TECH GUARD LABS FOUNDATION

REFERRAL PARTNER AGREEMENT

Sales Referral & Partner Commission Program

Version: Ver 1.2.0 - 15-July-2026 - published by TGL on its Referral Partner Portal.

THIS REFERRAL PARTNER AGREEMENT ("Agreement") IS MADE BY AND BETWEEN:

Tech Guard Labs Foundation, having its registered office at 395, Sarojini Road, Siddhapudhur, Coimbatore – 641044, India (hereinafter referred to as "TGL" or "Company", which expression shall, unless repugnant to the context or meaning thereof, be deemed to include its successors and permitted assigns), a Party of the FIRST PART;

AND

The individual or entity that completes registration as a Referral Partner through TGL's online partner portal, as identified by the name, organization, and contact details submitted at the time of registration (hereinafter referred to as "Partner" or "you", which expression shall, unless repugnant to the context or meaning thereof, be deemed to include its successors and permitted assigns), a Party of the SECOND PART.

TGL and Partner are hereinafter individually referred to as a "Party" and collectively as the "Parties".

This Agreement is a standard-form agreement offered by TGL to all prospective Referral Partners on the same terms. It is entered into, and becomes binding as between TGL and a given Partner, at the moment that Partner electronically accepts it as described in Section 1.4 below (the "Effective Date" for that Partner).

1. Background

TGL is a boutique cybersecurity consulting firm providing gap assessments, remediation services, retesting, and confirmation-of-compliance documentation across various security and compliance frameworks (the "Services").

Partner has access to, or an existing relationship with, individuals and organizations who may benefit from the Services, including Chief Information Security Officers, Heads of IT, and Chief Information Officers ("Prospective Clients").

TGL wishes to engage Partner, on a non-exclusive, independent contractor basis, to introduce Prospective Clients to TGL in exchange for commission on the terms below.

1.4 Acceptance of this Agreement. This Agreement is presented in full to each prospective Referral Partner on TGL's online partner portal during registration. By ticking the acceptance checkbox and clicking "I Agree & Submit Application" (or the equivalent confirmation control presented on the portal), Partner: (a) confirms that it has had a reasonable opportunity to read and review this Agreement in full before accepting; (b) agrees to be legally bound by all of its terms as a condition of participating in the referral program; and (c) consents to the use of electronic records and electronic signatures to form this Agreement, which the Parties agree shall carry the same legal effect as a handwritten signature, to the fullest extent permitted under applicable law, including the Information Technology Act, 2000 (India) and any equivalent electronic transactions or e-signature legislation applicable in Partner's jurisdiction. TGL will retain a record of the date, time, IP address, and version of the Agreement accepted, as evidence of the formation of this Agreement. TGL confirms its acceptance by activating Partner's account and portal access following a successful registration.

2. Definitions

• "Referral" means a Prospective Client formally introduced by Partner to TGL using the process in Section 3, with whom TGL had no pre-existing relationship or active discussion at the time of introduction.

• "Qualified Lead" means a Referral that TGL, at its reasonable discretion, confirms as a genuine business opportunity (i.e., a real need, budget authority, and an identifiable decision-maker).

• "Closed Deal" means a Qualified Lead that results in a signed statement of work, order form, purchase order, signed agreement or engagement letter between TGL and the client.

• "Net Invoice Value" means the total amount invoiced by TGL to the client for a Closed Deal, excluding taxes, duties, reimbursed third-party/out-of-pocket expenses, and any discounts or credits.

• "Commission Event" means the date on which TGL receives cleared payment (funds settled, not merely invoiced) from the client in respect of a Closed Deal.

• "Sub-Referral Partner" means a new referral partner introduced by Partner to TGL, who separately signs a Referral Partner Agreement with TGL.

• "Follow-On Period" means the Six [06]-month period following the invoice date of the first Closed Deal with a given client, during which additional engagements with that same client also qualify for commission under Section 5.3.

• "DPDPA" means the Digital Personal Data Protection Act, 2023 (India), together with any rules, regulations, codes, or notifications issued thereunder, as amended, re-enacted, or replaced from time to time.

