Legal – stell.ai

Legal

Data Processing Agreement

Version 1.1 date: 25.05.2026

This Data Processing Agreement (the "DPA") is entered into between Stellai AS, a company incorporated under the laws of Norway with company number 925 053 066 and registered office at Tordenskjolds gate 9, 4612 Kristiansand, Norway ("Stellai" or the "Processor"), and the customer identified in the given agreemant/s to which this DPA is incorporated by reference (the "Customer" or the "Controller"). Stellai and the Customer are each a "Party" and together the "Parties".

This DPA governs the Processor's processing of Personal Data on behalf of the Controller in the course of delivering Stellai´s services (the "Services"). The Services are described in the agreemants and the Product Specification published at stell.ai/legal/product.

This DPA is designed to satisfy Article 28 of Regulation (EU) 2016/679 (the "GDPR"), the UK GDPR, and the Norwegian Personal Data Act, and forms an integrale part of the commercial agreement between the Parties. In the event of any conflict between this DPA and the underlying commercial agreement regarding the processing of Personal Data, this DPA shall prevail.

Table of Contents

1. Definitions

2. Scope and Roles of the Parties

3. Subject Matter, Nature and Purpose of the Processing

4. Controller's Obligations

5. Processor's Obligations

6. Security of Processing

7. Sub-processors

8. International Transfers

9. Data Subject Rights

10. Personal Data Breaches

11. Audits and Inspections

12. Return or Deletion of Personal Data

13. Liability, Term and Governing Law

A. Appendix A — Processing Details

B. Appendix B — Sub-processors

C. Appendix C — Security Measures

1. Definitions

Capitalised terms used in this DPA shall have the meanings given below. Terms not defined here shall have the meaning given in the GDPR.

"Applicable Data Protection Law" means the GDPR, the UK GDPR, the Norwegian Personal Data Act, and any other applicable data protection or privacy law.
"Controller", "Processor", "Data Subject", "Personal Data", "Processing", "Sub-processor", "Personal Data Breach" and "Supervisory Authority" shall have the meanings given in the GDPR.
"Customer Personal Data" means any Personal Data Processed by Stellai on behalf of the Customer under the Services, as further described in Appendix A.
"Order Form/agreemants" means the commercial document executed between the Parties that references this DPA.
"Services" means all services delivered by Stellai, consisting of AI-based detection software, edge hardware, monitoring, and related services as set out in the Order Form/agreemant
"Sub-processor" means any third party appointed by Stellai to Process Customer Data on its behalf.

2. Scope and Roles of the Parties

2.1 The Customer is the Controller and Stellai is the Processor with respect to the Processing of Customer Personal Data under this DPA.

2.2 This DPA applies to all Processing of Customer Personal Data carried out by Stellai in connection with the provision of the Services.

2.3 Each Party shall comply with its respective obligations under Applicable Data Protection Law. Neither Party may require the other to act in breach of Applicable Data Protection Law.

3. Subject Matter, Nature and Purpose of the Processing

3.1 The subject matter, nature, purpose, categories of Personal Data, categories of Data Subjects, and duration of the Processing are set out in Appendix A.

3.2 Stellai Processes Customer Personal Data only for the following purposes: (i) to deliver, maintain, monitor and support the Services; (ii) to detect hazardous or non-compliant objects in the Customer's operations and provide alerts and documentation to the Customer; (iii) to improve the accuracy and performance of the AI detection models, using anonymised data only; and (iv) to comply with documented instructions from the Customer or with legal obligations applicable to Stellai.

3.3 Stellai shall not Process Customer Personal Data for any purpose other than those described in Section 3.2, or as documented in writing by the Customer.

4. Controller's Obligations

4.1 The Customer shall establish and maintain a lawful basis under Article 6 of the GDPR for the Processing of Customer Personal Data, including providing any required information to Data Subjects and obtaining any required consents.

4.2 The Customer shall ensure that its instructions to Stellai comply with Applicable Data Protection Law and shall be responsible for the accuracy, quality, and legality of Customer Personal Data and the means by which the Customer acquired such data.

4.3 The Customer acknowledges that Stellais solution is installed in environments where individuals may incidentally appear on camera and that the Customer is responsible for providing appropriate notices, signage, and information in accordance withApplicable Data Protection Law.

5. Processor's Obligations

5.1 Stellai shall Process Customer Personal Data only on documented instructions from the Customer. This DPA, and the Services documentation constitute the Customer's complete and final instructions at the time of execution. Additional or alternative instructions must be agreed in writing.

5.2 Stellai shall promptly inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

5.3 Stellai shall ensure that all personnel authorised to Process Customer Personal Data are bound by appropriate confidentiality obligations, whether contractual or statutory, and that access is granted strictly on a need-to-know basis.

5.4 Stellai shall assist the Customer in fulfilling its obligations under Articles 32 to 36 of the GDPR, including providing reasonable information and documentation required for data protection impact assessments and consultations with Supervisory Authorities.

6. Security of Processing

6.1 Stellai shall implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful Processing, accidental loss, destruction, damage, alteration, or disclosure, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risk to the rights and freedoms of Data Subjects.

6.2 The current technical and organisational measures are set out in Appendix C. Stellai may update these measures from time to time, provided the level of protection is not materially reduced.

6.3 Stellai shall test, assess and evaluate the effectiveness of its security measures on a regular basis and shall maintain records of such assessments.

7. Sub-processors

7.1 The Customer grants Stellai general authorisation to engage Sub-processors to Process Customer Personal Data, subject to the terms of this Section 7. The current list of authorised Sub-processors is set out in Appendix B and maintained at stell.ai/legal/subprocessors.

7.2 Stellai shall impose on each Sub-processor, by written contract, data protection obligations substantially equivalent to those set out in this DPA. Stellai remains fully liable to the Customer for any failure by its Sub-processors to comply with those obligations.

