1022-00008 · Northgate Telecommunications PLC · Transaction Documents

exhibit-d-acceptable-use-policy.docx DOCUMENT M&A / Corporate

32 / 38 ← → ✕

Contract analysis Extract to table

EXHIBIT D

ACCEPTABLE USE POLICY

to the

MASTER SERVICES AGREEMENT

dated June 9, 2023

between

NORTHGATE AMERICAS, INC.

and

CEDARPOINT SYSTEMS INTEGRATION, INC.

This Acceptable Use Policy (this "AUP") is Exhibit D to the Master Services Agreement dated June 9, 2023 (the "Agreement"), by and between Northgate Americas, Inc., a Delaware corporation ("Customer"), and Cedarpoint Systems Integration, Inc., a Delaware corporation ("Service Provider"). This AUP is incorporated into and forms an integral part of the Agreement. Capitalized terms used but not otherwise defined herein shall have the meanings ascribed to them in the Agreement.

SECTION 1 — PURPOSE AND SCOPE

1.1 Purpose. This Acceptable Use Policy establishes the rules, guidelines, and restrictions governing Customer's use of the managed network services and the ArcMesh platform (version 4.2) provided by Service Provider under the Agreement. The purpose of this AUP is to ensure the reliable, secure, and lawful operation of the Services, to protect the integrity and availability of the Managed Network and the ArcMesh platform, and to set forth clear expectations regarding acceptable and prohibited conduct by Customer and its Authorized Users. Service Provider has developed this AUP in accordance with industry best practices for managed network services and in consideration of the regulatory environments in which the Managed Network operates.

1.2 Scope of Application. This AUP applies to all Customer personnel, Authorized Users, contractors, and agents who access or use any portion of the managed wide-area network spanning three hundred forty (340) nodes across twenty-eight (28) U.S. states and three (3) Canadian provinces, as well as the ArcMesh platform licensed to Customer under the Agreement. The obligations set forth in this AUP apply regardless of the method of access to the Services—whether through direct network connections, remote access, API integrations, or the ArcMesh management console—and regardless of the geographic location from which access occurs. This AUP applies equally during the migration phases described in the Transition Services Side Letter and during steady-state operations following migration completion.

1.3 Relationship to Agreement. In the event of any conflict between this AUP and the Agreement, the Agreement shall control. This AUP supplements, but does not limit, the rights and obligations set forth in the Agreement, including without limitation the data security and privacy requirements set forth in Exhibit E (Data Security and Privacy Requirements) and the service level commitments set forth in Exhibit B (Service Level Agreement). Nothing in this AUP shall be construed to expand Customer's obligations beyond those set forth in the Agreement or to diminish Service Provider's obligations under the Agreement, except as expressly stated herein. For the avoidance of doubt, this AUP does not modify the limitation of liability, indemnification, or warranty provisions of the Agreement.

1.4 Acceptance. Customer's use of the Services constitutes acceptance of this AUP. Customer is responsible for ensuring that all Authorized Users are made aware of and comply with the terms of this AUP prior to accessing the Services or the ArcMesh platform. Customer shall take commercially reasonable steps to communicate the requirements of this AUP to all Authorized Users, including by incorporating this AUP or a summary thereof into Customer's internal acceptable use or information security policies, as applicable.

SECTION 2 — DEFINITIONS

For purposes of this AUP, the following terms shall have the meanings set forth below. All other capitalized terms shall have the meanings set forth in the Agreement.

2.1 "Authorized Users" means Customer's employees, officers, directors, agents, independent contractors, and other persons authorized by Customer to access or use the Services and the ArcMesh platform in connection with Customer's internal business operations. Authorized Users include, without limitation, personnel of Northgate Telecommunications PLC and its affiliates who have been granted authorized access to the Services in accordance with the Agreement and applicable Statements of Work. Customer shall maintain a current list of Authorized Users and shall make such list available to Service Provider upon reasonable request.

2.2 "Managed Network" means the managed wide-area network infrastructure operated by Service Provider on behalf of Customer under the Agreement, including all three hundred forty (340) managed nodes listed in Schedule 1 to this AUP, the SD-WAN overlay deployed using the ArcMesh platform, all associated routers, switches, firewalls, and other customer premises equipment managed by Service Provider, and the interconnections among such components. The Managed Network also includes any temporary or transitional network segments established during the migration from Greystone Halcyon Software's legacy MPLS infrastructure, as described in Exhibit A and the Transition Services Side Letter.

2.3 "ArcMesh Platform" means Service Provider's proprietary network orchestration platform (version 4.2), including all associated software modules, management consoles, APIs, dashboards, and documentation, licensed to Customer as embedded technology under the Agreement. The ArcMesh platform provides SD-WAN policy management, traffic engineering, network analytics, and automated failover capabilities across the Managed Network.

2.4 "NOC" means Service Provider's Network Operations Centers located in Reston, Virginia and Winnipeg, Manitoba, Canada, which provide twenty-four hours per day, seven days per week (24×7) monitoring, incident management, and technical support services for the Managed Network and the ArcMesh platform.

2.5 "Services" means all managed network services, ArcMesh platform license and maintenance, cybersecurity monitoring, and professional services provided by Service Provider to Customer under the Agreement, including all services described in the applicable Statements of Work (Exhibit A) and any ancillary services described in the Transition Services Side Letter.

2.6 "Applicable Laws" means all federal, state, provincial, and local laws, statutes, regulations, rules, ordinances, codes, and orders applicable to Customer's use of the Services in any jurisdiction in which the Managed Network operates or in which Customer or its Authorized Users access the Services, including without limitation applicable telecommunications regulations in the United States and Canada, data protection and privacy laws, export control laws, anti-spam legislation, and any applicable industry-specific regulations governing Customer's business operations.

SECTION 3 — PERMITTED USE

3.1 General. Customer may use the Services and the ArcMesh platform solely for Customer's internal business operations as contemplated by the Agreement. Permitted use includes the transmission, routing, and management of Customer's business data and communications across the Managed Network, including voice, video, and data traffic generated by Customer's employees, offices, data centers, and authorized third-party interconnections described in the applicable Statements of Work. Customer's use of the Services shall be consistent with the technical specifications, network architecture, and capacity planning parameters described in Exhibit A.

3.2 Licensed Scope. Customer's use of the ArcMesh platform shall be limited to the scope of the license granted under the Agreement. Customer shall not use the ArcMesh platform for purposes outside the licensed scope, including without limitation sublicensing, reselling, time-sharing, service bureau use, or providing the ArcMesh platform or access thereto to any third party. Notwithstanding the foregoing, Customer may permit its authorized contractors who are engaged to provide services to Customer in connection with Customer's internal business operations to access the ArcMesh platform solely to the extent necessary to perform such services, provided that (a) such contractors are included within the definition of Authorized Users, (b) Customer remains responsible for all acts and omissions of such contractors with respect to the Services and this AUP, and (c) such contractors are bound by confidentiality obligations at least as protective as those set forth in the Agreement.

3.3 Authorized Volume. Customer is authorized to use the Services across up to three hundred forty (340) managed nodes as identified in Schedule 1 to this AUP. The authorized node count reflects the capacity and pricing structure agreed upon by the parties under the Agreement. Addition of nodes beyond this authorized count requires a written amendment to the Agreement or the applicable Statement of Work (Exhibit A), as well as any applicable adjustments to the fees set forth in Exhibit C (Pricing and Payment Terms). Customer shall notify Service Provider in advance of any planned changes to its network topology that may affect the number of managed nodes or the capacity requirements of the Managed Network.

SECTION 4 — PROHIBITED ACTIVITIES

4.1 Illegal Activities. Customer shall not use, and shall ensure that Authorized Users do not use, the Services or the Managed Network for any purpose that is unlawful under Applicable Laws. Without limiting the generality of the foregoing, Customer and its Authorized Users shall not use the Services in connection with any of the following:

(a) Transmission, distribution, or storage of any material that violates any applicable federal, state, or provincial criminal statute, including but not limited to statutes governing fraud, computer crimes, and unauthorized access to computer systems;

(b) Conduct that would constitute a criminal offense or give rise to civil liability under Applicable Laws, whether directed at Service Provider, third parties, or the general public;

(c) Fraud, identity theft, phishing, pretexting, social engineering, or other deceptive practices designed to obtain sensitive information, financial gain, or unauthorized access to systems or accounts;

(d) Distribution, storage, transmission, or solicitation of child sexual abuse material, or any content that exploits, harms, or endangers minors in any manner;

(e) Unauthorized interception, recording, or monitoring of communications in violation of applicable wiretap, electronic surveillance, or communications privacy laws, including the Electronic Communications Privacy Act (18 U.S.C. §§ 2510–2522) and applicable Canadian federal and provincial privacy legislation.

