Terms of Service

Version 1.0. Effective 14 August 2026. Every published version of this document is retained and can be produced on request.

This Terms of Service ("TOS"), the Service Level Agreement at Schedule 1 (the "SLA"), the Acceptable Use Policy ("AUP") available at https://www.postlever.com/acceptable-use-policy, the PostLever Pricing Page published at postlever.com (the "Pricing Page"), and each Order Form, together form a legally binding agreement (collectively, the "Agreement") between PostLever Pty Ltd ACN 701 249 881 of 7 High Street, Victoria Point, Queensland 4165, Australia ("PostLever") and the Customer. The SLA, the AUP and the Pricing Page are the "Incorporated Documents", and each is incorporated into this Agreement by reference. The Pricing Page is incorporated for the figures only, being the fee figures, the volume band boundaries, the rates, the default sending ceiling, and the signup credit amount. PostLever may substitute an updated address for any URL stated in this Agreement, and the document identified by name at the substituted address is the document incorporated. The PostLever website terms of use govern use of the PostLever website and do not form part of this Agreement.

Where two documents forming part of this Agreement conflict, and the conflict is not expressly resolved in those documents, the order of precedence is: (1) the Order Form, then (2) this TOS, including Section 4 and Addendum A, then (3) the Pricing Page, then (4) the AUP, then (5) the SLA. A lower ranked document prevails over a higher ranked document on a matter where the lower ranked document expressly states that it does, except that no document may be read as varying, limiting or displacing Section 7.5, Section 12, or Section 4 and Addendum A of these terms. An amendment to a document takes precedence over the document it amends.

This Agreement governs PostLever's provision of hosted and managed email-related services to Customer, as described in one or more Order Forms (collectively, "Services"). The Parties intend this Agreement to serve as the primary contract governing the Services, including Australian and U.S. privacy and data processing terms, while Addendum A (GDPR/UK GDPR/Swiss Data Protection Addendum) applies only to Personal Data subject to the GDPR, UK GDPR, or Swiss data protection law.

PostLever is an Australian company. This Agreement is governed by Australian law, and PostLever's conduct in supplying the Services is subject to the Australian Consumer Law and the Privacy Act 1988 (Cth) irrespective of where Customer is located.

For U.S. privacy law purposes, the Agreement is intended to establish PostLever as Customer's service provider, contractor, or processor, as applicable, with respect to Covered Data Processed on Customer's behalf for the limited and specified business purposes described in this Agreement.

If you are entering into this Agreement on behalf of a company or other legal entity, you represent that you have the authority to bind such entity to the terms and conditions of this Agreement. If you do not have such authority, you may not enter into this Agreement. If you are entering into this Agreement on your behalf, you undertake that you are at least 18 years old. Otherwise, do not register or use the Services.

BY CLICKING "SIGN UP" (OR SIMILAR), YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THE TERMS OF SERVICE AND THE INCORPORATED DOCUMENTS, EACH OF WHICH IS INCORPORATED HEREIN BY REFERENCE. IF YOU DO NOT AGREE TO ALL OR PART OF THIS AGREEMENT, YOU ARE NOT ALLOWED TO USE THE POSTLEVER PLATFORM OR SERVICES IN ANY MANNER.

If you do not agree with any of the terms contained herein, or do not meet the qualifications included herein for registering or using the Services, do not access or use the Services.

Changes to this Agreement. PostLever may amend this Agreement or the AUP from time to time, and will publish the updated document at https://www.postlever.com/terms-of-service or at the address at which that document is then published.

Where an amendment would have a material adverse effect on Customer, PostLever will give Customer at least thirty (30) days' notice of it before it takes effect. An amendment has a material adverse effect on Customer where it could reasonably be expected to affect Customer's decision to subscribe to the Services and it increases Customer's cost, removes a right Customer holds, or places an additional restriction on Customer's use of the Services. PostLever characterises an amendment for this purpose acting reasonably. Every other amendment takes effect when it is published.

Notice of an amendment is given by email to the address on the Account, or by another reasonably substitutable means. PostLever will also ordinarily give notice in the PostLever dashboard, but that notice is operational practice rather than a condition of a validly given notice, and its absence is not a defect in a notice validly given by email. Section 14.6 states when a notice by email is deemed received.

If an amendment would have a material adverse effect on Customer, Customer may terminate this Agreement without penalty by written notice given before the amendment takes effect; that right to terminate is Customer's remedy for the amendment. A termination on that ground takes effect at the end of the then current billing period. Customer is billed as normal for that period, no further fee is charged for any period after the termination takes effect, and PostLever will refund on a pro rata basis any amount Customer has prepaid, including any unused send credits.

An amendment takes effect immediately when it is published, without prior notice and whether or not it would otherwise have a material adverse effect on Customer, where it is exclusively to Customer's benefit, where it is purely administrative and has no adverse effect on Customer, where it is directly required by law, or where it applies only to functionality Customer is not yet using.

1. DEFINITIONS.

1.1. "Account" means the Customer's online account enabling the use of the Service as provided by the PostLever platform.

1.2. "Account Information" means information provided by Customer during the registration and creation of the Account, including, without limitation, contact information, company names, company's contact information, and billing information associated with the Account.

1.3. "ACL" means the Australian Consumer Law set out in Schedule 2 to the Competition and Consumer Act 2010 (Cth), as amended, together with its application as a law of each State and Territory of Australia.

1.4. "APPs" means the Australian Privacy Principles set out in Schedule 1 to the Privacy Act.

1.5. "Australian Privacy Law" means the Privacy Act 1988 (Cth) (the "Privacy Act"), including the APPs and the Notifiable Data Breaches scheme in Part IIIC of that Act, and any other applicable Australian law governing the handling of personal information.

1.6. "Authorised User" means Customer's employees, consultants, contractors, and agents who are authorised by the Customer to access and use the Services in accordance with the Agreement. Except as expressly stated herein and for the purpose of this Agreement, "Customer" shall mean "Customer and its Authorised Users."

1.7. "Campaign" means any email, remarketing, retention, lifecycle, promotional, transactional, or third-party marketing campaign, message, or related content submitted by or on behalf of Customer for transmission or support through the Services.

1.8. "Confidential Information" means all nonpublic information, in whatever form disclosed, provided by or on behalf of either party ("Disclosing Party") to the other party ("Receiving Party"), that is designated as confidential or that, given the nature of the information or circumstances surrounding its disclosure, can reasonably be understood to be confidential, including, without limitation the PostLever technology. The Confidential Information shall not include information which: (a) is at the time of disclosure or subsequently becomes generally available to the public, other than as a result of a breach of the Agreement; (b) was previously in the possession of the Receiving Party prior to its disclosure hereunder; (c) is independently developed by the Receiving Party without reliance on, use of, or reference to the Confidential Information and without any breach of the terms of the Agreement; and (d) was lawfully received by the Receiving Party from a third-party having rights to disclose, and under no confidentiality obligations with respect to, such Confidential Information.

1.9. "Consequential Loss" means, and is limited to: (a) loss of profit or anticipated profit; (b) loss of revenue; (c) loss of business or business opportunity; (d) loss of goodwill or reputation; (e) loss of anticipated savings; (f) loss of use; (g) loss or corruption of data, other than the reasonable cost of restoring that data from Customer's own backups; and (h) any loss or damage that is indirect or consequential in the ordinary sense, whether or not it falls within any of paragraphs (a) to (g). This definition applies in place of any common law meaning of consequential or indirect loss.

1.10. "Content" means all text, files, images, graphics, illustrations, information, data, software, including machine images, audio, video, or images.

1.11. "Covered Data" means Customer Data that constitutes Personal Data.

1.12. "Customer Data" means all data, information, and other content of any type and in any format, provided by the Customer to PostLever or uploaded by the Customer to the PostLever platform for the purpose of using the Services. Customer Data may include, where applicable, Personal Data (as defined under applicable data protection regulation) and Confidential Information.

1.13. "Data Brokerage Activities" means the sale, licensing, transfer, disclosure, or other monetisation of personal data or data derived therefrom to third parties, including but not limited to the creation or commercialisation of audience segments, identity graphs, profiles, or datasets for use outside the direct provision of services to the originating customer.

1.14. "Derived Data" means data elements, flags, scores, routing inputs, enrichment outputs, suppression indicators, or analytics generated by PostLever from or in connection with Customer Data solely to provide the Services. Subject to Section 2.6, Derived Data shall be disclosed solely to Customer. A use of data permitted by Section 2.6 is not a disclosure of Derived Data for the purposes of this definition.

1.15. "Documentation" means the digital or printed technical user manuals, notes, instructions, summaries and other supporting documentation that PostLever makes available to the Customer from time to time, if and to the extent PostLever makes any available. Section 1.23 governs the effect of the Documentation.