7.3 Stellai shall give the Customer at least seven (7) days' prior written notice of any intended addition or replacement of Sub-processors. The Customer may object to such change on reasonable data protection grounds within the notice period. If the Parties are unable to resolve the objection, the Customer may terminate the affected Services with immediate effect.

8. International Transfers

8.1 Stellai Processes and stores Customer Personal Data primarily within the European Union and the European Economic Area (EU/EEA).

8.2 Customer Personal Data may transit via the United States in the course of certain AI inference operations, but shall not be stored outside the EU/EEA by the Services or its Sub-processors.

8.3 Where any transfer of Customer Personal Data to a country outside the EU/EEA does occur, Stellai shall ensure that such transfer is made in accordance with Chapter V of the GDPR, using an appropriate transfer mechanism (such as the EU Commission's Standard Contractual Clauses or an adequacy decision).

9. Data Subject Rights

9.1 Taking into account the nature of the Processing, Stellai shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR.

9.2 If Stellai receives a request directly from a Data Subject concerning Customer Personal Data, Stellai shall promptly forward the request to the Customer and shall not respond directly, except as required by law or as instructed by the Customer.

9.3 The Parties acknowledge that the Services are designed around data minimisation, including automatic and irreversible face anonymisation prior to storage. As a result, certain Data Subject requests — in particular access requests — may not be capable of being fulfilled, as no identifying information is retained. Stellai shall inform the Customer of such limitations on request.

10. Personal Data Breaches

10.1 Stellai shall notify the Customer without undue delay, and in any event within 24 hours of becoming aware, of any confirmed Personal Data Breach affecting Customer Personal Data.

10.2 Such notification shall include, to the extent known: the nature of the breach; the categories and approximate number of affected Data Subjects and records; the likely consequences; and the measures taken or proposed to address and mitigate the breach.

10.3 Stellai shall cooperate with the Customer and provide reasonable assistance in the Customer's fulfilment of its own notification obligations under Articles 33 and 34 of the GDPR.

11. Audits and Inspections

11.1 Stellai shall make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR.

11.2 The Customer may conduct audits of Stellai's compliance with this DPA no more than once per calendar year, on at least ten (10) business days' prior written notice. Shorter notice may apply where an audit is triggered by a confirmed or suspected Personal Data Breach, or at the direction of a Supervisory Authority.

11.3 Audits may be carried out through documentation review, written questionnaires, remote interviews, system demonstrations or, where reasonably necessary, on-site inspections. Stellai may satisfy its audit obligations by providing an up-to-date independent certification or assurance report (such as ISO/IEC 27001 or SOC 2 Type II), unless the Customer reasonably demonstrates that such reports are insufficient for its specific compliance purposes.

11.4 Audits shall be conducted in a manner that does not unreasonably disrupt Stellai's operations, and the Customer shall bear the costs of routine audits. Where an audit identifies a material breach of this DPA by Stellai, Stellai shall bear its own internal costs and the reasonable external costs of the audit.

12. Return or Deletion of Personal Data

12.1 Upon termination or expiry of the Services, Stellai shall, at the Customer's choice, delete or return all Customer Personal Data and delete existing copies, unless Union or Member State law requires continued storage.

12.2 Stellai shall confirm in writing, on request, that deletion has been completed. Backup copies shall be deleted in accordance with Stellai's standard backup retention cycle.

12.3 Default retention periods during the term of the Services are set out in Appendix C. The Customer may request in writing to modify these periods, subject to operational feasibility.

13. Liability, Term and Governing Law

13.1 This DPA shall take effect on the effective date of the Order Form and shall remain in force for as long as Stellai Processes Customer Personal Data in connection with the Services.

13.2 Each Party's liability under or in connection with this DPA shall be subject to the liability provisions of the underlying commercial agreement between the Parties, except where mandatory provisions of Applicable Data Protection Law provide otherwise.

13.3 This DPA shall be governed by the laws of Norway, without regard to conflict of law principles. Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the ordinary courts of Norway, with Agder District Court as venue, unless otherwise required by Applicable Data Protection Law.

13.4

(a) Stellai may amend this DPA from time to time to reflect changes in Applicable Data Protection Law, changes to Sub-processors, improvements to security measures, or other reasonable operational updates, provided that no such amendment shall materially reduce the level of protection for Customer Personal Data.

(b) Stellai shall notify the Customer in writing of any such amendment at least fourteen (14) days before the effective date. If the Customer does not object in writing within the notice period, the amendment shall be deemed accepted and shall take effect on the stated effective date. The current version of this DPA, together with its version history, is maintained at stell.ai/legal/dpa.

(c) If the Customer objects on reasonable data protection grounds within the notice period, the Parties shall negotiate in good faith to agree on a mutually acceptable alternative. If the Parties are unable to reach agreement within thirty (30) days of the objection, the Customer may terminate the affected Services with effect from the proposed effective date of the amendment, without further liability on either side in relation to such termination.

(d) Notwithstanding paragraphs (a) to (c), any amendment that modifies Appendix A (Processing Details) — including the subject matter, nature, purpose, categories of Personal Data, categories of Data Subjects, or duration of the Processing — shall require the Customer's express written agreement and shall not be subject to deemed acceptance. Amendments to the list of authorised Sub-processors are governed exclusively by Section 7.

Appendix A — Processing Details

A.1 Subject matter and nature of the Processing

Stellai provides the IdentifAI service to the Customer, consisting of real-time AI-based detection of hazardous or non-compliant objects in material handling and waste sorting operations. The Processing consists of capturing live video at the Customer's installation sites, running AI inference on an edge device, generating event records where the AI model detects a potential hazard, applying irreversible face anonymisation, and storing event records in the Customer's dedicated environment.

