Enterprise Custom Development Services Agreement

Provider: AUTH spółka z ograniczoną odpowiedzialnością (AUTH sp. z o.o.), Marszałkowska 58 / 15, 00-545 Warsaw, Poland. KRS: 0001043319 · NIP: 5273062913 · REGON: 525652590 (“GetUp”, “we”, “Provider”).

Customer: the legal person or registered business entity to whom the quote is addressed and which signs this MSA by electronic acceptance (“Customer”). The Customer represents that the information in the quote is accurate and falls within its representative authority.

Within this MSA:

• “Custom Services” — services defined in the quote that fall outside the standard SaaS subscription: bespoke module development, integrations, data migration, training, advisory, white-label work, enterprise SSO/SCIM, KSeF custom flows, and similar customisations.
• “Deliverables” — source code, compiled software, documents, scripts, architecture diagrams and training materials produced under the Custom Services and delivered to the Customer.
• “Platform” — the codebase, infrastructure and GetUp-branded interfaces of the SaaS service offered at getup.dev.
• “SOW” (Statement of Work) — the quote or scope document for Custom Services, defining scope, acceptance criteria, delivery timeline, fee and communication channels.
• “Laws” — Polish law, directly applicable EU law and the mandatory provisions of the Customer's jurisdiction of operation.

This MSA governs Custom Services that GetUp develops at the Customer's written and documented request solely for lawful, legitimate, good-faith commercial purposes. Both parties expressly acknowledge that this Agreement and the Deliverables are designed and delivered exclusively for purposes that comply with the Laws.

GetUp designs the Deliverables based on the Customer's representations of (a) business requirements, (b) intended end-use and (c) the legal framework to which the Customer is subject. GetUp shall not be liable for use beyond that scope or intent, infringement of third-party rights, or any unlawful application.

By accepting this MSA the Customer expressly, irrevocably and continuously represents, warrants and undertakes that:

1. (a) Lawful Purpose. The requested Custom Services and Deliverables will be used solely (i) for the Customer's lawful commercial activities, (ii) in compliance with all Laws to which it is subject, and (iii) within the scope of good faith and fair commercial practice.
2. (b) Prohibited Uses. The Customer will not use the Deliverables or the Platform for: money laundering, tax evasion, issuing fictitious invoices, manipulation of KSeF or accounting data, misuse of personal data, unauthorised financial operations, computer fraud, identity theft, malware distribution, breach of export control or sanctions regimes (EU 833/2014, OFAC, BAFA), human rights violations, threats to national security, or any other unlawful purpose.
3. (c) Information Accuracy. All business descriptions, use-case narratives, customer profiles and data samples provided to GetUp are accurate and complete; no hidden or undeclared illegal purpose underlies the engagement.
4. (d) Authority. The natural person accepting the MSA represents that they have the authority to bind the Customer entity.
5. (e) Licences and Permits. The Customer holds all licences, permits, registrations and certifications required for its industry; absent these, it will refrain from operational use of the Deliverables until obtained.
6. (f) Third-Party Rights. The Customer holds the necessary rights to all data, content, brand and material it transmits to GetUp and does not infringe third-party intellectual property.

A breach of these warranties — by misstatement, omission or concealment — entitles GetUp to (i) terminate the MSA immediately, (ii) retain payments made to date, (iii) trigger the indemnity in section 8, and (iv) invoke remedies under Polish Civil Code art. 84 et seq. (mistake) and art. 86 (fraud).

In designing Custom Services, GetUp's exclusive intent is to deliver solutions that serve the Customer's stated lawful purposes, conform to professional software-engineering practice, and meet reasonable security standards. Under no circumstances is GetUp's intent to enable any unlawful use of the Deliverables; any such use is solely the Customer's act.

