Institutional Services Agreement

This Institutional Services Agreement ("Agreement") is entered into as of the date Customer accepts it under Section 0 between FindBack AI LLC, a Virginia limited liability company (SCC ID 12098813), P.O. Box 2801, Woodbridge, VA 22195 ("FindBack"), and the institution identified in an Order Form or verified online registration ("Customer").

Definitions:

• "FindBack" means FindBack AI LLC.
• "Customer" means the institution identified in an Order Form or verified online registration.
• "Consumer" means an individual using the public service.
• "Service" means the hosted lost-and-found platform.
• "Customer Data" means item, staff and operational information supplied by Customer.
• "Order Form" means an accepted written commercial schedule.
• "Pilot" means the 30-day free evaluation.

0. Acceptance, authority and order of precedence

0.1 A private-sector Customer accepts this Agreement by either:

(a) an affirmative, unchecked-by-default checkbox adjacent to conspicuous links to the Agreement, Data Processing Addendum and applicable schedules; or

(b) execution of an Order Form incorporating it.

The individual represents that they are at least 18 and have actual authority to bind Customer. FindBack may verify that authority and defer activation.

0.2 FindBack will retain the accepted document version, hash or immutable copy, user identity, organization, timestamp, consent wording and relevant audit evidence, and will provide a copy by email. A domain-based email alone does not establish authority.

0.3 The Public Sector Addendum applies to covered public entities. No employee is personally obligated by accepting for an entity. For payment obligations of public entities, a duly authorized written Order Form, purchase order or other lawful authorization is required.

0.4 In a conflict, the following prevail in this order:

1. mandatory law and signed public-sector terms;
2. a negotiated signed Order Form;
3. the Public Sector Addendum;
4. the DPA, for personal-data processing;
5. this Agreement.

A signed negotiated amendment controls over online terms.

1. Services and AI matching

1.1 FindBack provides an institutional portal, desk intake, candidate AI matching, claim workflow, in-platform messages, handover scheduling and reports, subject to the plan and the documented features actually available. No particular match, recovery or ownership determination is guaranteed.

1.2 Customer makes all final decisions on legal ownership, lawful release, retention and disposal, using appropriate human review. AI scores and suggested matches are decision support only; Customer shall not rely on them as conclusive evidence.

1.3 Included desks, seats, volume limits, integrations and support commitments appear in the Order Form. No overage fee applies unless its amount and trigger are expressly disclosed and accepted in writing.

1.4 FindBack does not take physical custody of, store, pack or deliver property. Optional return-label sales and payments under Section 1.5 are exceptions to any general statement that FindBack never receives payments. FindBack remains responsible for its own platform, payment, label-procurement and data-handling conduct as required by law.

1.5 Optional shipping and courier releases

1.5.1 Customer may enable mail returns only after an authorized Manager or Owner accepts the shipping-specific terms and the function is operationally approved. An approved claimant may select an eligible USPS Hold for Pickup location or supported parcel locker; free in-person collection remains available. Customer may refuse shipment before carrier acceptance when lawful and reasonable.

1.5.2 At checkout, FindBack will separately disclose postage, its service fee, applicable taxes and the total. The Consumer pays FindBack via its processor; FindBack purchases the label as the stated return-service seller. Customer does not collect Consumer payment through the Service. This description is not a legal determination of money-transmission status.

1.5.3 Customer will verify the release, inspect and package with reasonable care, document the item's condition and the sealed parcel, affix the correct label and tender the parcel within ten days, subject to applicable law. Customer shall not tender prohibited or restricted items, including identity documents, payment cards, cash, medication, jewelry, high-value items or hazardous materials, unless expressly eligible under carrier rules and FindBack's product restrictions. Carrier lithium-battery and dangerous-goods rules control.

