IBM Sterling B2B Services

Service Description IBM Sterling B2B Services This Service Description describes the Cloud Service IBM provides to Client. Client means the contracting party and its authorized users and recipients of the Cloud Service. The applicable Quotation and Proof of Entitlement (PoE) are provided as separate Transaction Documents. 1. IBM Sterling B2B Services IBM Sterling B2B Service is a cloud-based, business-to-business (B2B) integration-as-a-service solution providing connectivity and collaboration between Client and customers, suppliers, and the organizational entities with which Client has a business relationship ("Trading Partners"). Client's Trading Partners are organizational entities with which Client has a business relationship. The Cloud Service is based upon a value added network (VAN) known as the IBM Sterling B2B Collaboration Network. The Cloud Service delivers visibility and control over the business processes shared with outside companies and can provide onboarding and community support for a Client's Trading Partners. The main component of the Cloud Service is Transport. The Cloud Service provides connectivity and collaboration with Trading Partners and delivers visibility and control over the business processes shared with outside companies. The Cloud Services include, but are not limited to, data transport, carbon copy, delimiter conversion, document clipping, and First-In-First-Out (FIFO) processing. IBM will establish the hardware, software, and communications for the Cloud Service. Client and IBM each retain responsibility for access control, firewalls, user security, and hardware at their respective network entry point. As part of this Cloud Service, IBM will implement connectivity between Client and IBM and will work with Client during joint connectivity testing between Client and IBM. As further set forth on the Transaction Document, IBM will provide Mailboxes on the IBM B2B Collaboration Network, each of which is a private, electronic storage space that is assigned to Client, allowing Client to send, store, and receive electronic data. Client may also choose to use Mailslots, which are components of a Mailbox that allows the drop off and pick up of data. 1.1 Optional Services 1.1.1 Premium Support Services This optional support offering provides a dedicated team of assigned resources to be available for Client's support issues over and above our basic technical support. This Cloud Service is only available in North America. 1.1.2 Networking Options a. Collaboration Network Co-Managed VPN Subscription Consists of a connection to the IBM B2B Collaboration Network via Client's VPN connection. 1.1.3 Set-Up Services for Networking Options Set-up services will be provided to a Client owned or controlled location or an IBM location, as applicable. a. IBM Sterling B2B Services Collaboration Network Co-Managed VPN Set-up Consists of working with Client to configure Client's VPN to connect to the IBM B2B Collaboration Network. b. IBM Sterling B2B Services Collaboration Network Managed AS2 Set-up Consists of configuring Client's managed AS2 connection to the IBM B2B Collaboration Network. c. IBM Sterling B2B Services Collaboration Network OFTP2 Set-up Consists of provisioning OFTP2 to connect to the IBM B2B Collaboration Network. 1.1.4 Community Services a. IBM Sterling B2B Services Community Development Services Standard Partner Survey Consists of sending an existing survey template to collect data about EDI capabilities and plans to Client's Trading Partners. Client must provide a Trading Partner list. i126-6371-04 (02/2018) Page 1 of 8

b. IBM Sterling B2B Services Community Development Services Custom Partner Survey Consists of assembling and sending a survey to collect data from Client's Trading Partners. Client must define the questions to be asked and provide a Trading Partner list. c. IBM Sterling B2B Services Community Development Services Document Verification Service Consists of checking each Trading Partner's initial compliance with Client's EDI specifications by testing inbound Documents from Trading Partners against Client's EDI specifications. IBM's work includes sharing specifications with trading partners, setting up testing with trading partners, notification to Client as each trading partner passes testing, and developing biweekly summary reports. Client must provide the mapping specifications of the Documents to be tested and a trading partner list. The subscription fee for this service will be based on each Document type tested per Trading Partner. d. IBM Sterling B2B Services Community Development Services Partner Conversion Service Consists of working with Client to convert existing VAN traffic and Client's Trading Partner community to the IBM B2B Collaboration Network. IBM's work includes contacting Trading Partners, notifying Trading Partners' VANs of the change, assigning a sponsor company ID to the Trading Partner's IBM Collaboration Network Mailbox, confirming that other VANs have routed IDs properly, monitoring Client's Mailboxes for five (5) business days, and working with Client to resolve Trading Partner/VAN issues. Client must provide a Trading Partner list. e. IBM Sterling B2B Services Community Development Services Partner Recruitment Service Consists of recruiting Trading Partners to join Client's Trading Partner community. IBM will engage in up to three (3) communication efforts to reach Trading Partners to determine if they will comply with Client's community request and will provide weekly program status updates to Client. Client must provide a Trading Partner list. f. IBM Sterling B2B Services Community Development Services Partner Test Coordination Service Consists of coordination of the end-to-end testing process between Trading Partner and Client. IBM's work includes sharing specifications with Trading Partners, scheduling initial end-to-end testing, monitoring and communicating test results to respective parties to facilitate corrective actions as appropriate and coordinating a go live date after successful testing has been completed and signed off. Client must provide the mapping specifications of the Documents to be tested and a Trading Partner list. The subscription fee for this service will be based on each Document type tested per Trading Partner. 