LUNARIS CYBERSECURITY SERVICES AGREEMENT

1. ACCEPTANCE AND AUTHORITY

1.1 Formation. This Agreement is formed, and the “Effective Date” occurs, when Client completes TCGi’s online checkout by (a) selecting services and quantities, (b) affirmatively checking the box indicating acceptance of this Agreement, and (c) submitting payment. TCGi will record the date and time of acceptance, the version of this Agreement accepted, the identity of the accepting individual, and the order details, and will send Client a confirmation that includes the Order and a copy of (or durable link to) this Agreement.

1.2 Authority. The individual completing checkout represents and warrants that they (a) are at least 18 years of age, (b) are an authorized representative of Client with authority to bind Client to this Agreement, and (c) are purchasing the services for business use and not for personal, family, or household purposes.

1.3 Electronic Transactions. Client consents to transact electronically. Client agrees that its electronic acceptance, and electronic records and notices under this Agreement, satisfy any requirement that this Agreement or related records be in writing or signed, to the fullest extent permitted by applicable law, including the U.S. E-SIGN Act and applicable state equivalents.

1.4 Online Orders. This Agreement governs all subscriptions purchased through TCGi’s online checkout, regardless of the number of endpoints covered. Any request to modify these terms requires a separately negotiated written agreement executed by TCGi. TCGi may decline or cancel any online order that TCGi reasonably believes was placed without authority or in error, or that TCGi is unable to fulfill, in which case TCGi will refund amounts paid for the cancelled order.

Online checkout is not available to any Client that is a covered entity or business associate under HIPAA, or that will transmit protected health information to or through the services. Such Clients must purchase under a separately negotiated agreement that includes an executed Business Associate Agreement. TCGi may cancel any online order placed in contravention of this paragraph and will refund amounts paid for the cancelled order.

1.5 No Reliance. Client acknowledges that in entering into this Agreement it has not relied on any statement, representation, warranty, or assurance of any kind other than those expressly set out in this Agreement, the Order, and the module descriptions incorporated by reference. No statement made by any TCGi representative before Client’s acceptance modifies this Agreement or creates any obligation of TCGi. This Section does not limit liability for fraud or fraudulent misrepresentation.

2. THE ORDER AND THE SERVICES

2.1 Order. “Order” means the order summary generated by TCGi’s checkout and included in Client’s confirmation, reflecting: the Lunaris service modules selected; the number of covered endpoints; the per-endpoint fees; any add-ons; and the total monthly subscription fee. Fees are billed monthly over the term. The Order is incorporated into and forms part of this Agreement. Modules may be presented at checkout under plain-language marketing names; the Order lists each with its corresponding name from Section 2.2, mapped one to one.

2.2 Service Modules. The Lunaris service catalog consists of the following modules, as further described in the module descriptions published at https://www.technologyconcepts.com/lunaris, which are incorporated by reference as of the Effective Date: (a) Email Security & Phishing Protection; (b) Endpoint Detection & Response (EDR); (c) Dark Web Monitoring; (d) Disaster Recovery (endpoint and SaaS backup); (e) Automatic Software Updates; and (f) Cloud Application Monitoring. An optional add-on, 24/7 Managed SOC, is available as stated at checkout. Client’s subscription includes only the modules and add-ons listed in the Order.

2.3 Endpoints. “Endpoint” means each desktop, laptop, or server covered by the subscription, as counted in the Order. Fees are charged per endpoint. Mailbox coverage for email-based modules is addressed in Section 3.4.

2.4 Services. TCGi will provide the Lunaris cybersecurity subscription services described in the Order and the module descriptions, including as applicable continuous monitoring, threat detection, endpoint protection, and automated response.