• "Personal Data", "Data Principal", "Data Fiduciary", "Data Processor", "Processing", and "Consent Manager" shall have the meanings given to those terms under the DPDPA.

3. Referral Process

1. Partner shall submit each Referral exclusively through TGL's designated online partner portal. Submissions made by any other method including email, fax, text/SMS, phone call, or verbal notice shall not constitute a valid Referral and shall not create any entitlement to commission, regardless of the outcome of any resulting engagement. Each portal submission must include the Prospective Company name, Prospective Company website, contact person name, Contact person direct contact number and email, role, and a brief description of the opportunity.

2. TGL will review and approve or decline each Referral via the portal, and Partner shall be able to view the status of the Referral (e.g., Pending, Approved as Qualified Lead, Declined) within 3 working days of submission. If the Prospective Client has already been submitted as a Referral by another Referral Partner, the portal will indicate that the lead already exists, and priority shall be determined in accordance with Section 3.4 below.

3. TGL may decline a Referral where, among other things, TGL already has an existing relationship or active discussion with that Prospective Client, the opportunity falls outside TGL's service offerings, or the Referral lacks sufficient information for TGL to act on it.

4. Priority between competing referrals for the same Prospective Client from different sources will be determined by the timestamp of first valid submission recorded by the portal.

5. TGL retains full and sole discretion over the manner in which it pursues, prices, scopes, negotiates, and delivers Services to any client, and Partner shall have no role in delivery or in negotiating commercial terms with the client unless separately agreed in writing.

6. Lead Validity Period. Each Qualified Lead shall remain valid for a period of three (03) months from the date it is approved on the portal (the "Lead Validity Period"). If no Closed Deal is executed with the relevant Prospective Client within the Lead Validity Period, the Qualified Lead shall automatically expire, Partner's association with that Prospective Client shall lapse, and no commission shall be payable on any subsequent engagement between TGL and that Prospective Client, even if such engagement occurs later. An expired lead may be resubmitted by any Referral Partner (including the original Partner) as a new Referral, subject to clause 3 of this Section (TGL's right to decline).

7. Causation. Commission is payable only where the Closed Deal results substantially from the introduction effected by Partner's Referral. Where TGL engages a Prospective Client through a channel, relationship, or opportunity that is independent of Partner's Referral including where the Prospective Client independently approaches TGL after the Lead Validity Period has expired no commission shall be payable, and TGL's good-faith determination on this question, based on its records, shall be final.

8. TGL's Records and Determinations. The records maintained by TGL's partner portal and systems including submission timestamps, lead status, approval and expiry dates, and invoice and payment records shall constitute conclusive evidence of the matters they record, absent manifest error. TGL's determinations regarding the acceptance, classification, priority, expiry, or attribution of any Referral or Qualified Lead, made in good faith, shall be final and binding on Partner.

4. Partner's Role and Limits of Authority

4.1 Scope of Role. Partner's sole role under this Agreement is to introduce TGL to the appropriate contact person(s) at a Prospective Client (e.g., the CISO, Head of IT, or CIO, or their designated representative). Partner's involvement ends at the point of introduction, unless TGL separately requests further assistance in writing. Partner has no role in scoping, pricing, negotiating, delivering, or otherwise being involved in any engagement between TGL and the client.

4.2 No Promises or Warranties. Partner shall not make, and has no authority to make, any promise, warranty, representation, guarantee, or commitment of any kind on behalf of TGL to any Prospective Client or third party, whether regarding pricing, scope, timelines, service capabilities, certifications, audit or compliance outcomes, or otherwise. Partner shall not negotiate terms, execute any contract, or otherwise bind TGL in any way. Any statement made by Partner beyond a simple introduction and general description of TGL's services is made solely on Partner's own behalf, and not as an agent or representative of TGL, and Partner shall be solely responsible for any liability arising from such statements.

4.3 No Agency Representation. Partner shall not represent itself as an agent, employee, partner, or representative of TGL beyond the limited referral function described in this Agreement.

4.4 Disclosure of Commission. Partner shall accurately describe its role to any Prospective Client if asked, including that Partner receives a commission from TGL in connection with the introduction, where reasonably necessary to avoid an undisclosed conflict of interest with the Prospective Client.

