.

"Onboarding" means the initial setup of the Client on the Platform, including DPP template configuration, account provisioning, training, and go-live support, as scoped in Schedule B.

"PAYG Fee" means the usage-based fees payable by the Client for Platform usage beyond the Onboarding scope, comprising Product Registration Fees, Batch Fees, Item-Level DPP Fees, Scout Parsing Fees, and Supplier Connection Fees, at the rates set out in Schedule B.

"Platform" means the Family Labs software-as-a-service platform built on the Universal Goods Protocol, comprising the Tokenisation Engine, the Enterprise Dashboard, the consumer claim and verification flow, and associated APIs and integrations.

"Protocol" means the Universal Goods Protocol, the open set of standards, smart contracts, data schemas, and rules that enable the creation, management, and verification of Digital Product Passports.

"Service Level Agreement" or "SLA" means the Service Level Agreement attached as Attachment 1, which sets out the availability target, support channels, and long-term DPP availability commitment applicable to the Platform.

"Term" means the period from the Commencement Date until this Agreement is terminated in accordance with Clause 11.

"Tokenisation" means the process of creating a Digital Product Passport, converting a physical product's data into a verifiable digital asset anchored to a secure network.

"Tokenisation Engine" means the backend system that creates Digital Product Passports at scale, connecting to the Client's product data sources and converting product data into digital assets.

"Top-Up Facility" means the self-serve payment facility (processed via Stripe) through which the Client purchases DPP Credits, as described in Clause 5.

1.2 Interpretation

In this Agreement, unless the context otherwise requires: (a) references to clauses and schedules are to clauses and schedules of this Agreement; (b) references to Attachments are to documents attached to and forming part of this Agreement; (c) headings are for convenience only and do not affect interpretation; (d) the singular includes the plural and vice versa; (e) a reference to legislation includes any modification or re-enactment of it; (f) a reference to a Party includes its successors and permitted assigns; and (g) where any word or phrase is given a defined meaning, any other grammatical form of that word or phrase has a corresponding meaning.

1.3 Order of Precedence

In the event of any conflict or inconsistency between the documents forming this Agreement, the following order of precedence shall apply (highest to lowest): (a) the body of this Master Service Agreement; (b) Schedule C (Data Processing Agreement); (c) Attachment 1 (Service Level Agreement); (d) Schedule B (Fees and Onboarding Scope); (e) Schedule A (Client Details and Agreement Parameters).

2. SERVICE DESCRIPTION

2.1 Platform Services

Family Labs shall provide the Client with access to the Platform, which enables the Client to:

(a) create, manage, and maintain EU ESPR-compliant Digital Product Passports for the Client's physical products;

(b) integrate product and supply chain data from the Client's existing systems via the Tokenisation Engine;

(c) manage product batches, ownership records, permissions, and lifecycle data through the Enterprise Dashboard; and

(d) enable end consumers to verify product authenticity and claim ownership of Digital Product Passports.

2.2 Nature of Service

The Client acknowledges and agrees that:

(a) Family Labs provides the Platform as a business-to-business software-as-a-service (SaaS) solution. Family Labs is an integrator and technology provider, and does not provide financial services, custody services, or act as a financial intermediary.

(b) The Client is solely responsible for authorising and signing all transactions relating to its Digital Product Passports. Family Labs does not sign, submit, or relay transactions on behalf of the Client. The Platform provides a passive interface through which the Client and its Authorised Users execute transactions directly.

(c) Digital Product Passports created through the Platform are anchored to a secure, distributed network. The availability of the underlying network infrastructure is subject to the terms set out in the Service Level Agreement (Attachment 1).

(d) The Platform is designed to support the Client's compliance with the ESPR and applicable Delegated Acts. However, Family Labs does not provide legal, regulatory, or compliance advice, and the Client remains solely responsible for ensuring its own compliance with all applicable laws and regulations.

2.3 Service Levels

Family Labs shall use commercially reasonable efforts to maintain Platform availability and performance. The Service Level Agreement (Attachment 1) sets out the availability target, the support channels available to the Client, and Family Labs' long-term DPP availability commitment. The Service Level Agreement forms an integral part of this Agreement.