4.2 Network Abuse and Interference. Customer shall not use the Services in any manner that:

(a) Disrupts, degrades, impairs, or interferes with Service Provider's ability to deliver the Services to Customer or to any other customer of Service Provider, including activities that consume disproportionate network resources, create bottlenecks, or reduce the quality of service available to other users of shared infrastructure;

(b) Introduces malicious code, viruses, worms, Trojan horses, ransomware, spyware, adware, rootkits, keyloggers, or other harmful software or code into the Managed Network, the ArcMesh platform, or any system or network connected thereto;

(c) Engages in denial-of-service attacks (including distributed denial-of-service attacks), port scanning, network probing, packet sniffing, IP spoofing, or other forms of network attack, reconnaissance, or interference directed at the Managed Network, the NOC facilities, or any third-party network or system;

(d) Generates excessive, disproportionate, or artificial traffic volumes designed to overwhelm network resources, circumvent bandwidth management policies, manipulate traffic engineering parameters, or otherwise interfere with the normal operation of the Managed Network;

(e) Modifies, reverse engineers, decompiles, disassembles, decrypts, or creates derivative works of the ArcMesh platform or any component thereof, or attempts to derive the source code, algorithms, or data structures of the ArcMesh platform, except to the extent expressly permitted by applicable law notwithstanding contractual restrictions (including applicable provisions of the Copyright Act of 1976, as amended, and the Canadian Copyright Act);

(f) Attempts to gain unauthorized access to any portion of Service Provider's systems, the NOC infrastructure, network management tools, monitoring systems, or other customers' data, network segments, virtual networks, or computing resources, whether by exploiting vulnerabilities, brute-force attacks, credential stuffing, or any other method.

4.3 intellectual Property Violations. Customer shall not use the Services to:

(a) Infringe, misappropriate, or violate the intellectual property rights of any third party, including copyrights, trademarks, service marks, patents, trade secrets, and other proprietary rights, whether such infringement occurs through the transmission, storage, distribution, or display of infringing content or through the use of infringing methods or processes;

(b) Distribute pirated software, unauthorized copies of copyrighted material, or content in violation of applicable intellectual property laws, including the Digital Millennium Copyright Act (17 U.S.C. § 512 et seq.) and the Canadian Copyright Act;

(c) Circumvent, disable, or interfere with any digital rights management technology, access controls, copy-protection mechanisms, or technological protection measures applied to any content, software, or service accessed through or transmitted over the Managed Network.

4.4 Unauthorized Commercial Use. Customer shall not:

(a) Resell, sublicense, redistribute, or otherwise make available the Services, access to the Managed Network, or the ArcMesh platform to any third party without Service Provider's prior written consent, whether for compensation or otherwise;

(b) Use the Services to provide managed network services, hosting services, colocation services, internet service provider services, or other commercial services to third parties, including Customer's own customers, vendors, or business partners (unless expressly authorized under the Agreement or an applicable Statement of Work);

(c) Use the ArcMesh platform outside the scope of the license granted under the Agreement, including use in connection with networks, infrastructure, or operations not covered by the Agreement. Customer acknowledges that any such misuse may trigger Customer's indemnification obligations under Section 12.2 of the Agreement and may constitute a material breach of the Agreement.

4.5 Spam and Unsolicited Communications. Customer shall not use the Services to:

(a) Transmit unsolicited bulk electronic mail, messages, or communications ("spam") in violation of applicable anti-spam legislation, including the CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq.) in the United States and Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23) in Canada;

(b) Harvest, collect, scrape, mine, or compile email addresses, phone numbers, or other contact information from third parties or third-party systems without the informed consent of the individuals whose information is collected, for the purpose of sending unsolicited communications or for any other purpose that violates Applicable Laws;

(c) Forge, falsify, or otherwise manipulate message headers, sender addresses, reply-to addresses, routing information, or other identifiers to disguise the origin of any communication transmitted via the Managed Network, or to impersonate any person, entity, or organization.

4.6 Security Violations. Customer shall not:

(a) Share, transfer, disclose, or make available access credentials (including usernames, passwords, API keys, tokens, certificates, and multi-factor authentication codes) for the ArcMesh platform or the Managed Network to any unauthorized person, or permit any unauthorized person to access the Services using Customer's credentials;

(b) Disable, circumvent, bypass, or interfere with any security features, authentication mechanisms, encryption protocols, firewalls, intrusion detection or prevention systems, access controls, or other security measures implemented by Service Provider as part of the Services;

(c) Use the Services to store, process, or transmit data in a manner that violates the data security and privacy requirements set forth in Exhibit E (Data Security and Privacy Requirements), including without limitation the requirements relating to encryption in transit and at rest, access controls, and data classification.

SECTION 5 — COMPLIANCE WITH TELECOMMUNICATIONS REGULATIONS

5.1 General Compliance Obligation. Customer shall use the Services in compliance with all applicable telecommunications regulations in each jurisdiction in which the Managed Network operates. Without limiting the generality of the foregoing, Customer shall comply with all applicable requirements of the Federal Communications Commission (FCC) in the United States and the Canadian Radio-television and Telecommunications Commission (CRTC) in Canada, including applicable rules governing the use of telecommunications services, interconnection, numbering, and emergency services. Customer acknowledges that the regulatory landscape for telecommunications services is complex and may vary by jurisdiction, and Customer shall be responsible for understanding and complying with the telecommunications regulations applicable to its specific use of the Services.

5.2 Regulatory Cooperation. Customer shall cooperate with Service Provider in responding to any regulatory inquiries, audits, investigations, or requests for information relating to the use of the Managed Network or the ArcMesh platform by Customer or its Authorized Users. Such cooperation shall include, without limitation, providing timely responses to information requests, making relevant personnel available for interviews or depositions, and producing relevant documents and records, in each case to the extent reasonably necessary to enable Service Provider to comply with its regulatory obligations. Customer shall bear its own costs in connection with such cooperation, unless the regulatory inquiry or investigation arises from Service Provider's breach of the Agreement or Service Provider's own regulatory non-compliance.

5.3 Lawful Intercept and Government Orders. Customer acknowledges that Service Provider may be required to comply with lawful interception orders, subpoenas, search warrants, court orders, national security letters, or other governmental directives issued by competent governmental authorities in the United States or Canada. Customer shall cooperate as reasonably requested by Service Provider in connection with such requirements, including by providing access to Customer premises equipment, network segments, or data to the extent required by the applicable order or directive. Service Provider shall provide notice to Customer of any such requirement to the extent permitted by law and the terms of the applicable order or directive. In the event that Service Provider is prohibited by law or by the terms of the applicable order from providing notice to Customer, Service Provider shall use commercially reasonable efforts to seek permission to provide such notice at the earliest practicable opportunity.

5.4 Export Controls. Customer shall not use the Services or the ArcMesh platform in violation of any applicable export control or sanctions laws and regulations, including without limitation the Export Administration Regulations (EAR) (15 C.F.R. Parts 730–774) administered by the Bureau of Industry and Security of the U.S. Department of Commerce, the International Traffic in Arms Regulations (ITAR) (22 C.F.R. Parts 120–130) administered by the U.S. Department of State, and the regulations administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) (31 C.F.R. Part 500 et seq.). Customer shall not export or re-export, directly or indirectly, the ArcMesh platform or any technical data received from Service Provider to any country, entity, or person prohibited under applicable export control or sanctions laws without first obtaining all required governmental authorizations.