A.2 Purposes of the Processing

Delivery, operation, monitoring and support of the Services.
Detection of hazardous or non-compliant objects and generation of operator alerts and documentation.
Continuous improvement of the AI detection models using anonymised data.
Remote troubleshooting, optimisation and technical support via secure VPN.

A.3 Categories of Personal Data

Live video frames containing individuals — processed in volatile memory (RAM) only and not stored.
Event-based cropped images in which faces have been automatically and irreversibly anonymised prior to storage.
Detection metadata: timestamps, object classifications, detection confidence scores, device identifiers.
System logs relating to access, detections and technical events.
Remote support metadata: IP addresses and device identifiers, where remote support sessions are used.

A.4 Categories of Data Subjects

Individuals who appear within the camera's field of view at the Customer's installation sites, typically employees, visitors, contractors or members of the public. All faces are automatically anonymised prior to storage.

A.5 Duration of the Processing

Processing is carried out continuously for the duration of the Services. Retention periods for each category of data are set out in Appendix C.1.

Appendix B — Sub-processors

The following Sub-processors are authorised by the Customer on the effective date of this DPA:

Sub-processor

Microsoft Azure (Ireland)

Purpose

Cloud hosting, databases, storage

Location of processing

One Microsoft Place, Dublin

Country

Ireland (EU)

Sub-processor

Microsoft Azure (Norway)

Purpose

Cloud hosting, regional processing

Location of processing

Dronning Eufemias gate 71, Oslo

Country

Norway (EEA)

Sub-processor

Alvir AS

Purpose

Frontend application development and maintenance

Location of processing

Sinsenterrassen 2B, Oslo

Country

Norway (EEA)

The current list of authorised Sub-processors, including any additions or replacements, is maintained at stell.ai/legal/subprocessors. Stellai shall notify the Customer at least seven (7) days in advance of any change to the Sub-processor list in accordance with Section 7.3.

Appendix C — Security Measures

Stellai implements the following categories of technical and organisational measures to protect Customer Personal Data. For operational security reasons, detailed internal policy content is not disclosed to third parties; summaries and independent assurance reports are available on request subject to confidentiality undertakings.

C.1 Data retention

Data category

Live video frames.

Retention period

Not stored. Processed in volatile memory (RAM) only.

Data category

Event images (face-blurred cropped stills).

Retention period

Duration of Services plus 12 mounths, to allow report downlowds for end-of-year audits and reports.

Data category

Detection metadata (timestamp, object class, confidence, device ID).

Retention period

Duration of Services plus 12 mounths, to allow report downlowds for end-of-year audits and reports.

Data category

Access logs and audit trails.

Retention period

12 months from creation.

Data category

Remote support logs.

Retention period

6 months from session close.

Data category

Training data (fully anonymised samples).

Retention period

For the duration of the Services, or as long as required for model improvement.

C.2 Data minimisation and anonymisation

Live video is not stored. Analysis occurs in volatile memory on the edge device.
Automatic, irreversible face blurring is applied to any event image prior to storage or display.
Only event-specific cropped images and the minimum metadata required for detection are retained.

C.3 Encryption and network security

Transport Layer Security (TLS 1.2 or higher) for all data in transit.
Encryption at rest for all stored event data, metadata and logs.
Virtual Private Network (VPN) with end-to-end encryption for remote support.
Network segmentation between edge, backend and management environments.

C.4 Access control and identity management

Role-based access control with least-privilege enforcement.
Multi-factor authentication for all administrative access.
Quarterly access reviews and prompt revocation on role change or termination.
Structured audit logging of all access to Customer environments.

C.5 System hardening and integrity

CIS Level 2 hardening baseline applied to edge devices.
Continuous vulnerability monitoring and regular patching of operating systems and dependencies.
Code signing and integrity verification for edge firmware updates.

C.6 Physical and environmental security

Primary Processing in EU/EEA data centres operated by certified Sub-processors.
Physical security, redundancy and environmental controls managed by the data centre operator (e.g., Microsoft Azure) under applicable certifications (ISO/IEC 27001, SOC 2).

C.7 Organisational measures

Confidentiality obligations for all personnel with access to Customer Personal Data.
Mandatory security awareness training on induction and annually thereafter.
Documented incident response procedures with defined escalation paths.
Documented change management, backup, and disaster recovery procedures.
Annual review of technical and organisational measures by Stellai management.

C.8 Testing and assurance

Routine security testing and evaluation of systems and infrastructure.
Regular testing of anonymisation, logging and access control functions.
Independent assurance reports (where available) provided on request under confidentiality.

Service Level Agreement

Version 1.1 — Last updated 22 April 2026

This Service Level Agreement (the "SLA") is issued by Stellai AS, company number 925 053 066, Tordenskjolds gate 9, 4612 Kristiansand, Norway ("Stellai"), and applies to all Stellai services delivered under an Order Form or framework agreement that incorporates this SLA by reference.

This SLA sets out service levels, support commitments, and remedies. It is designed to be read together with the applicable agreement and the Data Processing Agreement at stell.ai/legal/dpa. In the event of conflict, the order in Section 13 applies.

Scope and Applicability
Definitions
Support Hours and Channels
Severity Classification
Response Time Commitments
Uptime Commitment
Maintenance Windows
Remedy for Sustained Service Failure
Customer Responsibilities
Exclusions and Limitations
Reporting and Escalation
Changes to this SLA
Order of Precedence and Governing Law

1. Scope and Applicability

1.1 This SLA applies to production use of the Services during an active subscription term. It does not apply to trial accounts, pilot deployments, or Services designated as "beta" or "preview".

1.2 Commitments are provided with respect to the Stellai IdentifAI Units deployed under active agreements. The calculation of service levels excludes unavailability attributable to factors outside Stellai's reasonable control, including those in Section 10.