1.5.4 A carrier acceptance scan is evidence of transfer to carrier custody. It does not release either party from liability for its own prior wrongful release, negligent packaging, inaccurate label, misrepresentation, payment error or other actionable conduct. Carrier liability and included coverage depend on the purchased service and actual terms; no fixed $100 coverage is promised. FindBack will identify, in its consumer shipping terms, the party entitled to submit a carrier claim and a process for passing recoveries to the Consumer.

1.5.5 If a shipment is cancelled or refused before carrier acceptance, or a usable label is not provided, FindBack will issue the refund required by the disclosed consumer shipping terms and applicable law. The parties will coordinate returns of undeliverable parcels and document restored custody.

1.5.6 This template imposes no exclusivity in shipping. Any preferred-provider or eligible-item commitment requires a separate, conspicuous, negotiated addendum, procurement and competition review, and a public-sector exception.

1.5.7 Owner-arranged courier collection is disabled unless enabled in the Service and covered by consumer disclosures. If it is enabled, Customer verifies the one-time release code and records the minimum necessary courier details. The code alone does not waive the parties' responsibility for negligent release.

2. Customer obligations and found-property compliance

2.1 Customer controls approval roles and two-person verification settings; its designated personnel make claim and release decisions. The default product settings permit Staff approvals and require additional approval for specified high-value and device categories, but Customer can modify those settings. Customer must train staff and enforce its own risk policies.

2.2 Customer shall:

• avoid publishing government identifiers, financial credentials, addresses or sensitive third-party information in public item descriptions;
• use private fields appropriately; and
• promptly revoke departing staff access.

2.3 Customer is responsible for applicable local and state found-property custody, holding periods, notices, police turnover, records and disposal. FindBack does not acquire title to, possession of, or proceeds from unclaimed property. Neither a 30-day software Pilot nor a default software retention setting changes statutory holding periods.

3. Consumers and communications

3.1 Consumers are governed by separate Consumer Terms and a Privacy Notice; this Agreement does not bind Consumers to shipping terms that have not been presented to them. Customer may access Consumer data only to investigate and resolve legitimate claims, and must use in-platform communications except where law or an approved process requires otherwise.

3.2 Neither FindBack nor Customer will send marketing SMS or automated calls without independently evaluating applicable consent and messaging rules. This Agreement represents no present SMS functionality.

4. Fees, thirty-day pilot and paid conversion

4.1 Pilot duration. A qualified new Customer receives a thirty (30) calendar-day free Pilot, beginning on the date the institutional workspace is activated and access is provided to Customer. No credit card is required to register. No institutional subscription fee is charged during the Pilot. Optional Consumer-paid return shipping is separate and is not free postage.

4.2 One Pilot is generally available per legal entity. FindBack may verify work-domain identity, authorize exceptions for shared government domains and smaller institutions, and prevent abuse after reasonable notice and an opportunity to respond where practicable. The organization may cancel without a subscription fee during the Pilot.

4.3 Conversion rule (pre-authorized conversion). A paid subscription begins only on the basis of an authorized Customer representative's express, documented authorization. When registering the Pilot in the Service, the representative:

• selects a disclosed plan, billing interval and price;
• is shown the Pilot end date on which that plan starts; and
• expressly agrees, by an unchecked-by-default checkbox, that the selected plan starts on that date unless Customer cancels or changes it in the Service before then.

Silence, non-cancellation or mere continued access, without that express advance authorization, does not create a paid subscription. For public entities, Exhibit D.2 applies: no conversion without the required purchase order or other lawful approval.

4.4 FindBack will send notices approximately seven and two days before the Pilot expires. They will identify the end date, the selected plan, the price, how to change or cancel the plan in the Service without charge, and how to export data. If Customer cancels before the Pilot ends, or no plan was authorized, the workspace enters a limited read-only or safe-closure mode instead. That mode preserves the access needed for pending claims, lawful custody records and export for at least thirty days, subject to security and law.

4.5 Invoices for authorized paid plans are due thirty days after a proper invoice unless the Order Form states otherwise. Disputed charges may be raised in good faith within 30 days; undisputed amounts remain due. Late fees, interest, suspension thresholds, taxes and renewal mechanics require disclosure in the Order Form and applicable-law review.