5.5 Telecommunications Licensing. Customer represents and warrants that it holds all licenses, permits, authorizations, and registrations required under applicable telecommunications regulations for Customer's use of the Services in each jurisdiction covered by the Managed Network. Customer shall maintain such licenses, permits, and authorizations in good standing throughout the term of the Agreement. Customer shall promptly notify Service Provider of any revocation, suspension, or material modification of any such license, permit, or authorization that may affect Customer's ability to use the Services in compliance with Applicable Laws.

SECTION 6 — CONTENT RESTRICTIONS

6.1 Prohibited Content. Customer shall not use the Services to transmit, store, distribute, or make available content that:

(a) Is obscene, defamatory, libelous, slanderous, or constitutes harassment, stalking, bullying, or threats of violence directed at any individual or group;

(b) Constitutes hate speech or incitement to violence directed at individuals or groups based on protected characteristics, including race, color, religion, national origin, ethnicity, sex, gender, gender identity, sexual orientation, age, or disability, in violation of Applicable Laws;

(c) Violates the privacy rights of any individual, including the unauthorized collection, use, disclosure, or publication of personal information, personal health information, financial information, or other sensitive data, in violation of applicable privacy and data protection laws;

(d) Contains false, misleading, or deceptive information transmitted with the intent to defraud, mislead, or cause harm to any individual, entity, or governmental authority;

(e) Violates applicable data protection or privacy laws, including without limitation the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), the California Consumer Privacy Act (CCPA), the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada, and applicable provincial privacy legislation.

6.2 Customer Content Responsibility. Customer acknowledges and agrees that Customer is solely responsible for all data, information, content, files, communications, and other materials ("Customer Content") transmitted over or stored on the Managed Network by Customer or its Authorized Users. Service Provider does not monitor, review, edit, or control Customer Content, except as necessary to provide the Services, including cybersecurity monitoring, threat detection, and incident response services as set forth in Exhibit A (Statements of Work) and Exhibit E (Data Security and Privacy Requirements). Service Provider shall have no liability for Customer Content or for any claims, losses, or damages arising from the transmission, storage, or use of Customer Content by Customer or its Authorized Users. This Section 6.2 is consistent with the indemnification provisions of the Agreement, under which Customer indemnifies and holds harmless Service Provider against third-party claims, damages, and expenses relating to Customer-provided data or content transmitted over the Managed Network.

6.3 No Obligation to Monitor. Service Provider has no obligation to monitor Customer Content for compliance with this AUP, but Service Provider reserves the right to do so to the extent necessary to maintain the integrity, security, and performance of the Managed Network or to comply with Applicable Laws. Any monitoring conducted by Service Provider shall be performed in a manner consistent with the confidentiality and data protection obligations set forth in the Agreement and Exhibit E. Nothing in this Section 6.3 limits Service Provider's obligations under Exhibit E (Data Security and Privacy Requirements) or modifies the scope of Service Provider's cybersecurity monitoring obligations as set forth in Exhibit A.

SECTION 7 — MONITORING AND ENFORCEMENT

7.1 Network Monitoring. Customer acknowledges that Service Provider conducts twenty-four hours per day, seven days per week (24×7) network monitoring from its NOC facilities in Reston, Virginia and Winnipeg, Manitoba, Canada, as part of the managed network services described in the Agreement and the applicable Statements of Work. Such monitoring includes, without limitation, collection and analysis of network performance metrics (including latency, packet loss, jitter, bandwidth utilization, and uptime), traffic analysis and flow monitoring, security event correlation, and cybersecurity threat detection. Customer consents to such monitoring as a necessary component of the Services.

7.2 AUP Violation Detection. In the course of providing the Services, if Service Provider becomes aware of a potential violation of this AUP—whether through network monitoring, third-party complaints, regulatory inquiries, or any other means—Service Provider shall promptly notify Customer's designated contacts. As of the effective date of this AUP, Customer's primary designated contact for AUP-related matters is the VP of Network Operations, currently Katrina Bosch, or such other contact as Customer may designate in writing from time to time by notice to Service Provider in accordance with the Agreement. Service Provider's notification shall include reasonable detail regarding the suspected violation, including (to the extent available) the nature of the violation, the affected network segment or node, the time and date of the suspected activity, and any logs or evidence identified by Service Provider.

7.3 Investigation. Upon notification of a suspected AUP violation, Customer shall promptly investigate the matter and take corrective action as necessary to address the violation and prevent its recurrence. Customer shall cooperate with Service Provider in any investigation of a suspected AUP violation, including by providing access to relevant logs, records, system data, and personnel. Customer shall keep Service Provider reasonably informed of the progress and outcome of any investigation. Service Provider shall cooperate with Customer in such investigations by providing relevant network logs, traffic data, and other technical information within Service Provider's possession or control, subject to Service Provider's obligations to protect the confidentiality of its other customers and proprietary systems.

7.4 Right to Suspend. In the event of a material or imminent AUP violation that poses a risk to the integrity, security, or availability of the Managed Network, the ArcMesh platform, Service Provider's infrastructure, or any third-party network or system, Service Provider may take immediate action to suspend, block, filter, rate-limit, or otherwise limit the offending activity, provided that:

(a) Service Provider uses commercially reasonable efforts to limit the suspension or restriction to the affected node(s), network segment(s), or user(s) and to minimize the impact on Customer's other operations and unaffected portions of the Managed Network;

(b) Service Provider provides notice to Customer's designated contacts as soon as practicable, and in any event within two (2) hours of any suspension or restriction imposed under this Section 7.4, by telephone and confirmed by email;

(c) Service Provider works with Customer in good faith to investigate and resolve the underlying issue and to restore full service as promptly as possible following resolution of the violation;

(d) Any suspension or restriction under this Section 7.4 does not relieve Service Provider of its service level obligations under Exhibit B (Service Level Agreement), except to the extent that Exhibit B expressly excludes from service level calculations any downtime or degradation caused by Customer's violation of this AUP or Customer's failure to cooperate in the resolution of such violation.

For the avoidance of doubt, Service Provider's exercise of its rights under this Section 7.4 shall be proportional to the severity of the violation and shall not be used as a substitute for the notice and cure procedures set forth in Section 8.

SECTION 8 — CONSEQUENCES OF VIOLATIONS

8.1 Notice and Cure. Subject to Service Provider's emergency suspension rights under Section 7.4, upon identification of an AUP violation by Customer or any of its Authorized Users, Service Provider shall provide written notice to Customer describing the nature of the violation in reasonable detail. Customer shall have thirty (30) days from receipt of such notice to cure the violation (the "Cure Period"). Customer shall keep Service Provider reasonably informed of the steps being taken to cure the violation during the Cure Period and shall confirm in writing to Service Provider when the violation has been cured.

8.2 Escalation. If Customer fails to cure the violation within the Cure Period, or if the same or substantially similar violation recurs within twelve (12) months following the date on which Customer confirmed the cure of the original violation, Service Provider may take one or more of the following actions:

(a) Restrict or suspend the affected portion of the Services, including the specific nodes, network segments, or user accounts associated with the violation, until the violation is cured to Service Provider's reasonable satisfaction;

(b) Require Customer to implement specific remedial measures (which may include technical controls, access restrictions, additional monitoring, or revised internal policies) as a condition to continued service, provided that such measures are commercially reasonable and proportional to the violation;

(c) Escalate the matter to the executive sponsors designated under the Agreement (currently Warren Liang, President, Northgate Americas, Inc. on behalf of Customer, and Rajiv Sundaram, CEO, Cedarpoint Systems Integration, Inc. on behalf of Service Provider) for resolution in accordance with the dispute resolution procedures set forth in the Agreement.

8.3 Termination. A material, uncured violation of this AUP that continues for more than thirty (30) days after Service Provider has provided written notice of such violation to Customer shall constitute a material breach of the Agreement, entitling Service Provider to exercise its termination rights under Article 14 of the Agreement, subject to any additional cure periods, notice requirements, or limitations set forth therein. Nothing in this Section 8.3 limits Service Provider's obligation to provide transition assistance services following termination as set forth in the Agreement.

8.4 Indemnification. Customer's violation of this AUP does not limit, modify, or reduce the indemnification obligations set forth in the Agreement. In particular, and without limitation, Customer's use of the ArcMesh platform outside the scope of the license granted under the Agreement, Customer's transmission of data or content in violation of Applicable Laws or this AUP, and Customer's failure to comply with the security requirements of this AUP may give rise to Customer's indemnification obligations as set forth in Section 12.2 of the Agreement. Customer shall indemnify, defend, and hold harmless Service Provider and its affiliates, officers, directors, employees, and agents from and against any third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or relating to Customer's violation of this AUP.

