The French version is authoritative. The text below is a courtesy translation provided for convenience. In case of any discrepancy, the French version prevails.

TERMS AND CONDITIONS OF SALE

Hortval Software — self-service subscription — governed by French law

Version 1.0 — effective as of August 10, 2026

This English translation is provided for convenience only. In the event of any discrepancy or dispute, the French version (« Conditions Générales de Vente »), available at hortval.com, shall prevail.

Article 1 — Purpose and Scope

These Terms and Conditions of Sale (the “Sale Terms”) govern the subscription, supply and use of the Hortval software (the “Software”), published by SAFE PIC TECHNOLOGIES, a French simplified joint-stock company (SASU) with a share capital of €16,300, located at 4 Impasse de l’esplanade, 34380 St Martin de Londres, France, registered with the Montpellier Trade and Companies Register under number 504 935 008, EU VAT FR74504935008 (the “Publisher”), where the subscription is taken out on a self-service basis on hortval.com or from within the Software.

The Customer is the organisation that subscribes — a legal entity, referred to as “Organisation” in the portal interface. The Software and related offers are intended for business customers only; by subscribing, the Customer represents that it is acting for purposes falling within the scope of its professional activity.

Article 2 — Relationship with the Terms of Use

Two distinct contracts, two distinct parties.

These Sale Terms govern the sale: offer, price, invoicing, subscription term, renewal, the license granted in the Software, and termination. The contracting party is the Customer, bound by the person to whom it has given a role permitting it to do so (Article 3).

The Terms of Use (the “Use Terms”), published on hortval.com, govern the use of the portal by an individual: access, authentication, roles, cookies. The contracting party there is the User, including one who was invited by a third party and subscribes to nothing.

These Sale Terms therefore stipulate nothing about portal access, authentication or user accounts: those matters fall under the Use Terms. Accepting the Use Terms does not bind the Customer under these Sale Terms, and vice versa.

Article 3 — Acceptance, Version and Evidence

Acceptance of these Sale Terms is required from any individual who, on behalf of the Organisation, creates it, obtains a license for it, or carries out any act creating or increasing a payment obligation — in particular a change of offer or a renewal.

By assigning a person a role that permits such acts, the Customer gives that person authority to bind it within those limits, and answers for the acts so carried out, in accordance with Article 18. That person represents, under the Use Terms, that they hold the authority to bind the Organisation.

A member who merely uses the portal without carrying out any of these acts does not bind the Customer and has no acceptance to give here.

Installation or use of the Software by a person acting on behalf of the Customer constitutes acceptance of these Sale Terms by the Customer, who undertakes that the persons it authorises will comply with them.

The applicable version is the one in force, as published on hortval.com, on the date of subscription or, where applicable, on the date of each renewal.

Each version carries a number and an effective date at the head of the document. The Publisher retains the SHA-256 digest of the published file, so that the accepted version can be identified unambiguously, including where the text is subsequently amended.

The following are recorded upon acceptance: the Organisation bound, the identifier of the person binding it, the version accepted, the timestamp, the IP address and the browser user agent.

The Customer can retrieve at any time, from the Portal, the version in force and the history of acceptances given on its behalf: by whom, which version, on what date.

The Publisher may amend these Sale Terms. Any amendment gives rise to a new version, numbered and dated, published on hortval.com. Amendments apply as from the renewal following their publication, subject to the price guarantee set out in Article 8.

Article 4 — Order of Precedence of Contractual Documents

These Sale Terms exclusively govern self-service subscriptions. Where the Customer and the Publisher have entered into a specific agreement — in particular a signed quotation accompanied by license conditions attached thereto, a purchase order accepted by the Publisher, or any negotiated contract — such specific agreement prevails over these Sale Terms for all matters expressly stipulated therein, these Sale Terms applying on a supplementary basis for the remainder.

In the event of any conflict between contractual documents, the descending order of precedence is as follows:

• (1) the specific agreement and its annexes, including any license conditions attached thereto;
• (2) these Sale Terms;
• (3) the Use Terms, for matters concerning use of the portal;
• (4) the Software documentation.

In accordance with Article L.441-1 of the French Commercial Code, these Sale Terms constitute the sole basis of the commercial negotiation; the Customer’s general terms of purchase are unenforceable against the Publisher, unless expressly accepted in writing.

Article 5 — Description of the Software

Hortval is an ACME connector for Microsoft Active Directory Certificate Services (ADCS), deployed entirely on the Customer’s infrastructure (on-premise). The functional scope of each offer (number of production installations, ADCS authorities, supported databases) is as described on the pricing page of hortval.com on the date of subscription.