2.5 Changes to Services. TCGi may modify, update, replace, or discontinue features, components, technologies, or third-party providers used to provide the Services from time to time, including as a result of changes made by TCGi’s technology providers. TCGi will use commercially reasonable efforts to maintain substantially equivalent overall functionality and security of the Services during the then-current Term. TCGi will provide Client with reasonable prior notice of any change that materially reduces the overall functionality of the Services. If a material component of the Services is discontinued and TCGi is unable to provide substantially equivalent replacement functionality, TCGi may discontinue the affected component or Service and will provide Client with a prospective credit for fees attributable to the discontinued component or Service for the remainder of the then-current Term. Such credit will be Client’s exclusive remedy for the discontinuation.

2.6 Onboarding. Following purchase, Client will complete TCGi’s onboarding questionnaire and TCGi will deliver deployment instructions to Client’s designated contact. Client will cooperate reasonably in onboarding, including providing accurate environment information and access necessary to deploy the services. Onboarding fees, if any, are stated at checkout and reflected in the Order.

3. ENDPOINT COUNTS AND TRUE-UP

3.1 Accuracy. Client is responsible for the accuracy of the endpoint count in the Order and for keeping it current during the term.

3.2 Additions. Client may add endpoints at any time through its account or by written request. Added endpoints are billed at the then-current per-endpoint rates for Client’s selected modules, prorated for the remainder of the current billing period, and thereafter included in the recurring fee. Added endpoints are coterminous with the then-current term and do not extend, restart, or create a new term.

3.3 Reductions. Reductions in endpoint count take effect at the start of the next renewal term and do not reduce fees for the then-current term.

3.4 Mailbox Coverage. For email-based modules (Email Security & Phishing Protection, and email backup within Disaster Recovery), the subscription covers a number of mailboxes up to the endpoint count in the Order. Additional mailboxes are billed at TCGi’s then-current published rate of $7.00 per mailbox per month.

3.5 Verification. TCGi may verify deployed endpoint and mailbox counts through the Lunaris platform. If deployed counts exceed the Order, TCGi will invoice the difference at then-current rates, retroactive to when the excess deployment began.

4. FEES AND PAYMENT

4.1 Fees. Client will pay the monthly fees stated in the Order. Except as expressly provided in Section 5.4, all fees are non-cancelable and non-refundable.

4.2 Payment Method. Client will pay by credit card or ACH debit through TCGi’s third-party payment processor. Client authorizes TCGi, through the processor, to charge the payment method on file on a recurring basis for the fees due each billing period, including adjustments under Section 3. Client is responsible for keeping its payment method current. Payment credentials are collected and stored by the processor; TCGi does not collect or store Client’s full card number or bank account credentials.

4.3 Price Changes. TCGi may change per-endpoint rates effective at the start of a renewal term by giving Client written notice at least ninety (90) days before the renewal date.

4.4 Receipts and Charge Notices. TCGi will deliver an electronic receipt after each charge. If the amount of a recurring charge will differ from the amount most recently charged (for example, following endpoint or mailbox additions under Section 3), TCGi will deliver written notice of the new amount and charge date at least ten (10) days before the changed charge. Notices and receipts may be delivered by email, including automated notices from the payment processor.

4.5 Late or Failed Payment. If a recurring charge fails, TCGi will notify Client and retry. If payment of an undisputed amount remains outstanding fifteen (15) days after the due date, TCGi may suspend services until paid. Suspension does not relieve Client of its payment obligations for the term.

An amount is disputed only if Client notifies TCGi in writing on or before the due date, identifying the amount and the basis for the dispute in reasonable detail. Client will pay all undisputed amounts when due. The parties will work in good faith to resolve a disputed amount within thirty (30) days. If a dispute is resolved in TCGi’s favor, TCGi may suspend services for any amount that remains unpaid ten (10) days after resolution.

4.6 Taxes. Fees exclude taxes. Client is responsible for all applicable taxes other than taxes on TCGi’s income. Where TCGi is required to collect taxes, they will be added at checkout or on the invoice.

4.7 Payment Method Pricing. TCGi publishes a single price for each service module and add-on. The published price applies to payment by credit card. Client will receive a discount off the published per-endpoint price, in the amount shown at checkout and reflected in the Order, for so long as ACH debit is the payment method on file. Each invoice states the discounted per-endpoint price. TCGi may change the amount of the discount effective at the start of a renewal term on the notice required by Section 4.3. If Client’s payment method changes from ACH debit to credit card, the discount ceases beginning with the next billing period, and TCGi will provide notice under Section 4.4.