8.5 No Liability for Enforcement Actions. Service Provider shall not be liable to Customer for any damages, service credits, lost revenue, business interruption, or other remedies arising from Service Provider's good-faith enforcement of this AUP, including any suspension, restriction, or limitation of Services imposed pursuant to Section 7.4 or Section 8.2, provided that Service Provider has complied with the notice, procedural, and proportionality requirements set forth in this AUP. This limitation applies to claims of any kind, whether sounding in contract, tort, strict liability, or otherwise.

8.6 Reservation of Rights. The remedies set forth in this Section 8 are cumulative and in addition to any other rights or remedies available to Service Provider under the Agreement, at law, or in equity. No failure or delay by Service Provider in exercising any right or remedy under this AUP shall constitute a waiver thereof, and no single or partial exercise of any right or remedy shall preclude any further exercise thereof or the exercise of any other right or remedy.

SECTION 9 — CUSTOMER OBLIGATIONS AND REPRESENTATIONS

9.1 User Management. Customer is responsible for:

(a) Managing access credentials and authentication for all Authorized Users, including the assignment, rotation, and protection of usernames, passwords, API keys, tokens, certificates, and multi-factor authentication credentials used to access the ArcMesh platform and the Managed Network;

(b) Ensuring that all Authorized Users are made aware of and comply with this AUP prior to accessing the Services or the ArcMesh platform, and providing periodic reminders or training to Authorized Users regarding their obligations under this AUP;

(c) Promptly revoking access for any user who is no longer authorized to access the Services (including upon termination of employment, change of role, or expiration of contractor engagement) or who has violated this AUP, and notifying Service Provider's NOC of any such revocation within twenty-four (24) hours.

9.2 Incident Reporting. Customer shall promptly report to Service Provider's NOC any known or suspected security incident, AUP violation, unauthorized access to the Managed Network or the ArcMesh platform, or any other event that may affect the integrity, security, or availability of the Services. Such reports may be submitted via the NOC's twenty-four-hour telephone hotline or via the incident reporting procedures set forth in Exhibit A. Customer's incident reporting obligations under this Section 9.2 are in addition to, and do not replace, any incident notification obligations set forth in Exhibit E (Data Security and Privacy Requirements).

9.3 Cooperation During Migration. During the three-phase migration from the legacy MPLS infrastructure operated by Greystone Halcyon Software to Service Provider's SD-WAN/ArcMesh platform (as described in Exhibit A and the Transition Services Side Letter dated June 9, 2023), Customer shall ensure that its use of both the legacy infrastructure and the Managed Network complies with this AUP. This obligation applies during all migration phases, including any parallel-run periods during which Customer's traffic is carried simultaneously on the legacy MPLS network and the Managed Network. Customer shall coordinate with both Service Provider and Greystone Halcyon Software to ensure that the migration does not create conditions that would result in a violation of this AUP, including network conflicts, unauthorized access, or data leakage between the legacy and new environments.

9.4 Record-Keeping. Customer shall maintain reasonable records of Authorized User access to the Services, including user provisioning and de-provisioning records, access logs, and authentication records, for a period of not less than twelve (12) months following the date of such access. Customer shall make such records available to Service Provider upon reasonable request in connection with the investigation of a suspected AUP violation, a security incident, or a regulatory inquiry, subject to applicable privacy and data protection laws.

SECTION 10 — UPDATES AND AMENDMENTS

10.1 Right to Update. Service Provider may update this AUP from time to time to reflect changes in Applicable Laws, changes in industry best practices, changes in the threat landscape, or changes in the Services, the Managed Network, or the ArcMesh platform. Any material changes to this AUP shall require sixty (60) days' prior written notice to Customer, delivered in accordance with the notice provisions of the Agreement. The notice shall describe the proposed changes in reasonable detail and shall specify the effective date of the updated AUP. Non-material changes (such as corrections of typographical errors, updates to contact information, or clarifications that do not alter the substance of Customer's obligations) may be made by Service Provider upon reasonable written notice to Customer without the sixty (60) day notice period.

10.2 Customer Objection. If Customer reasonably objects to a material update to this AUP, Customer shall provide written notice of its objection to Service Provider within thirty (30) days of receipt of Service Provider's notice of the proposed update. Upon receipt of Customer's objection, the parties shall negotiate in good faith to reach a mutually acceptable resolution. If the parties are unable to agree within thirty (30) days of Customer's objection, Customer may escalate the matter to the dispute resolution procedures set forth in the Agreement, including the executive escalation and mediation procedures described therein. During the pendency of any dispute regarding a proposed AUP update, the existing version of the AUP shall remain in effect.

10.3 No Unilateral Material Changes. Service Provider shall not unilaterally amend this AUP in a manner that materially diminishes Customer's rights under the Agreement, materially increases Customer's obligations or costs under the Agreement, or materially restricts Customer's permitted use of the Services, without Customer's prior written consent. Any such material amendment shall be documented as a written amendment to the Agreement executed by authorized representatives of both parties.

SECTION 11 — MISCELLANEOUS

11.1 Governing Law. This AUP shall be governed by and construed in accordance with the laws of the State of New York, without giving effect to any choice of law or conflict-of-laws rules or provisions (whether of the State of New York or any other jurisdiction) that would cause the application of the laws of any jurisdiction other than the State of New York. This governing law provision is consistent with, and subject to, the governing law and dispute resolution provisions set forth in the Agreement.

11.2 Notices. All formal notices under this AUP shall be delivered in accordance with the notice provisions set forth in the Agreement. Operational notices regarding suspected AUP violations, emergency suspensions, or other time-sensitive matters under this AUP may be delivered via email to the designated contacts specified by each party, with telephone confirmation for emergency matters. As of the effective date of this AUP, Customer's designated operational contact is Katrina Bosch, VP of Network Operations, Northgate Americas, Inc. Service Provider's designated operational contact is the NOC Shift Manager on duty at the applicable NOC facility.

11.3 Severability. If any provision of this AUP is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, the validity, legality, and enforceability of the remaining provisions shall not in any way be affected or impaired thereby. In such event, the parties shall negotiate in good faith to replace the invalid, illegal, or unenforceable provision with a valid, legal, and enforceable provision that achieves, to the greatest extent possible, the economic, business, and other purposes of the original provision.

11.4 Entire Agreement. This AUP, together with the Agreement and all Exhibits and Schedules thereto (including Exhibit A — Statements of Work, Exhibit B — Service Level Agreement, Exhibit C — Pricing and Payment Terms, Exhibit E — Data Security and Privacy Requirements, and the Transition Services Side Letter), constitutes the entire agreement of the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous understandings, agreements, representations, and warranties, whether written or oral, with respect to such subject matter.

11.5 Effective Date. This AUP is effective as of June 9, 2023, the effective date of the Agreement, and shall remain in effect for the duration of the Agreement, including any renewal or extension periods, unless earlier terminated or superseded in accordance with the terms hereof or of the Agreement.

ACKNOWLEDGMENT

This Acceptable Use Policy is Exhibit D to the Master Services Agreement dated June 9, 2023, between Northgate Americas, Inc. and Cedarpoint Systems Integration, Inc. As an exhibit incorporated by reference into the Agreement, this AUP does not require separate signature pages. The execution of the Agreement by the authorized representatives of the parties governs and confirms each party's acceptance of this AUP.

The Agreement was executed on June 9, 2023 by:

On behalf of Customer:

NORTHGATE AMERICAS, INC.

By: ________

Name: Warren Liang

Title: President

Date: June 9, 2023

On behalf of Service Provider:

CEDARPOINT SYSTEMS INTEGRATION, INC.

By: ________

Name: Rajiv Sundaram

Title: Chief Executive Officer

Date: June 9, 2023

This Exhibit D — Acceptable Use Policy consists of eleven (11) sections. Schedule 1 (Managed Node List) is attached hereto and incorporated herein by reference.