1.1.5 On-Demand Services a. IBM Sterling B2B Services Collaboration Network Client Services Assisted Mailslot Status Check Consists of IBM checking the status of an EDI interchange or File within a Mailslot and communicating if the data was or was not found and if found, if the interchange or File was picked up. These details are communicated via phone call or email. b. IBM Sterling B2B Services Collaboration Network Client Services Assisted Restore Consists of IBM restoring data to a Mailslot after archival. c. IBM Sterling B2B Services Collaboration Network Mailbox Set-up Consists of allocating and setting up the Mailbox through which Client will send and receive data. 2. Content and Data Protection The Data Processing and Protection data sheet (Data Sheet) provides information specific to the Cloud Service regarding the type of Content enabled to be processed, the processing activities involved, the data protection features, and specifics on retention and return of Content. Any details or clarifications and terms, including Client responsibilities, around use of the Cloud Service and data protection features, if any, are set forth in this section. There may be more than one Data Sheet applicable to Client's use of the Cloud Service based upon options selected by Client. The Data Sheet may only be available in English i126-6371-04 (02/2018) Page 2 of 8

and not available in local language. Despite any practices of local law or custom, the parties agree that they understand English and it is an appropriate language regarding acquisition and use of the Cloud Services. The following Data Sheet(s) apply to the Cloud Service and its available options. Client acknowledges that i) IBM may modify Data Sheet(s) from time to time at IBM's sole discretion and ii) such modifications will supersede prior versions. The intent of any modification to Data Sheet(s) will be to i) improve or clarify existing commitments, ii) maintain alignment to current adopted standards and applicable laws, or iii) provide additional commitments. No modification to Data Sheet(s) will materially degrade the data protection of a Cloud Service. Link(s) to the applicable Data Sheet(s): https://www.ibm.com/software/reports/compatibility/clarityreports/report/html/softwarereqsforproduct?deliverableid=38bf2400b93711e7a5a50513c295686a Client is responsible to take necessary actions to order, enable, or use available data protection features for a Cloud Service and accepts responsibility for use of the Cloud Services if Client fails to take such actions, including meeting any data protection or other legal requirements regarding Content. IBM's Data Processing Addendum at http://ibm.com/dpa (DPA) and DPA Exhibit(s) apply and are referenced in as part of the Agreement, if and to the extent the European General Data Protection Regulation (EU/2016/679) (GDPR) applies to personal data contained in Content. The applicable Data Sheet(s) for this Cloud Service will serve as the DPA Exhibit(s). If the DPA applies, IBM's obligation to provide notice of changes to Subprocessors and Client's right to object to such changes will apply as set out in DPA. 2.1 Data Use IBM will not use or disclose the results arising from Client's use of the Cloud Service that are unique to your Content (Insights) or that otherwise identify Client. IBM may however use Content and other information (except for Insights) that results from Content in the course of providing the Cloud Service subject to removing personal identifiers; so that any personal data can no longer be attributed to a specific individual without the use of additional information. IBM will use such data only for research, testing, and offering development. 3. Service Level Agreement IBM provides the following availability service level agreement ("SLA") for the Cloud Service as specified in a PoE. The SLA is not a warranty. The SLA is available only to Client and applies only to use in production environments. 3.1 Availability Credits Client must log a Severity 1 support ticket with the IBM technical support help desk within 24 hours of first becoming aware that there is a critical business impact and the Cloud Service is not available. Client must reasonably assist IBM with any problem diagnosis and resolution. A support ticket claim for failure to meet an SLA must be submitted within 3 business days after the end of the contracted month. Compensation for a valid SLA claim will be a credit against a future invoice for the Cloud Service based on the duration of time during which production system processing for the Cloud Service is not available ("Downtime"). Downtime is measured from the time Client reports the event until the time the Cloud Service is restored and does not include time related to a scheduled or announced maintenance outage; causes beyond IBM's control; problems with Client or third party content or technology, designs or instructions; unsupported system