Master SaaS Subscription Agreement

This MSA is read together with the Data Processing Agreement (DPA), the Service Level Agreement (SLA), the Subscription Agreement, the Terms of Service (including its acceptable use provisions), the Subscription Details and any Statement of Work. Together they make up the Agreement. Order of precedence. If these documents conflict, the following order applies, highest first: 1. the Subscription Details, but only for the plan, fees, term, units, modules and Billing Party they state, and only where VulaKomplex has confirmed them in writing or on its invoice; 2. the DPA, but only for the processing of Personal Information; 3. this MSA; 4. the SLA, but only for availability, support and service credits; 5. the Subscription Agreement; and 6. the Terms of Service. Special terms apply above this order only if they are signed by both parties and expressly say they override it. No purchase order, supplier form or other Customer document forms part of the Agreement, even if VulaKomplex accepts or processes it. Individual users. Each Authorised User also accepts the Terms of Service when using the Platform. As between VulaKomplex and the Customer, this MSA prevails over the Terms of Service, and a user's acceptance of the Terms of Service does not increase VulaKomplex's liability or give any user or Scheme Entity a claim outside the limits in clause 17.

VulaKomplex grants the Customer a limited, non-exclusive, non-transferable and revocable right to access and use the Platform during the subscription term for the Customer's internal property, community, maintenance, communication and administrative management purposes. • The subscription applies only to the schemes, buildings, properties, units, users and modules stated in the Subscription Details. • A Scheme Entity may subscribe and pay VulaKomplex directly for its own Scheme workspace. • A Managing Agent may subscribe and pay VulaKomplex for a portfolio of Scheme workspaces, provided it has authority from each relevant Scheme Entity. • The Customer may not resell, sublicense, white-label or commercially exploit the Platform without written approval. • Additional modules, units, users, integrations or implementation services may attract additional fees.

VulaKomplex is a software provider. VulaKomplex does not act as a managing agent, trustee, estate agent, fiduciary service provider, legal advisor, tax advisor, auditor, bookkeeper, accountant, payment institution, debt collector or security company unless a separate written agreement expressly says otherwise. Platform outputs, including levy and billing calculations, statements, financial and management reports, VAT and tax treatment, compliance scores, arrears and notice templates, and meeting and resolution documents, are informational aids generated from data and settings supplied by the Customer. The Customer is solely responsible for checking them before relying on or issuing them, for the accuracy of its data and configuration, and for compliance with the Sectional Titles Schemes Management Act, the Community Schemes Ombud Service Act, POPIA, tax legislation and any other law that applies to it or to the scheme.

• The Customer remains responsible for all governance, trustee, managing-agent, accounting, legal, levy, billing, payment, maintenance, access-control and resident-management decisions within the authority it holds. • The Customer must ensure that Customer Data uploaded to the Platform is lawful, accurate, authorised and fit for the intended purpose. • The Customer must obtain all consents, notices and approvals required to submit Personal Information to the Platform. • The Customer controls which Authorised Users receive access and which role permissions are assigned. • The Customer must promptly remove access for users who leave employment, cease to be trustees, move out, change roles or no longer require access. • A Managing Agent onboarding or administering a Scheme workspace warrants that it has a valid mandate or other authority from the Scheme Entity and must promptly notify VulaKomplex if that authority ends or is disputed.