2.4 Service Boundaries

The following are expressly excluded from the scope of this Agreement unless separately agreed in writing under a separate enterprise agreement:

(a) legal, regulatory, or compliance advisory services;

(b) physical product labelling, tagging, or NFC/QR code procurement and application;

(c) supply chain auditing or physical verification of supplier claims;

(d) third-party system licences (ERP, PLM, or other enterprise software);

(e) automated end-to-end supplier data procurement, bespoke retail or point-of-sale integrations, and consumer membership-hub builds (for the avoidance of doubt, document-based Scout parsing, Supplier Connections, and stablecoin settlement activation are within scope and priced under Schedule B);

(f) custom software development beyond the scope specified in Schedule B; and

(g) consumer-facing support for end users of the Client's products.

2.5 Client Business and Revenue Carve-Out

Family Labs acknowledges that Marshall Trading AS is party to this Agreement solely for the purpose of purchasing PAYG Digital Product Passport services for its own physical product batches, including the initial Axis batch and any future Marshall Trading product batches activated under this Agreement or a signed Order Form.

Nothing in this Agreement grants Family Labs any right, title, interest, fee, royalty, commission, audit right, revenue share, profit share or participation in Marshall Trading AS's product margins, retailer relationships, distribution business, customer relationships, product revenue, webshop revenue, brand revenue, marketing revenue, or any other non-DPP revenue stream.

For the avoidance of doubt, Family Labs is entitled only to the Fees expressly set out in Clause 5 and Schedule B unless the Parties sign a separate written agreement.

2.6 Open Protocol and No Lock-In

The Universal Goods Protocol is an open, permissionless public good, governed independently of Family Labs. The Platform is an optional, non-custodial convenience layer through which the Client interacts with the Protocol; it is not a gatekeeper to it. Each Digital Product Passport created by the Client is recorded on the Protocol, whose on-chain records persist independently of Family Labs. Accordingly:

(a) Family Labs does not, and shall not, revoke, suspend, gate, or condition the Client's access to its Digital Product Passports or the Protocol, whether during the Term or following termination or expiry of this Agreement;

(b) the Client may access, resolve, verify, and continue to operate its Digital Product Passports at any time, including independently of Family Labs, and Family Labs' long-term availability commitment in Clause 5 of the SLA applies regardless of the status of this Agreement; and

(c) this Agreement imposes no lock-in. The Client is free to cease using the Platform, and to use alternative providers or self-hosted tooling to interact with the Protocol, at any time and without penalty.

3. ONBOARDING AND IMPLEMENTATION

3.1 Onboarding Scope

Family Labs shall perform the Onboarding services described in Schedule B, which include DPP template configuration, account provisioning, training, and go-live support.

3.2 Onboarding Timeline

Family Labs shall use commercially reasonable efforts to complete Onboarding within the timeline specified in Schedule B. The Parties acknowledge that the Onboarding timeline is dependent on the Client's timely provision of access, data, and cooperation as set out in Clause 4.

3.3 Deemed Performance

Family Labs' Onboarding obligations under this Agreement shall be deemed performed upon delivery of the initial DPP allocation specified in Schedule B to the Client's designated environment ("Delivery"). The Client shall have 10 Business Days following Delivery to notify Family Labs in writing of any material defects in the delivered DPPs ("Defect Notice Period"). Family Labs shall use commercially reasonable efforts to remedy any notified defects within 10 Business Days of receipt of such notice. If the Client does not provide written notice of material defects within the Defect Notice Period, the initial DPP allocation shall be deemed accepted as delivered.

3.4 Training

Family Labs shall provide the Client with reasonable training on the use of the Platform, as specified in Schedule B. Additional training beyond the initial scope may be provided at Family Labs' then-current professional services rates.

4. CLIENT OBLIGATIONS

4.1 General Obligations

The Client shall:

(a) provide Family Labs with timely access to all systems, data, personnel, and information reasonably required for Onboarding and ongoing service delivery;

(b) ensure that Client Data is accurate, complete, and provided in the formats reasonably specified by Family Labs;

(c) ensure that all Authorised Users comply with any acceptable use policies communicated by Family Labs;

(d) maintain appropriate security measures for its own systems and access credentials;

(e) promptly notify Family Labs of any security incidents, unauthorised access, or suspected breaches affecting the Platform or Client Data;

(f) obtain and maintain all necessary consents, licences, and authorisations required for the processing of data through the Platform; and

(g) not use the Platform for any purpose that is unlawful, fraudulent, or in breach of any applicable laws or regulations.