1.16. "GST" and "taxable supply", "tax invoice", "input tax credit", "recipient" and "supply" have the meanings given in the A New Tax System (Goods and Services Tax) Act 1999 (Cth) (the "GST Act").

1.17. "Intellectual Property" means all intellectual property rights of every kind and description, including without limitation: (a) rights in or to trade marks and service marks (whether or not registered), trade names, logos, and other designations of the source of origin, together with all goodwill related to the foregoing; (b) patents and patent applications; (c) rights in or to copyright, whether or not registered; (d) rights in or to trade secrets and confidential information, including without limitation know-how, technology methods, ideas, and inventions; (e) rights in the software and computer code (whether in source code, object code, or any other form); and (f) all applications and registrations of any of the foregoing.

1.18. "Personal Data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an identified or identifiable person, household, or device, or otherwise constitutes personal information, personal data, or a similar regulated category under applicable privacy law. In relation to Australian Privacy Law, "Personal Data" includes "personal information" as defined in the Privacy Act.

1.19. "PostLever Platform" means PostLever's developed and owned technology, online email marketing platform, that enables Customers to manage their contacts, send and manage certain email marketing campaigns ("Campaign(s)"), and other tasks related to email marketing.

1.20. "Spam Act" means the Spam Act 2003 (Cth), as amended.

1.21. "U.S. Privacy Laws" means the California Consumer Privacy Act, as amended by the CPRA, and any other applicable U.S. state privacy laws imposing processor, service provider, contractor, or similar obligations on a service recipient processing personal data on behalf of another business.

1.22. "Business Day" means a day that is not a Saturday, a Sunday, or a public holiday in Brisbane, Queensland, Australia. A period expressed in business days in this Agreement, in the Acceptable Use Policy, or in Schedule 1 is a period expressed in Business Days as defined in this Section, and no other document forming part of this Agreement states a different meaning.

1.23. Documentation guard. Documentation describes PostLever's own operating practice. It does not create, vary, or extend any obligation of Customer, and Customer's obligations as to its use of the Services are the standard set by the Acceptable Use Policy. A change to the Documentation that would tighten a trigger point on which suspension of the Services turns carries the notice period and the right to terminate in the Changes to this Agreement clause. A change to the Documentation that does no more than reflect a requirement published by a mailbox provider takes effect when it is published.

1.24. Commitments stated outside this Agreement. The Pricing Page, beyond the figures for which it is incorporated into this Agreement, and the Documentation are the only documents outside this Agreement in which a commitment of PostLever is stated. A materially adverse change to a commitment stated on the Pricing Page carries the notice period and the right to terminate in the Changes to this Agreement clause. The Documentation creates no obligation of Customer, as Section 1.23 states. No other document may state a commitment of PostLever, or an obligation of Customer, unless it does one or the other of those two things.

2. SCOPE OF SERVICES AND DATA PROCESSING.

2.1. Services. PostLever will perform the Services described in one or more ordering documents, statements of work, insertion orders, or online ordering flows referencing this Agreement (each, an "Order Form"). The Services are those an Order Form describes, and PostLever undertakes to supply no service that an Order Form does not describe.

2.2. Bring-your-own transport and suppression. Customer supplies, configures, controls, and pays for its own sending infrastructure (ESP or MTA), and connects its own suppression sources. Every Campaign is transmitted through sending infrastructure that Customer supplies and controls, and Customer determines the content of every Campaign and the audience to which it is directed. PostLever does not operate shared sending infrastructure and owns no suppression network. Customer retains control of, and responsibility for, its own sender reputation and its own suppression obligations.

2.3. Limited Processing Purpose. PostLever will Process Covered Data only for the following business purposes: (a) providing, operating, and maintaining the Services described in an Order Form, including campaign deployment, list hosting and segmentation, and suppression processing against the suppression sources Customer connects; (b) providing reporting to Customer on its own use of the Services and on its own Campaigns; (c) providing customer and technical support to Customer; (d) maintaining, testing, and improving the quality, integrity, and security of the Services, including debugging to identify and repair errors that impair intended functionality; (e) detecting, investigating, and preventing security incidents, fraud, and illegal activity, and taking action against those responsible; (f) performing internal analytics relating to Customer's use of the Services; (g) billing Customer and collecting the fees payable under this Agreement; and (h) complying with applicable law and responding to a lawful request of a court or of a regulatory authority with jurisdiction. PostLever will not Process Covered Data for any other purpose.

2.4. No Independent Data Rights. Except as expressly permitted in this Agreement or required by applicable law, PostLever will not: (a) sell Customer Data; (b) share Customer Data for cross-context behavioural advertising; (c) retain, use, or disclose Customer Data for any purpose other than the limited and specified purposes set out in this Agreement; (d) retain, use, or disclose Customer Data outside the direct business relationship between PostLever and Customer; or (e) combine Covered Data received from Customer with personal data received from another person or collected from PostLever's independent consumer interactions, except to the extent permitted for a service provider or contractor under applicable U.S. Privacy Laws.

2.5. Derived Data Restrictions. This Section is PostLever's authority to generate Derived Data. PostLever may generate, use, and disclose Derived Data to Customer in connection with the Services, but only to the extent such Derived Data is created to support Customer's campaigns, deliverability, suppression, optimisation, segmentation, attribution, compliance, or reporting. PostLever will not use Derived Data derived from Covered Data for independent monetisation, sale, or unrelated third-party advertising purposes. PostLever does not and will not engage in Data Brokerage Activities with respect to Customer Data or Covered Data, including the sale or sharing or otherwise monetising Customer Data or Derived Data to or for third parties. This prohibition includes disclosure of Customer Data or Derived Data in a manner that would cause PostLever to be classified as a data broker under applicable law.

2.6. De-Identified Data Use. Notwithstanding the foregoing, PostLever may use data, including Derived Data, in de-identified and aggregated form for internal analytics, service improvement, benchmarking, and security purposes, provided that: (a) such data cannot reasonably be used to infer information about any individual or Customer, and no output of a benchmarking use permits an inference about an identifiable individual or about an identifiable customer of PostLever; (b) PostLever implements technical and organisational safeguards designed to prevent re-identification; and (c) PostLever does not attempt to re-identify such data.

PostLever will maintain data used under this Section in de-identified form, will not attempt to re-identify it or to associate it with a particular individual, household, or device, and will not disclose it to any recipient unless that recipient is bound by an obligation to do the same and to impose the same obligations on any onward recipient. Nothing in this Section permits Data Brokerage Activities, which Section 2.5 prohibits, and nothing in this Section permits the disclosure of record level or customer identifiable output.

2.7. Enhancement or Enrichment Limitations. Any enrichment, scoring, tagging, or enhancement applied to Customer Data: (a) is performed solely on behalf of Customer and as part of the Services; (b) shall not incorporate third-party data or external datasets unless expressly authorised in writing by Customer; and (c) shall not result in the creation of independent data assets or datasets usable outside the Services. PostLever shall not append, combine, or supplement Customer Data with third-party data in a manner that would alter PostLever's status as a service provider, contractor, or processor under applicable law.

2.8. Roles of the Parties. Customer determines the purposes for which Campaigns are sent, the recipients to whom Campaigns are directed, the content of Campaigns, the source and legality of Customer Data, the lawful basis for Processing, and whether a Campaign is a remarketing campaign, a third-party campaign, or another type of campaign. Customer is therefore the business, controller, or equivalent regulated entity with respect to Customer Data, except to the extent PostLever independently processes its own account, billing, security, or legal compliance data for its own business purposes. PostLever acts as Customer's service provider, contractor, processor, or similar downstream service recipient, as applicable, when Processing Covered Data on Customer's behalf under this Agreement.

Australian Privacy Law does not draw a statutory distinction between controllers and processors, and each party may be separately accountable under the APPs for personal information it holds. The allocation of roles in this Section is a contractual allocation of responsibility as between the parties and does not limit either party's own obligations under Australian Privacy Law.

2.9. Application programming interfaces. Where PostLever makes an application programming interface available as part of the Services, Customer must access it only with the credentials PostLever issues, must keep those credentials confidential and must not disclose or share them outside its Authorised Users, and must observe the rate limits and usage limits PostLever applies. PostLever may set and vary those limits acting reasonably to protect the availability, integrity, and security of the PostLever Platform for all customers. PostLever may deprecate or withdraw an endpoint or a version of the interface on reasonable prior notice; where the deprecation or withdrawal would have a material adverse effect on Customer's use of the Services, it carries the notice period and the right to terminate in the Changes to this Agreement clause, except where a shorter period is reasonably necessary to address a security or legal risk.

3. CUSTOMER RESPONSIBILITIES AND USE RESTRICTIONS.

3.1. Customer represents, warrants, and covenants that:

• Customer will comply with the Acceptable Use Policy, and in particular with its consent standard, its consent record and production obligations, its data source requirements, and its message requirements.