• Fees are stated in the Subscription Details and may include onboarding fees, monthly subscription fees, per-unit fees, integration fees, messaging usage fees, support fees and professional-service fees. • Unless stated otherwise, all fees stated are the full amounts payable. • Recurring fees are payable monthly in advance unless the Subscription Details state otherwise. • Usage-based fees, WhatsApp/message fees, payment-provider fees, bank charges or integration fees may be billed in arrears. • Invoices may be issued to the Scheme Entity directly or to a Managing Agent portfolio account, as stated in the Subscription Details, billing settings or invoice. • The Billing Party is responsible for paying invoices issued to it. Payment by a Managing Agent may be recovered from the Scheme Entity under the Managing Agent's own mandate, but that recovery arrangement is between the Managing Agent and Scheme Entity. • If the Customer or Billing Party disputes an invoice, it must notify VulaKomplex in writing within 7 days of receiving it, giving reasonable detail of the disputed items and why they are disputed, and must pay all undisputed amounts on time. An invoice not disputed in this way is treated as accepted, without affecting the correction of genuine billing errors. • All amounts must be paid in full, without set-off, deduction or withholding, except as required by law. A dispute does not entitle the Customer or Billing Party to withhold undisputed amounts. • VulaKomplex may suspend access for non-payment after written notice and a reasonable opportunity to remedy. Unless VulaKomplex agrees otherwise in writing, the timeline in clause 6 of the Subscription Agreement is a reasonable opportunity. • Where a Managing Agent is the Billing Party, suspension for non-payment applies to the Scheme workspaces that Managing Agent pays for, and VulaKomplex may tell the relevant Scheme Entity that the fees are unpaid so that it can take over payment under clause 8B. • Overdue amounts accrue interest at the South African prime lending rate plus 2% per annum, calculated daily and compounded monthly from the due date until paid in full.

• The initial term is set out in the Subscription Details. If no term is stated, the term is month-to-month after onboarding. • The Agreement renews automatically for successive periods of the same length as the initial term unless either party gives at least 30 days' written notice of non-renewal before the end of the then-current term. • Pilot, promotional or discounted pricing may expire or convert to standard pricing at the end of the agreed pilot period. • Where the Consumer Protection Act applies to the Customer, cancellation rights and notice periods will be interpreted consistently with the CPA.

The Customer retains ownership of Customer Data that belongs to it. Scheme Data belongs to the relevant Scheme Entity, even where a Managing Agent is the Customer or Billing Party. The Customer grants, and warrants that it has authority to grant, VulaKomplex a limited licence to host, copy, process, transmit, store, back up, display, analyse and use Customer Data only as necessary to provide, secure, maintain, support, improve and develop the Platform, comply with law and enforce the Agreement.

Scheme Data belongs to the Scheme Entity and not to any Managing Agent, VulaKomplex or individual platform user. Payment of fees by a Managing Agent does not make the Managing Agent the owner of Scheme Data or the Responsible Party for Scheme Data under POPIA. Direct payment by a Scheme Entity also does not alter VulaKomplex's role as Operator for Scheme Data. A Managing Agent granted access to a Scheme workspace acts as an authorised administrator or delegated service provider of the Scheme Entity. The Scheme Entity may at any time direct VulaKomplex to remove, replace or limit a Managing Agent's access. VulaKomplex may require reasonable proof of authority before making such access changes. Where a Managing Agent activates, administers or pays for a Scheme workspace on behalf of a Scheme Entity, the Managing Agent warrants that it has authority to act on behalf of the Scheme Entity and acknowledges that the Scheme Entity retains ownership of Scheme Data and may instruct VulaKomplex directly at any time.

Where a Managing Agent is the Customer, it accepts the Agreement both in its own name and as agent for each Scheme Entity whose Scheme workspace it administers, and warrants that it has authority to bind each of them in this way. Each such Scheme Entity is bound by the Agreement, including the DPA, for its own Scheme workspace and Scheme Data as if it had signed it itself, and may enforce it directly, subject to its terms and the limit in clause 17. A Scheme Entity confirms the Managing Agent's authority by signing the DPA, or by another written mandate acceptable to VulaKomplex. VulaKomplex may ask a Scheme Entity to confirm the Agreement directly where a Managing Agent's authority is missing, has ended or is disputed. Where a Scheme Entity is itself the Customer, the Agreement applies to it directly, and any Managing Agent it appoints acts under clause 8A. Continuity. If a Managing Agent's subscription ends, or its authority for a Scheme Entity ends or is disputed, the Scheme Entity may continue its Scheme workspace and Scheme Data under its own subscription, or through a replacement Managing Agent, by giving VulaKomplex proof of authority and accepting the Agreement (or having the replacement Managing Agent accept it). If the Scheme Entity confirms in writing, within the 30-day export period in clause 20, that it wishes to continue, VulaKomplex will not soft-delete or permanently delete that Scheme Data while the transfer is completed. Until a new subscription is in place, VulaKomplex may restrict or suspend the workspace for non-payment under clause 6.

