Mutual Non-Disclosure Agreement (NDA)

This NDA is concluded between the following parties; both parties act simultaneously as Disclosing Party and Receiving Party:

• GetUp: AUTH spółka z ograniczoną odpowiedzialnością (AUTH sp. z o.o.), Marszałkowska 58 / 15, 00-545 Warsaw, Poland. KRS: 0001043319 · NIP: 5273062913 · REGON: 525652590.
• Customer: the legal person or registered business entity to whom the quote is addressed and which signs this NDA by electronic acceptance.

The purpose is to protect non-public information shared mutually during the Custom Services lifecycle under the MSA (scoping, development, integration, audit, support).

“Confidential Information” means all non-public or not-readily-available information disclosed by one party to the other or obtained in the context of the MSA, in oral, written, electronic, visual or any other form, including without limitation:

• From GetUp: source code (existing/developed), architecture, data models, KSeF integration details, builds, documentation, product roadmap, pricing structure, pricing-negotiation history, customer list, customer usage behaviour, financial data, organisation structure, subcontractor list, security control details, vulnerabilities, security tests, penetration-test results, keys, secrets, audit-log content, demo access credentials.
• From Customer: trade secrets, business process flows, customer/supplier list, tax structure, margin and pricing information, sales strategy, employee list, organisation chart, financial reports, business plans, legal proceedings, personal-data inventory, KSeF records (in conjunction with rules under the DPA).
• Joint: letters of intent exchanged in negotiation, plans, price quotations, scope documents, internal meeting notes, prototypes, mockups, draft contracts.

Failure to mark information as “confidential” does not strip protection from information that a reasonable person would, given its nature, treat as confidential (objective confidentiality test in line with UZNK art. 11).

The Receiving Party is excluded from NDA obligations only to the extent it can demonstrate that the information:

1. (a) was already publicly available at the time of disclosure;
2. (b) became publicly available subsequently without fault of the Receiving Party;
3. (c) was already in the Receiving Party's possession before disclosure, evidenced by written records;
4. (d) was lawfully obtained from a third party not under a confidentiality duty;
5. (e) was independently developed by the Receiving Party without reference to the Confidential Information.

Disclosure compelled by mandatory order of a competent authority (court, tax authority, UODO, prosecutor) is not deemed outside scope; however, the Receiving Party will, where legally possible, give the Disclosing Party prior written notice and allow time to seek protective measures.

The Receiving Party shall, with respect to Confidential Information:

• (a) Strict protection. Apply at least the same degree of care it applies to its own most sensitive information, and in any event reasonable, professionally accepted measures, including but not limited to access restriction, encryption, password storage, and processing only on corporate devices.
• (b) Limited use. Use Confidential Information only to evaluate, negotiate, develop, deliver, audit and maintain the Custom Services under the MSA (the “Permitted Purpose”), and for no other purpose.
• (c) Need-to-know. Disclose Confidential Information only to its employees, officers and pre-approved subcontractors who need to know it for the Permitted Purpose, and who are bound by written confidentiality obligations at least as protective as this NDA, or by statutory confidentiality duties.
• (d) No re-disclosure. Without prior written consent of the Disclosing Party, the Receiving Party will not disclose Confidential Information to any third party, news outlet, social-media post, blog, tweet, podcast, conference or academic paper.
• (e) No reverse-engineering. The Receiving Party shall not reverse-engineer, decompile or disassemble any software, algorithm, data structure or infrastructure within Confidential Information (save where mandatory law allows).
• (f) No reference use. The Receiving Party shall not refer to the Disclosing Party's collaboration, product integration, pricing or the existence of the MSA in references, case studies, presentations, sales pitches or investor materials without prior written consent.

The parties acknowledge that a substantial portion of the Confidential Information constitutes a trade secret within the meaning of the Polish Act on Combating Unfair Competition (Ustawa o zwalczaniu nieuczciwej konkurencji, 16 April 1993, art. 11) and EU Directive 2016/943, in that:

• The Disclosing Party has taken reasonable measures to keep it confidential (access controls, NDAs, labelling).
• It is not generally known or readily accessible to those circles to whom it would be of value.
• It has commercial value because of its confidentiality.

A breach may attract Polish-law remedies up to and including criminal liability, plus claims under UZNK art. 18 (injunctions, recall, restitution, account of profits).

The Receiving Party shall apply at minimum the following measures to protect Confidential Information:

• TLS 1.2+ encryption in transit; disk-level encryption at rest.
• Strong passwords and, where possible, two-factor authentication on devices and access points.
• No unnecessary use of paper printouts, personal devices, personal email, public cloud storage or consumer messaging apps.
• Written notice within 24 hours of any suspected breach.
• Immediate revocation of access on staff departure; recall of any token, key or extension.

In the event of a material breach of this NDA (in particular unauthorised disclosure, misuse of trade secret, reverse-engineering, unauthorised announcement), the Disclosing Party is entitled to a contractual penalty (kara umowna) under Polish Civil Code art. 483 et seq. The contractual penalty is set at EUR 50,000 per material breach, or 50% of the total fees paid under the MSA in the preceding 12 months, whichever is higher.

The contractual penalty does not exclude additional damages where the actual loss exceeds it (k.c. art. 484 § 1). The Disclosing Party may also seek:

• Compensation for non-material (personal-rights) damages (k.c. art. 23, 24, 448);
• Injunctions, recall, public statements, account of profits under UZNK art. 18;
• Restitution of any unjust enrichment (k.c. art. 405);
• Interim relief (zabezpieczenie) under k.p.c. art. 730 et seq.;
• Any other lawful remedy designed to halt the breach.