5. Commission Structure

5.1 In consideration of Referrals that become Closed Deals, TGL shall pay Partner the commissions set out below. The Direct Referral Commission is variable, up to a maximum of 10% of Net Invoice Value; the exact percentage applicable to a given Qualified Lead will be determined by TGL and communicated to Partner via the portal at the time the Referral is approved as a Qualified Lead and shall remain fixed for all Closed Deals arising from that Qualified Lead (including Follow-On Work under Section 5.3). The Override / Bonus Commission is a fixed 2% of Net Invoice Value.

5.2 Override / Bonus Commission One Tier Only. Where Partner introduces a Sub-Referral Partner to TGL, and that Sub-Referral Partner's own Referral results in a Closed Deal, Partner shall receive the 2% Override / Bonus Commission described above. For clarity: (a) overrides apply only one tier deep Partner receives no commission on Referrals made by a Sub-Referral Partner of a Sub-Referral Partner; and (b) the Override / Bonus Commission is paid by TGL out of its own revenue and does not reduce or come out of the Sub-Referral Partner's own Direct Referral Commission (up to 10%). The Override / Bonus Commission is subject to the Follow-On Period in the same manner as the Direct Referral Commission: it is payable on the first Closed Deal sourced through the Sub-Referral Partner and on Follow-On Work under Section 5.3 that falls within the applicable Follow-On Period, and ceases to be payable on engagements with that client after the Follow-On Period has expired.

5.3 Follow-On Work. If, within the Follow-On Period, the same client places additional orders with TGL directly resulting from the ongoing relationship (e.g., annual retest, expanded remediation scope),the same commission rates in Section 5.1 — including both the Direct Referral Commission and, where applicable, the Override / Bonus Commission — apply to those additional Closed Deals. Work with that client after the Follow-On Period has expired is not commissionable (whether as direct or override commission) unless the Parties agree otherwise in writing.

5.4 No Double Counting. A single Closed Deal shall generate commission under only one of the direct or override categories, never both, and only to the Partner(s) validly associated with that Referral chain.

5.5 Right to Revise Commission Rates. TGL reserves the right, in its sole discretion, to revise the commission percentages set out in Sections 5.1 and 5.2 (or the Follow-On Period in Section 2) at any time, by providing written notice to Partner via the portal or in accordance with Section 15 (a "Rate Change Notice"). Any revision shall take effect from the date specified in the Rate Change Notice (the "Effective Date of Revision"), and the following shall apply:

• Any new Referral submitted by Partner on or after the Effective Date of Revision, and any resulting Closed Deal, shall be commissioned at the revised rates.

• Any client engagement for which TGL has already generated and issued an invoice to the client prior to the Effective Date of Revision shall continue to be commissioned at the rates that were in effect at the time that client invoice was issued, regardless of when the corresponding Commission Event occurs or when Partner submits its own invoice under Section 6.

• For the avoidance of doubt, where a Referral was submitted before the Effective Date of Revision but TGL's invoice to the client is issued on or after that date, the revised rates then in effect shall apply to that client invoice.

A revision of commission rates under this Section 5.5 shall not affect Partner's entitlement to commission already accrued and payable at the rates in effect at the relevant time, and shall not require Partner's separate consent to take effect, provided reasonable notice is given as described above.

6. Payment Terms

1. Commission accrues only upon the occurrence of a Commission Event i.e., when TGL has received cleared payment from the client. No commission is payable on invoiced-but-unpaid amounts.

2. TGL will notify Partner via the portal once a Commission Event has occurred and the corresponding commission is available to be claimed.

3. To claim accrued commission, Partner must submit a valid invoice addressed to TGL, referencing the relevant Closed Deal(s), the Net Invoice Value, and the commission amount claimed. Invoices shall be sent to lalindra@techguardlabs.com. TGL shall have no obligation to pay any commission for which a corresponding invoice has not been submitted.

4. TGL shall pay undisputed commission amounts within 30 days of the date of Partner's invoice, provided the invoice is accurate and matches TGL's own records of the Commission Event.