VulaKomplex may create and use aggregated, de-identified or anonymised data for analytics, benchmarking, product improvement, security monitoring and market insight, provided that the output does not identify a Customer, scheme, unit, resident or individual.

The Platform may connect to accounting systems, messaging services, payment processors, cloud infrastructure, analytics tools, access-control systems and other third-party services. VulaKomplex is not responsible for third-party service failures, delays, security incidents, fee changes, API changes or discontinued services, except to the extent caused by VulaKomplex's breach of the Agreement. VulaKomplex will use all reasonable means to choose reliable providers, monitor them, limit the impact of a third-party failure and restore the Platform as quickly as reasonably possible.

All rights in the Platform, source code, object code, databases, workflows, designs, templates, documentation, algorithms, know-how, trademarks, product names and improvements remain owned by VulaKomplex or its licensors. Feedback may be used by VulaKomplex without compensation, provided it does not disclose confidential Customer Data.

Each party must protect the other party's Confidential Information using at least reasonable care and may only use it to perform or receive services under the Agreement. Confidentiality obligations do not apply to information that is public, already known, independently developed or lawfully received from a third party. Confidentiality obligations survive termination or expiry of the Agreement for a period of 3 years.

For Scheme Data, the Scheme Entity is the Responsible Party and VulaKomplex is the Operator. The Scheme Entity remains the Responsible Party regardless of whether the Scheme Entity pays VulaKomplex directly, a Managing Agent pays as part of its services to the Scheme Entity, or another authorised Billing Party pays the subscription fees. The parties must comply with POPIA and the Data Processing Agreement.

VulaKomplex will implement reasonable technical and organisational measures appropriate to the nature of the Platform and the risks involved, including encryption, access control, audit logging, backup controls, secure development practices, monitoring and incident response procedures.

Support and availability targets are governed by the Service Level Agreement at vulakomplex.co.za/sla. Service credits are the Customer's sole and exclusive remedy for any failure to meet an availability, uptime or performance target and for any interruption of the Platform, however the claim is framed (including breach of warranty, breach of contract, delict, or loss of data or business caused by the interruption), except for Excluded Liabilities. Service credits are applied to the Billing Party's account.

VulaKomplex warrants that it will provide the Platform with reasonable skill and care; that it has the right and authority to enter into the Agreement; and that the Platform will not, to VulaKomplex's knowledge, infringe the intellectual property rights of any third party. Except as expressly stated, the Platform is provided "as is" and "as available". VulaKomplex does not warrant that the Platform will be uninterrupted, error-free, meet every Customer requirement or replace professional judgment.

To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, punitive or consequential loss, including loss of profits, goodwill, opportunity, savings or data, except for Excluded Liabilities. VulaKomplex's total aggregate liability arising out of or in connection with the Agreement is limited to the fees paid or payable for the Scheme workspaces affected by the claim (or, if the claim is not specific to a workspace, for the affected subscription) during the 12 months preceding the event giving rise to the claim. This limit: • applies across all documents that form part of the Agreement and to all claims taken together, whether in contract, delict (including negligence), under statute, by indemnity (including clause 18A) or otherwise; and • is a single limit shared by the Customer, the Billing Party, each Scheme Entity and every Authorised User claiming under or through the Agreement, and is not multiplied by the number of claims, Scheme workspaces, Scheme Entities or users. Nothing in this clause limits or excludes Excluded Liabilities.

• The Customer indemnifies VulaKomplex against claims arising from Customer Data, unlawful instructions, unauthorised user access, misuse of the Platform, inaccurate data, internal disputes or decisions taken outside the Platform. • VulaKomplex's obligations in respect of third-party intellectual property claims are set out in clause 18A.

