SPECIFIC TERMS AND CONDITIONS FOR CELCOM CYBER RISK RATING SOLUTION

The Celcom Cyber Risk Rating Solution (“Service”) is made available by Celcom to the Customers subject to these specific terms and conditions for the Service (“Specific Terms and Conditions for Cyber Risk Rating” or “STC for CRR”) which shall always be read together with the General Terms and Conditions for Enterprise Services (“GTC”) published on Celcom’s Website (at https://www.celcom.com.my/legal/terms-and-conditions/business) as of the Effective Date (as defined herein). Nothing in this STC for CRR shall be construed as limiting any other rights Celcom may have under the Agreement unless specifically stated otherwise. The Agreement shall come into effect on the date of execution of the SAF by the Customer (“Effective Date”) and shall continue to be in force until terminated or expires in accordance with the Terms and Conditions (“Term”).

1. Definitions

In this STC for CRR, unless the context otherwise requires, the capitalized terms have the meanings assigned to them below and in the GTC.

“Contract Period” means the contract period applicable for each subscription activated by Celcom as specified in the SAF which shall commence from the Service Start Date of the subscription;

“End Users” means (a) the legitimate and authorized employees of Customer OR any third party Customer allows to use the Service; (c) who receives the subscription as the result of the use of the Services and (c) who uses or relies on the Service;

“Billing Account” means an account created by Celcom, for billing purposes, under the Customer’s name for the Service;

“Service Start Date/ Effective Date” means the date on which Celcom activates the subscription for Customer’s use subject to Customer’s compliance with any precondition in accordance with the respective terms and conditions of the Service (if any);

“Termination Fee” means the termination fee payable by Customer to Celcom in the event any subscription is terminated within its respective Contract Period;

“Service” means the services that Celcom has agreed to provide to Customer for the purposes of internal use by Customer as set forth in the SAF and as further detailed in the service proposal and all other relevant documentation (including the deployment sign-off).

2. Period of Agreement

2.1 The Service Start Date shall be no later than five (5)  Working Days upon received completion of information. Celcom will notify the Customer in writing (via SMS or email) upon Activation of the Service.

2.2 The Customer’s subscription to the Service is subject to the Contract Period as specified in the Package details under the SAF.

2.3 Upon expiry of the Contract Period and provided that the Customer is not in breach of any terms of the Terms and Conditions, subscription to the Service may be automatically renewed on year to year basis for a period of twelve (12) months with the same Terms and Conditions.

3. Provision of Service

3.1 The Service is a Cyber security solution provided by Celcom and powered by a third party, SecurityScorecard (“Service Provider”).

3.2 This Service is made available for subscription which provide threat monitoring on the life cycle of the digital risk threatening the digital assets and brand, threat alerts and notification of such occurrence.

3.3 Customer may refer to Celcom’s designated account manager duly authorised by Celcom, channel managers or dealers for more information regarding the Service and to subscribe to the Service.

3.4 Celcom will provide the Service to the Customer in accordance with the Package which particulars are set out in the SAF. Provision of Service is further subject to the commercial terms of the Package subscribed to by the Customer.

3.5 Celcom reserves the right not to accept or proceed with the Customer’s application for the Service by issuing the Customer a notice if:(a) the Customer’s SAF is not duly completed and signed; or (b) the Customer fails to provide Celcom with the information requested by Celcom.

3.6 An authorization letter issued on behalf of the Customer to request for additional Service issued and signed by the Authorized Signatory or other Customer’s authorized personnel shall be deemed to be given by the Customer.

3.7 Customer is required to assign dedicated person in charge and team for escalation related to monthly or quarterly report sharing, billing, operation and maintenance support.

4. Fees, Charges and Payment

4.1 There is no upfront payment or activation fee required upon registration unless otherwise specified in SAF.

4.2 The Customer will be invoiced for the Service from the Service Start Date in the billing frequency as per stated in the SAF ("Billing Frequency").

4.3 The Customer shall pay for the subscription on an annual basis (“Annual Service Fees”) for each package subscribed by the Customer as specified in SAF. In addition to the Annual Service Fees, Customer shall also be responsible to pay the Applicable Taxes imposed by applicable laws for the Service.

4.4 The Annual Service Fees shall be paid by the Customer to Celcom within thirty (30) days from the date of Invoice from Celcom.

4.5 Celcom will impose 1.5% late payment charges for the payment after 30 days from the billing date.

5. Restrictions on Use of Service

5.1 Customer may not rent, lease, license, transfer, loan or assign the rights to use the Service to any third party. Celcom holds no responsibility or liability for use of the Service by any unauthorized user in the event the Customer allows any third party to use the Service.

5.2 The Customer will not have any right, title or interest in the Service apart from the right to use the Service in accordance with the Terms and Conditions.

5.3 Customer shall not use the Service:

      (a) as a means to monitor the activities of other person without their express consent and authorization or use the Service to harvest personal information about others for any reason;

      (b) in a way that is unlawful, invasive of another’s privacy, or inappropriate, or damage Celcom’s reputation or that of a third party;

      (c) to victimize, harass, degrade, threaten or intimidate an individual or group of individuals for any reason;

      (d) in way that allows Customer to circumvent or disable features or technology used in the Service unless Celcom specifically allow Customer to;

      (e) to decompile, disassemble, reverse engineer, or otherwise attempt to derive the source code for any part of the Service;

      (f) to engage in any activity, outside of what is permitted by the Service, that otherwise interferes with the use and enjoyment of the Service by others; or

      (g) to violate Celcom’s or any other persons or entities rights (including intellectual property and other proprietary rights).