Accordingly the parties expressly and irrevocably agree that:

• Any liability, penalty, administrative sanction, damages, claim, investigation cost or reputational harm arising out of the Customer's unlawful, fraudulent, manipulative, regulatorily non-compliant, unethical or otherwise prohibited use of the Deliverables shall not be attributed to GetUp, AUTH sp. z o.o., its affiliates, directors, shareholders, employees, advisors, contractors or affiliates.
• After delivery, GetUp has no continuous duty to monitor, supervise or audit the Customer's operational use. The absence of such oversight does not constitute aiding, abetting or implicit consent to any unlawful Customer use.
• Where GetUp encounters credible, verifiable evidence of a criminal offence, GetUp may comply with mandatory reporting duties under Polish law; such compliance is not a breach of this MSA.

This section is to be construed in the light of Polish Civil Code art. 471 (contractual liability), art. 472 (duty of care) and art. 473 § 2 (limit on liability for wilful misconduct). GetUp's responsibility for damage caused by its wilful misconduct or gross negligence (wina umyślna lub rażące niedbalstwo) is preserved to the extent required by Polish mandatory law.

• SOW. Each Custom Service is documented in a separate SOW: scope, deliverables, acceptance criteria, milestone calendar, fee and payment plan, responsible team and communication channels. SOWs become binding on electronic acceptance.
• Acceptance. The Customer has 14 calendar days from delivery to perform acceptance testing. If no written rejection or change request is communicated within that period, the Deliverable is deemed accepted (in line with Polish k.c. art. 642–646 contractual acceptance).
• Change Requests. Out-of-scope requests are recorded as Change Requests and priced as an additional SOW or version upgrade.
• Bug-Fix Warranty. For 30 days from acceptance, GetUp will fix documented bugs in the Deliverable produced by GetUp at no charge, except where excluded in the SOW. The warranty does not apply to changes made by the Customer to the Deliverable.

• Pricing. Fees stated in the SOW are exclusive of VAT; Polish VAT (23%) or applicable EU reverse-charge rules apply.
• Payment. Unless otherwise stated, fixed-fee SOWs are 50% on kick-off and 50% on acceptance; subscription-bound SOWs are billed monthly via Stripe.
• Late Payment. Overdue amounts accrue interest under Polish k.c. art. 481 and the Act of 8 March 2013 on the Prevention of Excessive Delays in Commercial Transactions.
• Suspension. If payment is overdue by more than 15 days, GetUp may suspend Customer's use of the Deliverables or maintenance/support services after prior written notice.

• Background IP. Each party retains the IP it owned prior to the MSA. The Platform, the GetUp product name, libraries, architectural patterns and tooling remain the exclusive property of GetUp.
• Rights in the Deliverables. Unless otherwise stated in the SOW and after full payment of the relevant amount, GetUp grants the Customer a non-exclusive, worldwide, perpetual, non-transferable licence to use the Deliverables. Resale, white-labelling or distribution outside the Customer group requires an additional licence.
• Polish Copyright. Where the Deliverables fall under copyright, GetUp grants the Customer a licence pursuant to art. 50 and 64 of the Polish Act of 4 February 1994 on Copyright and Related Rights (Ustawa o prawie autorskim i prawach pokrewnych), only for the fields of exploitation (pola eksploatacji) explicitly listed in the SOW.
• Open Source. The Deliverables may include open-source components governed by their own licences. On request GetUp shares a list of known third-party dependencies.
• Customer Data. Data uploaded by the Customer to the Platform belongs to the Customer; GetUp processes it solely in the role defined in the DPA.

The Customer fully, unconditionally and irrevocably assumes, and shall indemnify and hold harmless (zwolnić z odpowiedzialności) GetUp, AUTH sp. z o.o., its affiliates, directors, shareholders, employees, advisors, contractors and group companies (collectively, the “Indemnified Parties”) against any direct, indirect, actual or potential damages, administrative fines, judgment amounts, reasonable defence costs (including attorney, advisor and expert fees), reputational damages, third-party claims and litigation costs arising out of:

1. (a) the Customer's use of the Deliverables or the Platform in violation of the Laws, third-party rights or this MSA;
2. (b) misleading, incomplete, fraudulent or unlawful information, requirements or data supplied by the Customer to GetUp;
3. (c) the Customer's failure to meet sectoral regulatory requirements (tax, financial services, healthcare, GDPR, e-invoicing, KSeF, export controls, sanctions);
4. (d) negligent, intentional or malicious acts by the Customer's staff, contractors or sub-contractors;
5. (e) defects arising from undisclosed modifications made by the Customer to the Deliverables;
6. (f) the Customer's inability to perform its own contractual obligations to its end-users, customers or business partners by means of the Deliverables.

