MUTUAL NON-DISCLOSURE AGREEMENT

Between

BrandX Invest SRL, trading as VeriScan, a company registered in Romania, registration no. J2024000390307, VAT ID RO49911446, registered office Str. Traian Vuia, bl. C3, ap. 6, Satu Mare, Romania, represented by Cristian Lazar, Manager ("VeriScan"),

and

, registration / VAT no. , address , represented by , (the "Client"),

each a "Party". The Party sharing information is the "Discloser"; the Party receiving it is the "Recipient".

1. Purpose

The Parties want to share information so that VeriScan can review the Client's packaging artwork and related product data and prepare a Free Pre-Check or an audit report, and so that the Client can use that result for its own products (the "Purpose").

2. Confidential Information

"Confidential Information" means all information one Party gives the other for the Purpose, in any form, including artwork files, label text, product and recipe data, unreleased products, brands, prices and VeriScan's reports and methods. It does not include information that the Recipient can show: (a) is or becomes public through no fault of the Recipient; (b) the Recipient already lawfully had without a duty of confidence; (c) the Recipient lawfully receives from a third party without a duty of confidence; or (d) the Recipient develops independently without using the Discloser's information.

3. What the Recipient must do

The Recipient will:

• use Confidential Information only for the Purpose;
• not disclose it to anyone except its own employees, group companies and, for the Client, the agencies and printers working on the packaging, who need it for the Purpose and are bound by confidentiality duties at least as strict as these. The Recipient is responsible for their compliance;
• protect it with at least the care it uses for its own confidential information, and never less than reasonable care;
• tell the Discloser promptly if it learns of any unauthorised use or disclosure.

The Recipient may disclose Confidential Information where the law, a court or a public authority requires it, but only the part required, after telling the Discloser first where the law allows.

4. Tools

VeriScan may process the Client's Confidential Information with software tools, including AI-assisted tools, only to carry out the Purpose. This is not a disclosure in breach of section 3. VeriScan remains responsible to the Client for that use as if it were its own.

5. Deletion

VeriScan deletes the files received from the Client, and the copies it made of them, 30 days after it delivers the report or the Free Pre-Check result, or 30 days after the Client withdraws its request or VeriScan closes it, if no report or result is delivered. VeriScan may keep (a) the report, and the records it must keep by law (for example invoices and accounting records), and (b) anonymised statistics (such as the number and type of findings per rule and language), combined with data from other clients so that they do not identify the Client, its brands or its products. Item (a) remains confidential under this Agreement. VeriScan may use item (b) to improve its service and in general publications; this is not a breach of sections 3 or 6. The Client may ask VeriScan in writing to delete its files earlier.

6. No publicity

Neither Party will use the other's name, logo or information in marketing, case studies or references without the other's prior written consent.

7. Personal data

Each Party is a separate controller of the business contact data it receives (such as names and email addresses) and will handle it under the EU General Data Protection Regulation (EU) 2016/679 (and the UK GDPR where it applies), only for the Purpose and its legal obligations. The Client will not include other personal data in the files unless needed; if it does, the Parties will sign a separate data processing agreement.

8. Ownership

All Confidential Information stays the property of the Discloser. This Agreement gives no licence or other right to it, except as needed for the Purpose. Subject to section 12, Confidential Information is provided "as is".

9. Duration

This Agreement starts when the Client signs or accepts it online. VeriScan signs in advance by issuing it. It covers information shared for the Purpose before that date and for 2 years after it. The duty of confidentiality lasts 3 years after the last disclosure, and for trade secrets (as defined in Directive (EU) 2016/943 and Romanian Law 211/2018) as long as they remain trade secrets.

10. Breach

A breach may cause harm that money cannot fully repair. The Discloser may therefore seek urgent court measures, in addition to any other remedy available by law.

11. Law and courts

This Agreement is governed by Romanian law. The courts of Cluj-Napoca, Romania have exclusive jurisdiction, but either Party may seek urgent measures before any competent court. The Client expressly accepts this section 11.

12. General

This Agreement covers confidentiality only. The audit itself (scope, price, warranties, liability) is governed by VeriScan's Terms of Service or a separate audit contract. If they conflict on confidentiality or deletion, this Agreement prevails. Changes are valid only in writing signed by both Parties. It may be signed or accepted electronically, including in VeriScan's online form, and in counterparts. Each person signing confirms they are authorised to bind their Party. Notices and requests under this Agreement may be sent by email.