• Customer is solely responsible for the content, accuracy, legality, and substantiation of Campaigns and for compliance with applicable advertising, consumer protection, privacy, email, anti-spam, and telecommunications laws, including the Spam Act, the ACL, Australian Privacy Law, CAN-SPAM and, where applicable, U.S. state privacy laws, CASL, GDPR, UK GDPR, and ePrivacy rules.

• Customer will not provide PostLever with sensitive information (as defined in the Privacy Act), Special Categories of Personal Data, or sensitive personal information for inferential targeting unless expressly authorised in writing and supported by an appropriate legal basis and technical controls.

• Customer will not instruct PostLever to sell, share, or process Customer Data in a manner that would cause PostLever to lose service provider, contractor, or processor status under applicable law.

• Customer holds any registration required of it as a data broker under applicable law, and will give effect to a deletion request made through any state data broker deletion platform or mechanism to which it is subject.

3.2. Australian anti-spam compliance. Customer acknowledges that a commercial electronic message may have an "Australian link" for the purposes of section 7 of the Spam Act, and may therefore be regulated by the Spam Act in addition to the law of the recipient's own jurisdiction. Customer's obligations as to consent, consent records, sender identification, unsubscribe facilities, and the giving of effect to unsubscribe requests are set out in Sections 3 and 5 of the Acceptable Use Policy, and Customer represents, warrants, and covenants that every Campaign sent through the Services complies with them.

Customer must not use the Services to send, or to cause, permit, aid, abet, counsel, or procure the sending of, a commercial electronic message in contravention of the Spam Act, or to supply, use, or acquire address-harvesting software or a harvested-address list within the meaning of Part 3 of the Spam Act.

3.3. PostLever has no obligation to independently verify Customer's rights in Customer Data; however, PostLever may implement reasonable compliance controls, including campaign review, data source inquiries, and suspension mechanisms where necessary to mitigate legal, regulatory, or reputational risk or to maintain service provider status under applicable law.

4. PRIVACY AND DATA PROCESSING TERMS.

4.1. Instructions. Customer instructs PostLever to Process Covered Data only for the business purposes enumerated in Section 2.3, in accordance with documented Customer instructions, and to carry out the processing activities described in applicable Order Forms. Those enumerated purposes are the specific business purposes for which Covered Data is Processed under this Agreement.

4.2. Australian Privacy Law commitments. PostLever handles personal information in accordance with the APPs and Australian Privacy Law, and undertakes to do so whether or not it is at any time an APP entity within the meaning of the Privacy Act. In particular, PostLever will:

• handle personal information only for the purposes set out in this Agreement, and not use or disclose it for direct marketing of its own;

• take such steps as are reasonable in the circumstances to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure, as required by APP 11;

• take such steps as are reasonable in the circumstances to destroy or de-identify personal information that is no longer needed for any purpose for which it may be used or disclosed, in accordance with APP 11.2 and Section 9.4;

• maintain a clearly expressed and up to date privacy policy that is available free of charge, as required by APP 1; and

• as a commercial commitment rather than because it is required to do so by law, assist Customer, so far as is reasonable in the circumstances and having regard to the information available to PostLever, to respond to requests for access to, or correction of, personal information under APPs 12 and 13, confined to requests PostLever is reasonably able to assist with.

The undertakings in this Section are contractual commitments given to Customer. They do not make PostLever an APP entity, do not confer on Customer or on any other person a right, remedy, or cause of action that the Privacy Act does not itself confer, and are subject to Section 12.

PostLever's obligations to destroy or de-identify personal information under this Section and under Section 9.4 do not apply to material that PostLever is required to preserve, and PostLever will retain that material for so long as the obligation requires. That includes a report and its contents preserved for at least ninety (90) days under 18 USC 2258A(h), material held under a removal notice given under the Online Safety Act 2021 (Cth), and material held in connection with an obligation under section 474.25 of the Criminal Code Act 1995 (Cth). Material retained under this paragraph is retained only for the purpose of the obligation requiring its preservation, is not used for any other purpose, and is destroyed or de-identified once that obligation ends.

4.3. Cross-border disclosure. Customer acknowledges and agrees that PostLever and its sub-processors may store and Process Personal Data outside Australia, including in the United States. Cloudflare is a global edge network and serves the platform edge from the point of presence nearest the individual, so request data may be handled in the country that point of presence is in. Where APP 8 applies to a disclosure by PostLever, PostLever will take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the APPs in relation to that information. Where Customer instructs PostLever to disclose Personal Data to an overseas recipient nominated by Customer, including Customer's own sending infrastructure and suppression sources, Customer is responsible for its own compliance with APP 8 in respect of that disclosure.

4.4. Data breach notification. PostLever will notify Customer without undue delay after becoming aware of unauthorised access to, unauthorised disclosure of, or loss of Personal Data Processed under this Agreement, and will provide the information reasonably required by Customer to assess whether the incident is an eligible data breach for the purposes of Part IIIC of the Privacy Act or a notifiable breach under any other applicable law. The parties will cooperate in good faith in assessing the incident. Where both parties hold the affected information and section 26WM of the Privacy Act applies, Customer is the party that will make any required notification to affected individuals unless the parties agree otherwise in writing, and PostLever will make any notification required of it to the Office of the Australian Information Commissioner. A notification given under this Section is not an admission of fault or liability by either party.

Where Customer is the party that will notify affected individuals, Customer must do so within ten (10) days after the parties conclude that notification is required, or within any shorter period the applicable law requires. If Customer has not done so by the end of that period, PostLever may make the notification itself, and will tell Customer before it does. Nothing in this Section relieves either party of an obligation imposed on it directly by Part IIIC of the Privacy Act or by any other applicable law, and section 26WM of the Privacy Act operates only where the party that gives the notification actually complies with the requirement.

4.5. Service Provider / Contractor Commitments. PostLever certifies that it understands and will comply with the restrictions applicable to a service provider, contractor, or processor under U.S. Privacy Laws, including that PostLever will not:

• Sell or share Covered Data.

• Retain, use, or disclose Covered Data for any purpose other than the business purposes and services specified in this Agreement.

• Retain, use, or disclose Covered Data outside the direct business relationship with Customer.

• Combine Covered Data with personal data obtained from another source except as permitted by law.

• Use Covered Data to build or supplement profiles for unrelated advertising, marketing, or commercial exploitation.

These restrictions are intended to satisfy the contractual requirements applicable to service provider and contractor relationships under U.S. Privacy Laws.

PostLever will provide the same level of privacy protection in respect of Covered Data as Customer is required by applicable U.S. Privacy Laws to provide in respect of it.

Customer may take reasonable and appropriate steps to stop and remediate an unauthorised use of Personal Data by PostLever, and PostLever will cooperate with any such step.

4.6. Assistance with Consumer Requests and Assessments. Taking into account the nature of the Processing and the information available to PostLever, PostLever will provide commercially reasonable assistance to Customer in responding to verifiable consumer requests and in completing privacy assessments or similar documentation required under applicable U.S. Privacy Laws or Australian Privacy Law, to the extent Customer cannot reasonably fulfil the obligation without PostLever's support.

4.7. Notification of Inability to Comply. PostLever will notify Customer if PostLever determines that it can no longer meet its obligations under this Agreement, Australian Privacy Law, or applicable U.S. Privacy Laws with respect to Covered Data Processed on Customer's behalf.

4.8. Monitoring and Audit. Customer may take reasonable and appropriate steps to verify that PostLever is Processing Covered Data in a manner consistent with Customer's own obligations under applicable law and with this Agreement, including by way of assessments, audits, and technical and operational testing. Upon reasonable written request, PostLever will make available the information reasonably necessary to demonstrate compliance with the obligations in this Section and will cooperate with any such step, subject to confidentiality, security, privilege, and protection of other customers' information. PostLever may satisfy an audit obligation through current third-party assessments, certifications, summaries, or similar materials where those materials reasonably address the matter being verified.

4.9. GDPR Data Addendum Trigger. If and to the extent PostLever Processes Personal Data subject to the GDPR, UK GDPR, or Swiss data protection law, the terms of Addendum A are incorporated into and made part of this Agreement solely with respect to such data. In the event of a conflict between Addendum A and the main body of this Agreement as to GDPR regulated Processing, Addendum A controls for that Processing.

4.10. Sub-Processors. Customer grants PostLever general authorisation to engage sub-processors in connection with the Services, provided that PostLever remains responsible for its sub-processors' performance of applicable data protection obligations and imposes on each sub-processor written obligations that are no less protective than, and that meet, PostLever's own obligations under this Agreement, to the extent those obligations are applicable to the sub-processor's services.