2. Definitions

"IdentifAI Unit" — one complete deployment of hardware, software, AI models, monitoring and standard support, installed at a single Installation Site.
"Business Day" — any day other than Saturday, Sunday, or a Norwegian public holiday.
"First Response" — Stellai's initial acknowledgement of a support request. It does not mean resolution.
"Monthly Uptime" — percentage of time during a calendar month that the IdentifAI Units are operational, excluding Permitted Downtime.
"Business Hours" — 08:00–16:00 Europe/Oslo time, Monday–Friday, excluding Norwegian public holidays.
"Permitted Downtime" — downtime from scheduled maintenance, emergency maintenance, force majeure, or causes outside Stellai's reasonable control.

3. Support Hours and Channels

3.1 Support is provided during Business Hours. Requests submitted outside Business Hours are treated as received at the start of the next Business Day.

3.2 Requests shall be submitted by email to Kristoffer.Sand@stell.ai or via any ticketing system made available by Stellai.

3.3 Stellai does not provide 24/7 support, on-call services, or telephone hotlines as part of the standard Services.

4. Severity Classification

Each request is classified on receipt. Stellai may reclassify based on new information.

Severity	Description	Example
P1 Critical	Complete unavailability of the Stellai backend; no workaround available.	Cloud dashboard fully down.
P2 High	Major degradation of a core feature; no reasonable workaround.	Event images not generated.
P3 Medium	Limited or intermittent issue; reasonable workaround available.	Delayed dashboard refresh.
P4 Low	Minor issue, cosmetic defect, general enquiry, or feature request.	Typo in report; feature request.

5. Response Time Commitments

Severity	First Response Target
P1 Critical	Within 1 business day
P2 High	Within 3 business days
P3 Medium	Within 10 business days
P4 Low	Best effort; addressed via backlog

First Response means acknowledgement and start of investigation — not resolution. Resolution times are not guaranteed.

6. Uptime Commitment

Stellai shall use commercially reasonable efforts to achieve Monthly Uptime of at least 95%, measured across IdentifAI Units deployed under active Order Forms.

Calculated as: (total minutes − Permitted Downtime − actual Unit downtime attributable to Stellai) ÷ (total minutes − Permitted Downtime). Excludes unavailability from factors controlled by the Customer (power, network, environment). On reasonable request (max once per quarter), Stellai will provide a Unit-level uptime summary.

7. Maintenance Windows

Scheduled maintenance takes place outside Business Hours where practicable, with at least 72 hours' notice. Emergency maintenance may occur at any time. Both constitute Permitted Downtime and are excluded from Monthly Uptime calculations.

8. Remedy for Sustained Service Failure

No service credits are payable. Commitments are service-level targets, not guarantees. The Customer's sole remedy is termination on 30 days' written notice if either trigger is met:

Trigger	Threshold
Sustained failure	Monthly Uptime below 90% for 3 consecutive calendar months
Repeated failure	Monthly Uptime below 95% in 4+ months within any rolling 6-month period

On termination, the Customer is entitled to a pro-rata refund of prepaid fees for the period after the effective date.

9. Customer Responsibilities

The Customer shall ensure Installation Sites comply with technical requirements (power, environment, lighting, network, access), shall not modify IdentifAI hardware without prior written consent, and shall provide personnel to support coordination and troubleshooting. Unauthorised modifications void this SLA for the affected Unit.

10. Exclusions and Limitations

SLA commitments do not apply to issues caused by: scheduled or emergency maintenance; force majeure; Customer infrastructure failures; unauthorised modifications; third-party service failures; use in breach of the Order Form or applicable law; or beta/preview features. Stellai does not warrant that the Services will detect all hazardous objects. IdentifAI is a decision-support tool and does not replace human judgement.

11. Reporting and Escalation

Support requests shall include: issue description, observed and expected behaviour, affected Unit, time, and supporting information. Escalations are acknowledged within 1 Business Day and receive a substantive response within 5 Business Days.

12. Changes to this SLA

Stellai may amend this SLA with 14 days' written notice. Silence during the notice period constitutes acceptance. Amendments that materially reduce service levels require the Customer's express written agreement and are not subject to deemed acceptance. The Customer may terminate if no agreement is reached within 30 days of a written objection.

13. Order of Precedence and Governing Law

In case of conflict: Order Form prevails, then governing framework agreement, then this SLA. Governed by Norwegian law. Disputes are subject to the exclusive jurisdiction of the ordinary courts of Norway, with Agder District Court as venue.

General Terms

Version 1.1 — Last updated 21 April 2026

These General Terms (the "Terms") are issued by Stellai AS, company number 925 053 066, Tordenskjolds gate 9, 4612 Kristiansand, Norway ("Stellai"), and govern the delivery and use of the IdentifAI service (the "Services") by customers (each a "Customer") under an Order Form or framework agreement that incorporates these Terms by reference.

These Terms are designed to be read together with the Service Level Agreement at stell.ai/legal/sla (the "SLA"), the Data Processing Agreement at stell.ai/legal/dpa (the "DPA"), and the applicable Order Form. Together, these documents constitute the complete contractual framework between the Parties. The order of precedence in the event of conflict is set out in Section 16.

Scope and Applicability
Definitions
Services and Licence
Customer Obligations
Fees, Invoicing and Payment
Data Rights and Service Improvement
Intellectual Property
Confidentiality
Warranties and Disclaimers
Limitation of Liability
Indemnification
Term, Renewal and Termination
Force Majeure
Assignment and Subcontracting
Changes to these Terms
Order of Precedence and Governing Law

1. Scope and Applicability

1.1 These Terms apply to the production use of the Services by the Customer during an active subscription term under an Order Form or other applicable agreements that references these Terms. They do not apply to trial accounts, pilot deployments, or features expressly designated as "beta" or "preview", which are provided on an "as is" basis.