Operational independence. The Software runs entirely on the Customer’s infrastructure. The certification authority, the private keys and the certificates issued remain there: they never pass through the Publisher, who has no access to them. Issuing and renewing certificates require no connection to the Publisher and continue throughout the validity of the license file, whatever the availability of the Portal or of the Publisher.

The Software may be operated offline, with no communication with the Publisher at all: the license file is then downloaded from the Portal and installed manually. The information transmitted by a connected installation is exhaustively listed in the Use Terms; it contains no certificate, no key and no issued domain name.

The Publisher is a company incorporated under French law and established in France, and its infrastructure is hosted in the European Union. The Portal is served behind a network protection provider subject to United States law, under the conditions described in the Use Terms: that dependency concerns the Portal alone, does not extend to the Software operated at the Customer’s premises, and is nil for an offline installation.

Article 6 — Organisation Information

The Customer provides the accurate and up-to-date information that regulations make necessary for issuing, delivering and settling invoices, and for determining the applicable tax regime.

Depending on the case, this includes in particular the legal name, the registered address and the billing address, the business identification number — the SIRET for organisations established in France —, the EU VAT number and the electronic invoice routing identifier. This enumeration is indicative and does not limit the obligation set out above.

The Customer keeps this information current and provides, at the Publisher’s request, any information that a change in regulations makes necessary. An invoice that cannot be issued or delivered for want of accurate information remains due nonetheless.

The Publisher may refuse or suspend a subscription in the event of fraud, non-payment or breach of these Sale Terms.

Article 7 — Trial Period

The Publisher may offer a free trial period, the duration and conditions of which are specified on hortval.com on the date of subscription. The trial period is a commercial offer granted at the Publisher’s sole discretion: the Publisher may modify, suspend or withdraw it at any time for new subscriptions, without affecting trial periods already in progress. Unless otherwise stated, the trial is limited to one per Organisation. Any circumvention of this limit, in particular through the creation of multiple organisations, may result in the suspension of the subscriptions concerned.

Article 8 — Subscription, Term, Renewal and Price Guarantee

The Software is provided on a subscription basis for a term of twelve (12) months. Where the subscription follows a trial period, the first paid subscription period runs from the expiry of the trial; in the absence of a trial, it runs from delivery of the license key. The subscription is then renewable for successive twelve (12) month periods.

The price applicable to a license is the price in force on the date of its initial subscription; it remains guaranteed, without increase, for successive renewals of that license for as long as the subscription is renewed without interruption. The prices in force published on hortval.com apply only to new subscriptions, to additional licenses taken out for new installations, and to re-subscriptions following an interruption of payment or the expiry of the subscription. The Customer may choose not to renew its subscription.

Article 9 — Prices and Payment

Prices are expressed in euros and are exclusive of taxes; applicable VAT is added thereto. Payment is made online and is due upon ordering or on the renewal date. In the event of non-payment, access to the Software may be suspended under the conditions of Article 14. Any late payment on invoice automatically gives rise to late-payment penalties at the ECB rate plus 10 points and to a fixed recovery indemnity of €40 (Article L.441-10 of the French Commercial Code). No discount is granted for early payment.

Article 10 — License Grant

Subject to payment of the price where the subscribed offer is a paid one, the Publisher grants the Customer a personal, non-exclusive and non-transferable license to use the Software, for its own internal needs only, for the duration of the subscription and within the limits of the subscribed offer. The supply of the Software constitutes the grant of a right of use and not an assignment of intellectual property rights. Any use exceeding the subscribed scope requires the subscription of an additional offer or license.

Free offers and trial periods are granted on the same conditions, without financial consideration: they fall under Articles 11 to 14 like any other license, and the Publisher may end them at any time on reasonable notice.

The license attaches to the Organisation, not to the persons who use the portal on its behalf.

Article 11 — Software Use Restrictions

Unless with the Publisher’s prior written authorization, the Customer shall not:

• (i) copy, distribute, rent, lend or make the Software available to third parties;
• (ii) modify, translate or create derivative works of the Software;
• (iii) decompile or reverse-engineer the Software, subject to the mandatory rights recognized by Article L.122-6-1 of the French Intellectual Property Code relating to interoperability;
• (iv) remove or alter any proprietary notice contained in the Software;
• (v) duplicate, share or reuse a license key or an installation key across several instances of the Software, nor alter the Software’s internal state — in particular its database — so that a single installation identity serves several instances;
• (vi) make a safety function depend on the issuance or validity of a certificate. Equipment whose safety function ceases for want of a valid certificate, or for want of connectivity, reflects a design fault in that equipment: safety must be assured independently of any external service.