PostLever will, upon request, make available a current list or description of the categories of sub-processors used in connection with the Services. That commitment is the whole of PostLever's obligation in respect of sub-processor disclosure under this Agreement. No such list or description is incorporated into this Agreement by reference, whether or not PostLever publishes it, and a change of sub-processor is not an amendment to this Agreement. Where Addendum A applies, the sub-processor notice and objection process in Addendum A will govern for GDPR-regulated Processing.

4.11. Permitted disclosure. PostLever discloses Customer Data only to its sub-processors under Section 4.10, to Customer and those Customer directs, and where disclosure is required by law or by a regulatory authority with jurisdiction.

4.12. Personnel. PostLever ensures that each of its personnel authorised to Process Personal Data under this Agreement is subject to a duty of confidentiality in respect of that Personal Data, whether imposed by contract or by statute, and that the duty continues after that person's engagement ends. This Section applies to all Personal Data Processed under this Agreement, and is not confined to Personal Data subject to Addendum A.

5. ACCOUNT REGISTRATION AND SECURITY.

5.1. In order to use the Services, the Customer shall register and create an Account. The Customer warrants and represents that the Account Information provided at the time of registration is complete, truthful, and accurate, and is kept up to date during the Term. The Account Information shall be processed in accordance with the PostLever Privacy Policy available at https://www.postlever.com/privacy. PostLever may, acting reasonably, refuse to offer access to or use of the Services to any person or entity where doing so would expose PostLever to legal, regulatory, security, or reputational risk, or where the applicant does not meet PostLever's published eligibility criteria. PostLever may change its published eligibility criteria, and a change that would have a material adverse effect on Customer carries the notice period and the right to terminate without penalty set out in the Changes to this Agreement clause.

5.2. THE CUSTOMER IS OBLIGED TO KEEP THE LOGIN DETAILS (E.G., PERSONAL PASSWORD AND USERNAME) CONFIDENTIAL AND TO PROTECT SUCH DETAILS AGAINST THIRD-PARTY USE. THE CUSTOMER IS RESPONSIBLE FOR ALL ACTIVITIES THAT OCCUR UNDER THE ACCOUNT AND IS TO INFORM POSTLEVER IMMEDIATELY IF IT SUSPECTS THAT A THIRD-PARTY MIGHT HAVE HAD OR MIGHT HAVE ACCESS TO THE CUSTOMER ACCOUNT OR LOGIN CREDENTIALS.

5.3. Customer is responsible for all activities in its Account, including those of its Authorised Users, and PostLever is not responsible for unauthorised access to the Account except to the extent that access results from PostLever's own breach of this Agreement or failure to take the steps required by Section 4.2. The Customer is responsible for identifying the authentication of the Authorised Users and for approving the access by such Authorised User.

5.4. Permitted use of the Platform for hosting and for contact storage. The restrictions on using the PostLever Platform as a general-purpose content hosting service, and as a general-purpose contact database or data warehouse, are set out in Section 8 of the Acceptable Use Policy and apply to Customer's use of the Services.

5.5. Not used. Its subject matter is dealt with in Section 5.4 and in Section 8 of the Acceptable Use Policy.

6. LICENCE AND INTELLECTUAL PROPERTY RIGHTS.

6.1. Subject to compliance with this Agreement, from the earlier of the date of the subscription purchase and the date the Customer first used the Services ("Effective Date"), and continuing thereafter for the term of the subscription (unless terminated earlier pursuant to the Agreement), PostLever grants Customer a licence to make use of the PostLever Platform and Services, solely for the Customer's own use, in connection with its own business in compliance with the terms of this Agreement. That licence is revocable in accordance with this Agreement, non-exclusive, payment-bearing, non-transferable, non-sublicensable, worldwide, and limited.

For the avoidance of doubt, use in connection with Customer's own business includes sending Campaigns that promote the offers of third-party advertisers on Customer's own account. The restriction to Customer's own use is directed at reselling or otherwise providing access to the PostLever Platform to a third party, which Section 6.2(b) addresses separately.

6.2. Except as permitted in the Agreement or by a law that cannot be excluded, Customer or any Authorised User shall not at any time, directly or indirectly: (a) copy, modify, or create derivative works of the PostLever Content, the Service or Documentation, in whole or in part; (b) rent, lease, lend, sell, license, sublicense, assign, distribute, publish, transfer, or otherwise make available the Service or Documentation to a third-party; (c) reverse engineer, disassemble, decompile, decode, adapt, or otherwise attempt to derive or gain access to any software component of the Service or the PostLever Platform, in whole or in part; (d) remove any proprietary notices from the PostLever Platform, Service, or Documentation; (e) create a database by systematically downloading and storing all or any content from the Service; or (f) use the Service for any illegal or unauthorised purpose (including that which would infringe upon the rights of a third-party) or that is in breach of applicable law.

Paragraph (c) does not apply to the extent that the relevant act is permitted by Division 3 of Part III of the Copyright Act 1968 (Cth) or any other provision of law that cannot be excluded by agreement.

6.3. Except as expressly provided herein, PostLever reserves all rights, title, and interest in and to the Services and Content, the PostLever Platform, and the Documentation. Customer may not use PostLever's trade names and logos unless PostLever provides prior written consent.

6.4. Feedback. Customer may, but need not, give PostLever suggestions, comments, or other feedback about the PostLever Platform or the Services. Customer grants PostLever a perpetual, irrevocable, worldwide, royalty-free, sublicensable licence to use, reproduce, modify, and otherwise exploit that feedback for any purpose, with no obligation, attribution, or compensation to Customer. Customer must not include Customer Data or Confidential Information in feedback, and nothing in this Section gives PostLever any right in Customer Data.

7. REPRESENTATIONS AND WARRANTIES.

7.1. Mutual Representations and Warranties. Each party hereby represents and warrants that: (a) it has the full legal authority to be engaged by and perform its obligations under the Agreement; and (b) nothing contained in the Agreement nor the performance thereof shall place the relevant party in breach or default of any obligation or other agreement, law or regulation by which it is bound or to which it is subject, or requires the consent of any person or entity.

7.2. PostLever Representations and Warranties. PostLever hereby represents and warrants that: (a) it owns or has the legal rights in the PostLever Platform and the Service; and (b) it will provide the Services with due care and skill and in a timely and professional manner, and, where PostLever has made Documentation available, the Services will conform in all material respects to that Documentation and to the subscription terms. The warranty in paragraph (b) is given subject to Section 12, and Customer's first remedy for a breach of it is supply of the affected Services again, PostLever having a reasonable opportunity to do so. This Section does not limit Section 7.5.

7.3. DISCLAIMER. SUBJECT TO SECTION 7.5, AND EXCEPT AS OTHERWISE EXPRESSLY STATED HEREIN, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES, THE POSTLEVER PLATFORM, AND THE FEATURES OR RELATED DOCUMENTATION, SOFTWARE, OR COMPONENT THEREIN ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS WITHOUT WARRANTY OF ANY KIND. POSTLEVER DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, OF ANY KIND, REGARDING THE POSTLEVER PLATFORM AND SERVICES (INCLUDING POSTLEVER CONTENT, PRODUCTS, INFORMATION, SOFTWARE, AND LINKS), INCLUDING ANY IMPLIED WARRANTIES AS TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, TITLE, NON-INFRINGEMENT, RESULTS, ACCURACY, COMPLETENESS, ACCESSIBILITY, COMPATIBILITY, SUITABILITY, RELIABILITY, AVAILABILITY, TIMELINESS, QUALITY, OR LACK OF VIRUSES. IF APPLICABLE LAW DOES NOT ALLOW THE EXCLUSION OF SOME OR ALL OF THE ABOVE IMPLIED WARRANTIES, THE ABOVE EXCLUSIONS WILL APPLY TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW.

7.4. Customer Representations and Warranties. Customer represents and warrants that: (a) the Customer Data will not violate any applicable law and that the Customer has all required rights and authorisations to upload Customer Data to the PostLever Platform for the purpose of receiving the Service; (b) it will use the Services in compliance with this TOS and the Acceptable Use Policy, and specifically that each Campaign will comply with the Acceptable Use Policy; and (c) it is responsible for any content or data uploaded, processed, submitted, or transmitted by it through the Services, including any Campaign. It is hereby clarified that PostLever has no obligation or responsibility to review the Customer Data or any Campaign or any other content uploaded through the Services. Customer further represents and warrants that all Campaigns sent through the PostLever Platform shall comply with all applicable anti-spam and electronic messaging laws, including, without limitation, the Spam Act, the CAN-SPAM Act (15 U.S.C. 7701, et seq.), the Canadian Anti-Spam Legislation ("CASL"), if applicable, and any applicable provisions of the GDPR, ePrivacy Directive, or other data protection laws governing electronic marketing communications. The Customer is responsible for ensuring that all recipients of its Campaigns have provided any required consent and that all Campaigns contain accurate sender information, a functioning unsubscribe mechanism, and any other disclosures required by applicable law. For the avoidance of doubt, PostLever's compliance features, including the application of suppression at send against the suppression sources Customer has connected, supplement but do not replace the Customer's independent compliance obligations, and PostLever does not verify the completeness, accuracy, or currency of any suppression source Customer connects.