1.2 These Terms form part of a layered contractual framework consisting of the Order Form, customer agreement, or any signed framework agreement, these Terms, the SLA and the DPA. The Customer acknowledges that by executing an agreement that references these Terms, the Customer accepts these Terms, the SLA and the DPA as in effect on the Effective Date of that agreement.

2. Definitions

"Applicable Law" — any law, regulation, rule or binding order applicable to a Party's performance under these Terms.
"Business Day" — any day other than Saturday, Sunday, or a public holiday observed in Norway.
"Customer Data" — any data or content submitted to, or processed by, the Services on behalf of the Customer.
"Effective Date" — the date on which the Agreement is executed by the Parties, or such later date as specified in said Agreement.
"Fees" — the subscription fees and any other charges payable under the Agreement.
"IdentifAI" — the Stellai hardware-integrated artificial intelligence solution for real-time detection of hazardous or non-compliant objects in material handling and waste sorting, including all associated hardware, software, AI models and services.
"IdentifAI Unit" — one complete deployment of hardware, software, AI models, monitoring and standard support, installed at a single Installation Site under an Agreement.
"Installation Site" — a physical location at which an IdentifAI Unit is installed, as identified in the Agreement.
"Intellectual Property Rights" — all intellectual property rights, including patents, copyrights, database rights, trademarks, trade secrets, know-how and any other proprietary rights, whether registered or unregistered.
"Order Form or Agreement" — the commercial ordering document executed between the Parties that references these Terms.
"Subscription Term" — the initial period and any renewal periods during which the Services are provided under an Order Form or Agreement, as set out in Section 12.

3. Services and Licence

3.1 Stellai shall provide the Services as described in the Agreement, these Terms and the SLA, as a subscription-based Hardware-as-a-Service (HaaS) and Software-as-a-Service (SaaS) solution.

3.2 Subject to the Customer's continued compliance with these Terms and payment of applicable Fees, Stellai grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable right to use the Services for the Customer's internal business purposes during the Subscription Term.

3.3 The Customer shall not, and shall not permit any third party to: (i) copy, modify or create derivative works of the Services; (ii) reverse engineer or decompile the Services; (iii) remove proprietary notices; (iv) use the Services to develop a competing product; (v) sublicense, rent, sell or otherwise commercially exploit the Services; or (vi) use the Services in breach of Applicable Law or these Terms.

3.4 Ownership of Hardware remains with Stellai. Hardware is provided on a lease basis for the duration of the Subscription Term. Risk of loss or damage to Hardware transfers to the Customer upon installation and remains with the Customer during the Subscription Term, subject to normal wear and tear.

4. Customer Obligations

4.1 The Customer shall use the Services only for its internal business purposes and in accordance with these Terms, the Order Form, the SLA, the DPA and all Applicable Law.

4.2 The Customer shall: (i) comply with Stellai's technical, operational and safety requirements for the Installation Sites; (ii) provide adequate power supply, network connectivity and environmental conditions; (iii) not modify, relocate or tamper with IdentifAI Units without prior written consent; (iv) maintain appropriate access controls and promptly notify Stellai of any suspected security incident; and (v) be responsible for the acts and omissions of its personnel and any third party accessing the Services through the Customer's credentials.

4.3 The Customer shall ensure it has established a lawful basis for the processing of Personal Data by the Services, as further described in the DPA.

5. Fees, Invoicing and Payment

5.1 Fees are set out in the Order Forms and Agreements. All Fees are stated exclusive of VAT and any other applicable taxes or duties, which shall be payable by the Customer in addition to the Fees.

5.2 Fees are invoiced quarterly in advance as standard, or annually in advance upon the Customer's written request. Payment term is fourteen (14) days net from invoice date, unless a different term is specified in the Order Form.

5.3 Overdue amounts shall bear interest at the rate set out in the Norwegian Late Payment Interest Act (forsinkelsesrenteloven) from the due date until paid. Reasonable costs of recovery shall be payable by the Customer.

5.4 Stellai may adjust Fees annually in accordance with changes in the Norwegian Consumer Price Index (CPI), limited to the percentage change in CPI during the preceding twelve (12) months. Such adjustment takes effect no earlier than twelve (12) months after the Subscription Term start date for the affected Unit and does not apply retroactively.

5.5 If the Customer fails to pay any undisputed amount when due and does not remedy the default within fifteen (15) days of written notice, Stellai may suspend the Services until the overdue amount is paid. Suspension does not relieve the Customer of its obligation to pay Fees accrued during the Subscription Term.

6. Data Rights and Service Improvement

6.1 Stellai may process, retain, aggregate and anonymise any data generated through use of IdentifAI — including detection metadata, anonymised event images, system logs and operational data — for the purpose of: (i) delivering, maintaining and supporting the Services; (ii) training, evaluating and developing AI models and products; (iii) generating aggregated insights and benchmarks; and (iv) internal research and development.

6.2 Once data has been anonymised such that no individual Data Subject and no specific Customer or Installation Site can be identified, such data shall be deemed Stellai's data and may be used, retained and disclosed by Stellai without restriction, including after termination of the Services.

6.3 Stellai shall not disclose any identifiable Customer Personal Data or Customer-specific operational data to third parties, except as permitted under the DPA or as required by Applicable Law.

7. Intellectual Property

7.1 All Intellectual Property Rights in and to the Services — including Hardware design, Software, AI models, algorithms, model weights, documentation and any derivatives — are and shall remain the exclusive property of Stellai or its licensors. No rights are granted to the Customer except as expressly set out in these Terms.

7.2 If the Customer provides any suggestions, comments or feedback relating to the Services, the Customer grants Stellai a perpetual, worldwide, royalty-free, irrevocable licence to use and incorporate such feedback into the Services and any other Stellai products, without restriction.

7.3 The Customer shall not use Stellai's trade marks, logos or brand names without prior written consent, except to identify Stellai as the provider of the Services in the ordinary course of business.