VulaKomplex will defend the Customer against any third-party claim, brought in the Republic of South Africa, that the Customer's authorised use of the Platform infringes that third party's intellectual property rights ('IP Claim'), and will pay the damages and costs finally awarded against the Customer by a court of competent jurisdiction, any settlement amount agreed by VulaKomplex, and the Customer's reasonable legal costs incurred at VulaKomplex's written request, provided that the Customer: • promptly notifies VulaKomplex in writing of the IP Claim; • gives VulaKomplex sole control of the defence and settlement (provided VulaKomplex does not settle in a manner that imposes any obligation on the Customer without the Customer's prior written consent); • provides all reasonable assistance at VulaKomplex's cost; and • takes reasonable steps to mitigate losses and makes no admission or compromise without VulaKomplex's prior written consent. VulaKomplex has no liability under this indemnity to the extent the IP Claim arises from: (a) modification of the Platform not made by VulaKomplex; (b) use of the Platform other than in accordance with the Agreement; (c) use of the Platform in combination with software or data not supplied by VulaKomplex where the claim would not have arisen but for such combination; (d) Customer Data or third-party content submitted to the Platform; (e) open-source software, or third-party software, services or integrations not supplied by VulaKomplex (including accounting, messaging and payment integrations); or (f) use of a version of the Platform after VulaKomplex has made a non-infringing update available and asked the Customer to use it. Remedies. If the Platform becomes, or in VulaKomplex's reasonable opinion is likely to become, the subject of an IP Claim, VulaKomplex may, at its option and cost: (i) procure the right for the Customer to keep using the affected part of the Platform; (ii) modify or replace it so that it is non-infringing with materially equivalent functionality; or (iii) if neither is commercially reasonable, end the affected subscription on written notice and refund any prepaid fees for the period after it ends. Limit and exclusive remedy. VulaKomplex's liability under this clause is part of, and not in addition to, the limit in clause 17. This clause and the remedies above are the Customer's sole and exclusive remedy for any actual or alleged infringement of third-party intellectual property rights by the Platform.

VulaKomplex may suspend access where necessary to protect the Platform, prevent unlawful activity, address security risk, comply with law, respond to non-payment or prevent material harm. VulaKomplex will use reasonable efforts to notify the Customer unless urgent action is required.

Neither party will be in breach of the Agreement nor liable for any failure or delay in performing its obligations (other than payment obligations) if such failure or delay results from a Force Majeure Event. 'Force Majeure Event' means any circumstance beyond a party's reasonable control, including: acts of God; fire; flood; earthquake; epidemic; pandemic; war; terrorism; civil unrest; labour disputes; governmental actions; electricity supply interruptions or load-shedding by Eskom or any electricity distributor; municipal water or service delivery failures; internet or telecommunications outages including Telkom, ISP or undersea cable failures; denial-of-service attacks; or cloud infrastructure outages beyond VulaKomplex's direct control. The affected party must notify the other as soon as reasonably practicable. If a Force Majeure Event prevents VulaKomplex's performance for more than 30 consecutive days, the Customer may terminate the Agreement by giving 10 business days' written notice, without penalty. VulaKomplex will use commercially reasonable efforts to maintain continuity of service during Force Majeure Events.