4.6 No institutional subscription fee is incurred during the Pilot. A fee is incurred only after the Pilot ends, under a plan that an authorized representative expressly authorized under §4.3 and did not cancel before the Pilot ended.

5. Data protection and security

5.1 The Data Processing Addendum in Exhibit A forms part of this Agreement. Customer generally determines the purposes for institutional item and staff data, and FindBack acts as processor or service provider for those processing activities. FindBack may act as independent controller or business for separately collected Consumer account and transaction data, as described in the applicable privacy notice. Roles must be validated by data-flow mapping.

5.2 FindBack will implement the specific technical and organizational safeguards actually listed in the executed Security Schedule. No unsupported SOC 2 certification, security audit, breach-notice deadline or encryption claim is incorporated by implication.

5.3 Subprocessors, international transfers, incident notices, assistance with rights requests, retention, deletion and audit mechanisms are governed by Exhibit A. Customer shall not upload data beyond lawful, necessary categories. Each party shall comply with applicable privacy and breach-notification law.

6. Intellectual property and data rights

6.1 FindBack and its licensors retain rights in the Service, software, algorithms, matching models, interfaces, documentation, trademarks and improvements. Customer receives a nonexclusive, nontransferable, limited right to use the Service for authorized internal lost-property operations during the term, subject to public-sector procurement terms.

6.2 Customer retains its rights in Customer Data. Customer grants FindBack a limited license to host, process, display and transmit Customer Data solely to provide, secure, support and lawfully improve the contracted Service, subject to the DPA. Customer Data is not used to train general-purpose or shared AI models without separate written authorization and an appropriate privacy and legal basis.

6.3 Aggregated or de-identified analytics may be used only where reasonably designed not to identify individuals or reveal Customer confidential information, with appropriate safeguards against re-identification. No irrevocable perpetual license to raw Customer Data is granted.

6.4 Customer may use FindBack marks only as approved. FindBack may publish Customer's name or logo in external marketing only with prior written consent. Customer grants FindBack a nonexclusive, royalty-free license to use voluntary feedback to improve the Service, without disclosing Customer confidential information. Neither party transfers ownership of third-party IP.

6.5 Customer shall not reverse engineer, resell, scrape, bypass controls or attempt unauthorized access, except to the extent a prohibition is unenforceable under applicable law. FindBack will provide an IP infringement defense subject to Section 9 and the stated remedies.

7. Service levels and support

7.1 The Order Form may state additional uptime targets, exclusions, support channels and remedies. Unless an Order Form expressly provides an SLA, no numerical availability guarantee or service credit applies. FindBack will use commercially reasonable efforts to provide reliable access, and advance notice of planned maintenance when practicable.

7.2 Emergency maintenance, security incidents, carrier outages and third-party failures will be communicated according to the agreed support schedule. No guarantee of uninterrupted operation is made.

8. Warranties and disclaimers

8.1 Each party warrants its authority to contract. FindBack warrants that, during a paid term, the Service will materially conform to its current written specifications, subject to prompt notice and a reasonable opportunity to correct. FindBack will use commercially reasonable efforts to repair or provide a workaround. If a material nonconformity persists for 30 days after notice, Customer may terminate the affected paid Service and receive a pro rata refund of prepaid unused subscription fees.

8.2 FindBack does not guarantee recovery, match accuracy, legal ownership or a particular carrier delivery time. Disclaimers do not waive nonwaivable statutory rights or liability for actionable misconduct.

9. Liability, indemnities and insurance

9.1 Subject to law and agreed exceptions, neither party is liable for remote consequential losses such as lost profits. Each party's aggregate ordinary contractual liability is limited to the greater of (a) the fees paid or payable under this Agreement in the preceding twelve months and (b) US$10,000. A free Pilot therefore does not create a zero-dollar liability cap.