4.2 Transaction Responsibility

The Client acknowledges and agrees that the Client and its Authorised Users are solely responsible for authorising, reviewing, and confirming all transactions executed through the Platform. Family Labs shall have no liability for any transaction authorised by the Client or its Authorised Users, including the creation, transfer, or modification of Digital Product Passports.

4.3 Data Accuracy

The Client is solely responsible for the accuracy and completeness of all product data, supply chain information, sustainability metrics, and other data submitted to the Platform. Family Labs does not verify or audit the truthfulness of Client Data, and shall have no liability for any regulatory non-compliance, inaccuracy, or loss arising from incorrect or incomplete Client Data.

5. FEES AND PAYMENT

5.1 Fee Structure

The Client shall pay the Fees specified in Schedule B, comprising:

(a) Onboarding Fee: A one-time fee payable upon execution of this Agreement, covering Onboarding and the registration of the Client's initial Axis Socks product line, as specified in Schedule B.

(b) PAYG Fee: Usage-based fees payable for Platform usage beyond the Onboarding scope, charged per Product registered, per additional Batch, per Item-Level Digital Product Passport, per unstructured document parsed by Scout, and per Supplier Connection, and funded from pre-paid DPP Credits through the Top-Up Facility in accordance with Clause 5.3, at the rates set out in Schedule B.

5.2 DPP Compliance Services Only

Family Labs is entitled to payment only for (a) the Onboarding Fee and (b) PAYG Fees for Platform usage, as set out in Clause 5 and Schedule B. Family Labs makes no claim to, and is not entitled to any share of, the Client's product revenue, marketing revenue, brand revenue, or revenue from any service operated by the Client, whether or not such service is built on or connected to the Platform.

The Platform Fees set out in Schedule B are the all-in fees for standard PAYG Digital Product Passport creation and include tokenisation, blockchain gas, hosting, GS1 Digital Link resolution infrastructure, API access required for standard PAYG use, standard claim and verification flow, and standard PAYG support. No additional infrastructure, gas, hosting, protocol, API, resolution, scan, claim, verification or standard support fees shall be payable by the Client unless expressly agreed in a signed Order Form. Scout document parsing, Supplier Connections, and stablecoin settlement activation are separately-priced optional services, charged only when used, at the rates set out in Schedule B.

5.3 PAYG Billing via Top-Up

(a) Platform usage beyond the Onboarding scope is funded by pre-paid DPP Credits, which are drawn down against the fees set out in Schedule B (Product Registration Fees, Batch Fees, Item-Level DPP Fees, Scout Parsing Fees, and Supplier Connection Fees). DPP Credits are a pre-paid monetary balance denominated in US Dollars and are not tied to a fixed number of Digital Product Passports.

(b) The Client purchases DPP Credits through the Top-Up Facility (processed via Stripe), subject to the Minimum Top-Up set out in Schedule B. DPP Credits are delivered to the Client's account upon successful payment. Each chargeable action draws down the applicable fee from the Client's DPP Credit balance.

(c) The Client is responsible for maintaining a sufficient DPP Credit balance to perform the chargeable actions it requires. The Platform will not perform a chargeable action where the Client has an insufficient DPP Credit balance, and no debt arises in respect of actions not performed.

(d) DPP Credits are valid for 24 months from the date of purchase and expire if unused after that period. On termination or expiry of this Agreement, any unused pre-paid DPP Credits are refunded to the Client in accordance with Clause 11.4.

(e) There is no monthly invoicing and no monthly subscription fee under this Agreement. Billing for Digital Product Passports is entirely self-serve through the Top-Up Facility.

5.4 Platform Fees and Price Changes

(a) The Platform Fees are set out in Schedule B and are, as at the Commencement Date: Product Registration USD $200 per Product (inclusive of the first Batch and unlimited variants), Additional Batch USD $49 per subsequent production run, Item-Level Digital Product Passport USD $0.35 per unit, Scout Parsing to be determined (TBD) and set by notice in accordance with paragraph (b) below, Supplier Connection USD $25 per supplier, and Stablecoin Settlement Activation USD $40 per entity (one-time).

(b) Family Labs may set any Platform Fee marked "TBD" in Schedule B, and may vary any Platform Fee, at any time on at least 30 days' prior written notice to the Client, which may be given through the Platform. Any fee so set or varied applies only to chargeable actions performed, and DPP Credits purchased, on or after the date it takes effect; DPP Credits already purchased are not affected. Until a Platform Fee marked "TBD" has been set and has taken effect, no fee is payable for the corresponding service. The Client is not obliged to use any service to which a Platform Fee applies and may cease using it at any time.

