Master SaaS Subscription Agreement

This Master SaaS Subscription Agreement is intended to be read and agreed to by VulaKomplex and each Customer. It should be read together with the applicable Order Form, Data Processing Agreement, Service Level Agreement, Acceptable Use Policy, Implementation Statement of Work and any special terms agreed in writing.

VulaKomplex grants the Customer a limited, non-exclusive, non-transferable and revocable right to access and use the Platform during the subscription term for the Customer's internal property, community, maintenance, communication and administrative management purposes. • The subscription applies only to the schemes, buildings, properties, units, users and modules stated in the Order Form. • The Customer may not resell, sublicense, white-label or commercially exploit the Platform without written approval. • Additional modules, units, users, integrations or implementation services may attract additional fees.

VulaKomplex is a software provider. VulaKomplex does not act as a managing agent, trustee, estate agent, fiduciary service provider, legal advisor, tax advisor, auditor, bookkeeper, accountant, payment institution, debt collector or security company unless a separate written agreement expressly says otherwise.

• The Customer remains responsible for all governance, trustee, managing-agent, accounting, legal, levy, billing, payment, maintenance, access-control and resident-management decisions. • The Customer must ensure that Customer Data uploaded to the Platform is lawful, accurate, authorised and fit for the intended purpose. • The Customer must obtain all consents, notices and approvals required to submit Personal Information to the Platform. • The Customer controls which Authorised Users receive access and which role permissions are assigned. • The Customer must promptly remove access for users who leave employment, cease to be trustees, move out, change roles or no longer require access.

• Fees are stated in the Order Form and may include onboarding fees, monthly subscription fees, per-unit fees, integration fees, messaging usage fees, support fees and professional-service fees. • Unless stated otherwise, fees exclude VAT and other taxes. • Recurring fees are payable monthly in advance unless the Order Form states otherwise. • Usage-based fees, WhatsApp/message fees, payment-provider fees, bank charges or integration fees may be billed in arrears. • If the Customer disputes an invoice, it must notify VulaKomplex in writing within 7 days and pay all undisputed amounts on time. • VulaKomplex may suspend access for non-payment after written notice and a reasonable opportunity to remedy.

• The initial term is set out in the Order Form. If no term is stated, the term is month-to-month after onboarding. • The agreement renews automatically for successive periods unless either party gives written notice before renewal. • Pilot, promotional or discounted pricing may expire or convert to standard pricing at the end of the agreed pilot period. • Where the Consumer Protection Act applies to the Customer, cancellation rights and notice periods will be interpreted consistently with the CPA.

The Customer retains ownership of Customer Data. The Customer grants VulaKomplex a limited licence to host, copy, process, transmit, store, back up, display, analyse and use Customer Data only as necessary to provide, secure, maintain, support, improve and develop the Platform, comply with law and enforce the Agreement.

Scheme Data belongs to the Scheme Entity and not to any Managing Agent, VulaKomplex or individual platform user. Payment of fees by a Managing Agent does not make the Managing Agent the owner of Scheme Data or the Responsible Party for Scheme Data under POPIA. A Managing Agent granted access to a Scheme workspace acts as an authorised administrator or delegated service provider of the Scheme Entity. The Scheme Entity may at any time direct VulaKomplex to remove, replace or limit a Managing Agent's access. VulaKomplex may require reasonable proof of authority — including a trustee resolution, chairperson confirmation, appointment or termination letter, or other governance record — before making such access changes. Where a Managing Agent activates a Scheme workspace on behalf of a Scheme Entity, the Managing Agent warrants that it has authority to act on behalf of the Scheme Entity and acknowledges that the Scheme Entity retains ownership of Scheme Data and may instruct VulaKomplex directly at any time.

VulaKomplex may create and use aggregated, de-identified or anonymised data for analytics, benchmarking, product improvement, security monitoring and market insight, provided that the output does not identify a Customer, scheme, unit, resident or individual.

The Platform may connect to accounting systems, messaging services, payment processors, cloud infrastructure, analytics tools, access-control systems and other third-party services. VulaKomplex is not responsible for third-party service failures, delays, security incidents, fee changes, API changes or discontinued services, except to the extent caused by VulaKomplex's breach of the Agreement.

All rights in the Platform, source code, object code, databases, workflows, designs, templates, documentation, algorithms, know-how, trademarks, product names and improvements remain owned by VulaKomplex or its licensors. Feedback may be used by VulaKomplex without compensation, provided it does not disclose confidential Customer Data.

Each party must protect the other party's confidential information using at least reasonable care. Confidential information may only be used to perform or receive services under the Agreement. Confidentiality obligations do not apply to information that is public, already known, independently developed or lawfully received from a third party.

For Scheme Data, the Scheme Entity is the Responsible Party and VulaKomplex is the Operator. The Scheme Entity remains the Responsible Party for Scheme Data regardless of which party pays the subscription fees or operates the Scheme workspace on a day-to-day basis. The parties must comply with POPIA and the Data Processing Agreement. The Customer remains responsible for determining the lawful basis, notices and instructions for processing Personal Information submitted to the Platform.

VulaKomplex will implement reasonable technical and organisational measures appropriate to the nature of the Platform and the risks involved. Security measures may include encryption, access control, audit logging, backup controls, secure development practices, monitoring and incident response procedures.

Support and availability targets are governed by the Service Level Agreement. Service credits, if any, are the Customer's sole remedy for failure to meet stated availability targets, except for wilful misconduct, gross negligence or liabilities that cannot legally be limited.

VulaKomplex warrants that it will provide the Platform with reasonable skill and care. Except as expressly stated, the Platform is provided "as is" and "as available". VulaKomplex does not warrant that the Platform will be uninterrupted, error-free, meet every Customer requirement, prevent all fraud, guarantee legal compliance or replace professional judgment.

To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, punitive or consequential loss, including loss of profits, goodwill, opportunity, savings or data, except where such loss cannot legally be excluded. VulaKomplex's aggregate liability is limited to the fees paid or payable by the Customer during the 12 months preceding the event giving rise to the claim.

• The Customer indemnifies VulaKomplex against claims arising from Customer Data, unlawful instructions, unauthorised user access, misuse of the Platform, inaccurate data, internal disputes or decisions taken outside the Platform. • VulaKomplex will defend the Customer against third-party claims that the Platform infringes intellectual property rights, provided the claim does not arise from Customer Data, unauthorised modifications, third-party services or use outside the Agreement.

VulaKomplex may suspend access where necessary to protect the Platform, prevent unlawful activity, address security risk, comply with law, respond to non-payment or prevent material harm. VulaKomplex will use reasonable efforts to notify the Customer unless urgent action is required.

• Either party may terminate for material breach not remedied within 20 business days after written notice. • On termination, the Customer must pay all outstanding fees. • VulaKomplex will provide reasonable data export assistance according to the Data Retention and Deletion Policy and any paid exit support scope agreed in writing. • VulaKomplex may delete Customer Data after the retention/export period, subject to legal obligations and backup cycles.

• South African law governs the Agreement. • The parties will first attempt senior-level negotiation before litigation or arbitration, unless urgent relief is required. • Neither party may assign the Agreement without consent, except as part of a sale of business, merger, restructuring or group transfer. • The Agreement is the complete agreement between the parties for the subscribed services. Questions about this Agreement: Email: legal@vulakomplex.co.za Address: 44 Amhurst Place, Midstream Estate, Olifantsfontein, Gauteng, 1692 Company registration: 2026/311419/07