Subscriptions with total recurring monthly fees exceeding one thousand five hundred dollars ($1,500) are available only with payment by ACH debit. If Client’s total recurring monthly fee comes to exceed that amount, whether through additions under Section 3.2 or otherwise, Client will provide ACH payment credentials within fifteen (15) days of TCGi’s notice.

5. TERM, AUTO-RENEWAL, AND TERMINATION

5.1 Term. This Agreement begins on the Effective Date and continues for one (1) year (the “Initial Term”).

5.2 Auto-Renewal. The subscription automatically renews for successive one (1) year terms unless either party gives written notice of non-renewal at least sixty (60) days before the end of the then-current term. Client may opt out of auto-renewal at any time by written notice, effective at the end of the then-current term. TCGi will send Client a renewal reminder, including the renewal date, the then-applicable fees, and instructions for cancelling, at least seventy-five (75) days before each renewal date.

5.3 Termination for Cause. Either party may terminate for the other party’s material breach if not cured within thirty (30) days of written notice. Three (3) or more failures of the same or substantially similar nature occurring within any six-month period constitute a material breach, notwithstanding cure of each individual failure. TCGi may suspend services during the cure period if Client fails to pay undisputed amounts when due.

5.4 Effect of Expiration, Non-Renewal, or Termination. Upon expiration, non-renewal, or termination, Client’s access to the services will cease. If Client purports to cancel or terminate the subscription before the end of the then-current term other than because of TCGi’s uncured material breach under Section 5.3 or a termination under Section 5.5, or if TCGi terminates this Agreement because of Client’s uncured material breach, all fees payable for the remainder of the then-current term will become immediately due and no refund or credit will be provided. If Client validly terminates this Agreement because of TCGi’s uncured material breach under Section 5.3, or under Section 5.5, TCGi will refund any prepaid fees allocable to the period after the effective date of termination. At Client’s request, TCGi will delete or return all Client Data within thirty (30) days, except as required by applicable law. Any retained Client Data remains subject to Section 6 and will be securely destroyed upon expiration of the applicable retention period.

5.5 Termination Following a Security Incident. If a security incident or breach involving Client Data results from TCGi’s negligent act or omission, Client may terminate this Agreement on written notice given within thirty (30) days after Client’s receipt of the post-incident report under Section 7.3(e). Termination under this Section takes effect on the date stated in Client’s notice, and TCGi will refund prepaid fees as provided in Section 5.4. This Section is in addition to, and does not limit, Client’s rights under Section 5.3.

6. CONFIDENTIALITY

6.1 Definition and Obligations. “Confidential Information” means any non-public information disclosed by one party to the other in any form. Each party will (a) protect the other’s Confidential Information with at least reasonable care and (b) use it only to perform under this Agreement.

6.2 Survival. Confidentiality obligations survive for five (5) years after termination; provided that obligations relating to (i) attorney-client privileged communications, (ii) work product, (iii) Client Data subject to professional responsibility obligations, and (iv) personally identifiable information of Client’s clients or personnel survive indefinitely.

7. DATA OWNERSHIP, SECURITY, AND COMPLIANCE

7.1 Ownership. Client retains ownership of all data provided to or accessed by TCGi (“Client Data”). TCGi will use Client Data solely to deliver the services.

7.2 Security. TCGi will maintain administrative, technical, and physical safeguards consistent with the NIST Cybersecurity Framework. TCGi will provide Client with written confirmation of its security practices upon request. For clarity, the Lunaris platform is powered by Kaseya’s infrastructure; TCGi is not in a position to provide SOC 2 Type II audit reports or conduct penetration tests on Kaseya’s systems. Security compliance documentation available from Kaseya will be shared upon written request, subject to execution of a non-disclosure agreement.

