SERVICE LEVEL AGREEMENT

Attachment 1 to the Master Service Agreement

Standard Pay-As-You-Go Terms

Between

FAMILY LABS PTY LTD (ACN 688 034 988)

and

MARSHALL TRADING AS

MSA Reference: UGPAYG0001 Effective Date: {{effective_date}} Version: 5.0 - Amended and Restated (Family Labs Draft)

CONFIDENTIAL

Note on this SLA. This is the standard Service Level Agreement for the Pay-As-You-Go (PAYG) tier. PAYG is a low-friction, self-serve service: Family Labs provides the Platform on a best-efforts basis, with no binding uptime guarantee, no mandatory incident-response times, and no service credits. Clients requiring binding uptime commitments, defined response and resolution times, service credits, or a partnership service level should use an enterprise agreement or, where applicable, the separate White-Label/Reseller Service Level Agreement. The one binding commitment in this SLA is the long-term DPP availability commitment in Clause 5.

1. RELATIONSHIP TO MASTER SERVICE AGREEMENT

This Service Level Agreement ("SLA") is Attachment 1 to the Master Service Agreement ("MSA") between Family Labs Pty Ltd and the Client identified on the cover page. This SLA forms an integral part of the MSA and is subject to all terms and conditions therein. Capitalised terms used but not defined in this SLA have the meanings given to them in the MSA.

In the event of any conflict between this SLA and the body of the MSA, the MSA shall prevail.

2. PLATFORM AVAILABILITY

2.1 Availability Goal

Family Labs targets a Monthly Uptime Percentage of 99.5% for the Platform, measured at the application layer (Enterprise Dashboard and Tokenisation Engine APIs). This is a commercially reasonable target, not a binding commitment. Family Labs shall use commercially reasonable efforts to maintain Platform availability but does not guarantee uninterrupted access.

2.2 Downtime

"Downtime" means any period during which the Platform is unavailable or materially degraded, excluding periods caused by: (a) scheduled or emergency maintenance; (b) Force Majeure Events (as defined in the MSA); (c) actions or omissions of the Client or its Authorised Users; or (d) failure or unavailability of third-party services, networks, or infrastructure outside Family Labs' reasonable control, including the underlying public network on which Digital Product Passports are anchored, cloud hosting providers, and stablecoin or settlement infrastructure.

2.3 Transparency

Family Labs may publish Platform status and incident information via a status page or shared channel. Where Family Labs becomes aware of a material Platform incident affecting the Client, Family Labs will use commercially reasonable efforts to inform the Client.

3. MAINTENANCE

Family Labs may perform scheduled or emergency maintenance as needed to ensure the security, stability, and performance of the Platform. Family Labs will use commercially reasonable efforts to provide reasonable advance notice of planned maintenance that is likely to cause material Downtime, and to schedule such maintenance outside ordinary retail peak periods where practicable. Emergency maintenance, including security patching, may be performed with as much notice as is reasonably practicable.

4. SUPPORT

4.1 Support Tier — PAYG Standard

The Client is on the PAYG Standard support tier. Support is provided on a best-efforts basis and is not subject to mandatory response times or resolution commitments.

4.2 Support Contacts

4.3 No Service Credits

The PAYG Standard tier does not include service credits, uptime guarantees, or mandatory incident-response commitments. Family Labs will use commercially reasonable efforts to address issues reported by the Client but is not obligated to meet specific response or resolution timeframes.

4.4 Critical Production Incidents

Notwithstanding Clause 4.3, where the Client reports a Critical Production Incident affecting an active production batch, Family Labs shall use commercially reasonable efforts to respond via email or Slack within 4 Business Hours and to provide reasonable status updates until the incident is resolved or a workaround is provided.

A "Critical Production Incident" means a material outage or failure that prevents the Client from creating, resolving, verifying or accessing Digital Product Passports for an active production batch, excluding issues caused by the Client, the Client's Authorised Users, scheduled or emergency maintenance, Force Majeure Events, or third-party services outside Family Labs' reasonable control.