8. Confidentiality

8.1 Each Party (the "Receiving Party") shall keep confidential all non-public information disclosed by the other Party (the "Disclosing Party") that is marked as confidential or that would reasonably be understood to be confidential given its nature ("Confidential Information").

8.2 The Receiving Party shall: (i) use Confidential Information solely for the purpose of performing its obligations under these Terms; (ii) protect it using at least the same degree of care as its own confidential information, and in no event less than reasonable care; and (iii) not disclose it to any third party except to its employees, contractors and advisors who have a need to know and are bound by equivalent confidentiality obligations.

8.3 Confidentiality obligations do not apply to information that: (i) is or becomes publicly available through no breach of these Terms; (ii) was rightfully known to the Receiving Party prior to disclosure; (iii) is rightfully received from a third party without restriction; or (iv) is independently developed without reference to the Disclosing Party's Confidential Information. Disclosure required by Applicable Law is permitted with prompt notice where lawful.

8.4 These confidentiality obligations survive termination or expiry of these Terms for five (5) years.

9. Warranties and Disclaimers

9.1 Each Party warrants that it has the legal capacity and authority to enter into and perform its obligations under these Terms.

9.2 The Services are provided "as is" and "as available". Stellai does not warrant that the Services will be uninterrupted, error-free, or will meet any specific performance or accuracy thresholds.

9.3 IdentifAI is a decision-support tool intended to supplement, not replace, the Customer's own safety procedures, personnel and operational responsibility. Stellai makes no warranty regarding the specific detection rate, false-positive rate, or accuracy of the AI models, and the Customer acknowledges that AI-based detection is inherently probabilistic. The Customer remains solely responsible for operational decisions taken in reliance on outputs generated by the Services.

9.4 To the maximum extent permitted by Applicable Law, Stellai disclaims all other warranties, whether express, implied, statutory or otherwise, including any warranty of merchantability, fitness for a particular purpose, or non-infringement.

10. Limitation of Liability

10.1 To the maximum extent permitted by Applicable Law, each Party's total aggregate liability arising out of or in connection with these Terms, whether in contract, tort or otherwise, shall not exceed the total Fees paid by the Customer during the twelve (12) months immediately preceding the event giving rise to the liability.

10.2 To the maximum extent permitted by Applicable Law, neither Party shall be liable to the other for any indirect, incidental, consequential, special or punitive damages, or for any loss of profits, revenue, anticipated savings, business opportunities, goodwill, reputation, or data, whether or not foreseeable.

10.3 The limitations in this Section 10 do not apply to: (i) obligations to pay Fees; (ii) liability for fraud, wilful misconduct or gross negligence; (iii) liability for death or personal injury caused by negligence; (iv) indemnification obligations under Section 11; or (v) any liability that cannot be limited under Applicable Law.

11. Indemnification

11.1 Stellai shall defend, indemnify and hold harmless the Customer from any third-party claim alleging that the Services infringe such third party's Intellectual Property Rights, and shall pay any damages finally awarded, provided that the Customer: (i) gives Stellai prompt written notice; (ii) grants Stellai sole control over the defence; and (iii) provides reasonable cooperation at Stellai's expense.

11.2 Stellai's indemnification obligation does not apply to claims from: (i) modifications by or on behalf of the Customer; (ii) combination with products not provided by Stellai; (iii) use in breach of these Terms; or (iv) use of a superseded version where the infringement would have been avoided by use of the current version.

11.3 If the Services become the subject of an infringement claim, Stellai may: (i) procure the right to continue using the Services; (ii) modify the Services to make them non-infringing; or (iii) terminate the affected Services and refund prepaid Fees. These remedies are the Customer's sole and exclusive remedies for any infringement claim.

11.4 The Customer shall defend, indemnify and hold harmless Stellai from any third-party claim arising from: (i) the Customer's breach of these Terms, the SLA or the DPA; (ii) use of the Services in breach of Applicable Law; (iii) the Customer's operational decisions; or (iv) Customer Data or Customer-provided content.

12. Term, Renewal and Termination

12.1 These Terms take effect on the Effective Date and remain in force for the duration of any Order Form that incorporates them.

12.2 Unless otherwise agreed, each IdentifAI Unit is subject to a minimum binding Subscription Term of thirty-six (36) months from the subscription start date.

12.3 Upon expiry of the initial Subscription Term, the subscription automatically renews for successive periods of twenty-four (24) months, unless either Party gives written notice of non-renewal no later than six (6) months prior to the expiry of the then-current Subscription Term.

12.4 Either Party may terminate immediately by written notice if the other Party: (i) commits a material breach and fails to cure within thirty (30) days of written notice; or (ii) becomes insolvent, enters liquidation, or is unable to pay its debts as they fall due.

12.5 Upon termination or expiry: (i) the Customer's right to use the Services shall cease; (ii) the Customer shall return Hardware per Stellai's instructions; (iii) each Party shall return or destroy the other's Confidential Information; and (iv) Personal Data shall be handled in accordance with the DPA. Sections 6.2, 7, 8, 10, 11, 16 and accrued payment obligations survive termination.

12.6 Early termination by the Customer of a binding Subscription Term other than under Section 12.4 shall entitle Stellai to payment of the remaining Fees for that Subscription Term as agreed compensation for Stellai's investment in Hardware and deployment.

13. Force Majeure

13.1 Neither Party shall be liable for any failure or delay in performance to the extent caused by events beyond its reasonable control, including acts of God, natural disasters, war, terrorism, strikes, epidemics, governmental action, or failures of third-party infrastructure ("Force Majeure Events"). Payment obligations for Services already delivered are not excused.

13.2 The affected Party shall promptly notify the other Party, use commercially reasonable efforts to mitigate the impact, and resume performance as soon as reasonably practicable.