On a claim, action or investigation against an Indemnified Party: (i) the Indemnified Party promptly notifies the Customer; (ii) the Customer appoints qualified defence counsel of its choice (subject to the Indemnified Party's reasonable objection); (iii) the Indemnified Party reasonably co-operates; (iv) the Customer cannot enter into any settlement that contains an admission, acknowledgment or stipulation without GetUp's prior consent.

This section survives termination of the MSA. Under Polish law, this clause operates as an assumption of debt / indemnity (zwolnienie z długu / indemnity) compatible with k.c. art. 392 (undertaking on behalf of a third party).

• Professional Care. GetUp warrants that it will deliver the Deliverables in line with generally accepted software-engineering practice and that they will meet the acceptance criteria stated in the SOW.
• Disclaimer. To the maximum extent permitted by the Laws, all other implied warranties — including merchantability, fitness for a particular purpose, uninterrupted operation and freedom from defects — are disclaimed.
• Liability Cap. The total contractual liability of either party arising out of this MSA or any SOW is capped at the Custom Services fees actually paid by the Customer to GetUp in the 12 months preceding the event giving rise to the claim.
• Excluded Damages. Neither party is liable for indirect, consequential, punitive, lost-profit, business-interruption, data-loss, lost-opportunity or reputational damages, save where mandatory provisions of Polish law require otherwise.
• Carve-Outs. The above limitations do not apply to (i) wilful misconduct or gross negligence, (ii) personal injury or death, (iii) liability owed to data subjects under GDPR, or (iv) the Customer Indemnity in section 8.

Confidentiality obligations are set out in a separate mutual Non-Disclosure Agreement (NDA), which is incorporated as an annex to this MSA. Electronic acceptance of the quote constitutes simultaneous acceptance of both documents. In case of conflict, the NDA's confidentiality provisions prevail.

The Customer specifically acknowledges that during the engagement it may gain access to non-public information about the Deliverables, the Platform's architecture, development processes, pricing, roadmap and customer list; unauthorised disclosure of such information triggers the remedies set out in the NDA.

Where Custom Services involve processing of personal data, the parties' processing relationship is governed by the GetUp DPA. The Customer acts as Controller (Administrator), GetUp as Processor (Procesor). See: getup.dev/dpa.

The Customer warrants that the data it shares may lawfully be processed under GDPR art. 6 (legal basis) and, where applicable, art. 9 (special categories), and that all required notices have been given to data subjects.

The Customer warrants that it will not use the Deliverables, or any data obtained through them, for purposes prohibited under (i) EU Council Regulation 833/2014 et seq. (Russia sanctions), (ii) UN Security Council sanctions lists, (iii) US OFAC SDN lists, or (iv) the EU dual-use goods regime (Regulation 2021/821).

GetUp reserves the right to refuse to ship Deliverables to a particular jurisdiction or to release them to a particular user where reasonable sanction-risk assessment so requires.

Neither party is liable for failure to perform caused by events beyond its reasonable control and unavoidable despite due care (war, civil unrest, natural disaster, epidemic, large-scale internet outage, government order, sanctions). The affected party promptly notifies the other; performance is suspended for the duration of the event. If a force-majeure event lasts more than 60 days, either party may terminate the MSA, refunding paid fees pro rata to outstanding work.