5. LONG-TERM DPP AVAILABILITY

5.1 Twenty-Year Availability Commitment

Family Labs commits to maintaining the availability and resolvability of each Digital Product Passport created by the Client through the Platform for a period of not less than twenty (20) years from the date that Digital Product Passport is created (the "Availability Period"), so that the Digital Product Passport can continue to be resolved and verified by consumers, regulators, and other authorised parties throughout the product's lifecycle. This is a binding commitment, subject to the limitation of liability in Clause 10 of the MSA.

5.2 What the Commitment Covers

During the Availability Period, Family Labs shall use commercially reasonable efforts to: (a) maintain the on-chain anchor of each Digital Product Passport on the underlying network; (b) maintain the off-chain resolution and content hosting necessary for each Digital Product Passport's identifier to resolve to its record; and (c) maintain the resolution path (including any GS1 Digital Link resolution) by which each Digital Product Passport is reached.

5.3 Survival and Relationship to Deletion

The Availability Period applies to each Digital Product Passport independently and survives the expiry or termination of the MSA. The continued availability of published Digital Product Passport records under this Clause 5 is an express exception to the data deletion provisions of Clause 6.5 of the MSA. For the avoidance of doubt, this Clause 5 concerns the published Digital Product Passport records only. Personal data and the Client's private account data continue to be handled, retained, and deleted in accordance with Clause 6.5 of the MSA and Schedule C (Data Processing Agreement), and nothing in this Clause 5 requires Family Labs to retain personal data beyond the period permitted or required by applicable data protection law.

5.4 Underlying Network

The on-chain anchor of each Digital Product Passport persists on the underlying public network independently of Family Labs. Family Labs' commitment under this Clause 5 is to maintain its own resolution, hosting, and content-addressing layer for the Availability Period. Family Labs is not responsible for the continued operation of the underlying public network itself, which is outside its control, but shall use commercially reasonable efforts to preserve Digital Product Passport availability, including by migrating records to an alternative network, resolver, or storage medium where reasonably necessary.

5.5 Continuity on Cessation

If Family Labs ceases, or forms a settled intention to cease, providing the Platform at any time during the Availability Period, Family Labs shall, before ceasing, use commercially reasonable efforts to: (a) transfer the Digital Product Passport resolution and hosting function to the Universal Goods Foundation or another successor steward so that availability continues; or (b) where no such transfer is reasonably practicable, make available to the Client the data, records, and resolution information necessary for the Client to maintain Digital Product Passport availability itself.

5.6 Access Not Conditional on the Commercial Relationship

The availability, resolvability, and accessibility of Digital Product Passports under this Clause 5 are independent of the status of the MSA and of the commercial relationship between the Parties. Family Labs shall not condition, suspend, restrict, or revoke the Client's ability to access, resolve, or verify its Digital Product Passports on payment status, termination, expiry, or any other feature of the commercial relationship, consistent with Clause 2.6 of the MSA (Open Protocol and No Lock-In). This Clause 5 reflects that the Universal Goods Protocol is an open, permissionless public good and that the Client's Digital Product Passports are not locked to Family Labs.

6. DATA PORTABILITY AND SECURITY

For the Client's convenience, this Clause restates obligations set out in the MSA. In the event of any conflict, the MSA prevails.

6.1 Data Portability

On termination or expiry of the MSA, Family Labs shall make available to the Client a complete export of Client Data and DPP metadata in a standard, machine-readable format within 30 days, and shall maintain read access to allow verification and migration, in accordance with Clause 6.5 of the MSA.

6.2 Security Breach Notification

Family Labs shall notify the Client without undue delay and in any event within 72 hours of becoming aware of any security breach affecting Client Data, in accordance with Clause 6.6 of the MSA.

Family Labs Pty Ltd · Amended and Restated Pay-As-You-Go Service Level Agreement · Version 5.0 - Amended and Restated (Family Labs Draft)