configurations and platforms or other Client errors; or Client-caused security incident or Client security testing. IBM will apply the highest applicable compensation based on the cumulative availability of the Cloud Service during each contracted month, as shown in the table below. The total compensation with respect to any contracted month cannot exceed 10 percent of one twelfth (1/12th) of the annual charge for the Cloud Service. For bundled Cloud Services (individual Cloud Service offerings packaged and sold together as a single offering for a single combined price), the compensation will be calculated based on the single combined monthly price for the bundled Cloud Service, and not the monthly subscription fee for each individual Cloud Service. Client may only submit claims relating to one individual Cloud Service in a bundle at a given time. i126-6371-04 (02/2018) Page 3 of 8

3.2 Service Levels Availability of the Cloud Service during a contracted month Availability during a contracted month Compensation (% of monthly subscription fee* for contracted month that is the subject of a claim) Less than 99.9% 2% Less than 99% 5% Less than 95% 10% * If the Cloud Service was acquired from an IBM Business Partner, the monthly subscription fee will be calculated on the then-current list price for the Cloud Service in effect for the contracted month which is the subject of a claim, discounted at a rate of 50%. IBM will make a rebate directly available to Client. Availability, expressed as a percentage, is calculated as: the total number of minutes in a contracted month minus the total number of minutes of Downtime in a contracted month divided by the total number of minutes in the contracted month. 4. Technical Support Technical support for the Cloud Service is provided via telephone, email, online forums, and an online problem reporting system. IBM's software as a service support guide available at https://www- 01.ibm.com/software/support/saas_support_guide.html provides technical support contact and other information and processes. Technical support is offered with the Cloud Service and is not available as a separate offering. 5. Entitlement and Billing Information 5.1 Charge Metrics The Cloud Service is available under the charge metric specified in the Transaction Document: Connection is a unit of measure by which the Cloud Service can be obtained. A Connection is a link or association of a database, application, server, or any other type of device to the Cloud Service. Sufficient entitlement must be obtained to cover the total number of Connections which have been or are made to the Cloud Service during the measurement period specified in a Proof of Entitlement (PoE) or Transaction Document. Document is a unit of measure by which the Cloud Service can be obtained. A Document is defined as a finite volume of data that is enveloped within a document header and trailer record that marks its beginning and end. Sufficient entitlements must be obtained to cover the total number of Documents processed by the Cloud Service during the measurement period specified in a Proof of Entitlement (PoE) or Transaction Document. Entity ID is a unit of measure by which the Cloud Service can be obtained. An Entity ID is a unique identifier, which may be referred to in the Cloud Service environment by different terms that may include but would not be limited to Client's ID, partner ID, supplier ID, vendor ID, or EDI ID within the Cloud Service. Sufficient entitlements must be obtained to cover the total number of Entity IDs contained in the Cloud Service during the measurement period specified in Client's Proof of Entitlement (PoE) or Transaction Document. For the Cloud Service, an Entity ID is a unique identifier for a trading entity, regardless of that trading entity's organizational structure. Kilo Character is a unit of measure by which the Cloud Service can be obtained. A Kilo Character is defined as 1000 bytes of data. Sufficient entitlements must be obtained to cover the total number of Kilo Characters processed by the Cloud Service during the measurement period specified in a Proof of Entitlement (PoE) or Transaction Document. Request is a unit of measure by which the Cloud Service can be obtained. A Request is defined as the act by the client that authorized IBM to perform the service. Depending upon the service, the Request can be in the form of a written notice or a support request which is made by phone call, email, or online case. Sufficient entitlements must be obtained to cover the total number of Requests submitted to the Cloud Service during the measurement period specified in a Proof of Entitlement (PoE) or Transaction Document. i126-6371-04 (02/2018) Page 4 of 8

5.2 Set-Up Charges A one-time setup fee will be billed at the rate specified in the Transaction Document for each setup service ordered. An on-demand set-up charge, if ordered, will be billed at the rate specified in the Transaction Document for each setup service. 5.3 Overage Charges If actual usage of the Cloud Service during the measurement period exceeds the entitlement specified in the PoE, an overage charge will be billed at the rate specified in the Transaction Document in the month following such overage. 5.4 Remote Services Charges An on-demand remote service charge, if ordered, will be billed at the rate specified in the Transaction Document. 5.5 Billing Frequency Based on selected billing frequency, IBM will invoice Client the charges due at the beginning of the billing frequency term, except for overage and usage type of charges which will be invoiced in arrears. 