7.5. Australian Consumer Law. Nothing in this Agreement excludes, restricts, or modifies any guarantee, condition, warranty, right, or remedy conferred on Customer by the ACL or any other applicable law that cannot lawfully be excluded, restricted, or modified. To the extent that this Agreement would otherwise do so, it is to be read down so that it does not.

Where the Services are not of a kind ordinarily acquired for personal, domestic, or household use or consumption, and to the extent permitted by section 64A of Schedule 2 to the Competition and Consumer Act 2010 (Cth), PostLever's liability for a failure to comply with a guarantee under the ACL (other than a guarantee conferred by section 51, 52, or 53 of the ACL) is limited, at PostLever's option, to: (a) supplying the Services again; or (b) paying the cost of having the Services supplied again.

7.6. No system is immune from compromise, and PostLever does not represent otherwise.

7.7. Preview features. PostLever may make a feature available as an alpha, beta, preview, or early access feature and identify it as such (a "Preview Feature"). A Preview Feature is provided on an "as is" and "as available" basis, is excluded from the warranties in Section 7.2(b), and is excluded from any availability commitment and any service credits in Schedule 1, so that unavailability of a Preview Feature is not Unplanned Downtime for the purposes of Schedule 1. PostLever may change or withdraw a Preview Feature at any time, and doing so is not an amendment to this Agreement. This Section does not limit Section 7.5.

8. FEES, PAYMENTS AND TAXES.

8.1. The Services are provided pursuant to the payment terms set out in this Section 8, and, as to the figures for which the Pricing Page is incorporated, pursuant to the Pricing Page. PostLever may modify pricing upon thirty (30) days' prior written notice to the Customer; provided, however, that any pricing change shall not apply to the then-current billing cycle, and that Customer may terminate this Agreement without penalty by written notice given before the change takes effect. A termination on that ground takes effect at the end of the then current billing period; Customer is billed as normal for that period, no further fee is charged for any period after the termination takes effect, and PostLever will refund on a pro rata basis any amount Customer has prepaid, including any unused send credits. Pricing for a service or feature that PostLever has not previously offered takes effect when it is posted, and is not a modification of pricing for the purposes of this Section. The Customer's continued use of the Services following the effective date of any pricing change constitutes acceptance of such change. All fees are stated in U.S. Dollars, are non-refundable except as expressly provided herein or as required by law, and are exclusive of GST and of any other applicable local or regionally required taxes and fees.

8.2. GST. Unless expressly stated otherwise, all amounts payable under this Agreement are exclusive of GST. If a supply made under this Agreement is a taxable supply, the recipient must pay to the supplier, in addition to the consideration for that supply, an additional amount equal to the GST payable on that supply, at the same time and in the same manner as the consideration is payable. The supplier must issue a valid tax invoice to the recipient. If an amount payable under this Agreement is calculated by reference to a cost, expense, or other amount paid or incurred by a party, that amount is reduced by any input tax credit to which that party is entitled.

Customer warrants that, at the time each supply is made, it is not a resident of Australia and is not in Australia in relation to the supply, unless Customer has notified PostLever in writing to the contrary. Customer must promptly notify PostLever if it becomes registered or required to be registered for GST in Australia or if the circumstances relevant to the GST treatment of a supply change. If a supply that the parties treated as GST-free is subsequently determined to be a taxable supply, Customer must pay PostLever, on demand, the amount of the GST together with any interest and penalty imposed on PostLever in respect of it.

The parties agree that, where Customer is not a resident of Australia and is not in Australia in relation to a supply made under this Agreement, that supply is treated as GST-free. The parties make no agreement as to the GST treatment of a supply that is provided, or is required to be provided, to another entity in Australia, and the recovery provisions of this Section apply to any GST subsequently determined to be payable on such a supply.

8.3. If your billing information and payment source are invalid, if charges billed to you are declined or not paid, or if you fail to pay charges for the Services when due, PostLever will give you written notice of the failure, and your Account may be suspended or cancelled if the failure is not remedied within ten (10) days after that notice. That ten (10) day period applies in place of the thirty (30) day period in Section 9.2.2 for a failure to pay, and it is the only cure period for non-payment under this Agreement. If an Account is suspended, PostLever may, but is not obliged to, maintain the Account or related content and information, in order to allow the Customer to pay the past-due charges and restore the Account.

8.4. Subscription term, renewal, and billing cycle. The subscription begins when Customer first provides a payment method and accepts the billing terms, and it renews automatically each month on the anniversary of that day (the "Billing Anniversary") until it is cancelled under Section 8.5 or this Agreement is terminated. Fees are charged in arrears at each Billing Anniversary for the monthly period then ended. Fees are not prorated, and a monthly period is charged in full whether or not Customer sends any Campaign in it.

8.5. Cancellation. Customer may cancel the renewal of its subscription at any time through the PostLever dashboard, without notice and without penalty. Cancellation stops the next renewal only: Customer is billed as normal for the then current billing period, retains access to the Services until the next Billing Anniversary, and is charged no further subscription fee for any period after that date. Sending through the Services is gated once the subscription ends. Section 9.4 governs what happens to Customer Data after that.

8.6. Billable sends and overage. A billable send is a send PostLever hands off to transport for delivery, counted once per recipient. An address suppressed at send is not handed off and is not billed. The monthly subscription fee includes the send allowance stated on the Pricing Page. Volume above that allowance is charged as graduated overage at the band boundaries and rates stated on the Pricing Page, each band's rate applying only to the sends falling within it, and the monthly send count is rounded up as the Pricing Page states.

8.7. Signup credit. PostLever applies a signup credit, in the amount stated on the Pricing Page, to Customer's first invoice before payment is collected. The credit is applied against the subscription fee for the first billing period, is not redeemable for cash, and is refundable only to the extent this Agreement expressly provides.

8.8. Sending ceiling. PostLever sets a sending ceiling for the Account, in the default amount stated on the Pricing Page, from the time Customer first provides a payment method and accepts the billing terms. Sends do not exceed the ceiling in force. PostLever will notify Customer as the ceiling is approached and when it is reached. Customer may request a higher ceiling, and PostLever will decide the request acting reasonably and against objective criteria only, being: the outcome of the screening PostLever conducts under Section 14.9; verified business registration; payment and chargeback risk as scored by PostLever's payment provider; any prior enforcement history on the Account or on an Account connected with it; and Customer's observed sending behaviour. PostLever will not apply a criterion based on the country in which Customer is located, incorporated, or operates. PostLever will tell Customer the reason for a refusal.

8.9. Invoices. Where PostLever issues an invoice rather than charging a payment method on file, payment is due within thirty (30) days of Customer's receipt of a valid tax invoice.

8.10. United States sales and use taxes. Fees are exclusive of any United States federal, state, or local sales, use, excise, gross receipts, or similar transaction tax. Where PostLever is required to collect such a tax on a supply made to Customer, PostLever may charge, collect, and remit it in addition to the fees, and Customer must pay it. Customer must give PostLever the information PostLever reasonably requires to determine the correct treatment, including Customer's place of primary use and any valid exemption or resale certificate, and Customer is responsible for the accuracy of that information and for any tax, interest, or penalty arising from information that is inaccurate or out of date. This Section applies in addition to, and does not limit, Section 8.2.

9. TERM AND TERMINATION.

9.1. Term. This Agreement shall automatically become effective upon the Effective Date and continue indefinitely until terminated as further detailed herein below.

9.2. Termination.

9.2.1. Termination for Convenience. PostLever may terminate this Agreement for convenience upon thirty (30) days' prior written notice to Customer, the termination taking effect at the end of the billing period in which that notice period expires. Customer may cancel the renewal of its subscription at any time under Section 8.5, and may terminate this Agreement for convenience at any time by written notice, in either case without a notice period, the termination taking effect at the end of the then current billing period. Either is a "Termination for Convenience". Following a Termination for Convenience by either party, Customer is billed as normal for the billing period in which the termination takes effect, no further fee is charged for any period after that, and PostLever will refund on a pro rata basis any amount Customer has prepaid, including any unused send credits.

9.2.2. Termination for Cause. Either party may terminate this Agreement immediately upon written notice if the other party commits a material breach of this Agreement and fails to remedy such breach within thirty (30) days of receiving written notice specifying the breach ("Termination for Cause"). For the avoidance of doubt, failure by the Customer to pay fees when due, and breach by Customer of Section 3.2 or the Acceptable Use Policy, each constitutes a material breach. For a failure by the Customer to pay fees when due, the cure period is the ten (10) day period in Section 8.3 and not the thirty (30) day period in this Section.