9.2 The ordinary cap does not apply to fraud, willful misconduct, gross negligence, or liabilities that cannot lawfully be limited. A separate aggregate cap of US$100,000 applies to each party's confidentiality and data-security breaches and to FindBack's IP indemnity, except to the extent applicable law requires a higher amount. Public-sector terms prevail where applicable.

9.3 Indemnities.

• Customer shall defend third-party claims to the extent caused by its unlawful custody, handling or wrongful release of property, or by its material breach, except to the extent caused by FindBack.
• FindBack shall defend covered third-party claims alleging that the unmodified Service infringes U.S. IP rights, or arising from FindBack's material breach of its agreed data-protection duties, subject to agreed carve-outs.
• Conditions for each indemnity: prompt notice; reasonable cooperation; defense control; no settlement imposing admissions or nonmonetary obligations without consent; and allocation by fault.
• Government indemnities apply only as law permits.

9.4 Insurance. FindBack will not represent that insurance is in force unless a valid certificate confirms it. Before entering a paid institutional contract that requires coverage, FindBack will procure:

• commercial general liability coverage of at least US$1 million per occurrence; and
• technology errors-and-omissions / cyber coverage of at least US$1 million per claim;

or negotiate an expressly disclosed alternative in the Order Form. Coverage obligations take effect only when the policies are confirmed as bound.

10. Term, suspension and exit

10.1 The Pilot ends after 30 days and converts only as pre-authorized under Section 4.3. A paid initial term, renewal interval and cancellation notice are stated in the Order Form; no undisclosed automatic renewal applies. Public-sector renewals require authorized approval.

10.2 Either party may terminate for material breach not cured within 30 days after notice, unless law or the public-sector contract provides otherwise. FindBack may restrict access immediately to address credible fraud, security threats or unlawful use. It will use a proportionate process and protect pending property claims where reasonably possible.

10.3 On expiry or termination, Customer may obtain a no-charge export of item records and photographs, in a usable format, during the 90-day exit window in Exhibit A.7, subject to lawful restrictions on Consumer data. Data deletion, legal holds, backups and audit-log retention follow Exhibit A and applicable law. FindBack may retain de-identified operational audit information for up to two years, unless applicable law requires a different retention period.

11. Confidentiality and general terms

11.1 Each party shall protect the other's nonpublic confidential information using reasonable care and use it only for the purposes of this Agreement. The exceptions are information that is independently developed, public, lawfully received or legally compelled, with advance notice of compelled disclosure where lawful. Public-records obligations prevail under Exhibit D.

11.2 Material amendments require at least 30 days' notice, and affirmative agreement where law or contract requires it. Material changes that reduce Customer's rights apply only after the relevant renewal or a written amendment. Government amendments require lawful written approval.

11.3 For private Customers, Virginia law applies, excluding conflicts rules, and disputes go to the courts in Prince William County, Virginia, or to the United States District Court for the Eastern District of Virginia if it has jurisdiction. Public entities are governed by Exhibit D and mandatory law. The parties will first attempt good-faith executive resolution for 30 days, without delaying emergency relief or statutory deadlines.

11.4 Assignment, notices and force majeure.

• Neither party assigns this Agreement without consent, which may not be unreasonably withheld, except in an approved business succession subject to data and public-sector restrictions.
• Notices go to designated administrative and legal contacts.
• Force majeure excuses delay only to the extent caused by events beyond reasonable control, and never excuses payment already due. The affected party mitigates and notifies promptly.

11.5 Invalid terms are severed only to the extent necessary, and the remaining terms survive. This Agreement, executed schedules and Order Forms are the entire agreement. Provisions concerning IP, confidentiality, accrued payment, lawful records, indemnities, limitations and dispute resolution survive as applicable. Electronic signatures and counterparts are permitted, subject to law.

Exhibit A — Data Processing Addendum

Forms part of the Agreement.

A.1 Scope, roles and instructions.