5.5 No Minimum Annual Volume

This Agreement does not impose a minimum annual volume or minimum annual spend. Billing is entirely pre-paid and usage-based through the Top-Up Facility, and the Client is under no obligation to register any minimum number of Products, create any minimum number of Digital Product Passports, or purchase any minimum quantity of DPP Credits in any period.

5.6 Onboarding Fee Payment

The Onboarding Fee shall be invoiced upon execution of this Agreement and is payable within 14 days of the invoice date, or paid through the Top-Up Facility upon execution.

5.7 Taxes

All Fees are stated exclusive of any GST, VAT, withholding tax, sales tax, or other taxes, duties, or levies. Where the services qualify as GST-free exports under the A New Tax System (Goods and Services Tax) Act 1999 (Cth), no Australian GST will be charged. The Client is responsible for any taxes arising in its own jurisdiction, including any reverse-charge VAT obligations under the Norwegian Value Added Tax Act or equivalent legislation.

5.8 Disputed Invoices

If the Client disputes any invoice in good faith, the Client shall: (a) notify Family Labs in writing within 14 days of the invoice date, specifying the nature and basis of the dispute; and (b) pay all undisputed amounts by the due date. The Parties shall use commercially reasonable efforts to resolve any invoice dispute within 30 days.

5.9 Marketplace and Protocol Fees

The Client acknowledges that secondary-market transactions involving Digital Product Passports created through the Platform are governed by the rules of the Protocol, which may from time to time include marketplace fees payable to Family Labs and protocol fees payable to the Universal Goods Foundation. Such fees are paid by transacting buyers at the point of transaction via the Protocol's settlement mechanism, are independent of the Fees payable under this Agreement, and do not require the Client to fund or remit such fees from its own treasury.

For the avoidance of doubt, the Client shall not be liable for any marketplace or protocol fees arising from consumer scans, consumer claims, verification events, ordinary DPP resolution, ordinary use of QR codes, or ordinary access to Digital Product Passport records. Any marketplace or protocol fee payable by the Client must be expressly agreed in a separate signed Order Form.

6. DATA HANDLING AND SECURITY

6.1 Data Ownership

The Client retains all rights, title, and interest in and to Client Data. Family Labs acquires no ownership rights in Client Data by virtue of this Agreement. Family Labs shall process Client Data solely for the purpose of providing the Platform and performing its obligations under this Agreement.

6.2 Data Processing

Where Client Data includes personal data within the meaning of the Australian Privacy Act 1988 (Cth), the EU General Data Protection Regulation (EU) 2016/679, the Norwegian Personal Data Act, or any other applicable data protection legislation, the Parties shall comply with the Data Processing Agreement set out in Schedule C. Where there is any conflict between this Agreement and the Data Processing Agreement, the Data Processing Agreement shall prevail in respect of data protection matters.

6.3 Security Measures

Family Labs shall implement and maintain industry-standard technical and organisational security measures appropriate to the nature and sensitivity of Client Data, including:

(a) encryption of Client Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);

(b) access controls, including role-based access, multi-factor authentication for administrative access, and the principle of least privilege;

(c) regular security assessments, vulnerability scanning, and penetration testing;

(d) secure software development practices, including code review and dependency management;

(e) incident detection, logging, and monitoring;

(f) business continuity and disaster recovery measures, including regular backups with a recovery point objective (RPO) of 24 hours and a recovery time objective (RTO) of 4 hours; and

(g) staff training on information security and data protection.

6.4 Data Location

Client Data shall be hosted on Microsoft Azure infrastructure located in EU West. Family Labs shall not transfer Client Data outside the agreed hosting region without the Client's prior written consent, except where necessary for the provision of the Platform (for example, anchoring DPP data to the underlying distributed network).

6.5 Data Portability and Deletion

Upon termination or expiry of this Agreement, or upon reasonable written request during the term, Family Labs shall: (a) make available to the Client a complete export of Client Data in a standard, machine-readable format (JSON or CSV) within 30 days; and (b) delete all Client Data from Family Labs' systems within 90 days of termination, unless retention is required by law. For the avoidance of doubt: (i) Digital Product Passport records anchored to the distributed network cannot be deleted from the network; (ii) the continued availability of published Digital Product Passport records is governed by Clause 5 (Long-Term DPP Availability) of the SLA and is an exception to the deletion obligation in this Clause 6.5; and (iii) the Client's Platform account, private account data, and personal data shall be deleted in accordance with this Clause 6.5 and Schedule C.