7.3 Incident Notification and Response.

(a) Notice. TCGi will notify Client in writing within forty-eight (48) hours of becoming aware of any confirmed or reasonably suspected security incident or breach involving Client Data.

(b) Containment. TCGi will use commercially reasonable efforts to contain and remediate the incident without undue delay. Where an incident originates in infrastructure operated by a third-party provider, TCGi’s obligations under this subsection are to use commercially reasonable efforts to cause that provider to contain and remediate, and to pass through information that provider makes available.

(c) Status Updates. Until the incident is resolved, TCGi will provide Client with status updates not less often than every seventy-two (72) hours.

(d) Point of Contact. TCGi will designate a single point of contact for incident communications. Client will designate a corresponding contact during onboarding and keep it current.

(e) Post-Incident Report. Within thirty (30) days after containment, TCGi will provide Client a written summary of the incident, including its nature, the categories of Client Data involved, the remediation steps taken, and any measures adopted to prevent recurrence. The summary will be based on information reasonably available to TCGi.

(f) Cooperation. TCGi will cooperate fully with Client’s investigation and remediation and with any regulatory or individual notifications Client is required to make.

(g) Costs. Responsibility for costs arising from a security incident, including notification and remediation costs, is determined under Section 9.4 and remains subject to Sections 9.2 and 9.3.

7.4 Compliance. TCGi will comply with data protection laws applicable to TCGi in its provision of the services. Client is responsible for determining the legal and regulatory requirements applicable to Client’s business and to Client Data, and for notifying TCGi before transmitting to the services any Client Data subject to a requirement beyond those generally applicable. If Client Data processed triggers such a requirement, the parties will execute a Data Processing Addendum, Business Associate Agreement, or equivalent. Any such addendum or agreement will be incorporated into this Agreement by reference and, notwithstanding Section 12.7, will control over this Agreement to the extent of any conflict regarding the matters addressed therein.

8. INTELLECTUAL PROPERTY

8.1 TCGi IP. TCGi retains all intellectual property in its services, software, tools, and methodologies. No rights are granted to Client other than as expressly stated in this Agreement.

8.2 Client IP. Client retains all intellectual property it provides to TCGi.

9. WARRANTY, LIABILITY, AND INDEMNIFICATION

9.1 Warranty. TCGi warrants that services will be performed in a professional and workmanlike manner. EXCEPT AS EXPRESSLY STATED, TCGI DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED.

9.2 Exclusion of Damages. NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF REVENUE, PROFITS, OR DATA, EVEN IF ADVISED OF THE POSSIBILITY.

9.3 Liability Cap. To the fullest extent permitted by law, each party’s aggregate liability arising out of or relating to this Agreement will not exceed the lesser of (a) the total fees paid or payable by Client under the applicable Order for the twelve (12)-month subscription term during which the event giving rise to the claim occurred, or (b) $500,000. This cap applies regardless of the form of action and includes liability arising from confidentiality obligations, a security incident or data breach, indemnification obligations, and non-compliance with Section 7.4. The cap does not apply to (a) Client’s payment obligations, (b) a party’s gross negligence or willful misconduct, or (c) liability that cannot lawfully be limited.

9.4 Indemnification. Each party will indemnify, defend, and hold harmless the other from third-party claims arising out of its negligence or willful misconduct in connection with this Agreement. TCGi’s indemnification also covers third-party claims arising from unauthorized access to or disclosure of Client Data caused by TCGi’s negligent acts or omissions. Nothing in this Section is intended to assume, and neither party assumes by this Section, any liability that it would not have in the absence of this Agreement. All liability under this Section 9.4 is subject to the exclusions and limitations in Sections 9.2 and 9.3.

10. SUBCONTRACTORS

10.1 Use. TCGi may use third-party technology providers and subcontractors in providing the Services. TCGi remains responsible for performing its obligations under this Agreement, subject in all respects to the warranties, exclusions and limitations of liability set forth herein.