• Term. The MSA enters into force on electronic acceptance of the quote and remains in force until completion of the last active SOW.
• Ordinary Termination. Either party may terminate any SOW by giving 30 days' written notice; active SOWs continue under their own terms (unless otherwise specified).
• Termination for Cause. GetUp may terminate the MSA with immediate effect on notice if (i) the Customer breaches the lawful-use warranty, (ii) payment is overdue by more than 30 days, (iii) the Customer becomes insolvent or enters bankruptcy, (iv) export-control or sanctions risk indicators arise, or (v) the NDA is materially breached.
• Survival. Sections 3, 4, 7, 8, 9, 10, 11, 12, 16, 17 and 18 survive termination. The Customer pays unpaid amounts plus interest within 14 days.

• Assignment. The Customer cannot assign this MSA or any rights under it without GetUp's prior written consent. GetUp may assign the MSA on prior notice within reorganisations of the AUTH sp. z o.o. group.
• Subcontractors. GetUp may engage subcontractors within reasonable professional standards; GetUp remains liable for their acts.
• Independence. The parties are independent commercial actors; this MSA does not create an employment, partnership, joint venture or agency relationship.

Formal notice addresses for the purposes of this MSA:

• GetUp: legal@getup.dev (legal), privacy@getup.dev (data), support@getup.dev (operational)
• Customer: the contact email given in the quote and the address shown on the invoice

Pursuant to EU eIDAS Regulation 910/2014 art. 25 and Polish Civil Code art. 60–61, art. 78¹, the parties accept that electronic acceptance has the effect of written form and that signing the MSA electronically (the “Accept” action on the quote page) constitutes a binding declaration of will.

Recording of acceptance evidence (Audit Trail). The Customer expressly and irrevocably consents to GetUp collecting, storing and, where necessary, producing as evidence before competent authorities the following information attesting to the electronic acceptance:

• Timestamp of the acceptance (UTC) and session duration;
• IP address of the accepting device, and the approximate geolocation derived from it (country, region, city, latitude/longitude, time zone);
• Browser and device fingerprint (user agent, screen resolution, device pixel ratio, platform, hardware concurrency, navigator.languages, touch capability);
• Versions of the accepted documents (Terms, Privacy, DPA, MSA, NDA) and the record of which checkboxes were ticked;
• The Customer's quote token, email, contact name and company details.

These data are processed to evidence the Customer's express declaration of will and the formation of the contract. Legal bases: GDPR Art. 6(1)(b) (performance of the contract), Art. 6(1)(c) (legal obligation — eIDAS Regulation 910/2014's requirement to maintain reliable electronic evidence) and Art. 6(1)(f) (legitimate interest — proving the contractual relationship). Retention: up to six (6) years after the end of the contract, in line with the general limitation period under Polish Civil Code art. 118 et seq. The data are processed under the DPA and the Privacy Policy; the data subject's rights under GDPR Chapter III remain reserved (privacy@getup.dev).

This MSA is governed by the law of the Republic of Poland and directly applicable EU law. The United Nations Convention on Contracts for the International Sale of Goods (CISG) is expressly excluded.

Jurisdiction lies with the ordinary courts of the place of GetUp's registered seat (Sąd Rejonowy / Sąd Okręgowy w Warszawie) or, at the Customer's option, any other commonly competent Polish court. The parties shall first attempt to resolve any commercial dispute through good-faith negotiation; disputes not resolved within 30 days may be brought to court.

• Entire Agreement. This MSA, together with its annexes (SOW, NDA, DPA), the Terms of Service and the Privacy Policy, constitutes the entire agreement of the parties on the subject matter.
• Severability. If any provision is held invalid the remaining provisions remain in force; the invalid provision is to be construed in the closest lawful sense (Polish k.c. art. 58 § 3).
• No Waiver. Failure to exercise a right does not constitute a waiver of that right.
• Third-Party Beneficiaries. The Indemnified Parties are direct beneficiaries of section 8.
• Versioning. The current version of the MSA is 2026-04-19, published at getup.dev/enterprise-agreement. The Customer is bound by the version in force on the date of acceptance; subsequent versions apply only on the Customer's consent.