EXHIBIT D
ACCEPTABLE USE POLICY
to the
MASTER SERVICES AGREEMENT
dated June 9, 2023
between
NORTHGATE AMERICAS, INC.
and
CEDARPOINT SYSTEMS INTEGRATION, INC.
This Acceptable Use Policy (this "AUP") is Exhibit D to the Master Services Agreement dated June 9, 2023 (the "Agreement"), by and between Northgate Americas, Inc., a Delaware corporation ("Customer"), and Cedarpoint Systems Integration, Inc., a Delaware corporation ("Service Provider"). This AUP is incorporated into and forms an integral part of the Agreement. Capitalized terms used but not otherwise defined herein shall have the meanings ascribed to them in the Agreement.
SECTION 1 — PURPOSE AND SCOPE
1.1 Purpose. This Acceptable Use Policy establishes the rules, guidelines, and restrictions governing Customer's use of the managed network services and the ArcMesh platform (version 4.2) provided by Service Provider under the Agreement. The purpose of this AUP is to ensure the reliable, secure, and lawful operation of the Services, to protect the integrity and availability of the Managed Network and the ArcMesh platform, and to set forth clear expectations regarding acceptable and prohibited conduct by Customer and its Authorized Users. Service Provider has developed this AUP in accordance with industry best practices for managed network services and in consideration of the regulatory environments in which the Managed Network operates.
1.2 Scope of Application. This AUP applies to all Customer personnel, Authorized Users, contractors, and agents who access or use any portion of the managed wide-area network spanning three hundred forty (340) nodes across twenty-eight (28) U.S. states and three (3) Canadian provinces, as well as the ArcMesh platform licensed to Customer under the Agreement. The obligations set forth in this AUP apply regardless of the method of access to the Services—whether through direct network connections, remote access, API integrations, or the ArcMesh management console—and regardless of the geographic location from which access occurs. This AUP applies equally during the migration phases described in the Transition Services Side Letter and during steady-state operations following migration completion.
1.3 Relationship to Agreement. In the event of any conflict between this AUP and the Agreement, the Agreement shall control. This AUP supplements, but does not limit, the rights and obligations set forth in the Agreement, including without limitation the data security and privacy requirements set forth in Exhibit E (Data Security and Privacy Requirements) and the service level commitments set forth in Exhibit B (Service Level Agreement). Nothing in this AUP shall be construed to expand Customer's obligations beyond those set forth in the Agreement or to diminish Service Provider's obligations under the Agreement, except as expressly stated herein. For the avoidance of doubt, this AUP does not modify the limitation of liability, indemnification, or warranty provisions of the Agreement.
1.4 Acceptance. Customer's use of the Services constitutes acceptance of this AUP. Customer is responsible for ensuring that all Authorized Users are made aware of and comply with the terms of this AUP prior to accessing the Services or the ArcMesh platform. Customer shall take commercially reasonable steps to communicate the requirements of this AUP to all Authorized Users, including by incorporating this AUP or a summary thereof into Customer's internal acceptable use or information security policies, as applicable.
SECTION 2 — DEFINITIONS
For purposes of this AUP, the following terms shall have the meanings set forth below. All other capitalized terms shall have the meanings set forth in the Agreement.
2.1 "Authorized Users" means Customer's employees, officers, directors, agents, independent contractors, and other persons authorized by Customer to access or use the Services and the ArcMesh platform in connection with Customer's internal business operations. Authorized Users include, without limitation, personnel of Northgate Telecommunications PLC and its affiliates who have been granted authorized access to the Services in accordance with the Agreement and applicable Statements of Work. Customer shall maintain a current list of Authorized Users and shall make such list available to Service Provider upon reasonable request.
2.2 "Managed Network" means the managed wide-area network infrastructure operated by Service Provider on behalf of Customer under the Agreement, including all three hundred forty (340) managed nodes listed in Schedule 1 to this AUP, the SD-WAN overlay deployed using the ArcMesh platform, all associated routers, switches, firewalls, and other customer premises equipment managed by Service Provider, and the interconnections among such components. The Managed Network also includes any temporary or transitional network segments established during the migration from Greystone Halcyon Software's legacy MPLS infrastructure, as described in Exhibit A and the Transition Services Side Letter.
2.3 "ArcMesh Platform" means Service Provider's proprietary network orchestration platform (version 4.2), including all associated software modules, management consoles, APIs, dashboards, and documentation, licensed to Customer as embedded technology under the Agreement. The ArcMesh platform provides SD-WAN policy management, traffic engineering, network analytics, and automated failover capabilities across the Managed Network.
2.4 "NOC" means Service Provider's Network Operations Centers located in Reston, Virginia and Winnipeg, Manitoba, Canada, which provide twenty-four hours per day, seven days per week (24×7) monitoring, incident management, and technical support services for the Managed Network and the ArcMesh platform.
2.5 "Services" means all managed network services, ArcMesh platform license and maintenance, cybersecurity monitoring, and professional services provided by Service Provider to Customer under the Agreement, including all services described in the applicable Statements of Work (Exhibit A) and any ancillary services described in the Transition Services Side Letter.
2.6 "Applicable Laws" means all federal, state, provincial, and local laws, statutes, regulations, rules, ordinances, codes, and orders applicable to Customer's use of the Services in any jurisdiction in which the Managed Network operates or in which Customer or its Authorized Users access the Services, including without limitation applicable telecommunications regulations in the United States and Canada, data protection and privacy laws, export control laws, anti-spam legislation, and any applicable industry-specific regulations governing Customer's business operations.
SECTION 3 — PERMITTED USE
3.1 General. Customer may use the Services and the ArcMesh platform solely for Customer's internal business operations as contemplated by the Agreement. Permitted use includes the transmission, routing, and management of Customer's business data and communications across the Managed Network, including voice, video, and data traffic generated by Customer's employees, offices, data centers, and authorized third-party interconnections described in the applicable Statements of Work. Customer's use of the Services shall be consistent with the technical specifications, network architecture, and capacity planning parameters described in Exhibit A.
3.2 Licensed Scope. Customer's use of the ArcMesh platform shall be limited to the scope of the license granted under the Agreement. Customer shall not use the ArcMesh platform for purposes outside the licensed scope, including without limitation sublicensing, reselling, time-sharing, service bureau use, or providing the ArcMesh platform or access thereto to any third party. Notwithstanding the foregoing, Customer may permit its authorized contractors who are engaged to provide services to Customer in connection with Customer's internal business operations to access the ArcMesh platform solely to the extent necessary to perform such services, provided that (a) such contractors are included within the definition of Authorized Users, (b) Customer remains responsible for all acts and omissions of such contractors with respect to the Services and this AUP, and (c) such contractors are bound by confidentiality obligations at least as protective as those set forth in the Agreement.
3.3 Authorized Volume. Customer is authorized to use the Services across up to three hundred forty (340) managed nodes as identified in Schedule 1 to this AUP. The authorized node count reflects the capacity and pricing structure agreed upon by the parties under the Agreement. Addition of nodes beyond this authorized count requires a written amendment to the Agreement or the applicable Statement of Work (Exhibit A), as well as any applicable adjustments to the fees set forth in Exhibit C (Pricing and Payment Terms). Customer shall notify Service Provider in advance of any planned changes to its network topology that may affect the number of managed nodes or the capacity requirements of the Managed Network.
SECTION 4 — PROHIBITED ACTIVITIES
4.1 Illegal Activities. Customer shall not use, and shall ensure that Authorized Users do not use, the Services or the Managed Network for any purpose that is unlawful under Applicable Laws. Without limiting the generality of the foregoing, Customer and its Authorized Users shall not use the Services in connection with any of the following:
(a) Transmission, distribution, or storage of any material that violates any applicable federal, state, or provincial criminal statute, including but not limited to statutes governing fraud, computer crimes, and unauthorized access to computer systems;
(b) Conduct that would constitute a criminal offense or give rise to civil liability under Applicable Laws, whether directed at Service Provider, third parties, or the general public;
(c) Fraud, identity theft, phishing, pretexting, social engineering, or other deceptive practices designed to obtain sensitive information, financial gain, or unauthorized access to systems or accounts;
(d) Distribution, storage, transmission, or solicitation of child sexual abuse material, or any content that exploits, harms, or endangers minors in any manner;