• For institutional item records, staff information and claim-review data processed on Customer's instructions, Customer determines the purposes and means of processing. FindBack acts as processor or service provider to the extent applicable law assigns those roles.
• For independently collected Consumer accounts, checkout and direct support, FindBack may be an independent controller, as determined by actual data flows and its Consumer Privacy Notice.
• Each party remains responsible for its own legal obligations.
• Processing instructions consist of this Agreement, the completed Order Form, documented product settings, and lawful written instructions consistent with the Service.

A.2 Processing schedule.

• Subject matter: hosted lost-and-found intake, matching, ownership review, messaging, return coordination and analytics.
• Purpose: provide and secure the contracted Service and support lawful item recovery.
• Duration: during the Agreement and the documented exit and retention period.
• Data subjects: Customer staff, finders, claimants, Consumers and relevant courier contacts.
• Data categories: business contact information, item descriptions and photographs, claims and messages, verification evidence, activity and audit logs, shipping pickup details where enabled, and limited device and account metadata.
• Sensitive data: no intentional collection of SSNs, full payment-card credentials, passport images, health data or other highly sensitive categories, absent a separately approved documented workflow.
• Processing operations: collect, host, organize, search, match, disclose to authorized parties, secure, export and delete.

A.3 Confidentiality and security.

• FindBack shall restrict access to personnel and approved subprocessors under confidentiality duties.
• FindBack shall maintain, commensurate with the risks:
  • access controls and least privilege;
  • appropriate authentication;
  • logging;
  • backup and restoration procedures;
  • vulnerability management;
  • secure development practices; and
  • an incident response plan.
• Encryption commitments and other implementation details shall be recorded in Exhibit C after technical verification.
• No SOC 2 certification or other external attestation is represented unless documented.

A.4 Incident notification and cooperation.

• FindBack shall notify Customer without undue delay after identifying a credible actual or reasonably suspected security incident involving Customer Personal Data, using a 24-hour internal escalation target for material incidents. This operational target is not a universal statutory reporting deadline.
• Notice may be preliminary and shall be supplemented as facts become available.
• FindBack will preserve relevant evidence, mitigate harm and assist Customer with legally required notifications.
• Each party determines and fulfills its own statutory obligations, including Code of Virginia § 18.2-186.6 where applicable.
• Neither party shall delay legally required notification merely because an investigation continues.

A.5 Subprocessors and transfers.

• FindBack shall maintain an up-to-date list of subprocessors, with their function and processing location, and provide it to Customer before production processing.
• New subprocessors must be bound by written terms imposing materially equivalent confidentiality, security and data-protection obligations. FindBack remains responsible for their contractual performance.
• FindBack will give at least 30 days' notice of a new material subprocessor where practicable. Customer may object on reasonable data-protection grounds and may terminate the affected Service if no reasonable resolution is reached.
• Cross-border transfers shall occur only with legally required safeguards.

A.6 Assistance, assessment and audit.

• To the extent applicable law requires, including Code of Virginia § 59.1-579 where applicable, FindBack shall reasonably assist Customer with rights requests, security and breach obligations, and data-protection assessments.
• FindBack shall provide relevant compliance information, and cooperate with reasonable assessments or an appropriate independent-assessment alternative, subject to confidentiality, security and proportionality protections.
• On-site audits require a separate agreement unless law mandates them.

A.7 Return, deletion and legal holds.