13.3 If a Force Majeure Event continues for more than ninety (90) consecutive days, either Party may terminate the affected Services by written notice without further liability.

14. Assignment and Subcontracting

14.1 The Customer may not assign, transfer or novate these Terms or any Agreements without Stellai's prior written consent, such consent not to be unreasonably withheld.

14.2 Stellai may assign, transfer or novate these Terms: (i) to an affiliate; or (ii) in connection with a merger, acquisition or sale of all or substantially all of its assets or business, in each case on written notice to the Customer.

14.3 Stellai may engage subcontractors to perform all or part of its obligations, provided that Stellai remains responsible for performance. Engagement of Sub-processors is governed exclusively by the DPA.

15. Changes to these Terms

15.1 Stellai may amend these Terms from time to time to reflect operational improvements, changes in service offerings, clarifications, or changes in Applicable Law, with at least fourteen (14) days' written notice before the effective date.

15.2 If the Customer does not object in writing within the notice period, the amendment shall be deemed accepted. The current version is maintained at stell.ai/legal/terms. If no agreement is reached within sixty (60) days of a written objection, the Customer may terminate the affected Services without further liability.

15.3 Amendments that materially reduce the Customer's rights or materially increase the Customer's obligations — including raising Fees beyond the CPI adjustment, lowering the limitation of liability in favour of Stellai, or narrowing the indemnification in Section 11.1 — require the Customer's express written agreement and are not subject to deemed acceptance.

16. Order of Precedence and Governing Law

16.1 In the event of conflict, the following order of precedence applies: (i) the Order Form or Agreement; (ii) any signed framework agreement; (iii) the DPA (on matters relating to processing of Personal Data); (iv) the SLA (on matters relating to service levels); and (v) these Terms.

16.2 The DPA shall prevail to the extent necessary to ensure compliance with Applicable Data Protection Law.

16.3 These Terms shall be governed by the laws of Norway, without regard to conflict of law principles. The United Nations Convention on Contracts for the International Sale of Goods shall not apply.

16.4 Any dispute arising out of or in connection with these Terms shall be subject to the exclusive jurisdiction of the ordinary courts of Norway, with Agder District Court as venue.

Data Processing Agreement

Standard Contractual Clauses — Article 28(3) GDPR

Between the data controller (Customer) and Stellai AS, Org. Nr. 925 053 066, Tordenskjolds gate 9, 4612 Kristiansand, Norway (the data processor)

These Contractual Clauses (the "Clauses") set out the rights and obligations of the data controller and the data processor when processing personal data on behalf of the data controller. The Clauses have been designed to ensure the parties' compliance with Article 28(3) of Regulation 2016/679 (GDPR). In the context of the provision of the IdentifAI system, the data processor will process personal data on behalf of the data controller in accordance with the Clauses. The Clauses shall take priority over any similar provisions in other agreements between the parties.

Preamble
Rights and Obligations of the Data Controller
Data Processor Acts According to Instructions
Confidentiality
Security of Processing
Use of Sub-Processors
Transfer of Data to Third Countries
Assistance to the Data Controller
Notification of Personal Data Breach
Erasure and Return of Data
Audit and Inspection
Other Terms
Commencement and Termination
Contacts
Appendix A — Information about the Processing
Appendix B — Authorised Sub-Processors
Appendix C — Instructions

1. Preamble

These Clauses set out the rights and obligations of the data controller and the data processor when processing personal data on behalf of the data controller, in compliance with GDPR Article 28(3). Four appendices are attached and form an integral part of the Clauses: Appendix A (details of processing), Appendix B (sub-processors), Appendix C (instructions and security measures), and Appendix D (other terms). The Clauses shall not exempt the data processor from obligations under the GDPR or other applicable legislation.

2. Rights and Obligations of the Data Controller

The data controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR (Article 24), the applicable EU or Member State data protection provisions, and the Clauses. The data controller has the right and obligation to make decisions about the purposes and means of the processing of personal data, and shall be responsible for ensuring that the processing has a legal basis.

3. Data Processor Acts According to Instructions

The data processor shall process personal data only on documented instructions from the data controller, unless required to do so by Union or Member State law. Such instructions are specified in Appendices A and C. The data processor shall immediately inform the data controller if any instructions are considered to contravene the GDPR or applicable data protection provisions.

4. Confidentiality

The data processor shall only grant access to personal data to persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and only on a need-to-know basis. The list of persons with access shall be kept under periodic review, and access shall be withdrawn if no longer necessary.

5. Security of Processing

Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks to the rights and freedoms of natural persons, the data controller and data processor shall implement appropriate technical and organisational measures (Article 32 GDPR). These measures may include:

Pseudonymisation and encryption of personal data
Ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems
Ability to restore availability and access to personal data in the event of a technical incident
A process for regularly testing and evaluating the effectiveness of security measures

The data processor shall also independently evaluate risks and implement mitigating measures, and shall assist the data controller in ensuring compliance with Article 32 GDPR.

6. Use of Sub-Processors

The data processor has the data controller's general authorisation for the engagement of sub-processors. The data processor shall inform the data controller in writing of any intended changes concerning the addition or replacement of sub-processors at least one week in advance, giving the data controller the opportunity to object on reasonable data-protection grounds. The same data protection obligations as set out in the Clauses shall be imposed on sub-processors by contract. The data processor remains fully liable to the data controller for the fulfilment of sub-processor obligations.

7. Transfer of Data to Third Countries

Any transfer of personal data to third countries or international organisations by the data processor shall only occur on the basis of documented instructions from the data controller and in compliance with GDPR Chapter V. Without documented instructions, the data processor shall not transfer personal data to a controller or processor in a third country, transfer processing to a sub-processor in a third country, or have personal data processed in a third country.