6. Term and Renewal Options The term of the Cloud Service begins on the date IBM notifies Client of their access to the Cloud Service, as documented in the PoE. The PoE will specify whether the Cloud Service renews automatically, proceeds on a continuous use basis, or terminates at the end of the term. For automatic renewal, unless Client provides written notice not to renew at least 90 days prior to the term expiration date, the Cloud Service will automatically renew for the term specified in the PoE. For continuous use, the Cloud Service will continue to be available on a month to month basis until Client provides 90 days written notice of termination. The Cloud Service will remain available to the end of the calendar month after such 90 day period. 7. Additional Terms 7.1 General Client agrees IBM may publicly refer to Client as a subscriber to the Cloud Services in a publicity or marketing communication. Client may not use Cloud Services, alone or in combination with other services or products, in support of any of the following high risk activities: design, construction, control, or maintenance of nuclear facilities, mass transit systems, air traffic control systems, automotive control systems, weapons systems, or aircraft navigation or communications, or any other activity where failure of the Cloud Service could give rise to a material threat of death or serious personal injury. 7.2 Third Party Networks Transmission of content to and from the Cloud Service by Client and Client's Trading Partners may use third party networks. It is up to Client to choose the protocols and means used to transmit content on the Cloud Service and through third party networks. Client is advised to use the appropriate technology, such as adequate encryption if Client wants to protect Client's content, including Client IDs and passwords. 7.3 Links to Third Party Websites or Other Services Transmission of content to and from the Cloud Service by Client and Client's Trading Partners may use third party networks. It is up to Client to choose the protocols and means used to transmit content on the Cloud Service and through third party networks. Client is advised to use the appropriate technology, such as adequate encryption if Client wants to protect Client's content, including Client IDs and passwords. 7.4 Unique Extensions If the Cloud Service contains user exits that allow Client (or Client's designated third party) to configure an IBM software application and Client (or Client's designated third party) utilize the user exits, then IBM is i126-6371-04 (02/2018) Page 5 of 8

not liable for any resulting configurations ("Unique Extensions") and the Unique Extensions are not part of the Cloud Service. 7.5 Guest User Access Client and any third party user of the Cloud Service authorized by Client to access the Cloud Service to exchange data with Client or to use the Cloud Service on Client's behalf ("Guest User") may be required to execute an online agreement provided by IBM in order to access and use the Cloud Service. Client is responsible for these Guest Users, including but not limited to a) any claims made by the Guest Users relating to the Cloud Service, b) charges incurred by the Guest User, or c) any misuses of the Cloud Service by these Guest Users. 7.6 Data Exchange The Cloud Service may include (1) the sending or receiving of data between Client and Client's Trading Partners; 2) transmission of data to and from Client's Trading Partners either via direct connections with IBM or interconnections through one or more gateways or networks provided by third parties ("Interconnect Services" and each third party an "Interconnect Provider"); or (3) certain translation services or other associated services. IBM may transfer or store the data outside of the country where Client or Client's Trading Partners are located solely for the purposes of providing the Cloud Service or as required by applicable law or legal process. EXCEPT AS SET FORTH IN A SEPARATE AGREEMENT BETWEEN CLIENT AND AN INTERCONNECT PROVIDER, IN NO EVENT WILL ANY INTERCONNECT PROVIDER HAVE ANY LIABILITY TO CLIENT IN CONNECTION WITH THE PROVISION OF THE CLOUD SERVICE. 7.7 Data Retention Unless otherwise stated in the description of the available Cloud Services, IBM will retain and provide online visibility to data for at least 35 and up to 42 days, via browser-based visibility tools. Once the data is no longer available the data is purged and is not recoverable. 7.8 Exclusions Instances of customized scripts that perform custom processing of the data prior to translation (inbound or outbound) are not documented or included as part of the Cloud Service. The Cloud Service may involve the transmission of content including Client ID and password from, to, or over third-party systems or networks, such as the Internet and other Interconnect Services, over which IBM exercises no control and for which IBM is not responsible or liable. IBM does not represent or warrant that content coming into the Cloud Service environment has been treated by the sender of the content as confidential, or that content transmitted from the Cloud Service environment will be treated by the recipient as confidential. Accordingly, Client should encrypt the content if Client wants to make the content unreadable or indecipherable in the Cloud Service environment and in transit over IBM and other third party networks, including any Interconnect Services. Client is responsible for, and assumes any risk for, choosing the protocols and means it uses to transmit content over IBM and other third party networks. 