The breaching party shall reimburse all reasonable defence and enforcement costs (lawyer, advisor, expert, translator).

Unauthorised disclosure of Confidential Information may cause both material (financial) and non-material (personal-rights) damage to natural persons connected with the Disclosing Party or identifiable through it — in particular owner(s), members of the management board, founders, shareholders, employees, advisors, customers and business partners. The Receiving Party undertakes to compensate such damage directly and indirectly, in full.

Material (financial) damages (k.c. art. 361, 415 and 471): loss of income, lost profits (lucrum cessans), loss of employment, terminated contracts, lost investments, decline in share value, lost customers/partners, legal/administrative defence costs, relocation costs and any other measurable financial loss suffered by such persons or by the Disclosing Party as a result of the disclosure.

Non-material (personal-rights) damages (k.c. art. 23–24, 448): harm to name, reputation, privacy, dignity, image, secrecy of correspondence and professional standing of such persons; emotional distress, harm to health, and loss of social or professional standing caused by the disclosure.

On a breach the Receiving Party assumes the following obligations cumulatively:

• Material damages (odszkodowanie): full compensation of the financial loss of the connected persons — k.c. art. 361 § 2 (damnum emergens + lucrum cessans);
• Non-material damages (zadośćuczynienie): an appropriate sum of money under k.c. art. 448 for the infringement of personal rights;
• Corrective publication: publication of corrective statements in the form and outlet reasonably specified by the Disclosing Party or the affected persons to address the consequences of the breach;
• Destruction of copies: destruction of every existing physical and digital copy, backup and derivative content;
• Costs: judicial fees, reasonable legal fees, expert/advisor fees and the costs of any out-of-court settlement.

The connected persons are direct beneficiaries of this clause within the meaning of k.c. art. 393 (contract for the benefit of a third party) and art. 449, and may bring claims directly against the Receiving Party. The Disclosing Party additionally reserves the right to claim on its own behalf or on behalf of those persons.

These remedies are cumulative with, and not in lieu of, the contractual penalty in section 7; all amounts may be claimed cumulatively under k.c. art. 484 § 1.

On termination of the MSA, written request of either party or completion of the Permitted Purpose, the Receiving Party shall, within 30 calendar days:

• Return or destroy all physical and digital copies of the Confidential Information;
• Copies remaining in backup systems are protected for the lifecycle of the backup and destroyed on natural expiry;
• Provide, on request, a destruction certificate signed by an authorised representative;
• Documents under mandatory legal retention (tax, KSeF, evidence in legal disputes) are stored confidentially for the legal retention period.

The confidentiality obligations apply:

• (a) from disclosure throughout the term of the MSA, and
• (b) for five (5) years after the MSA terminates for any reason.

For information that constitutes a trade secret, the obligation is indefinite for as long as the information retains its trade-secret character (UZNK art. 11 and k.c. art. 721). Personal-data obligations follow the GDPR and DPA retention periods.

No disclosure of Confidential Information grants any implied or express licence, transfer or ownership right in the disclosed material. All rights remain with the Disclosing Party. Reverse engineering, derivative creation or use for IP filings is expressly prohibited.

Neither party shall issue press releases, social-media posts, investor presentations, case studies or public events about the existence of the MSA, the establishment of the commercial relationship or the nature of the cooperation, save by joint prior written agreement. Standard customer-logo listings require prior written consent.

Where Confidential Information includes personal data, the parties' data-protection roles and responsibilities are governed by the DPA. This NDA shall not be construed to limit any rights of data subjects under GDPR or Polish data-protection law; rather, it is to be interpreted to support those rights.

Acquiring Confidential Information through deceit, surreptitious backups, third-party fronts, copying during staff departure or similar bad-faith methods constitutes a serious breach within the meaning of k.c. art. 86 (fraud) and UZNK art. 11–18, entitling the other party to immediate termination, contractual penalty, additional damages and criminal-law remedies.

The parties retain the right to seek interim relief, evidentiary preservation and judicial protection under Polish k.p.c. art. 730 et seq. against actual or imminent unauthorised disclosure. Seeking such relief does not prejudice the contractual-penalty or damages claims.

• Independence. Signing this NDA does not place the parties in partnership, joint venture or employment; it sets the boundaries for the sharing of Confidential Information.
• Assignment. Neither party may assign this NDA without the other's written consent; reorganisation within the AUTH sp. z o.o. group is excepted.
• Entire agreement. Together with the MSA, DPA, Terms of Service and Privacy Policy, this NDA constitutes the parties' entire agreement on confidentiality.
• Severability. Invalid provisions do not affect the rest (k.c. art. 58 § 3).
• Governing law. Polish law and directly applicable EU law.
• Jurisdiction. Sąd Rejonowy / Sąd Okręgowy w Warszawie, or any other Polish court of general jurisdiction.
• Versioning. The current version of this NDA is 2026-04-19, published at getup.dev/nda.
• Acceptance evidence. The Customer acknowledges that, on electronic acceptance, GetUp collects and stores the timestamp, IP address, IP-derived approximate geolocation (country/region/city/coordinates/time zone), browser and device fingerprint, the accepted document version and the record of ticked checkboxes, in order to evidence formation of the contract. Legal bases: GDPR Art. 6(1)(b), 6(1)(c) (eIDAS 910/2014) and 6(1)(f). Retention: up to six (6) years after termination, in line with Polish k.c. art. 118 et seq. Details: DPA and Privacy Policy.