Where a material breach is incapable of remedy, or where it carries a credible risk of serious harm to a person or of criminal liability, the terminating party may terminate immediately on written notice without allowing the thirty (30) day period. This applies in particular to a breach involving material that sexually exploits or endangers a child, which the Acceptable Use Policy addresses.

9.2.3. Termination for Insolvency. Either party may terminate this Agreement immediately upon written notice if the other party becomes insolvent, has a controller, administrator, receiver, liquidator, or provisional liquidator appointed to it or any of its assets, enters into an arrangement or composition with its creditors, or is subject to an event with a substantially similar effect under the law of its jurisdiction. This Section is subject to sections 415D, 434J, and 451E of the Corporations Act 2001 (Cth), to 11 USC 365(e)(1), and to any other law that stays or invalidates the exercise of a right of termination by reason of insolvency, and is unenforceable to the extent of any such stay or invalidity.

9.3. Suspension. PostLever may immediately suspend the Services (in whole or in part) if PostLever reasonably determines that: (a) the Customer's use of the Services poses a security risk to the PostLever Platform or third-parties; (b) the Customer's use may adversely impact the Services or the systems of other customers; (c) the Customer is in violation of the Acceptable Use Policy or Section 3.2; (d) such suspension is required by applicable law or by a regulatory authority, including a direction of the Australian Communications and Media Authority; (e) the Customer has failed to produce consent records within the period required by Section 3.4 of the Acceptable Use Policy; or (f) the Customer has failed to pay charges for the Services when due and the ten (10) day period in Section 8.3 has expired. Any suspension will be no broader in scope and no longer in duration than is reasonably necessary to address the matter giving rise to it. PostLever will use commercially reasonable efforts to notify the Customer prior to or promptly following any such suspension, and will restore the Services promptly once the matter is resolved.

9.4. Post Termination. Following termination or expiration of this Agreement, PostLever shall make Customer Data available for export by the Customer for thirty (30) days. The Customer is responsible for exporting and retaining its Customer Data before the end of that period. PostLever shall destroy or de-identify Customer Data on the Customer's request, made in writing to the support address stated in Section 14.6, and shall do so in accordance with the terms of this Agreement, unless retention is required by applicable law. Termination or expiration of this Agreement does not of itself destroy or de-identify Customer Data. Nothing in this Section limits PostLever's obligation under APP 11.2, which applies as a matter of law, to take such steps as are reasonable in the circumstances to destroy or de-identify personal information that PostLever no longer needs for any purpose for which it may be used or disclosed.

Notwithstanding termination, PostLever will continue for at least thirty (30) days after the last Campaign sent through the Services to receive and process unsubscribe requests relating to that Campaign, and to record them against Customer's suppression data, so that Customer's obligations under the Spam Act and CAN-SPAM in respect of previously sent Campaigns can continue to be met. The destruction obligation in the first paragraph of this Section does not apply to the Customer Data PostLever needs in order to do so, including Customer's suppression data, until that thirty (30) day period has ended. Where Customer has asked PostLever to destroy or de-identify that data, PostLever does so once that period has ended.

The destruction obligation in this Section is subject to the preservation carve out in Section 4.2, which applies to it in the same terms.

9.5. Survival. The following survive termination or expiration of this Agreement for any reason: Section 1 (Definitions); Sections 2.4, 2.5, 2.6, and 2.7; Section 4 and Addendum A, for so long as PostLever holds Personal Data Processed under this Agreement; Sections 6.3 and 6.4; Sections 7.3, 7.5, and 7.6; Section 8 in respect of fees accrued before termination, together with Sections 8.2 and 8.10; Section 9.4, including the thirty (30) day export window and the thirty (30) day unsubscribe tail; this Section 9.5; Section 11, on the terms stated in that Section, including the three (3) year tail and the perpetual obligations in respect of trade secrets and source code; Section 12; Section 13; and Sections 14.2, 14.5, 14.6, 14.9, 14.10, and 14.11. No other Section survives, except to the extent of a right or obligation that accrued under it before termination.

10. SERVICE LEVELS, SUPPORT, AND MAINTENANCE.

10.1. Service Levels. PostLever's commitments on availability, support, maintenance, and backups are set out in the Service Level Agreement at Schedule 1, which forms part of this Agreement. Schedule 1 states no availability target, and no service credit is payable while it states none. Where PostLever publishes an availability target and service credit rates, they are stated in Schedule 1 and nowhere else, so that there is one figure for each.

10.2. Service level remedy. Service credits under Schedule 1 are Customer's sole contractual remedy for a failure to meet an availability commitment stated in Schedule 1, and do not limit any right or remedy Customer has under Section 7.5.

10.3. Exceptions. A number of factors may affect the quality of communications and use of the Services. PostLever is not responsible for any disruption, interruption, or delay caused by failures or inadequacies in items outside PostLever's reasonable control. PostLever gives no availability or performance commitment in respect of Customer's own sending infrastructure or connected suppression sources, and no commitment as to deliverability outcomes, as set out in Schedule 1.

10.4. Maintenance. From time to time, PostLever may need to perform maintenance on or upgrade the PostLever Platform, in accordance with Schedule 1. Planned and emergency maintenance carried out in accordance with Schedule 1 does not count toward Unplanned Downtime.

10.5. For PostLever platform support-related needs, please contact PostLever at: support@postlever.com. Support hours and response targets are in Schedule 1.

11. CONFIDENTIALITY.

Except as set forth herein, and to the extent required under applicable law, the Receiving Party agrees to keep confidential and not disclose, use, copy, or distribute any Confidential Information to anyone, other than to those of its employees and contractors, if and to the extent that such employees and contractors have a need to know such Confidential Information for the purpose of Receiving Party's performance of the Agreement, and provided that such employees and contractors are bound to abide by all the obligations concerning such Confidential Information contained in the Agreement. The obligations outlined in this Section shall survive the termination or expiration of the Agreement for a period of three (3) years following the termination, except that: (a) the obligations in respect of Confidential Information that is a trade secret, or that consists of the source code of the PostLever Platform, continue for so long as the information remains a trade secret or remains source code that is not publicly available; and (b) personal information is governed by Section 4 and, where it applies, by Addendum A, rather than by the three (3) year period in this Section. All Confidential Information shall be and remain the property of the Disclosing Party. The disclosure of the Confidential Information shall not be construed as granting the Receiving Party any right, title, or licence, whether express or implied, with respect to the Confidential Information or to its related Intellectual Property. Each party acknowledges that its breach of this Section may cause the other party extensive and irreparable harm and damage and agrees that the other party shall be entitled to seek injunctive relief to prevent use or disclosure of its Confidential Information not authorised by this Agreement, in addition to any other remedy available to the other party under applicable law.

12. LIMITATIONS ON LIABILITY.

12.1. This Section 12 is subject to Section 7.5, and does not limit or exclude any liability that cannot lawfully be limited or excluded, including liability under the ACL for a guarantee that cannot be excluded and liability for misleading or deceptive conduct under section 18 of the ACL to the extent that liability cannot be limited.

12.2. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY FOR ANY CONSEQUENTIAL LOSS ARISING OUT OF OR RELATED TO THIS AGREEMENT, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), UNDER STATUTE, OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS.

12.3. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY THE CUSTOMER TO POSTLEVER DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

12.4. THE LIMITATIONS SET FORTH IN SECTIONS 12.2 AND 12.3 SHALL NOT APPLY TO: (A) EITHER PARTY'S INDEMNIFICATION OBLIGATIONS UNDER SECTION 13, WHICH ARE INSTEAD LIMITED, FOR EACH PARTY ALIKE, TO THREE (3) TIMES THE AMOUNT OF THE CAP IN SECTION 12.3; (B) EITHER PARTY'S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS UNDER SECTION 11, EXCEPT THAT LIABILITY FOR A BREACH CONSISTING OF UNAUTHORISED ACCESS TO, OR UNAUTHORISED DISCLOSURE OF, CUSTOMER DATA IS LIMITED TO THREE (3) TIMES THE AMOUNT OF THE CAP IN SECTION 12.3, WHILE LIABILITY FOR DELIBERATE MISUSE OF CONFIDENTIAL INFORMATION IS NOT LIMITED BY THIS SECTION 12; (C) THE CUSTOMER'S PAYMENT OBLIGATIONS; OR (D) DAMAGES ARISING FROM A PARTY'S FRAUD OR WILFUL MISCONDUCT.

12.5. EACH PARTY'S LIABILITY IS REDUCED TO THE EXTENT THAT THE OTHER PARTY'S ACT OR OMISSION, OR THAT OF ITS PERSONNEL, CAUSED OR CONTRIBUTED TO THE RELEVANT LOSS, AND EACH PARTY MUST TAKE REASONABLE STEPS TO MITIGATE ITS LOSS.