10.2 Prohibited. TCGi will not subcontract to any entity (a) subject to U.S. OFAC sanctions or (b) located in a jurisdiction subject to U.S. comprehensive sanctions, without Client’s prior written consent.

11. GOVERNING LAW AND DISPUTE RESOLUTION

11.1 Governing Law. This Agreement is governed by the laws of the State of New Jersey, without regard to its conflict-of-law principles, consistent with TCGi’s principal place of business in Iselin, New Jersey.

11.2 Dispute Resolution. Any dispute will be resolved through binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules. Arbitration will be conducted virtually or, if an in-person hearing is required, in Middlesex County, New Jersey. Either party may seek emergency injunctive or equitable relief in a court of competent jurisdiction in New Jersey. EACH PARTY AGREES THAT ANY ARBITRATION OR OTHER PROCEEDING WILL BE CONDUCTED ONLY ON AN INDIVIDUAL BASIS AND NOT AS A CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE ACTION. Neither party may combine or consolidate a claim with the claim of any other person or entity without the written consent of all parties to the affected proceedings. To the fullest extent permitted by law, each party waives any right to participate in or recover relief through a class, collective, consolidated, or representative action.

Notwithstanding Section 12.6, if a court of competent jurisdiction finally determines that the waiver of class, collective, consolidated, or representative proceedings in this Section 11.2 is unenforceable with respect to a particular claim, that claim, and only that claim, shall be severed from arbitration and resolved exclusively in a state or federal court of competent jurisdiction in New Jersey. Under no circumstances shall the arbitrator have authority to conduct class, collective, consolidated, or representative arbitration absent the written agreement of both parties after the dispute arises.

Either party may bring an individual claim in a small claims court of competent jurisdiction in lieu of arbitration, provided the claim remains in that court and on an individual basis.

For any arbitration in which the amount in controversy is less than seventy-five thousand dollars ($75,000), TCGi will pay the portion of the AAA filing, administrative, and arbitrator fees that exceeds the amount Client would have paid to file the same claim in a New Jersey state court of competent jurisdiction. Each party otherwise bears its own attorneys’ fees and costs.

12. GENERAL

12.1 Entire Agreement. This Agreement, including the Order and any documents incorporated by reference, constitutes the entire agreement between the parties and supersedes all prior agreements on the same subject matter.

12.2 Updates to These Terms. TCGi may update this Agreement from time to time. Updates do not apply to Client’s then-current term. TCGi will provide written notice of updated terms at least ninety (90) days before they take effect, and updated terms apply beginning with Client’s next renewal term. If Client does not agree to updated terms, Client may decline renewal under Section 5.2. Each version of this Agreement will be identified by version number and effective date, and TCGi will retain each version and Client’s acceptance records.

12.3 Assignment. Neither party may assign this Agreement without the other’s prior written consent, except in connection with a merger, acquisition, or sale of substantially all assets.

12.4 Force Majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control, including acts of God, natural disasters, pandemics, and government actions.

12.5 Notices. Notices must be in writing. Notices to Client may be delivered by email to the primary contact email in the Order and are effective when sent. Notices to TCGi must be delivered by email to notices@technologyconcepts.com or by certified mail or overnight courier to TCGi’s address above. Client is responsible for keeping its contact information current.

12.6 No Waiver; Severability. Failure to enforce a provision is not a waiver. If any provision is held unenforceable, it will be modified to the minimum extent necessary and the remainder will continue in effect.

12.7 Order of Precedence. In any conflict, this Agreement controls over the Order unless the Order expressly references the specific section being superseded. Notwithstanding the foregoing, in the event of any conflict between this Agreement and a Business Associate Agreement, Data Processing Addendum, or equivalent data protection agreement executed by the parties, the terms of such agreement will control solely with respect to the privacy, security, and processing of Protected Health Information or personal data governed thereby. No such agreement will be construed to modify Sections 9.2 or 9.3 unless it expressly states that it does so.

ACCEPTANCE: Acceptance of this Agreement occurs electronically at checkout as described in Section 1.1. No signature is required.