• Exit window. On expiry or termination, including a Pilot that ends without an authorized paid plan, a cancellation, or an invoice unpaid after its grace period, the workspace becomes read-only for an exit window of ninety (90) days. During it, Customer may export institutional item records and photographs without charge, in a usable format, and pending Consumer claims and returns continue. Export is subject to restrictions protecting independent Consumer data and other persons. Paying for a plan during the window ends it.
• Notices. FindBack will notify Customer's owners, managers and billing contact when the exit window starts, and approximately thirty (30) and seven (7) days before it ends.
• Deletion. At the end of the exit window, FindBack will delete Customer's item records, photographs, custody logs, locations and staff access. Records on which an independent Consumer claim or a Consumer-paid mail return depends are retained without Customer's identifying details, for the Consumer retention periods in FindBack's Privacy Policy. At Customer's written direction, FindBack shall return or delete Customer Personal Data sooner, unless law requires retention.
• Backups. Backups are encrypted, isolated, used only to restore the Service, and expire within thirty (30) days after deletion. They are not used to restore data that was deleted.
• Audit records. Security audit records are kept for two (2) years, then deleted.
• Legal holds. Deletion is suspended while a documented legal hold applies (a litigation hold, a records or law-enforcement preservation request, or fraud prevention), for the period it requires. FindBack will tell Customer of a hold on Customer Data unless law prohibits it.
• Customer's records. Customer remains responsible for keeping any record it must retain under its own records schedule or applicable law, including public-records retention schedules. Exporting before the exit window ends is the means to do so.

A.8 Model training and de-identification.

• FindBack shall not use identifiable Customer Personal Data to train a general-purpose or shared AI model without a separate written authorization and an appropriate legal basis.
• De-identified statistics may be used only with controls against re-identification and against disclosure of Customer confidential information.

Exhibit B — Institutional Order Form

The institutional Pilot is free for thirty (30) calendar days, and no payment card is required at signup. No institutional subscription fee is due during the Pilot. The Pilot converts to a paid subscription only as pre-authorized under §4.3, by an authorized representative's affirmative, documented election, together with any required public-sector procurement authorization. Customer may cancel or change the plan before the Pilot ends without charge. Optional Consumer-paid shipping is disclosed separately. By signing the paid-plan election below, Customer affirmatively authorizes the specified charges from the paid service commencement date. Without a signature or a recorded equivalent affirmative acceptance, no paid subscription begins.

Exhibit C — Security, Support and Operational Commitments

C.1 Security baseline. FindBack will maintain:

• reasonable access controls;
• least-privilege permissions;
• encrypted connections;
• logging of privileged activity;
• backups appropriate to operational needs; and
• incident-response procedures.

This schedule does not represent SOC 2 certification or an independent audit.

C.2 Customer duties. Customer manages:

• staff access;
• password and SSO hygiene;
• staff training;
• lawful data entry;
• device security; and
• prompt reporting of suspected compromise.

C.3 Support. FindBack provides email-based support during its published business hours, with priority triage for suspected security incidents and service outages. Specific response-time commitments and service credits apply only if expressly listed in the Order Form.

C.4 Security disclosures. Before paid enterprise or public-sector execution, FindBack will provide Customer with:

• its current security summary;
• its subprocessor list;
• an incident contact; and
• any negotiated security annex.

No unsupported certification or specific recovery time is promised.

C.5 Required before production publication. Attach a dated and approved control inventory identifying:

• the actual hosting provider and region;
• encryption in transit and at rest;
• identity and MFA policies;
• role-based access;
• logging and retention;
• backup and restore frequency, with test evidence;
• vulnerability patching;
• subprocessors;
• incident contacts;
• penetration-testing status;
• data deletion and backups; and
• disaster-recovery objectives.

These are verification fields, not assertions that the controls already exist.

Exhibit D — Public Sector Addendum

D.1 Coverage. This Addendum applies to U.S. federal, state and local governments, public schools, public higher-education institutions and Tribal entities, acting in an official capacity, but only to the extent each is legally covered. Classification and contracting authority must be confirmed. It prevails over conflicting commercial terms.

D.2 Authority and payment.

• Government staff are not personally liable.
• Only duly authorized officials may incur payment or renewal obligations.
• There is no Pilot-to-paid conversion, automatic renewal or expansion without a required purchase order, written modification or other lawful approval.