(e) Unauthorized interception, recording, or monitoring of communications in violation of applicable wiretap, electronic surveillance, or communications privacy laws, including the Electronic Communications Privacy Act (18 U.S.C. §§ 2510–2522) and applicable Canadian federal and provincial privacy legislation.
4.2 Network Abuse and Interference. Customer shall not use the Services in any manner that:
(a) Disrupts, degrades, impairs, or interferes with Service Provider's ability to deliver the Services to Customer or to any other customer of Service Provider, including activities that consume disproportionate network resources, create bottlenecks, or reduce the quality of service available to other users of shared infrastructure;
(b) Introduces malicious code, viruses, worms, Trojan horses, ransomware, spyware, adware, rootkits, keyloggers, or other harmful software or code into the Managed Network, the ArcMesh platform, or any system or network connected thereto;
(c) Engages in denial-of-service attacks (including distributed denial-of-service attacks), port scanning, network probing, packet sniffing, IP spoofing, or other forms of network attack, reconnaissance, or interference directed at the Managed Network, the NOC facilities, or any third-party network or system;
(d) Generates excessive, disproportionate, or artificial traffic volumes designed to overwhelm network resources, circumvent bandwidth management policies, manipulate traffic engineering parameters, or otherwise interfere with the normal operation of the Managed Network;
(e) Modifies, reverse engineers, decompiles, disassembles, decrypts, or creates derivative works of the ArcMesh platform or any component thereof, or attempts to derive the source code, algorithms, or data structures of the ArcMesh platform, except to the extent expressly permitted by applicable law notwithstanding contractual restrictions (including applicable provisions of the Copyright Act of 1976, as amended, and the Canadian Copyright Act);
(f) Attempts to gain unauthorized access to any portion of Service Provider's systems, the NOC infrastructure, network management tools, monitoring systems, or other customers' data, network segments, virtual networks, or computing resources, whether by exploiting vulnerabilities, brute-force attacks, credential stuffing, or any other method.
4.3 intellectual Property Violations. Customer shall not use the Services to:
(a) Infringe, misappropriate, or violate the intellectual property rights of any third party, including copyrights, trademarks, service marks, patents, trade secrets, and other proprietary rights, whether such infringement occurs through the transmission, storage, distribution, or display of infringing content or through the use of infringing methods or processes;
(b) Distribute pirated software, unauthorized copies of copyrighted material, or content in violation of applicable intellectual property laws, including the Digital Millennium Copyright Act (17 U.S.C. § 512 et seq.) and the Canadian Copyright Act;
(c) Circumvent, disable, or interfere with any digital rights management technology, access controls, copy-protection mechanisms, or technological protection measures applied to any content, software, or service accessed through or transmitted over the Managed Network.
4.4 Unauthorized Commercial Use. Customer shall not:
(a) Resell, sublicense, redistribute, or otherwise make available the Services, access to the Managed Network, or the ArcMesh platform to any third party without Service Provider's prior written consent, whether for compensation or otherwise;
(b) Use the Services to provide managed network services, hosting services, colocation services, internet service provider services, or other commercial services to third parties, including Customer's own customers, vendors, or business partners (unless expressly authorized under the Agreement or an applicable Statement of Work);
(c) Use the ArcMesh platform outside the scope of the license granted under the Agreement, including use in connection with networks, infrastructure, or operations not covered by the Agreement. Customer acknowledges that any such misuse may trigger Customer's indemnification obligations under Section 12.2 of the Agreement and may constitute a material breach of the Agreement.
4.5 Spam and Unsolicited Communications. Customer shall not use the Services to:
(a) Transmit unsolicited bulk electronic mail, messages, or communications ("spam") in violation of applicable anti-spam legislation, including the CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq.) in the United States and Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23) in Canada;
(b) Harvest, collect, scrape, mine, or compile email addresses, phone numbers, or other contact information from third parties or third-party systems without the informed consent of the individuals whose information is collected, for the purpose of sending unsolicited communications or for any other purpose that violates Applicable Laws;
(c) Forge, falsify, or otherwise manipulate message headers, sender addresses, reply-to addresses, routing information, or other identifiers to disguise the origin of any communication transmitted via the Managed Network, or to impersonate any person, entity, or organization.
4.6 Security Violations. Customer shall not:
(a) Share, transfer, disclose, or make available access credentials (including usernames, passwords, API keys, tokens, certificates, and multi-factor authentication codes) for the ArcMesh platform or the Managed Network to any unauthorized person, or permit any unauthorized person to access the Services using Customer's credentials;
(b) Disable, circumvent, bypass, or interfere with any security features, authentication mechanisms, encryption protocols, firewalls, intrusion detection or prevention systems, access controls, or other security measures implemented by Service Provider as part of the Services;
(c) Use the Services to store, process, or transmit data in a manner that violates the data security and privacy requirements set forth in Exhibit E (Data Security and Privacy Requirements), including without limitation the requirements relating to encryption in transit and at rest, access controls, and data classification.
SECTION 5 — COMPLIANCE WITH TELECOMMUNICATIONS REGULATIONS
5.1 General Compliance Obligation. Customer shall use the Services in compliance with all applicable telecommunications regulations in each jurisdiction in which the Managed Network operates. Without limiting the generality of the foregoing, Customer shall comply with all applicable requirements of the Federal Communications Commission (FCC) in the United States and the Canadian Radio-television and Telecommunications Commission (CRTC) in Canada, including applicable rules governing the use of telecommunications services, interconnection, numbering, and emergency services. Customer acknowledges that the regulatory landscape for telecommunications services is complex and may vary by jurisdiction, and Customer shall be responsible for understanding and complying with the telecommunications regulations applicable to its specific use of the Services.
5.2 Regulatory Cooperation. Customer shall cooperate with Service Provider in responding to any regulatory inquiries, audits, investigations, or requests for information relating to the use of the Managed Network or the ArcMesh platform by Customer or its Authorized Users. Such cooperation shall include, without limitation, providing timely responses to information requests, making relevant personnel available for interviews or depositions, and producing relevant documents and records, in each case to the extent reasonably necessary to enable Service Provider to comply with its regulatory obligations. Customer shall bear its own costs in connection with such cooperation, unless the regulatory inquiry or investigation arises from Service Provider's breach of the Agreement or Service Provider's own regulatory non-compliance.
5.3 Lawful Intercept and Government Orders. Customer acknowledges that Service Provider may be required to comply with lawful interception orders, subpoenas, search warrants, court orders, national security letters, or other governmental directives issued by competent governmental authorities in the United States or Canada. Customer shall cooperate as reasonably requested by Service Provider in connection with such requirements, including by providing access to Customer premises equipment, network segments, or data to the extent required by the applicable order or directive. Service Provider shall provide notice to Customer of any such requirement to the extent permitted by law and the terms of the applicable order or directive. In the event that Service Provider is prohibited by law or by the terms of the applicable order from providing notice to Customer, Service Provider shall use commercially reasonable efforts to seek permission to provide such notice at the earliest practicable opportunity.
5.4 Export Controls. Customer shall not use the Services or the ArcMesh platform in violation of any applicable export control or sanctions laws and regulations, including without limitation the Export Administration Regulations (EAR) (15 C.F.R. Parts 730–774) administered by the Bureau of Industry and Security of the U.S. Department of Commerce, the International Traffic in Arms Regulations (ITAR) (22 C.F.R. Parts 120–130) administered by the U.S. Department of State, and the regulations administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) (31 C.F.R. Part 500 et seq.). Customer shall not export or re-export, directly or indirectly, the ArcMesh platform or any technical data received from Service Provider to any country, entity, or person prohibited under applicable export control or sanctions laws without first obtaining all required governmental authorizations.
5.5 Telecommunications Licensing. Customer represents and warrants that it holds all licenses, permits, authorizations, and registrations required under applicable telecommunications regulations for Customer's use of the Services in each jurisdiction covered by the Managed Network. Customer shall maintain such licenses, permits, and authorizations in good standing throughout the term of the Agreement. Customer shall promptly notify Service Provider of any revocation, suspension, or material modification of any such license, permit, or authorization that may affect Customer's ability to use the Services in compliance with Applicable Laws.