6.6 Security Breach Notification

Family Labs shall notify the Client without undue delay and in any event within 72 hours of becoming aware of any security breach that affects Client Data. The notification shall include: (a) the nature of the breach; (b) the categories and approximate number of records affected; (c) the likely consequences; and (d) the measures taken or proposed to address the breach.

7. INTELLECTUAL PROPERTY

7.1 Family Labs IP

Family Labs retains all rights, title, and interest in and to the Platform, the Tokenisation Engine, the Enterprise Dashboard, all associated software, documentation, APIs, algorithms, user interfaces, and all intellectual property rights therein. Nothing in this Agreement transfers ownership of any Family Labs intellectual property to the Client.

7.2 Protocol

The Universal Goods Protocol is open infrastructure governed separately from the Family Labs commercial Platform. The Client's use of the Protocol is subject to the applicable open-source licence terms. Nothing in this Agreement restricts the Client's rights under any applicable open-source licence.

7.3 Client IP

The Client retains all rights, title, and interest in and to Client Data, the Client's trademarks, product designs, and all intellectual property provided by the Client in connection with this Agreement. The Client grants Family Labs a non-exclusive, royalty-free, worldwide licence to use Client Data solely for the purpose of providing the Platform and performing its obligations under this Agreement.

7.4 Digital Product Passports

Digital Product Passports created through the Platform are owned by the Client (or, following transfer, by the applicable transferee in accordance with the Protocol rules). Family Labs acquires no ownership interest in any Digital Product Passport created by or on behalf of the Client.

7.5 Feedback

If the Client provides feedback, suggestions, or improvement ideas regarding the Platform, Family Labs may use such feedback without restriction or obligation. For the avoidance of doubt, feedback does not include Client Data or the Client's Confidential Information.

Feedback does not include Client Data, product concepts, retail opportunities, customer introductions, commercial models, brand strategy, or Confidential Information of Marshall Trading AS, Markus Olsen, or their technology partners.

8. CONFIDENTIALITY

8.1 Obligations

Each Party shall: (a) keep the other Party's Confidential Information strictly confidential; (b) not disclose Confidential Information to any third party without the prior written consent of the disclosing Party; and (c) use Confidential Information solely for the purposes of this Agreement. Each Party may disclose Confidential Information to its employees, officers, advisors, and subcontractors who have a genuine need to know, provided that such persons are bound by obligations of confidentiality no less restrictive than those in this Agreement.

8.2 Exceptions

The obligations in Clause 8.1 do not apply to information that: (a) is or becomes publicly available other than through a breach of this Agreement; (b) was known to the receiving Party before disclosure; (c) is independently developed by the receiving Party without reference to Confidential Information; or (d) is required to be disclosed by law, regulation, or order of a court or regulatory authority, provided that the receiving Party gives the disclosing Party reasonable prior notice where legally permitted.

8.3 Duration

The obligations of confidentiality under this Clause 8 shall survive termination or expiry of this Agreement for a period of 3 years.

9. WARRANTIES AND REPRESENTATIONS

9.1 Mutual Warranties

Each Party warrants and represents that: (a) it has the legal right, power, and authority to enter into and perform this Agreement; (b) the execution of this Agreement does not breach any other agreement to which it is a party; and (c) it shall comply with all applicable laws and regulations in the performance of its obligations.

9.2 Family Labs Warranties

Family Labs warrants that: (a) the Platform will perform materially in accordance with its documentation; (b) Family Labs will provide the services with reasonable skill and care; and (c) Family Labs will use commercially reasonable efforts to ensure the Platform is free from viruses, malware, and other malicious code at the point of delivery.

9.3 Disclaimer

Except as expressly stated in this Agreement, all warranties, conditions, and terms (whether express or implied by statute, common law, or otherwise) are excluded to the maximum extent permitted by law. Family Labs does not warrant that the Platform will be uninterrupted or error-free, that all defects will be corrected, or that the Platform will meet the Client's specific requirements beyond the functionality described in the documentation. Family Labs does not warrant the continued availability, performance, or functionality of any third-party network or infrastructure on which the Platform depends.