5. If a client fails to pay, pays late, disputes an invoice, or receives a refund or credit, TGL's payment obligation is adjusted accordingly, and any commission already paid on the disputed or refunded amount shall be deducted from Partner's next payment or, if none is due within 90 days, refunded by Partner to TGL on demand.

6. All commissions are exclusive of any applicable withholding tax, VAT/GST, or other levy, which shall be handled in accordance with applicable law. Partner is solely responsible for its own tax reporting and obligations arising from commissions received, and Partner's invoice should reflect any applicable taxes in accordance with law.

7. Payments will be made by [bank transfer] to the account details provided by Partner in writing. Partner is responsible for keeping payment details current.

8. Disputes and Time Bar. Partner must notify TGL in writing of any dispute regarding a commission calculation, commission statement, declined or expired lead, or non-payment, within sixty (60) days of the date on which the relevant status or statement was made available on the portal or communicated to Partner. Subject to applicable law, Partner agrees that raising a dispute within this period is a condition precedent to pursuing any claim in respect of that matter, and undisputed statements shall be deemed accepted.

7. Independent Contractor Status

Partner is an independent contractor and not an employee, joint venturer, partner, or agent of TGL. Nothing in this Agreement creates any employment relationship, partnership, or joint venture between the Parties. Partner is solely responsible for its own taxes, insurance, and business expenses, and TGL will not withhold or contribute to any employment taxes, benefits, or social security on Partner's behalf. Partner has no authority to make commitments of any kind on behalf of TGL.

8. Non-Exclusivity

This Agreement is non-exclusive. TGL may operate similar referral or partner arrangements with other individuals or entities, and may pursue any client directly or through other channels. Partner may refer opportunities to other consulting firms, provided doing so does not breach Partner's confidentiality obligations under this Agreement.

9. Confidentiality

Each Party may disclose to the other confidential and proprietary information, including but not limited to client identities, security posture information, pricing, business plans, and the terms of this Agreement ("Confidential Information"). The receiving Party shall: (a) use Confidential Information solely to perform its obligations under this Agreement; (b) not disclose Confidential Information to any third party without prior written consent, except to professional advisors under a duty of confidentiality or as required by law; and (c) protect Confidential Information using at least the same degree of care it uses for its own confidential information, and no less than a reasonable standard of care.

This obligation does not apply to information that is or becomes publicly available through no fault of the receiving Party, was already lawfully known to the receiving Party without restriction or is independently developed without use of the disclosing Party's Confidential Information. Confidentiality obligations survive termination of this Agreement for a period of 3 years, except for client-related security information, which survives indefinitely.

Where Confidential Information includes personal data, the Parties' obligations regarding such personal data are additionally governed by Section 17 (Data Protection).

10. Non-Circumvention and Non-Solicitation

1. Neither Party shall attempt to bypass the other to deal directly with a Referral's Prospective Client in a manner designed to avoid commission obligations that would otherwise be owed under this Agreement, for as long as that Prospective Client remains a logged Qualified Lead or active client relationship.

2. During the term of this Agreement and for 12 months afterward, neither Party shall directly solicit for employment or engagement any employee or contractor of the other Party who was materially involved in the referral relationship, without that Party's prior written consent.

11. Compliance with Laws

Each Party shall comply with all applicable laws in performing this Agreement, including anti-bribery and anti-corruption laws. Partner represents that it will not offer, promise, or provide anything of value to any Prospective Client's personnel as an inducement to select TGL, and that no portion of any commission paid under this Agreement will be shared with, or used to improperly influence, any employee, officer, or decision-maker of the client being referred, unless fully and lawfully disclosed to that client in advance.

Where the Prospective Client is a government body, public sector entity, or otherwise subject to public procurement rules, Partner shall notify TGL before submitting the Referral so the Parties can assess any additional disclosure or compliance requirements.

12. Intellectual Property

All materials, methodologies, deliverables, trademarks, and know-how used or provided by TGL in connection with the Services remain the sole property of TGL. This Agreement grants Partner no license or right to use TGL's trademarks, logos, or marketing materials except as expressly authorized in writing (e.g., for approved referral marketing use).

13. Term and Termination

1. This Agreement begins on the Effective Date and continues until terminated by either Party with 30 days' written notice.