D.3 Federal Customers. Federal law and the underlying procurement instrument govern federal Customers. There is no mandatory private arbitration, no unilateral material amendment and no prohibited unilateral suspension. Applicable federal supplier-agreement overrides control, including GSAR 552.212-4(w) where incorporated.

D.4 State and local Customers.

• Applicable public-entity law controls, including sovereign immunity, appropriations, forum, records disclosure, accessibility, retention and procurement rules.
• No Customer indemnification beyond legal authority.
• FindBack's supplier obligations and liability limits must conform to the actual procurement instrument and applicable law.
• Virginia Code § 2.2-2012.1 is limited by its statutory scope to major IT project procurement, and must not be treated as a universal 2× minimum.

D.5 Public records and funding. Public-records laws permit disclosure of agreements and prices. FindBack may identify trade secrets as allowed but cannot guarantee nondisclosure. Government may terminate for nonappropriation, subject to law and written notice.

D.6 Shipping, assignment and other matters.

• Shipping terms and any preferred-provider language do not override property, procurement or safety rules. The Customer may decline an otherwise eligible shipment if its policies or applicable law prohibit it.
• Governing law, forum, assignment, taxes, accessibility, security, records retention, procurement, audit and dispute requirements follow the relevant agency and the governing procurement contract.
• The agency-specific negotiated instrument controls where mandatory.

Exhibit E — Virginia Law and Data Security Rider

Supplements this Agreement and is incorporated by reference when identified in the accepted Agreement or Order Form.

• For a Virginia private-sector Customer, this Exhibit governs any conflict on its specific subject matter, subject to nonwaivable law and the applicable DPA.
• For Virginia public entities, the Public Sector Addendum and applicable procurement law take priority.
• This Rider does not certify that technical controls or insurance coverage exist.

E.1 Virginia statutory compliance and scope.

• Each party shall comply with the Virginia statutes applicable to its own conduct, including:
  • Virginia Code § 18.2-186.6, where its conditions are met;
  • the Virginia Consumer Data Protection Act (VCDPA), §§ 59.1-575 through 59.1-585, where applicable; and
  • the Virginia Consumer Protection Act, §§ 59.1-196 et seq., to the extent applicable to a transaction.
• A contractual promise to comply does not enlarge or eliminate statutory scope, exemptions or rights.
• FindBack will assess VCDPA applicability annually, based on statutory thresholds, covered processing and exemptions. Its Virginia location alone does not establish that the VCDPA applies.
• Other jurisdictions may impose additional obligations notwithstanding this Rider.

E.2 Security incidents and Virginia breach notification.

• FindBack shall maintain a documented incident-response process.
• FindBack shall notify an affected Customer without undue delay after discovering an actual or reasonably suspected unauthorized access to, or acquisition of, Customer Personal Data maintained by FindBack.
• The parties adopt a 24-hour operational escalation target, running from when FindBack determines that a credible incident may affect Customer Personal Data. This is not a representation that Virginia imposes a universal 24-hour statutory notice deadline.
• FindBack shall promptly provide reasonably available incident facts, affected data categories, containment measures and material updates. It shall preserve relevant evidence and cooperate in determining whether Virginia Code § 18.2-186.6 or another law requires notice to data owners, residents, regulators or consumer reporting agencies.
• Each party retains responsibility for the notices legally imposed on it. Notices shall not be withheld merely because an investigation remains incomplete when law requires notice.
• For Virginia § 18.2-186.6, the parties shall separately evaluate whether the statutory conditions are satisfied: covered personal information, unauthorized access and acquisition, and identity-theft or fraud, including the encryption and key-compromise provisions. FindBack shall not promise that every security event is a statutorily reportable breach.

E.3 Virginia data processing terms.

