FAQ

EULA rev. February 2019 CONFIDENTIAL Page 5 of 11
designed to process, store, or be used in connection with Excluded Data. Customer is solely responsible for reviewing data that will be
provided to or accessed by Suppliers to ensure that it does not contain Excluded Data.
B. Indemnification Process . A party’s duty to defend and indemnify under this section is contingent upon the party seeking indemnity:
(i) sending prompt written notice of the matter to the party providing indemnity and taking reasonable steps to mitigate damages; (ii)
granting to the party providing indemnity the sole right to control the defense and resolution of the matter; and (iii) cooperating
with the party providing indemnity in the defense and resolution of the matter and in mitigating any damages.
8. LIMITATION OF LIABILITY. Limitations on Damages. The limitations, exclusions and disclaimers stated below apply to
any and all disputes, claims, or controversies (whether in contract, tort, or otherwise) related to or arising out of the CSA or any
quote or Order (“Dispute”). The terms of this Section are agreed allocations of risk constituting part of the consideration for
RSA’s sale of products and services to Customer and will apply even if there is a failure of the essential purpose of any limited
remedy, and regardless whether a party has been advised of the possibility of the liabilities.
A. (1). Limitation on Direct Damages. Except for Customer’s obligations to pay for products and services, Customer’s violation of
the restrictions on use of products and services or RSA’s or its Affiliates’ intellectual property rights, or a party’s indemnity obligation
stated in the Section above titled “Indemnity”, each party’s total liability arising out of any Dispute or any matter under this CSA, is
limited to the amount Customer paid to RSA during the twelve months before the date that the matter or Dispute arose for the
product, services, or both that are the subject of the Dispute, but excluding amounts received as reimbursement of expenses or
payment of taxes.
A. (2). No Indirect Damages. Except for Customer’s payment obligations and violation of RSA’s or its Affiliates’ intellectual property
rights, neither RSA nor Customer has liability to the other for special, consequential, exemplary, punitive, incidental, or indirect
damages, or for lost profits, loss of revenue, loss or corruption of data, or loss of use, or procurement of substitute products or services.
B. Regular Back-ups. Customer is solely responsible for its data. Customer must back up its data before RSA performs any remedial,
upgrade, or other work on Customer’s production systems. If applicable law prohibits exclusion of liability for lost data, then RSA will only
be liable for the cost of the typical effort to recover the lost data from Customer’s last available back-up.
C. Limitation Period. Except as stated in this Section, all claims must be made within the period specified by applicable law. If the law
allows the parties to specify a shorter period for bringing claims, or the law does not provide a time at all, then claims must be made within
twelve months after the cause of action accrues.
D. Suppliers and Affiliates. The foregoing limitations shall also apply in favor of RSA’s Suppliers and Affiliates.
9. Trade Compliance. Customer’s purchase of licenses for Software and access to related technology (“Materials”) are for its own
use, not for resale, export, re-export, or transfer. Customer is subject to and responsible for compliance with the export control and
economic sanctions laws of the United States and other applicable jurisdictions. Materials may not be used, sold, leased, exported,
imported, re-exported, or transferred except with prior written authorization by RSA. or its Affiliates and in compliance with such laws,
including, without limitation, export licensing requirements, end-user, end-use, and end-destination restrictions, and prohibitions on
dealings with sanctioned individuals and entities, including but not limited to persons on the Office of Foreign Assets Control's Specially
Designated Nationals and Blocked Persons List or the U.S. Department of Commerce Denied Persons List. Customer represents and
warrants that it is not the subject or target of, and that Customer is not located in a country or territory (including without limitation,
North Korea, Cuba, Iran, Syria, and Crimea) that is the subject or target of, economic sanctions of the United States or other applicable
jurisdictions. Customer understands and will comply with all applicable provisions of the U.S. Arms Export Control Act (AECA) and
the U.S. International Traffic in Arms Regulations (ITAR) in Customer’s receipt, use, transfer, modification, or disposal of
Software. Customer acknowledges that any use, modification, or integration of the Software in or with defense articles or in the
provision of defense services is not authorized by RSA, and that RSA will not provide warranty, repair, customer support, or other
services in connection with such end uses. Customer certifies that any software, disk images, or other data provided to RSA in
connection with the purchase of the Software will not contain technical data, software, or technology controlled by the ITAR or AECA,
and that if Customer later returns the Software to RSA or grants RSA access to the Software, Customer will not include or otherwise
make available to RSA any such technical data, software, or technology. Customer agrees to indemnify and hold RSA harmless for any
liability, loss, damage, cost, expense, or penalty arising from Customer’s non-compliance with the AECA, ITAR, or the provisions of
this Section.
10. CONFIDENTIALITY. “Confidential Information” means any information that is marked “confidential” or “proprietary” or any
other similar term or in relation to which its confidentiality should by its nature be inferred or, if disclosed orally, is identified as being
confidential at the time of disclosure and, within two (2) weeks thereafter, is summarized, appropriately labeled and provided in tangible
form. Confidential Information does not include information that is (i) rightfully in the receiving party’s possession without prior
obligation of confidentiality from the disclosing party; (ii) a matter of public knowledge; (iii) rightfully furnished to the receiving party
by a third party without confidentiality restriction; or (iv) independently developed by the receiving party without reference to the
disclosing party's Confidential Information. Each party shall (a) use Confidential Information of the other party only for the purposes of
exercising rights or performing obligations in connection with this Agreement or any purchase order hereunder; and (b) protect from
disclosure to any third parties, by use of a standard of care equivalent to that as used by recipient to protect its own information of a
similar nature and importance, and, no less than the use of reasonable care, any Confidential Information disclosed by the other party
for a period commencing upon the date of disclosure until three (3) years thereafter, except with respect to (1) Customer data to which
RSA may have access in connection with the provision of Services, which shall remain Confidential Information until one of the
exceptions stated in the above definition of Confidential Information applies; and (2) Confidential Information that constitutes, contains
or reveals, in whole or in part, RSA proprietary rights, which shall not be disclosed by the receiving party at any time, and (3) Products,