2. Either Party may terminate immediately on written notice if the other Party commits a material breach of this Agreement that is not cured within 15 days of written notice, becomes insolvent, or engages in conduct that could reasonably damage the other Party's reputation or legal standing (including a breach of Section 11).

3. Tail Period. Commission remains payable, per Section 5, on any Qualified Lead that was validly submitted and logged prior to the effective date of termination, provided the resulting Closed Deal occurs within three [-3] months of termination and within that lead's Lead Validity Period under Section 3, whichever expires first. No commission is owed on Referrals submitted after termination.

4. Sections 6 (for accrued but unpaid amounts), 7, 9, 10, 12, 14, 16, and 17 survive termination of this Agreement.

14. Limitation of Liability and Indemnification

Neither Party shall be liable to the other for any indirect, incidental, special, or consequential damages, including loss of profits, arising out of this Agreement. TGL's total aggregate liability to Partner under this Agreement shall not exceed the total commission paid to Partner in the three [03] months preceding the claim.

Partner shall indemnify and hold TGL harmless from any claims, losses, damages, regulatory fines, or penalties arising from Partner's misrepresentation of TGL's Services, breach of this Agreement (including Partner's data protection warranties under Section 17.2), or violation of applicable law (including the DPDPA) in the course of making Referrals.

Sole Remedy. Partner acknowledges and agrees that the commission set out in Section 5 is the sole and entire compensation payable to Partner in connection with this Agreement and any Referral. Partner shall have no claim against TGL for loss of opportunity, loss of goodwill, quantum meruit, agency compensation, or any other remuneration or damages in connection with any Referral, whether or not it results in a Closed Deal, except for accrued and unpaid commission validly claimed in accordance with this Agreement. TGL is under no obligation to pursue, and shall have no liability to Partner for electing not to pursue, any Referral or Qualified Lead.

15. Notices

As this Agreement is executed electronically at the time the Referral Partner registers on TGL's portal, all notices to Partner under this Agreement shall be sent to the email address registered by Partner on the portal. Partner is responsible for keeping this email address current and for promptly notifying TGL of any change via the portal. Notices to TGL shall be sent to lalindra@techguardlabs.com. Notice is deemed given on the date it is sent by email, provided no delivery failure notification is received, or, if sent by courier or registered mail, 3 business days after dispatch.

16. General Provisions

• Entire Agreement. This Agreement (including any schedules) constitutes the entire agreement between the Parties regarding referral commissions and supersedes all prior discussions or agreements on this subject.

• Amendment. This Agreement may only be amended in writing signed (including electronically) by both Parties. TGL may update the general partner program terms on its portal from time to time for new Referrals submitted after such update, with reasonable notice to Partner; existing Qualified Leads are governed by the terms in effect when they were logged.

• Assignment. Partner may not assign this Agreement without TGL's prior written consent. TGL may assign this Agreement in connection with a merger, acquisition, or sale of substantially all its assets.

• Severability. If any provision of this Agreement is held unenforceable, the remaining provisions remain in full force and effect.

• No Waiver. Failure to enforce any provision is not a waiver of the right to do so later.

• Governing Law and Disputes. This Agreement shall be governed by and construed in accordance with the laws of India. Subject to the arbitration provisions below, the courts at Coimbatore, Tamil Nadu shall have exclusive jurisdiction over any matters not referred to arbitration. The Parties shall first attempt to resolve any dispute arising out of or in connection with this Agreement through good-faith negotiation for a period of 30 days from the date either Party gives written notice of the dispute. Any dispute not resolved through such negotiation shall be referred to and finally resolved by arbitration administered by the Nani Palkhivala Arbitration Centre (NPAC), in accordance with its Arbitration Rules then in force, by a sole arbitrator appointed under those rules. The seat and venue of arbitration shall be Coimbatore, Tamil Nadu, and the language of arbitration shall be English. The arbitral award shall be final and binding on the Parties, subject to the provisions of the Arbitration and Conciliation Act, 1996.

17. Data Protection (DPDPA Compliance)

This Section sets out each Party's obligations regarding personal data processed in connection with this Agreement, in accordance with the DPDPA.