7.9 Communications Software and Equipment IBM must approve any communications software used to transmit data to (and receive data from) IBM. If the Cloud Service requires a connection of Client's equipment with IBM equipment (using common carrier communication devices or terminal equipment), the devices and equipment that Client provides (and use) must be of a type approved by IBM. IBM has the sole and exclusive right to select its own equipment, software, and communications carriers to provide the Cloud Service. Unless otherwise specified herein, Client is responsible for obtaining an appropriate internet service account and connection for accessing the Cloud Service. 7.10 Responsibilities 7.10.1 Client's Responsibilities Client will (and will, if applicable, require Client's Trading Partners to): a. ensure adequate security over Client's respective applications, hardware (including installing and maintaining appropriate firewalls to prevent unauthorized access), Mailboxes, and transmission and monitor those Mailboxes and transmissions; i126-6371-04 (02/2018) Page 6 of 8

b. notify IBM of any translation errors or failures, processing errors or failures, nonconforming transmissions, failures to send or receive transmissions, or inability to access any Mailbox; c. inspect data for accuracy and completeness and encrypt the data if Client is required to make it (or wants to make it) unreadable or indecipherable in the Cloud Service environment and in transit over IBM and other third party networks, including any Interconnect Services; d. set the applicable data-processing parameters and transmissions param11eters; e. ensure that appropriate safeguards are in place to identify data, processing, and transmission errors; f. maintain supporting data, files, and other materials sufficient to enable IBM to recover all data, files, and other materials (such as card files, tape files, disk files, and printer outputs) needed to reperform any service provided by Cloud Service; g. implement connectivity between Client and IBM and work with IBM during joint connectivity testing between Client and IBM; h. for any Cloud Service component where Client is required to provide a Trading Partner list, provide the following information: (1) Partner Name and Address; (2) Contact Name and Phone Number; (3) Fax Number (if available); (4) E-mail Address; (5) Value Added Service Provider (if applicable); (6) Qualifier and ID (if applicable); i. maintain business continuity and communicate expectations to the Trading Partner community, as it relates to test periods, migrations, and conversions of and to the Cloud Service; j. provide systems, security and communication architecture diagrams as reasonably requested; k. ensure that Client staff is available to provide assistance as IBM reasonably requires; and l. ensure each Cloud Service User protects their Account identification and password and controls who may access a Cloud Service User Account or use any Cloud Service on Client's behalf. 7.10.2 IBM Responsibilities IBM will not be responsible for: a. Client or any third party's equipment or software errors or failures; b. any failure by Client or a third party to act on any communication transmitted to (or by) Client; c. the creditworthiness or performance of any of Client's Trading Partners; d. data improperly transmitted by Client or Client's Trading Partners; e. Client Interconnect Services (or any errors in or failures of the Interconnect Services) to the extent caused by Client's Interconnect Services provider, Client, or Client's Trading Partners, or any force majeure events; or f. providing any reverse migration services if IBM has terminated any portion of the Agreement. 7.11 Defined Terms a. File one or more data, information, or program records bundled together with a specific name. b. Mailbox A private, secure electronic storage space that is assigned to Client and allows Client to send, store, and receive electronic data. c. Mailslot A component of a Mailbox that allows the drop off and pick up of data. 7.12 Pan European Public Procurement OnLine (PEPPOL) The Cloud Service provides a PEPPOL access point and Service Metadata Provider (SMP) which enables users of the PEPPOL edelivery network to interoperate using a set of common business processes and technical standards. The IBM access point available via the Cloud Service provides connectivity to the PEPPOL edelivery network for Clients who have enabled the Cloud Service for i126-6371-04 (02/2018) Page 7 of 8

PEPPOL. The IBM access point was established pursuant to the OpenPEPPOL Transport Infrastructure Agreement (TIA) located at http://www.peppol.eu. Contact information for OpenPEPPOL representatives responsible for the access point program is located on the PEPPOL site. Client acknowledges and agrees that IBM's ability to provide certain features, including without limitation serving as a PEPPOL Access Point, is subject to agreements with third parties. To the extent such third party alters, suspends or terminates IBM's right to provide such feature, IBM may immediately alter the feature to conform with third party instructions, or cease providing such feature as part of the Cloud Service. 7.13 Interoperability Services IBM may transfer or store the data outside of the country where Client or its partners are located solely for the purposes of providing the Cloud Service or as required by applicable law or legal process. EXCEPT AS SET FORTH IN A SEPARATE AGREEMENT BETWEEN CLIENT AND AN INTERCONNECT PROVIDER, IN NO EVENT WILL ANY INTERCONNECT PROVIDER HAVE ANY LIABILITY TO CLIENT IN CONNECTION WITH THE PROVISION OF THE CLOUD SERVICE. i126-6371-04 (02/2018) Page 8 of 8