10. LIMITATION OF LIABILITY

10.1 Cap on Liability

Subject to Clauses 10.3 and 10.4, each Party's total aggregate liability under this Agreement (including the SLA) shall not exceed the Fees paid by the Client in the 12 months preceding the event giving rise to the claim.

10.2 Excluded Losses

Subject to Clauses 10.3 and 10.4, neither Party shall be liable to the other for any: (a) indirect, special, incidental, or consequential loss or damage; (b) loss of profit, revenue, business, goodwill, anticipated savings, or data (whether direct or indirect); or (c) punitive or exemplary damages, in each case however arising and whether or not such loss was foreseeable.

10.3 Liability Not Capped

Nothing in this Agreement excludes or limits either Party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot lawfully be excluded or limited.

10.4 Super Cap on Excepted Matters

The matters listed in this Clause 10.4 are not subject to the cap in Clause 10.1 but are instead subject to an aggregate super cap of USD $10,000, except that any data breach affecting personal data is subject to a separate aggregate super cap of USD $50,000. The matters subject to the USD $10,000 super cap are: (a) breach of Clause 8 (Confidentiality); (b) infringement of a third party's intellectual property rights; and (c) gross negligence or wilful misconduct. For the avoidance of doubt, except for the liabilities described in Clause 10.3 (which are not capped), the Client's obligation to pay Fees properly due, and personal data breach claims subject to the USD $50,000 cap, in no event shall either Party's total aggregate liability under or in connection with this Agreement, across all claims of any kind combined, exceed USD $10,000.

10.5 Essential Basis

The limitations in this Clause 10 reflect the allocation of risk between the Parties and form an essential basis of the bargain between them. The Fees payable under this Agreement reflect this allocation of risk and would be substantially higher without these limitations.

10.6 Platform Availability

The availability target set out in the Service Level Agreement (Attachment 1) is a commercially reasonable target and not a binding uptime guarantee, save that the long-term DPP availability commitment in Clause 5 of the SLA is a binding commitment subject to the liability limits in this Clause 10. Family Labs shall use commercially reasonable efforts to maintain Platform availability but does not guarantee uninterrupted access.

11. TERM AND TERMINATION

11.1 Term

This Agreement commences on the Commencement Date and continues on a rolling basis, with no fixed term, minimum term, or lock-in period, until terminated by either Party in accordance with this Clause 11.

11.2 Termination for Cause

Either Party may terminate this Agreement immediately by written notice if the other Party: (a) commits a material breach of this Agreement and fails to remedy such breach within 30 days of receiving written notice specifying the breach; (b) becomes insolvent, enters into liquidation, has a receiver or administrator appointed, or makes an assignment for the benefit of creditors; or (c) ceases or threatens to cease carrying on business.

11.3 Termination for Convenience

Either Party may terminate this Agreement for convenience at any time by providing 30 days' written notice to the other Party. There is no minimum term or lock-in period, and neither Party is required to give a reason. For the avoidance of doubt, the Onboarding Fee is non-refundable upon execution of this Agreement (being payment for onboarding work performed), regardless of any subsequent termination.

11.4 Effect of Termination

Upon termination or expiry of this Agreement: (a) Family Labs shall cease providing the paid, Platform-specific commercial services (such as guided support, Scout parsing, and settlement activation), but shall not, and has no right to, restrict, gate, or revoke the Client's access to its Digital Product Passports or the Protocol (see Clause 2.6). In particular: (i) all Digital Product Passports created before termination remain hosted, resolvable, and verifiable with full accessibility in accordance with Clause 5 of the SLA, regardless of the status of this Agreement; (ii) the Client retains access to, and may continue to operate, its Digital Product Passports on the Protocol independently of Family Labs; and (iii) the Client retains read and export access to its existing Digital Product Passport records; (b) Family Labs shall comply with its data portability and deletion obligations under Clause 6.5 and its long-term DPP availability commitment under Clause 5 of the SLA; (c) each Party shall return or destroy the other Party's Confidential Information; and (d) all Fees accrued prior to termination shall remain payable; and (e) Family Labs shall refund to the Client, within 30 days of termination, any unused pre-paid DPP Credits (the Onboarding Fee, being payment for work performed, is non-refundable). Clauses 1, 5.2, 5.9, 6.5, 7, 8, 10, 12, and 13, and Clause 5 of the SLA, shall survive termination or expiry.