SECTION 6 — CONTENT RESTRICTIONS
6.1 Prohibited Content. Customer shall not use the Services to transmit, store, distribute, or make available content that:
(a) Is obscene, defamatory, libelous, slanderous, or constitutes harassment, stalking, bullying, or threats of violence directed at any individual or group;
(b) Constitutes hate speech or incitement to violence directed at individuals or groups based on protected characteristics, including race, color, religion, national origin, ethnicity, sex, gender, gender identity, sexual orientation, age, or disability, in violation of Applicable Laws;
(c) Violates the privacy rights of any individual, including the unauthorized collection, use, disclosure, or publication of personal information, personal health information, financial information, or other sensitive data, in violation of applicable privacy and data protection laws;
(d) Contains false, misleading, or deceptive information transmitted with the intent to defraud, mislead, or cause harm to any individual, entity, or governmental authority;
(e) Violates applicable data protection or privacy laws, including without limitation the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), the California Consumer Privacy Act (CCPA), the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada, and applicable provincial privacy legislation.
6.2 Customer Content Responsibility. Customer acknowledges and agrees that Customer is solely responsible for all data, information, content, files, communications, and other materials ("Customer Content") transmitted over or stored on the Managed Network by Customer or its Authorized Users. Service Provider does not monitor, review, edit, or control Customer Content, except as necessary to provide the Services, including cybersecurity monitoring, threat detection, and incident response services as set forth in Exhibit A (Statements of Work) and Exhibit E (Data Security and Privacy Requirements). Service Provider shall have no liability for Customer Content or for any claims, losses, or damages arising from the transmission, storage, or use of Customer Content by Customer or its Authorized Users. This Section 6.2 is consistent with the indemnification provisions of the Agreement, under which Customer indemnifies and holds harmless Service Provider against third-party claims, damages, and expenses relating to Customer-provided data or content transmitted over the Managed Network.
6.3 No Obligation to Monitor. Service Provider has no obligation to monitor Customer Content for compliance with this AUP, but Service Provider reserves the right to do so to the extent necessary to maintain the integrity, security, and performance of the Managed Network or to comply with Applicable Laws. Any monitoring conducted by Service Provider shall be performed in a manner consistent with the confidentiality and data protection obligations set forth in the Agreement and Exhibit E. Nothing in this Section 6.3 limits Service Provider's obligations under Exhibit E (Data Security and Privacy Requirements) or modifies the scope of Service Provider's cybersecurity monitoring obligations as set forth in Exhibit A.
SECTION 7 — MONITORING AND ENFORCEMENT
7.1 Network Monitoring. Customer acknowledges that Service Provider conducts twenty-four hours per day, seven days per week (24×7) network monitoring from its NOC facilities in Reston, Virginia and Winnipeg, Manitoba, Canada, as part of the managed network services described in the Agreement and the applicable Statements of Work. Such monitoring includes, without limitation, collection and analysis of network performance metrics (including latency, packet loss, jitter, bandwidth utilization, and uptime), traffic analysis and flow monitoring, security event correlation, and cybersecurity threat detection. Customer consents to such monitoring as a necessary component of the Services.
7.2 AUP Violation Detection. In the course of providing the Services, if Service Provider becomes aware of a potential violation of this AUP—whether through network monitoring, third-party complaints, regulatory inquiries, or any other means—Service Provider shall promptly notify Customer's designated contacts. As of the effective date of this AUP, Customer's primary designated contact for AUP-related matters is the VP of Network Operations, currently Katrina Bosch, or such other contact as Customer may designate in writing from time to time by notice to Service Provider in accordance with the Agreement. Service Provider's notification shall include reasonable detail regarding the suspected violation, including (to the extent available) the nature of the violation, the affected network segment or node, the time and date of the suspected activity, and any logs or evidence identified by Service Provider.
7.3 Investigation. Upon notification of a suspected AUP violation, Customer shall promptly investigate the matter and take corrective action as necessary to address the violation and prevent its recurrence. Customer shall cooperate with Service Provider in any investigation of a suspected AUP violation, including by providing access to relevant logs, records, system data, and personnel. Customer shall keep Service Provider reasonably informed of the progress and outcome of any investigation. Service Provider shall cooperate with Customer in such investigations by providing relevant network logs, traffic data, and other technical information within Service Provider's possession or control, subject to Service Provider's obligations to protect the confidentiality of its other customers and proprietary systems.
7.4 Right to Suspend. In the event of a material or imminent AUP violation that poses a risk to the integrity, security, or availability of the Managed Network, the ArcMesh platform, Service Provider's infrastructure, or any third-party network or system, Service Provider may take immediate action to suspend, block, filter, rate-limit, or otherwise limit the offending activity, provided that:
(a) Service Provider uses commercially reasonable efforts to limit the suspension or restriction to the affected node(s), network segment(s), or user(s) and to minimize the impact on Customer's other operations and unaffected portions of the Managed Network;
(b) Service Provider provides notice to Customer's designated contacts as soon as practicable, and in any event within two (2) hours of any suspension or restriction imposed under this Section 7.4, by telephone and confirmed by email;
(c) Service Provider works with Customer in good faith to investigate and resolve the underlying issue and to restore full service as promptly as possible following resolution of the violation;
(d) Any suspension or restriction under this Section 7.4 does not relieve Service Provider of its service level obligations under Exhibit B (Service Level Agreement), except to the extent that Exhibit B expressly excludes from service level calculations any downtime or degradation caused by Customer's violation of this AUP or Customer's failure to cooperate in the resolution of such violation.
For the avoidance of doubt, Service Provider's exercise of its rights under this Section 7.4 shall be proportional to the severity of the violation and shall not be used as a substitute for the notice and cure procedures set forth in Section 8.
SECTION 8 — CONSEQUENCES OF VIOLATIONS
8.1 Notice and Cure. Subject to Service Provider's emergency suspension rights under Section 7.4, upon identification of an AUP violation by Customer or any of its Authorized Users, Service Provider shall provide written notice to Customer describing the nature of the violation in reasonable detail. Customer shall have thirty (30) days from receipt of such notice to cure the violation (the "Cure Period"). Customer shall keep Service Provider reasonably informed of the steps being taken to cure the violation during the Cure Period and shall confirm in writing to Service Provider when the violation has been cured.
8.2 Escalation. If Customer fails to cure the violation within the Cure Period, or if the same or substantially similar violation recurs within twelve (12) months following the date on which Customer confirmed the cure of the original violation, Service Provider may take one or more of the following actions:
(a) Restrict or suspend the affected portion of the Services, including the specific nodes, network segments, or user accounts associated with the violation, until the violation is cured to Service Provider's reasonable satisfaction;
(b) Require Customer to implement specific remedial measures (which may include technical controls, access restrictions, additional monitoring, or revised internal policies) as a condition to continued service, provided that such measures are commercially reasonable and proportional to the violation;
(c) Escalate the matter to the executive sponsors designated under the Agreement (currently Warren Liang, President, Northgate Americas, Inc. on behalf of Customer, and Rajiv Sundaram, CEO, Cedarpoint Systems Integration, Inc. on behalf of Service Provider) for resolution in accordance with the dispute resolution procedures set forth in the Agreement.
8.3 Termination. A material, uncured violation of this AUP that continues for more than thirty (30) days after Service Provider has provided written notice of such violation to Customer shall constitute a material breach of the Agreement, entitling Service Provider to exercise its termination rights under Article 14 of the Agreement, subject to any additional cure periods, notice requirements, or limitations set forth therein. Nothing in this Section 8.3 limits Service Provider's obligation to provide transition assistance services following termination as set forth in the Agreement.