17.1 Roles. TGL acts as a Data Fiduciary in respect of: (a) the personal data of Partner (e.g., name, contact details, banking and tax information) collected to administer this Agreement and pay commission; and (b) the personal data of any Prospective Client submitted as part of a Referral. Partner, when submitting a Referral, is a discloser of personal data to TGL and shall comply with the warranties in Section 17.2 below.

17.2 Partner's Data Protection Warranties. Partner represents and warrants that: (a) any personal data of a Prospective Client included in a Referral has been collected and is being disclosed to TGL lawfully and in a manner consistent with the DPDPA and other applicable law; (b) Partner has a reasonable, good-faith basis to believe the Prospective Client would not object to being contacted by TGL for the purpose of exploring the Services; and (c) Partner will not submit personal data obtained through unlawful means, purchased contact lists of unknown or unverifiable provenance, or scraped data lacking a lawful basis for onward disclosure.

17.3 Purpose and Storage Limitation. TGL shall process personal data contained in a Referral solely for the specified purpose of evaluating and pursuing the potential business opportunity, and shall not use it for unrelated purposes (including unrelated marketing) without a separate lawful basis. TGL shall retain such personal data only for as long as necessary for that purpose or as otherwise required by law, after which it shall be erased or anonymized.

17.4 Notice to Data Principals. Where TGL contacts a Prospective Client on the basis of a Referral, TGL shall, at the point of first contact, provide notice describing the personal data it holds, the purpose of processing, how the individual may exercise their rights, and how to lodge a complaint, consistent with Section 5 of the DPDPA.

17.5 Partner's Own Personal Data; Rights. TGL's processing of Partner's own personal data is further described in TGL's privacy notice, available at [], which forms part of this Agreement by reference. As a Data Principal, Partner may exercise the rights available to it under the DPDPA including access, correction, erasure, grievance redressal, and withdrawal of consent where processing is consent-based by contacting TGL at admin@techguardlabs.onmicrosoft.com. TGL will address such requests within the timeframe prescribed under the DPDPA and its rules.

17.6 Security Safeguards. TGL shall implement reasonable technical and organizational security safeguards to protect personal data processed under this Agreement against unauthorized access, loss, misuse, or disclosure, consistent with Section 8(5) of the DPDPA.

17.7 Breach Notification. In the event of a personal data breach affecting personal data processed under this Agreement, TGL shall notify the Data Protection Board of India and affected Data Principals as required under Section 8(6) of the DPDPA, and shall notify Partner without undue delay where the breach affects personal data submitted by, or concerning, Partner.

17.8 Cross-Border Storage. Personal data processed under this Agreement may be stored or processed on servers located outside India. Such transfers are permitted under the DPDPA except where the Central Government has restricted transfer to a specific country or territory by notification, and TGL will comply with any such restriction as and when notified.

17.9 Sub-Processors. Where TGL engages third-party service providers (e.g., cloud hosting or payment processing providers) to process personal data on its behalf, TGL shall ensure such providers are contractually bound to implement appropriate safeguards consistent with the DPDPA.

17.10 Retention on Termination. On termination of this Agreement, TGL shall erase Partner's personal data once it is no longer necessary for the purpose for which it was collected, except where retention is required to comply with applicable law (including tax, accounting, or audit obligations) or to establish, exercise, or defend legal claims.

18. Acceptance

This Agreement does not require a wet-ink or separately countersigned signature. It is accepted electronically as follows:

1. The full text of this Agreement is presented to the prospective Partner on TGL's online partner portal during registration, with a mandatory checkbox confirming the Partner has read and agrees to its terms.

2. The Partner must affirmatively check that box and click the confirmation button (e.g., "I Agree & Submit Application") before registration can be completed. Registration cannot proceed without this affirmative action.

3. Upon acceptance, TGL's system logs the date, time, IP address, and version of the Agreement accepted. This record constitutes conclusive evidence of the formation of this Agreement between TGL and that Partner, absent manifest error.

4. TGL confirms its own acceptance by activating the Partner's account and portal access, and/or by sending a confirmation email to the Partner's registered email address.