Article 12 — Resale, Distribution and Operation on Behalf of Third Parties

The Customer shall not resell, distribute, sublicense or otherwise make available the Software or the license keys, whether for consideration or free of charge.

The Customer shall likewise not operate the Software to issue, renew or manage certificates for the benefit of a third party, whether as part of an outsourcing arrangement, a managed service, a shared offering or any other provision of the service rendered by the Software. The fact that the Software is installed on the Customer’s infrastructure and operated by the Customer is not sufficient to qualify such use as an internal need within the meaning of Article 10.

Companies that the Customer controls, that control the Customer, or that are under common control with the Customer, within the meaning of Article L.233-3 of the French Commercial Code, are not third parties for the purposes of this Article.

Any resale, distribution or operation on behalf of third parties requires the Publisher’s prior written agreement, which sets out the applicable conditions.

Article 13 — Actual Scope, Declaration and Regularisation

Each running instance of the Software counts as one installation, whatever the declared environment and whatever infrastructure hosts it. An installation key belongs to one instance and one only.

On registration and on each renewal, every installation transmits the technical information described in the Use Terms — in particular the declared environment, the number of configured certification authorities and the number of managed servers. That information shall constitute evidence between the parties, unless proven otherwise, of the declared scope. The Customer can view it from the portal and may dispute it within thirty (30) days of being notified of an excess.

That information reveals neither operation for the benefit of third parties nor the duplication of an installation key. On those two points, the declaration set out below is the only means of establishing the actual scope, and an inaccurate declaration constitutes a serious breach within the meaning of Article 21.

At the Publisher’s request, the Customer shall disclose within thirty (30) days the actual scope of use, including, where applicable, the existence of operation for the benefit of third parties — which the technical information above cannot reveal. The Publisher may have these declarations verified no more than once a year, on thirty (30) days’ notice, during business hours and without unreasonable disruption to the Customer’s activity. Information gathered on that occasion is confidential and used solely for that verification.

Any excess over the subscribed scope gives rise to the subscription of the corresponding licenses, invoiced at the rates in force as from the date of the excess, without prejudice to Article 21.

Article 14 — License Key, Expiry and Grace Period

Use of the Software is conditional upon activation of a license key supplied by the Publisher, the validity of which is limited to the subscription term. Upon expiry of the subscription, in the absence of renewal, the Customer benefits from a grace period during which the Software continues to operate in order to allow renewal. Its duration is the one stated in the Software documentation published on hortval.com on the expiry date. At the end of this period, the key expires and the Software ceases to operate; only the activation of a new key allows use to resume. The Customer’s data, hosted on its own infrastructure, remains in its possession in all circumstances.

Article 15 — Intellectual Property

The Software, its documentation, the Hortval name and all related intellectual property rights remain the exclusive property of the Publisher or its licensors. Nothing in these Sale Terms transfers any ownership to the Customer.

Article 16 — Limited Warranty

The Software is provided “as is”. The Publisher warrants that, as of the date of delivery, the Software substantially conforms to its documentation. The Publisher does not warrant uninterrupted or error-free operation, nor fitness for any specific purpose not expressly agreed. To the fullest extent permitted by law, all other warranties, express or implied, are excluded; this exclusion is without prejudice to mandatory statutory warranties.

Article 17 — Limitation of Liability

The Publisher’s liability, for all damages and on all grounds whatsoever, is limited to compensation for direct damages and capped at the amount of the sums actually paid by the Customer under the subscription during the twelve (12) months preceding the event giving rise to liability. Indirect or consequential damages are expressly excluded, including any loss of data, revenue, business, customers or profits.

Automation does not remove the need for monitoring. The Software runs on the Customer’s infrastructure and depends on its certification authority, its network and the ACME clients it operates. It is for the Customer to monitor the expiry of its certificates and the successful completion of their renewals, by means of an alert independent of the Software. The Publisher is not liable for the consequences, for the Customer’s systems or for third parties, of a certificate not issued, not renewed, not installed or not deployed in time — in particular service interruption, loss of access, equipment unavailability or communication failure. The foregoing is without prejudice to the warranty of conformity set out in Article 16.

Nor is the Publisher liable for the consequences of an external constraint beyond its control: a measure imposed by a public authority, whether French or foreign, including under legislation of extraterritorial reach; a decision or failure of an infrastructure, network or email provider; a change in the requirements of a certification ecosystem. The Publisher informs the Customer as soon as it becomes aware of it, so far as the measure permits.

These limitations do not apply in the event of personal injury, gross negligence or willful misconduct, or where their limitation is prohibited by law.