8.4 Indemnification. Customer's violation of this AUP does not limit, modify, or reduce the indemnification obligations set forth in the Agreement. In particular, and without limitation, Customer's use of the ArcMesh platform outside the scope of the license granted under the Agreement, Customer's transmission of data or content in violation of Applicable Laws or this AUP, and Customer's failure to comply with the security requirements of this AUP may give rise to Customer's indemnification obligations as set forth in Section 12.2 of the Agreement. Customer shall indemnify, defend, and hold harmless Service Provider and its affiliates, officers, directors, employees, and agents from and against any third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or relating to Customer's violation of this AUP.
8.5 No Liability for Enforcement Actions. Service Provider shall not be liable to Customer for any damages, service credits, lost revenue, business interruption, or other remedies arising from Service Provider's good-faith enforcement of this AUP, including any suspension, restriction, or limitation of Services imposed pursuant to Section 7.4 or Section 8.2, provided that Service Provider has complied with the notice, procedural, and proportionality requirements set forth in this AUP. This limitation applies to claims of any kind, whether sounding in contract, tort, strict liability, or otherwise.
8.6 Reservation of Rights. The remedies set forth in this Section 8 are cumulative and in addition to any other rights or remedies available to Service Provider under the Agreement, at law, or in equity. No failure or delay by Service Provider in exercising any right or remedy under this AUP shall constitute a waiver thereof, and no single or partial exercise of any right or remedy shall preclude any further exercise thereof or the exercise of any other right or remedy.
SECTION 9 — CUSTOMER OBLIGATIONS AND REPRESENTATIONS
9.1 User Management. Customer is responsible for:
(a) Managing access credentials and authentication for all Authorized Users, including the assignment, rotation, and protection of usernames, passwords, API keys, tokens, certificates, and multi-factor authentication credentials used to access the ArcMesh platform and the Managed Network;
(b) Ensuring that all Authorized Users are made aware of and comply with this AUP prior to accessing the Services or the ArcMesh platform, and providing periodic reminders or training to Authorized Users regarding their obligations under this AUP;
(c) Promptly revoking access for any user who is no longer authorized to access the Services (including upon termination of employment, change of role, or expiration of contractor engagement) or who has violated this AUP, and notifying Service Provider's NOC of any such revocation within twenty-four (24) hours.
9.2 Incident Reporting. Customer shall promptly report to Service Provider's NOC any known or suspected security incident, AUP violation, unauthorized access to the Managed Network or the ArcMesh platform, or any other event that may affect the integrity, security, or availability of the Services. Such reports may be submitted via the NOC's twenty-four-hour telephone hotline or via the incident reporting procedures set forth in Exhibit A. Customer's incident reporting obligations under this Section 9.2 are in addition to, and do not replace, any incident notification obligations set forth in Exhibit E (Data Security and Privacy Requirements).
9.3 Cooperation During Migration. During the three-phase migration from the legacy MPLS infrastructure operated by Greystone Halcyon Software to Service Provider's SD-WAN/ArcMesh platform (as described in Exhibit A and the Transition Services Side Letter dated June 9, 2023), Customer shall ensure that its use of both the legacy infrastructure and the Managed Network complies with this AUP. This obligation applies during all migration phases, including any parallel-run periods during which Customer's traffic is carried simultaneously on the legacy MPLS network and the Managed Network. Customer shall coordinate with both Service Provider and Greystone Halcyon Software to ensure that the migration does not create conditions that would result in a violation of this AUP, including network conflicts, unauthorized access, or data leakage between the legacy and new environments.
9.4 Record-Keeping. Customer shall maintain reasonable records of Authorized User access to the Services, including user provisioning and de-provisioning records, access logs, and authentication records, for a period of not less than twelve (12) months following the date of such access. Customer shall make such records available to Service Provider upon reasonable request in connection with the investigation of a suspected AUP violation, a security incident, or a regulatory inquiry, subject to applicable privacy and data protection laws.
SECTION 10 — UPDATES AND AMENDMENTS
10.1 Right to Update. Service Provider may update this AUP from time to time to reflect changes in Applicable Laws, changes in industry best practices, changes in the threat landscape, or changes in the Services, the Managed Network, or the ArcMesh platform. Any material changes to this AUP shall require sixty (60) days' prior written notice to Customer, delivered in accordance with the notice provisions of the Agreement. The notice shall describe the proposed changes in reasonable detail and shall specify the effective date of the updated AUP. Non-material changes (such as corrections of typographical errors, updates to contact information, or clarifications that do not alter the substance of Customer's obligations) may be made by Service Provider upon reasonable written notice to Customer without the sixty (60) day notice period.
10.2 Customer Objection. If Customer reasonably objects to a material update to this AUP, Customer shall provide written notice of its objection to Service Provider within thirty (30) days of receipt of Service Provider's notice of the proposed update. Upon receipt of Customer's objection, the parties shall negotiate in good faith to reach a mutually acceptable resolution. If the parties are unable to agree within thirty (30) days of Customer's objection, Customer may escalate the matter to the dispute resolution procedures set forth in the Agreement, including the executive escalation and mediation procedures described therein. During the pendency of any dispute regarding a proposed AUP update, the existing version of the AUP shall remain in effect.
10.3 No Unilateral Material Changes. Service Provider shall not unilaterally amend this AUP in a manner that materially diminishes Customer's rights under the Agreement, materially increases Customer's obligations or costs under the Agreement, or materially restricts Customer's permitted use of the Services, without Customer's prior written consent. Any such material amendment shall be documented as a written amendment to the Agreement executed by authorized representatives of both parties.
SECTION 11 — MISCELLANEOUS
11.1 Governing Law. This AUP shall be governed by and construed in accordance with the laws of the State of New York, without giving effect to any choice of law or conflict-of-laws rules or provisions (whether of the State of New York or any other jurisdiction) that would cause the application of the laws of any jurisdiction other than the State of New York. This governing law provision is consistent with, and subject to, the governing law and dispute resolution provisions set forth in the Agreement.
11.2 Notices. All formal notices under this AUP shall be delivered in accordance with the notice provisions set forth in the Agreement. Operational notices regarding suspected AUP violations, emergency suspensions, or other time-sensitive matters under this AUP may be delivered via email to the designated contacts specified by each party, with telephone confirmation for emergency matters. As of the effective date of this AUP, Customer's designated operational contact is Katrina Bosch, VP of Network Operations, Northgate Americas, Inc. Service Provider's designated operational contact is the NOC Shift Manager on duty at the applicable NOC facility.
11.3 Severability. If any provision of this AUP is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, the validity, legality, and enforceability of the remaining provisions shall not in any way be affected or impaired thereby. In such event, the parties shall negotiate in good faith to replace the invalid, illegal, or unenforceable provision with a valid, legal, and enforceable provision that achieves, to the greatest extent possible, the economic, business, and other purposes of the original provision.
11.4 Entire Agreement. This AUP, together with the Agreement and all Exhibits and Schedules thereto (including Exhibit A — Statements of Work, Exhibit B — Service Level Agreement, Exhibit C — Pricing and Payment Terms, Exhibit E — Data Security and Privacy Requirements, and the Transition Services Side Letter), constitutes the entire agreement of the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous understandings, agreements, representations, and warranties, whether written or oral, with respect to such subject matter.
11.5 Effective Date. This AUP is effective as of June 9, 2023, the effective date of the Agreement, and shall remain in effect for the duration of the Agreement, including any renewal or extension periods, unless earlier terminated or superseded in accordance with the terms hereof or of the Agreement.
ACKNOWLEDGMENT
This Acceptable Use Policy is Exhibit D to the Master Services Agreement dated June 9, 2023, between Northgate Americas, Inc. and Cedarpoint Systems Integration, Inc. As an exhibit incorporated by reference into the Agreement, this AUP does not require separate signature pages. The execution of the Agreement by the authorized representatives of the parties governs and confirms each party's acceptance of this AUP.
The Agreement was executed on June 9, 2023 by:
On behalf of Customer:
NORTHGATE AMERICAS, INC.
By: ________
Name: Warren Liang
Title: President
Date: June 9, 2023
On behalf of Service Provider:
CEDARPOINT SYSTEMS INTEGRATION, INC.
By: ________
Name: Rajiv Sundaram
Title: Chief Executive Officer
Date: June 9, 2023
This Exhibit D — Acceptable Use Policy consists of eleven (11) sections. Schedule 1 (Managed Node List) is attached hereto and incorporated herein by reference.

EXHIBIT D

ACCEPTABLE USE POLICY

MASTER SERVICES AGREEMENT

NORTHGATE AMERICAS, INC.

CEDARPOINT SYSTEMS INTEGRATION, INC.

ACKNOWLEDGMENT

NORTHGATE AMERICAS, INC.

CEDARPOINT SYSTEMS INTEGRATION, INC.

Record

Parties

Dates

Amounts