8. Assistance to the Data Controller

Taking into account the nature of the processing, the data processor shall assist the data controller by appropriate technical and organisational measures in fulfilling the data controller's obligations to respond to requests for exercising data subject rights under GDPR Chapter III, including the rights of access, rectification, erasure, restriction, data portability, and objection. The data processor shall also assist the data controller in ensuring compliance with obligations under Articles 32–36 GDPR, including data breach notification and data protection impact assessments.

9. Notification of Personal Data Breach

In case of any personal data breach, the data processor shall notify the data controller without undue delay after becoming aware of it, and where possible within 24 hours. The notification shall include: the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed. The data processor shall assist the data controller in notifying the competent supervisory authority as required by Article 33 GDPR.

10. Erasure and Return of Data

On termination of the provision of personal data processing services, the data processor shall return all personal data to the data controller and delete existing copies, unless Union or Member State law requires continued storage. The data processor commits to exclusively process personal data for the purposes and duration provided for by applicable law.

11. Audit and Inspection

The data processor shall make available all information necessary to demonstrate compliance with the obligations in Article 28 GDPR and the Clauses, and shall allow for and contribute to audits, including inspections, conducted by the data controller or another mandated auditor. The data controller shall provide at least 10 business days' written notice before a planned audit (shorter notice for suspected breaches). The data processor shall provide access to personnel, facilities, systems, logs, and documentation as needed. One audit per calendar year is standard; more may be required following a security incident, suspected breach, or supervisory authority request.

12. Other Terms

The parties may agree other clauses concerning the provision of personal data processing services, specifying e.g. liability, as long as they do not contradict the Clauses or prejudice the fundamental rights or freedoms of the data subject and the protection afforded by the GDPR.

13. Commencement and Termination

The Clauses become effective on the date of both parties' signature and apply for the duration of the provision of personal data processing services. Both parties may require renegotiation if changes to the law or inexpediency of the Clauses give rise to such renegotiation. The Clauses cannot be terminated during the provision of services unless other Clauses have been agreed. If services are terminated and data is deleted or returned pursuant to Clause 11, the Clauses may be terminated by written notice.

14. Contacts

On behalf of the data processor (Stellai AS): Trygve Solberg, CTO — +47 954 67 878 — Trygve.solberg@stell.ai. The parties shall continuously inform each other of changes to contacts.

Appendix A — Information about the Processing

A.1 Purpose: To enable the IdentifAI product to support safe handling of waste and reduce fire risk by detecting potentially hazardous waste items deposited in or near containers at the data controller's site(s). Live video streams from cameras are analysed in real time on an edge device. Only event material (cropped still images and metadata) is stored when the model classifies an event as potentially hazardous. Face blurring is applied prior to storage and display. Selected data may be used to improve detection accuracy. Remote access is strictly limited to troubleshooting, optimisation, and support.

A.2 Nature of processing:

Real-time analysis of live video streams for AI-based object detection
Automatic face blurring before any storage or visualisation
Storage of anonymised event images (cropped, object-relevant only)
SaaS hosting, system maintenance, logs, and operational telemetry
Remote technical support via VPN
Use of selected anonymised data for AI model improvement

A.3 Types of personal data: Live video frames (processed in RAM only, not stored); event-specific cropped images with face blurring applied before storage; metadata (timestamps, object-type classifications, detection confidence, device IDs); system logs; remote support metadata (IP address, device identifier).

A.4 Categories of data subjects: Individuals appearing within the camera's field of view (employees, visitors, contractors, or members of the public). All individuals are anonymised via automated face-blurring before any storage of event imagery.

A.5 Duration: Processing is carried out continuously for the duration of the service agreement. Event images and associated metadata are retained only for the time periods defined in Appendix C.4. Upon termination, the data processor shall return or delete all data in accordance with Clause 11.

Appendix B — Authorised Sub-Processors

Name	Org. Nr.	Address	Description
Ludvig Alvir (Alvir)	934292472	Sinsenterrassen 2 B, 0574 Oslo	Frontend programming
Microsoft Azure (Norway)	972235857	Dronning Eufemias gate 71, 0194 Oslo	Hosting and database
Microsoft Azure (Ireland)	256796	One Microsoft Place, Dublin D18 P521	Hosting and database

Appendix C — Instructions Pertaining to the Use of Personal Data

C.1 Subject/instruction: Real-time AI-based object detection on live video; automatic face blurring prior to storage; storage and access of anonymised event images; SaaS hosting and secure remote support via VPN; logging and analysis of detections; AI model improvement using selected anonymised data. All processing strictly limited to purposes set by the data controller.

C.2 Security measures: TLS 1.2+ encryption in transit; encryption at rest for event data and logs; CIS Level 2 hardening; VPN/E2EE remote access; regular security assessments; routine testing of anonymisation, logging and access controls. Processing primarily in secure EU/EEA data centres.

C.3 Assistance: The data processor assists the data controller by providing information for rights requests (access, deletion, rectification, objection), supporting GDPR Articles 32–36 compliance, assisting with breach investigation and notification, providing documentation for DPIA assessments, and ensuring availability of logs for audits.

C.4 Retention and erasure: Event images are retained for 30 days; metadata for 3 months. Upon termination, the data processor shall delete or return all personal data in accordance with Clause 11. Data is stored for the duration of the service agreement and automatically erased thereafter.

C.5 Processing location: Primarily within the EU/EEA. Certain data may be routed for inference in the USA on a transit basis only — no storage outside the EU/EEA. Remote access during pilot periods may involve temporary processing outside the EU/EEA, subject to established data protection procedures.

C.6 Third-country transfers: No transfers to third countries without express written instruction from the data controller and GDPR Chapter V compliance.

C.7–C.8 Audit procedures: See Section 11 (Audit and Inspection). The data controller may provide independent certifications (e.g. SOC 2, ISO 27001) or audit reports as partial evidence of compliance.

Appendix D — Other Terms

No additional terms specified unless added by the parties in writing.