Article 18 — Customer Obligations

The Customer is responsible for installing the Software in its environment, for regularly backing up its data and for the security of its systems. It is the Customer’s responsibility to verify that the Software is suitable for its needs, in particular during the trial period, before and during its use.

The Customer monitors the expiry of its license keys and ensures that its installations can reach the portal in order to renew them. The Publisher sends reminders ahead of expiry to the Organisation’s contact address: these are a convenience and do not shift the burden of that monitoring. Monitoring of the certificates issued by the Software is the Customer’s responsibility, under the conditions of Article 17.

The Customer represents that it is not subject to any international sanction or asset-freezing measure, that it is not acting on behalf of a person who is, and undertakes not to make the Software available in breach of applicable export control regulations. Where compliance with those regulations so requires, the Publisher may suspend or terminate the subscription without compensation.

The Customer designates the persons authorised to act on its behalf on the portal and assigns their roles. It answers for the actions they carry out there within the limits of those roles. It is the Customer’s responsibility to remove them when they leave the Organisation; the Publisher takes no part in that management, with one exception: where an Organisation no longer has an owner able to act — departure, incapacity or death —, the Publisher appoints a new owner upon written request from a legal representative of the Customer evidencing their capacity. Failing that, the Customer would have to subscribe to a new License and would lose the benefit of the price guarantee set out in Article 8, for a cause internal to it.

Article 19 — Personal Data

Each party shall comply with applicable regulations, in particular Regulation (EU) 2016/679 (GDPR).

As the Software is deployed on the Customer’s infrastructure (on-premise), the Publisher does not operate its certification authority, holds none of its private keys, and does not access the data processed by the Customer by means of the Software, except at the Customer’s express request in the context of support.

The Publisher acts as data controller for the processing connected with the portal and with invoicing. Each acceptance of these Sale Terms is retained for five (5) years from the day it ceases to be the version in force for the Customer; the last one, five (5) years after the end of the contractual relationship. The Customer acts as data controller for designating its members and assigning their roles: it ensures that it has a legal basis for communicating its staff’s data and that it informs them of that processing, in accordance with Article 14 GDPR.

The Customer’s account and billing data are processed by the Publisher in accordance with its privacy policy published on hortval.com. Data concerning the individuals who use the portal is described in the Use Terms.

Article 20 — Support, Updates and Operational Maintenance

For the duration of the subscription, updates and fixes for the Software are included and made available to the Customer for download, together with the support associated with the subscribed offer, under the conditions described on hortval.com. The Customer may and must install updates within a reasonable time from their release, in particular security fixes, in order to keep the Software in proper operational and security condition. The Publisher’s assistance may be conditional upon the prior installation of available updates.

Article 21 — Termination

In the event of a serious breach by either party not remedied within thirty (30) days following a formal notice that has remained without effect, the other party may terminate the subscription as of right, without prejudice to any damages it may be entitled to claim. The Publisher may also suspend access to the Software in the event of non-payment or breach of Articles 10 to 13, after notice has remained without effect.

Suspension of an individual’s access to the portal, provided for by the Use Terms, is a separate measure: it constitutes neither termination nor suspension of the subscription.

Article 22 — Force Majeure

Neither party shall be liable for any failure resulting from an event of force majeure within the meaning of Article 1218 of the French Civil Code and the case law of the French courts.

Article 23 — Severability and Miscellaneous

If any provision of these Sale Terms is held to be null, unlawful or unenforceable by a court of competent jurisdiction, it shall be deemed unwritten, without such nullity entailing that of the other provisions or of the Sale Terms as a whole, which shall remain in full force and effect. The parties shall endeavor in good faith to replace the severed provision with a valid provision producing an economic and legal effect as close as possible to that originally intended. The failure of a party to enforce any provision shall not constitute a waiver thereof.

Article 24 — Governing Law and Jurisdiction

These Sale Terms are governed by French law.

Failing amicable resolution, any dispute relating to their validity, interpretation or performance falls within the jurisdiction of the Commercial Court (Tribunal de commerce) of Montpellier, notwithstanding multiple defendants or third-party claims.

This attribution of jurisdiction does not apply where the Customer has not contracted in the capacity of a merchant — associations, public bodies, liberal professions and civil-law companies in particular — nor where a mandatory rule designates another court. The ordinary rules then apply.

---

SAFE PIC TECHNOLOGIES — SASU with a share capital of €16,300 — 4 Impasse de l’esplanade, 34380 St Martin de Londres, France — SIREN 504 935 008 — Montpellier Trade and Companies Register — VAT FR74504935008 — [email protected]