• To the extent FindBack is a processor subject to Virginia Code § 59.1-579, the following shall be specified in Exhibit A and a completed Data Processing Schedule:
  • the documented processing instructions;
  • the nature and purpose of processing;
  • the categories of personal data;
  • the processing duration; and
  • the parties' responsibilities.
• FindBack shall:
  • bind personnel to confidentiality;
  • assist with rights requests and data protection assessments as required;
  • make appropriate compliance information available;
  • cooperate with reasonable assessments;
  • return or delete personal data at Customer's direction, subject to lawful retention; and
  • bind subprocessors to equivalent applicable duties.
• FindBack acts as an independent controller for its direct Consumer accounts and return-service transactions only to the extent supported by actual processing purposes and a corresponding Consumer Privacy Notice. A role label in the contract does not override the fact-based statutory analysis.
• No identifiable Customer Data may be used for shared-model training without separate documented authorization and a lawful basis.

E.4 Intellectual property, confidentiality and software use.

• Ownership. FindBack retains the rights it lawfully owns in its software, source code, algorithms, model architecture, documentation, trademarks and confidential know-how. Customer retains the rights it lawfully owns in Customer Data, and grants only the limited rights reasonably necessary for contracted services, security, support and lawful retention. Neither party transfers rights it does not possess.
• Confidentiality and trade secrets. Each party shall use reasonable measures, including access controls and need-to-know restrictions, to protect the other party's confidential information and trade secrets. Information qualifies for trade-secret protection under Virginia Code § 59.1-336 only when the statutory elements, including reasonable secrecy measures, are satisfied. Confidentiality restrictions do not prohibit disclosures compelled by law or by lawful public-records obligations, subject to permissible notice.
• Prohibited use. Except where applicable nonwaivable law permits the activity, Customer shall not:
  • access or use FindBack systems beyond authorization;
  • copy or redistribute proprietary code;
  • defeat access controls; or
  • misappropriate trade secrets.

This clause does not purport to criminalize permitted security research, or independently establish a violation of the Virginia Computer Crimes Act.

E.5 Electronic acceptance and contract records.

• For private institutional accounts, acceptance requires:
  • an unchecked-by-default affirmative assent mechanism;
  • conspicuous access to the Agreement and exhibits; and
  • an authorized representative certification.
• FindBack shall retain the accepted version or a tamper-evident copy, the consent language, identity, organization, date and time, and relevant audit evidence, and shall provide a copy to the representative.
• Virginia Code § 59.1-485 recognizes electronic records and signatures, subject to applicable statutory requirements and the facts of assent.
• Virginia's Uniform Computer Information Transactions Act (Title 59.1, Chapter 43) may affect certain software access and information transactions. Counsel shall assess its applicability and nonwaivable provisions.
• For Virginia public entities, no paid obligation arises without legally sufficient procurement authorization.

E.6 Consumer charges and representations.

• Where FindBack sells an optional return-shipping service to a Consumer, it shall conspicuously disclose, before payment authorization:
  • postage;
  • FindBack service fees;
  • applicable taxes;
  • refund terms;
  • delivery limitations; and
  • the total.
• FindBack shall not misrepresent carrier coverage, AI matching accuracy, data security certifications, insurance or the availability of features.
• Consumer-facing terms and checkout screens shall be reconciled with this Agreement and with the Virginia Consumer Protection Act where applicable.

E.7 Virginia governing law; public-sector carve-out.

• For private Customers, Virginia law governs this Agreement, excluding conflict-of-law rules, and the parties submit to state and federal courts of competent jurisdiction in Virginia, except where mandatory law requires otherwise.
• This provision does not displace privacy or breach-notification laws applicable to residents of other states.
• Virginia public entities are subject to their legally required procurement, venue, immunity, public-records and funding terms; the Public Sector Addendum controls conflicts.

E.8 Operational commitments requiring confirmation. Before publication, FindBack management and counsel must confirm and complete:

• an executed Data Processing Schedule;
• actual security controls;
• the vendor and subprocessor list;
• an incident contact and escalation workflow;
• data retention periods;
• approved consumer terms and shipping checkout;
• cyber and technology E&O insurance status; and
• a lawful public-sector procurement process.

No statement in this Rider asserts that those items have been completed.