12.6. BECAUSE SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, IN SUCH JURISDICTIONS, LIABILITY SHALL BE LIMITED TO THE EXTENT PERMITTED BY LAW.

13. INDEMNITY.

13.1. Customer Indemnity. The Customer agrees to indemnify PostLever and its directors, officers, employees, advisors, subsidiaries, affiliates, and agents against all losses, damages, expenses, claims, demands, and liabilities (including reasonable legal costs) incurred by or asserted against PostLever arising out of: (a) any representation made by Customer to third-parties creating any obligation or liability regarding PostLever's Services which PostLever has not specifically assumed or approved under this Agreement; (b) Customer's breach of any term or condition of this Agreement or the Acceptable Use Policy; (c) Customer's failure to comply with all applicable laws, regulations, and requirements, including without limitation laws relating to data protection, privacy rights, anti-spam (including the Spam Act, CAN-SPAM, and CASL), and intellectual property; (d) any Customer Data or Campaign content that infringes or misappropriates the rights of any third-party; (e) claims arising from Customer's use of data obtained from third-party data brokers, list vendors, or affiliate sources; (f) violations of applicable data broker laws, registration requirements, or consumer opt-out rights; or (g) failure to provide required notices or obtain valid consent for the collection and disclosure of Customer Data.

This indemnity extends, to the extent permitted by law, to any penalty, infringement notice, enforceable undertaking, or remedial cost imposed on or incurred by PostLever by the Australian Communications and Media Authority, the Office of the Australian Information Commissioner, or the Australian Competition and Consumer Commission, to the extent that it arises from Customer's Campaigns or Customer Data, and not to the extent that it arises from a contravention by PostLever of an obligation imposed on PostLever itself.

Customer's liability under this Section is reduced to the extent that PostLever's own act or omission caused or contributed to the relevant loss.

13.2. PostLever Indemnity. PostLever agrees to indemnify the Customer and its directors, officers, employees, and agents against all losses, damages, expenses, claims, demands, and liabilities (including reasonable legal costs) incurred by or asserted against Customer arising out of any third-party claim that the PostLever Platform, as provided by PostLever and used by Customer in accordance with this Agreement, infringes or misappropriates any third-party intellectual property right; provided, however, that PostLever shall have no obligation under this Section 13.2 to the extent such claim arises from: (a) Customer Data or Campaign content; (b) modifications to the PostLever Platform made by or at the direction of the Customer; (c) combination of the PostLever Platform with products, services, or materials not provided by PostLever; or (d) Customer's use of the PostLever Platform in violation of this Agreement.

If the PostLever Platform becomes, or in PostLever's reasonable opinion is likely to become, the subject of such a claim, PostLever may at its option and its own expense: (a) procure for Customer the right to continue using the PostLever Platform; (b) modify or replace the affected part of the PostLever Platform so that it is no longer infringing, without material reduction in functionality; or, (c) if neither paragraph (a) nor paragraph (b) is reasonably available to it, terminate the affected Services on written notice and refund any amount Customer has prepaid for those Services in respect of a period after the termination takes effect. This Section 13.2 states PostLever's entire liability, and Customer's sole remedy, for a third-party claim that the PostLever Platform infringes or misappropriates an intellectual property right. This Section does not limit Section 7.5.

13.3. The indemnifying party's obligations under this Section 13 are conditioned upon the indemnified party: (a) providing prompt written notice of the claim, except that a failure to give prompt notice relieves the indemnifying party of its obligations only to the extent that the delay materially prejudices the defence of the claim; (b) granting the indemnifying party control over the defence and settlement of the claim; and (c) providing reasonable cooperation at the indemnifying party's expense. The indemnified party may participate in the defence of the matter with counsel at its own cost. Neither party shall enter into or acquiesce to any settlement which contains any admission of or stipulation to any guilt, fault, liability, or wrongdoing on the part of the other party, or which would otherwise adversely affect the other party, without that other party's prior written consent (which shall not be unreasonably withheld), and under no circumstances shall an indemnified party be required to admit to any liability.

14. MISCELLANEOUS.

14.1. Force Majeure. Neither party shall be liable for any delay or failure to perform its obligations under the Agreement (other than an obligation to pay money) if and to the extent that such delay or failure is caused by circumstances beyond that party's reasonable control, including strikes, lockouts, industrial action, restrictive government or judicial orders or decrees, riots, insurrection, war, terrorism, epidemic or pandemic, cyber attack or denial of service attack on a third party, natural disasters, fire, flood, or inclement weather, which that party is unable to prevent by the exercise of reasonable diligence. The affected party must notify the other promptly and use reasonable efforts to resume performance. If a force majeure event continues for more than sixty (60) days, either party may terminate this Agreement on written notice.

14.2. Severance. If any provision of this Agreement is held to be unenforceable, that provision is to be read down to the extent necessary to make it enforceable, and if it cannot be read down, it is severed. All remaining provisions of this Agreement shall remain in full force and effect.

14.3. Independent Contractor. Each party is an independent contractor and, as such, will not have any authority to bind or commit the other. Nothing herein shall be deemed or construed to create a joint venture, partnership, fiduciary, or agency relationship between the parties for any purpose.

14.4. Assignment. Customer may not assign or novate this Agreement without PostLever's prior written consent, which will not be unreasonably withheld. PostLever may assign or novate this Agreement to a successor in interest in connection with a merger, consolidation, sale of substantially all of its assets, or other corporate reorganisation, provided that the assignment does not have a material adverse effect on Customer and that the assignee assumes PostLever's obligations under this Agreement. PostLever shall provide the Customer with written notice of the assignment or novation on or before PostLever's next communication to the Customer following it.

14.5. Governing Law and Venue. This Agreement, the Services, and any dispute arising in connection with either, are governed by the laws of Queensland, Australia. Each party submits to the exclusive jurisdiction of the courts of Queensland and the courts competent to hear appeals from them, and waives any objection to venue in those courts on the ground of inconvenient forum. Nothing in this Section prevents a party from seeking urgent injunctive or other interlocutory relief, from enforcing a judgment, or from bringing proceedings to recover a debt due and payable under this Agreement, in any court of competent jurisdiction.

The United Nations Convention on Contracts for the International Sale of Goods does not apply to this Agreement.

14.6. Notices and Contact Information. If you have any questions or comments regarding this Agreement, please contact us at support@postlever.com. Notices to PostLever must be sent to legal@postlever.com and to 7 High Street, Victoria Point, Queensland 4165, Australia. Notices to Customer will be sent by email to the address on the Account, or by another reasonably substitutable means. A notice given by email is deemed received on the Business Day after it is sent, unless the sender receives a delivery failure notification in respect of it, in which case the notice must be resent or given by another means before it is treated as given. All correspondence, notices, and technical documentation exchanged between the parties shall be provided in the English language only.

14.7. Entire Agreement. This Agreement, together with the SLA at Schedule 1, the AUP, the Pricing Page, and any Order Form, is the entire agreement between the parties in relation to its subject matter and supersedes all prior representations, understandings, and agreements. Nothing in this Section limits liability for misleading or deceptive conduct or for any representation that cannot lawfully be excluded.

14.8. Agreement To Conduct Business Electronically. Each party agrees to conduct business electronically with the other and acknowledges that, by signing an Order Form or insertion order, each is confirming and acknowledging that it has accepted this Agreement and all the policies, terms and conditions identified in it. Each party consents, for the purposes of the Electronic Transactions Act 1999 (Cth) and the corresponding legislation of each State and Territory, to the giving of information and notices by electronic communication, and to the signing of documents by electronic signature. A signature transmitted electronically is deemed an original signature, and this Agreement may be signed and delivered electronically.

14.9. Trade Controls. Each party must comply with the sanctions, export control, and trade control laws that apply to it. Customer must not use the Services, and must not permit the Services to be used, for or on behalf of a person or entity that is designated or otherwise the subject of a sanction under the Autonomous Sanctions Act 2011 (Cth), the Autonomous Sanctions Regulations 2011 (Cth), the Charter of the United Nations Act 1945 (Cth) and the regulations made under it, or the Customs (Prohibited Exports) Regulations 1958 (Cth), and must not use the Services in a way that would cause PostLever to contravene any of those laws. The same obligation applies in respect of the sanctions, export control, and trade control laws of the United States, the United Kingdom, the European Union, and the United Nations, including designation on the Specially Designated Nationals and Blocked Persons List maintained by the United States Office of Foreign Assets Control. Customer must cooperate with any screening PostLever conducts and must give PostLever the information PostLever reasonably requires for it, including the identity of any advertiser on whose behalf a Campaign is sent. PostLever may suspend the Services immediately, and may terminate this Agreement immediately on written notice, where screening returns a match that PostLever reasonably determines it cannot lawfully disregard. This Section applies to every Account, wherever Customer is located, incorporated, or operates.