12. FORCE MAJEURE

Neither Party shall be liable for any failure or delay in performing its obligations under this Agreement to the extent that such failure or delay results from a Force Majeure Event. A "Force Majeure Event" means any event beyond the reasonable control of the affected Party, including natural disaster, fire, flood, epidemic, pandemic, war, terrorism, civil unrest, government action, power failure, internet or telecommunications failure, or cyberattack (provided that reasonable security measures were in place). The affected Party shall: (a) notify the other Party as soon as reasonably practicable; (b) use commercially reasonable efforts to mitigate the impact; and (c) resume performance as soon as the Force Majeure Event ceases. If a Force Majeure Event continues for more than 60 consecutive days, either Party may terminate this Agreement upon written notice.

13. DISPUTE RESOLUTION

13.1 Good Faith Negotiation

In the event of any dispute arising out of or in connection with this Agreement, the Parties shall first attempt to resolve the dispute by good faith negotiation between senior representatives of each Party. Either Party may initiate this process by written notice to the other. The Parties shall meet (in person or by video conference) within 14 days of such notice.

13.2 Mediation

If the dispute is not resolved within 30 days of the notice under Clause 13.1, either Party may refer the dispute to mediation administered by the Australian Disputes Centre (ADC) in accordance with its mediation rules. The mediation shall be held in Melbourne, Victoria, or by video conference where the Parties agree.

13.3 Litigation

If the dispute is not resolved within 30 days of the commencement of mediation, either Party may commence court proceedings. Nothing in this clause prevents a Party from seeking urgent interlocutory or injunctive relief from a court of competent jurisdiction at any time.

14. GENERAL PROVISIONS

14.1 Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of Victoria, Australia. The Parties submit to the exclusive jurisdiction of the courts of Victoria and the Federal Court of Australia.

14.2 Notices

All notices under this Agreement shall be in writing and delivered by email to: (a) for Family Labs: james@universalgoods.org; and (b) for the Client: markus@marshalltrading.no. Notices are deemed received on the Business Day following the date of transmission.

14.3 Assignment

Neither Party may assign or transfer this Agreement or any of its rights or obligations without the prior written consent of the other Party, except that Family Labs may assign this Agreement to any successor entity in connection with a merger, acquisition, or sale of all or substantially all of its assets.

14.4 Subcontracting

Family Labs may engage subcontractors to perform any of its obligations under this Agreement, provided that Family Labs remains responsible for the performance of such obligations and ensures that any subcontractor is bound by obligations no less restrictive than those in this Agreement.

14.5 Entire Agreement

This Agreement, including all Schedules and Attachments, constitutes the entire agreement between the Parties with respect to its subject matter and supersedes all prior agreements, understandings, negotiations, and discussions, whether oral or written, including any prior drafts exchanged between the Parties.

14.6 Amendment

This Agreement may only be amended by a written instrument signed by both Parties.

14.7 Waiver

No failure or delay by a Party in exercising any right or remedy under this Agreement shall constitute a waiver of that right or remedy. A waiver is effective only if given in writing and signed by the waiving Party.

14.8 Severability

If any provision of this Agreement is found to be invalid or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.

14.9 No Partnership or Agency

Nothing in this Agreement creates a partnership, joint venture, or agency relationship between the Parties. Neither Party has authority to bind the other or incur obligations on behalf of the other.

14.10 Counterparts

This Agreement may be executed in any number of counterparts, each of which is deemed an original, and all of which together constitute one agreement. Electronic signatures shall have the same legal effect as original signatures.

EXECUTION

This Agreement has been executed by the Parties on the date first written above.

Family Labs Pty Ltd· ACN 688 034 988

Name: James Albarracin

Title: Founder & CEO

Date: —

Family Labs Pty Ltd is bound by this Agreement upon issuance to the Client through the Family Labs signing platform.

Marshall Trading AS· 992 317 795

Awaiting signature

Name: Markus Olsen

Title: Commercial Director

Date: —

SCHEDULE A — CLIENT DETAILS AND AGREEMENT PARAMETERS

SCHEDULE B — FEES AND ONBOARDING SCOPE

B.1 Fee Summary

All amounts are stated in United States Dollars (USD) and are exclusive of any applicable taxes (refer to Clause 5.7).