• Cancellation and notice. The Customer may cancel the Agreement or any subscription at any time by giving VulaKomplex at least 30 days' written notice. VulaKomplex may terminate the Agreement or any subscription by giving the Customer at least 30 days' written notice. The cancellation and notice clauses in the Subscription Agreement and the Terms of Service are commercial notice mechanisms only; they do not add to, extend or replace this clause. • Breach and other grounds. Either party may terminate for material breach not remedied within 20 business days after written notice. VulaKomplex may also terminate as provided in clause 13 of the Subscription Agreement, and the Customer may also terminate under clause 19A and the persistent-failure clause of the SLA. • Fees. On termination, the Customer or Billing Party must pay all fees due up to the effective date of termination, and all overdue amounts become immediately payable. If VulaKomplex terminates other than for the Customer's breach or non-payment, it will refund any prepaid fees for the period after termination. • Managing Agents. The ending of a Managing Agent's subscription or authority does not end the Scheme Entity's rights in its Scheme Data. The Scheme Entity may continue its Scheme workspace as set out in clause 8B. • Export. Customer Data remains available for export for 30 days after termination. Export is through the Platform's standard export functions, in the formats those functions provide. Scheme Data may be exported by the Scheme Entity, or by a Managing Agent while it remains authorised for that Scheme Entity. Assistance beyond the standard export functions, such as bespoke formats, bulk extracts or migration support, is a professional service charged at VulaKomplex's then-current rates. • Deletion. After the 30-day export period, Customer Data is soft-deleted (removed from the Platform and no longer accessible to users), and it is permanently deleted 90 days after termination, in each case in accordance with the DPA and subject to legal retention obligations, legal holds and backup cycles.

• South African law governs the Agreement. Any dispute arising from or in connection with the Agreement will be subject to the exclusive jurisdiction of the South African courts. • The parties will first attempt good-faith senior-level negotiation before commencing litigation or arbitration, unless urgent relief is required. • VulaKomplex may assign or transfer the Agreement, without the Customer's consent and on notice, to a holding company, subsidiary or fellow subsidiary, or to a successor to all or substantially all of its business or assets. The Customer may not assign, cede or delegate any right or obligation under the Agreement without VulaKomplex's prior written consent. A change of control of the Customer, or the transfer of a Managing Agent's portfolio to another managing agent, does not transfer any Scheme workspace, subscription or fee obligation; the incoming party must accept the Agreement and show authority from each Scheme Entity. • No variation or amendment to the Agreement is valid unless made in writing and signed by authorised representatives of both parties, except that VulaKomplex may update the standard published terms that form part of the Agreement (the MSA, DPA, SLA, Subscription Agreement and Terms of Service) by giving the Customer at least 30 days' notice by email or prominent in-app notice. Changes required by law or by an urgent security need may take effect on shorter notice. If an update materially and adversely affects the Customer, the Customer may cancel by written notice given before the update takes effect, and the cancellation takes effect on the date the update would have applied, without penalty. Continued use after the effective date is acceptance of the update. This clause may not itself be varied orally. • If any provision is or becomes invalid, illegal or unenforceable, it will be deemed modified to the minimum extent necessary to make it valid, and the remaining provisions will continue in full force. • Failure or delay by either party to exercise any right or remedy does not constitute a waiver of that right or remedy. • The Agreement is the entire agreement between the parties for the subscribed services and supersedes all prior agreements, representations and understandings. Questions about this Agreement: Email: legal@vulakomplex.co.za Address: 44 Amhurst Place, Midstream Estate, Olifantsfontein, Gauteng, 1692 Company registration: 2026/311419/07

The parties agree that: • Acceptance of these terms by electronic means — including clicking 'I agree', completing online registration or using the Platform — constitutes a valid and binding agreement under section 22 of the Electronic Communications and Transactions Act 25 of 2002 ('ECT Act') and has the same legal force as a paper agreement signed in ink. • Documents created, signed or transmitted electronically through the Platform — including trustee resolutions, levy notices, maintenance authorisations and consent forms — are admissible as evidence under section 15 of the ECT Act, subject to the Platform's audit-log records. • Electronic signatures applied through the Platform carry legal force under section 13 of the ECT Act. • VulaKomplex maintains an immutable audit log of electronic acceptance events, including timestamps, IP addresses, user identifiers and document hash values, which may be produced as evidence of electronic execution. • This Agreement may be executed in counterparts — whether electronically or otherwise — each of which, when executed by the party signing it, shall be deemed an original. All counterparts together shall constitute one and the same agreement, and no counterpart need contain the signature of every party provided that each party has executed at least one counterpart. The parties expressly agree that a counterpart executed and delivered electronically has the same legal force as one executed in ink on paper.