6. Celcom’s Rights

6.1 Without limiting the other rights Celcom may have under the Agreement Celcom hereby reserves the rights to provide any information in relation to the Service and use of the Service by the Customer including but not limited to the web browsing history to the law enforcing agencies as and when required and/or requested by any lawful, regulatory, governmental or statutory authority.

7. Limitation of Liability

7.1 Pursuant to the nature of the Service which is provided by a third party, and not in derogation of the Terms and Conditions, Celcom excludes any liability and responsibility related to the Service.

7.2 Customer agrees that Celcom’s entire liability in contract, tort (including negligence or breach or statutory duty) or otherwise to the Customer (except for death or personal injury caused by Celcom’s negligence) under this Agreement shall not at any time exceed the sum specified in the SAF (“Limit of Liability”).

7.2 The Limit of Liability shall not apply to the extent that the liability may not be limited or excluded under applicable laws. Nothing in the Agreement will limit or exclude the Customer’s liability in relation to: (a) damage to Celcom’s property, if any, by the Customer and all costs incurred thereto; (b) Customer’s fraud, fraudulent misrepresentation, gross negligence, violation of applicable laws, or willful default; (c) Customer’s breach of its obligations pertaining to Celcom’s cyber security requirements, personal data protection or confidentiality; (d) Customer’s indemnity obligations; and (e) Customer’s payment obligations.

8. Disclaimer of Liability against the Customer

8.1 The Service does not protect the Customer:

      (a) if arising from Customer’s use of the Services including relating to any inaccuracies, inconsistencies, unreliability or errors in the Service, including any output, data or results generated by the Service;

      (b) if arising from any acts or omissions (whether negligent or otherwise) by Service Provider in connection with the Service;

      (c) if due to loss or corruption of data caused by the Service, including any misuse of the Service by Customer or Third Party User or any use which is not in accordance with this Agreement;

      (d) if caused by Customer’s or Third Party User’s use of a release or version of the Service that is no longer supported by Service Provider or provided hereunder;

      (e) if caused by any equipment, software or services not provided by Service Provider, or their combination with or application to the Service or act or omission of Customer or any third party (including Third Party User) when using data enabled apps including those with a proprietary form of encryption.

8.2 Celcom will not be responsible or liable for any claims by the Customers or any third party arising from the act, omission or negligence by the Customer or by the Service Provider.

9. Suspension

9.1 Without limiting other rights Celcom may have under this Agreement, Celcom may suspend immediately, in whole or in part, with or without notice, the Service if

      (a) the Customer does not comply with any instruction or directive issued by Celcom from time to time in compliance with the relevant laws; or

      (b) the Customer or any of its agents, officer, directors or employees has committed any act of fraud, misrepresentation, negligence or dishonesty (including the provision of any false or misleading information or the making of any misrepresentation to Celcom or the Subscribers in connection with the Service); and/or

      c) the Customer or any of its agents, officers, directors, or employees has committed any act or omission which may adversely affects the Celcom.

9.2 The Service will be suspended in the event the subscription services subscribed by the Customer is suspended in accordance with the Terms and Conditions. No Reconnection Fee is applicable for the Service in the event of reconnection of the subscription services subsequent to the suspension.

10. Termination

10.1 Either Party shall be entitled to terminate this Agreement by giving ninety (90) days prior written notice to the other Party without assigning any reason whatsoever. Celcom shall not be liable for any compensation and damages towards the Customer in the event Celcom exercises its right to terminate for convenience in accordance with the Terms and Conditions.

10.2 Upon termination of this Agreement

      (a) the Customer’s access to the Service shall immediately cease;

      (b) the Customer shall be responsible to settle all outstanding amount due to Celcom in relation to the Agreement incurred up to the date of such termination.

11. Warranty

11.1 The availability of the Service is subject to the use and availability of Celcom network connection.

11.2 As far as Celcom is able to under the law Celcom excludes all representations, warranties, conditions and other terms not expressly stated in these terms, including any implied warranties or conditions as to non-infringement of third party rights and fitness for a particular purpose in relation to the Customer’s use of the Service.

11.3 Celcom does not warrant that the Customer’s use of the Service will be error-free, uninterrupted, available at all times, or that it will protect against all possible security threats.

12. Maintenance Support and Problem Reporting

12.1 For any complaints or queries, Customer may contact the dedicated customer service email at cybersecuritysupport@celcom.com.my

13. Anti-Bribery And Anti-Corruption

13.1 The Customer shall comply with Celcom’s Anti-Bribery and Anti-Corruption (“ABAC”) Policy and ABC Terms and Conditions (“ABAC T&C”) as published on Celcom’s website at https://www.celcom.com.my/about-celcom/governance or other uniform resource locator (“URL”) as communicated by Celcom from time to time. Reference to ‘Counterparty’ in the ABAC T&C shall refer to the Customer In the event of any inconsistency between the provisions of the ABAC T&C and the provisions of this Agreement, the former shall prevail to the extent of such inconsistency.