B.2 Onboarding Scope

The Onboarding Fee covers the standard PAYG setup, comprising:

For the avoidance of doubt, registration of the initial Axis Socks product line is bundled into the Onboarding Fee. PAYG billing via the Top-Up Facility commences only for Platform usage beyond this initial product line (additional Products, additional Batches, any Item-Level Digital Product Passports, Scout parsing, and Supplier Connections).

B.3 PAYG Pricing and Platform Access

Beyond the initial product line, all Platform usage is paid for on a pre-paid, pay-as-you-go basis through the Top-Up Facility, drawn down against the following fees.

For the purposes of this Schedule: a "Product" is a distinct product model (a parent stock-keeping unit), which may carry unlimited variants (colour, size, capacity, and other dimensions) at no additional charge; a "Batch" is a single production run of a Product; a "model-level Digital Product Passport" is one passport representing a Product or Batch (used for commodity, high-volume product lines such as the Axis Socks line); and an "item-level Digital Product Passport" is one passport representing an individual physical unit.

B.4 Out of Scope (Enterprise-Tier)

The following are out of scope of the PAYG Onboarding Fee. If the Client requires any of them, Family Labs will scope and quote them under a separate enterprise agreement:

• Automated, end-to-end supplier data procurement (PAYG includes document-based Scout parsing and supplier deployment; fully automated procurement is enterprise-tier)
• Bespoke retail or point-of-sale connector development (for example, integration with a retail channel partner's ERP or POS)
• Consumer membership-hub, loyalty, sub-club, or promotional-flow design and build
• White-label re-skinning of the Consumer Wallet beyond standard branding configuration
• Migration of historical product data predating the initial product line

SCHEDULE C — DATA PROCESSING AGREEMENT

This Schedule sets out the terms on which Family Labs (as data processor) processes personal data on behalf of the Client (as data controller) in connection with the Platform.

C.1 Scope of Processing

Family Labs shall process personal data only to the extent necessary to provide the Platform. The categories of personal data, data subjects, and purposes of processing are as follows:

C.2 Processor Obligations

Family Labs shall: (a) process personal data only on documented instructions from the Client; (b) ensure that persons authorised to process personal data have committed to confidentiality; (c) implement appropriate technical and organisational security measures; (d) assist the Client with data subject rights requests and data protection impact assessments; (e) notify the Client of any personal data breach in accordance with Clause 6.6 of the MSA; (f) make available to the Client all information necessary to demonstrate compliance; and (g) delete or return all personal data upon termination in accordance with Clause 6.5 of the MSA.

C.3 Sub-processors

The Client provides general authorisation for Family Labs to engage sub-processors. Family Labs shall: (a) maintain a list of current sub-processors and make it available to the Client upon request; (b) notify the Client at least 30 days before engaging a new sub-processor; (c) ensure each sub-processor is bound by data protection obligations no less stringent than those in this Schedule; and (d) remain fully liable for the acts and omissions of its sub-processors.

C.4 International Transfers

Family Labs shall not transfer personal data outside the jurisdiction specified in Clause 6.4 of the MSA without appropriate safeguards in place, such as the Standard Contractual Clauses approved by the European Commission or equivalent transfer mechanisms recognised under the GDPR and Norwegian data protection law.

C.5 Audit Rights

The Client may, upon 30 days' written notice and no more than once per 12-month period, audit Family Labs' compliance with this Schedule. Audits shall be conducted during Business Hours and shall not unreasonably interfere with Family Labs' operations. Alternatively, the Client may accept a third-party audit report (SOC 2 Type II or equivalent) as evidence of compliance.

C.6 No Secondary Use of Identifiable Data

Family Labs shall not use Client Data, DPP Data, consumer claim data, scan data, or any data derived from them that identifies, or could reasonably be used to identify, the Client or any individual (together, "Identifiable Data") for its own commercial purposes, product development, benchmarking, model training, marketing, sales enablement, or analytics without the Client's prior written consent.

Family Labs may use data that has been genuinely anonymised or aggregated, such that it can no longer reasonably be used to identify the Client or any individual, for the operation, security, monitoring, and improvement of the Platform, including its services and models. This Clause C.6 is consistent with, and does not limit, Family Labs' rights in Platform Data under Clause 6.1.

Family Labs Pty Ltd · Amended and Restated Pay-As-You-Go Master Service Agreement · Version 5.0 - Amended and Restated (Family Labs Draft)