14.10. Publicity. PostLever may identify Customer as a customer by name and logo in its customer list, on its website, and in its marketing materials only with Customer's prior written consent, which Customer may withhold or later withdraw on written notice. Nothing in this Agreement gives either party any right in the trade marks or trade names of the other beyond the limited right in this Section.

14.11. Non-waiver. A waiver by either party of a default or breach under this Agreement is not a waiver of any subsequent default or breach, whether of the same kind or a different kind. A right under this Agreement is not waived except in writing.

Addendum A

GDPR / UK GDPR / Swiss Data Protection Addendum

This Addendum A applies only to the extent PostLever Processes Personal Data subject to the GDPR, UK GDPR, or Swiss data protection law on behalf of Customer in connection with the Services.

A1. Roles.

For Processing subject to this Addendum, Customer is the Controller (or Processor acting on behalf of a Controller, where disclosed to PostLever) and PostLever is the Processor with respect to Personal Data Processed by PostLever on Customer's behalf.

A2. Subject Matter and Duration.

The subject matter of the Processing is the performance of the Services under the Agreement. The duration of the Processing is the term of the Agreement plus any limited post-termination period during which PostLever retains Personal Data in accordance with the Agreement or applicable law.

A3. Nature, Purpose, and Data Types.

The nature of the Processing may include collection, storage, organisation, access, hosting, use, transmission, suppression processing, segmentation, enrichment, campaign deployment support, reporting, and deletion of Personal Data solely to provide the Services and on Customer's documented instructions.

Categories of data subjects may include Customer's existing customers, prospects, subscribers, leads, employees using the platform, and recipients included in Campaign audiences. Categories of Personal Data may include identifiers, contact information, commercial and engagement data, geolocation indicators, internet or network information, campaign response data, ISP or domain-level deliverability information, segmentation attributes, and other Personal Data included in Customer Data.

Customer will not provide special category data unless the parties expressly agree in writing and implement additional safeguards.

A4. Processor Obligations.

PostLever will:

• Process Personal Data only on Customer's documented instructions, including this Agreement and applicable Order Forms, unless otherwise required by applicable law, in which case PostLever will inform Customer unless legally prohibited.

• Ensure that authorised personnel are subject to confidentiality obligations.

• Implement appropriate technical and organisational measures designed to protect Personal Data.

• Assist Customer, taking into account the nature of the Processing, with appropriate requests relating to data subject rights, security incidents, data protection impact assessments, and consultations with supervisory authorities, to the extent required by GDPR Article 28 and reasonably feasible.

• At Customer's choice, delete or return Personal Data after the end of the provision of the Services, unless retention is required by law. Section 9.4 states how Customer makes that choice, and termination does not of itself delete Personal Data.

• Make available information reasonably necessary to demonstrate compliance and allow audits or inspections in a manner that is proportionate, secure, and minimally disruptive.

A5. Sub-processors.

Customer authorises PostLever to engage sub-processors. PostLever will impose data protection obligations on each sub-processor that are no less protective than the obligations imposed on PostLever under this Addendum to the extent applicable to the sub-processor's services.

PostLever will provide prior notice of material new sub-processors where commercially practicable. If Customer reasonably objects on data protection grounds, the parties will work in good faith to resolve the objection; if no reasonable resolution is available, Customer may terminate the affected Services on written notice.

A6. Security Incidents.

PostLever will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data Processed under this Addendum and will provide timely information reasonably requested by Customer to support Customer's compliance obligations. PostLever's notice does not constitute an admission of fault or liability.

A7. International Transfers.

If Personal Data subject to this Addendum is transferred from the EEA, UK, or Switzerland to a country that does not provide an adequate level of protection under applicable law, the parties agree that the applicable Standard Contractual Clauses, together with the UK Addendum and Swiss supplements where required, are incorporated by reference and apply to such transfer.

For EEA transfers, Module Two (Controller to Processor) will apply where Customer acts as controller and PostLever acts as processor. Australia has not been the subject of an adequacy decision, so transfers of such Personal Data to PostLever in Australia are made on the basis of the Standard Contractual Clauses.

The Annexes to the Standard Contractual Clauses are completed as set out in A9, A10, and A11.

A8. Order of Precedence.

If there is a conflict between this Addendum and the main body of the Agreement regarding Processing subject to GDPR, UK GDPR, or Swiss law, this Addendum controls. If the parties execute separate transfer terms or Standard Contractual Clauses, those terms control to the extent of any direct conflict.

A9. Annex I to the Standard Contractual Clauses.

A. List of parties.

Data exporter: Customer, as identified in the Order Form, at the address stated in the Order Form, and contactable at the address on the Account. Activities relevant to the transfer: procuring the Services described in the Order Form for the purposes of its own email campaigns. Role: controller, or processor where Customer acts on behalf of a controller and has disclosed that to PostLever.

Data importer: PostLever Pty Ltd ACN 701 249 881 of 7 High Street, Victoria Point, Queensland 4165, Australia. Contact: legal@postlever.com. Activities relevant to the transfer: providing the Services described in the Order Form. Role: processor.

B. Description of the transfer.

Categories of data subjects: as set out in A3, being Customer's existing customers, prospects, subscribers, leads, employees using the platform, and recipients included in Campaign audiences.

Categories of personal data: as set out in A3, being identifiers, contact information, commercial and engagement data, geolocation indicators, internet or network information, campaign response data, ISP or domain-level deliverability information, segmentation attributes, and other Personal Data included in Customer Data.

Sensitive data: none. Customer will not provide special category data unless the parties expressly agree in writing and implement additional safeguards, as A3 states.

Frequency of the transfer: continuous, for the duration of the Processing.

Nature and purpose of the Processing: as set out in A2 and A3, being the performance of the Services on Customer's documented instructions and for the business purposes enumerated in Section 2.3.

Retention period: as set out in A2 and Section 9.4. Personal Data is retained for the term of the Agreement and afterwards until Customer asks PostLever to destroy or de-identify it, because termination does not of itself destroy or de-identify it. The thirty (30) day export window and the thirty (30) day unsubscribe tail in Section 9.4 apply, as does any period for which retention is required by law or by the preservation carve out in Section 4.2.

Transfers to sub-processors: for the same subject matter, nature, and duration, on the terms in A5 and Section 4.10.

C. Competent supervisory authority.

For transfers subject to the GDPR: where the data exporter is established in the European Economic Area, the supervisory authority of the Member State in which it is established; where the data exporter is not established in the European Economic Area but has appointed a representative under Article 27 of the GDPR, the supervisory authority of the Member State in which that representative is established; and where the data exporter is not established in the European Economic Area and is not required to appoint a representative, the supervisory authority of the Member State in which the data subjects whose personal data is transferred are located.

For transfers subject to the UK GDPR: the Information Commissioner's Office.

For transfers subject to Swiss data protection law: the Federal Data Protection and Information Commissioner.

A10. Annex II to the Standard Contractual Clauses.

Technical and organisational measures:

• Pseudonymisation and encryption. Not yet established.

• Ongoing confidentiality, integrity, availability and resilience. Application containers run in private subnets and have no public IP address. Access to production requires multi-factor authentication and is through individual named accounts, with no shared production logins.

• Restoring availability and access after an incident. A restore from backup has been performed and verified. PostLever maintains a written incident response plan.

• Regular testing and evaluation of effectiveness. Not yet established.

• User identification and authorisation. Identity is provided by AWS Cognito. Access to production requires multi-factor authentication and is through individual named accounts, with no shared production logins. Staff in a designated support group enter a customer account through a signed impersonation token targeting a real user in that account, and once inside the account have what that user has.

• Protection of data in transmission. Transport Layer Security is enforced, and HTTP is redirected to HTTPS at the edge.

• Protection of data in storage. Not yet established.

• Physical security of processing locations. Inherited from Amazon Web Services rather than operated by PostLever.

• Events logging. Not yet established.

• System configuration. Credentials are held in AWS Secrets Manager. Application containers run in private subnets and have no public IP address.

• Internal IT and IT security governance. PostLever maintains a written incident response plan.

• Certification and assurance. Not yet established.

• Data minimisation. Not yet established.

• Data quality. Not yet established.

• Limited data retention. Not yet established.

• Accountability. Access to production is through individual named accounts, with no shared production logins, so an action taken in production is attributable to a person.

• Data portability and erasure. Not yet established.

• Measures applied by sub-processors. Not yet established.

This Annex is outstanding, and this Addendum is not to be relied on for a restricted transfer until it is completed.

A11. Annex III to the Standard Contractual Clauses.

List of sub-processors, where Module Two applies on the basis of specific prior authorisation:

Section 4.10 governs sub-processor authorisation in every other case, and nothing in this Annex creates an obligation to publish a sub-processor list.