Mutual Confidentiality and Protected Information Agreement

This Mutual Confidentiality and Protected Information Agreement (the “Agreement”) is entered into between Traditional Knowledge Inc., a corporation existing under the laws of Canada (“TKI”), and the Indigenous Nation, Indigenous Government, or related entity identified in the onboarding record (“Nation”). This Agreement is effective as of the date the Nation’s authorized representative clicks “Accept and Continue”, signs electronically, or otherwise electronically accepts this Agreement (the “Effective Date”).

TKI and the Nation may each be referred to as a “Party” and together as the “Parties.”

The Parties intend this Agreement to support respectful, protected collaboration in connection with the evaluation, onboarding, implementation, configuration, training, governance, support, use, improvement, and broader business relationship relating to Protektant, the Sovereign Data Treasury, and related TKI products and services. The Parties further acknowledge that this collaboration may involve access to each Party’s non-public information, including TKI’s trade secrets, private operations, and restricted materials, and the Nation’s confidential Nation Information, and that each Party is entering into this Agreement in reliance on the other Party’s care, discretion, and compliance with the protections set out below.

1. Purpose and Scope

1.1 Purpose.

The Parties may disclose, receive, observe, access, discuss, or create certain Confidential Information in order to enable protected collaboration in connection with the evaluation, onboarding, implementation, configuration, training, governance, support, use, improvement, or other business relationship relating to Protektant, the Sovereign Data Treasury, and any related TKI products, services, tools, systems, methods, operations, or commercial relationship (the “Purpose”).

1.2 Protected Collaboration Access.

TKI may, in its sole discretion, make certain TKI Information available to the Nation within a protected, controlled, conditional, revocable, and need-to-know collaboration setting, including through demonstrations, meetings, documents, data rooms, training sessions, sandbox or production environments, support channels, implementation sessions, administrative tooling, and other controlled access points.

1.3 Supplemental Agreement.

This Agreement supplements, and does not replace, the Master Agreement defined below. This Agreement applies in addition to any confidentiality, privacy, data governance, or intellectual property obligations already binding on the Parties.

2. Definitions

2.1 “Confidential Information” (also referred to in this Agreement as “Protected Information”)

means any non-public information disclosed, made available, provided, observed, accessed, learned, or otherwise obtained by or on behalf of a Party, directly or indirectly, in any form or medium, whether written, oral, visual, electronic, digital, recorded, physical, embodied in software or systems, or communicated through demonstrations, observation, access credentials, meetings, or environments, that either:

(a) is marked, labeled, or identified as confidential, proprietary, restricted, sensitive, or similar; or

(b) a reasonable person would understand to be confidential, proprietary, restricted, or sensitive given the nature of the information and the circumstances of disclosure.

Confidential Information includes, without limitation: Trade Secrets; business plans; pricing; proposals; product strategy; roadmaps; source code; object code; scripts; APIs; prompts; models; datasets; software; architecture; infrastructure; hosting details; security controls; penetration test information; vulnerabilities; monitoring practices; private operations; implementation methods; governance methods; onboarding methods; templates; forms; questionnaires; playbooks; deliverables; training materials; documentation; financial information; customer, partner, Nation, or user information; negotiations; the existence and terms of this Agreement; and all notes, analyses, compilations, extracts, summaries, observations, or derivative materials derived from any of the foregoing.

2.2 “Nation Information”

means any Confidential Information disclosed by or on behalf of the Nation, including Indigenous Knowledge, Traditional Knowledge, oral histories, cultural materials, community information, governance materials, consultation records, Nation positions, directives, internal decisions, reports, documents, communications, data, and any non-public information of or relating to the Nation, its citizens, members, representatives, contractors, institutions, or programs.

2.3 “TKI Information”

means any Confidential Information disclosed by or on behalf of TKI, including TKI’s Trade Secrets, private operations, methods, software, product information, security information, implementation information, commercial information, TKI IP, Restricted Materials, and Work Product.

2.4 “Trade Secrets”

means Confidential Information of a Party that derives actual or potential economic, technical, strategic, operational, competitive, commercial, or other value from not being generally known or readily ascertainable, and that the disclosing Party treats as secret, restricted, or highly confidential.

2.5 “Restricted Materials”

means any TKI Information that TKI designates as restricted or highly sensitive, or that by its nature should reasonably be understood to be subject to heightened protection, including without limitation: administrative tools; non-public product areas; architecture; infrastructure details; security controls; implementation playbooks; product roadmaps; private operations; unpublished documentation; benchmark data; pricing logic; partner-specific materials; customer-specific materials; training environments; test environments; and any Work Product not intended by TKI for general distribution.

2.6 “Representatives”

means, with respect to a Party, that Party’s leaders, directors, officers, employees, agents, contractors, consultants, professional advisors, legal counsel, auditors, service providers, and affiliates, in each case who have a legitimate need to know the relevant Confidential Information for the Purpose and who are bound by confidentiality and use restrictions at least as protective as those in this Agreement.

2.7 “TKI IP”

means all right, title, and interest, including all intellectual property rights, in and to TKI’s products, services, software, platforms, tools, methods, techniques, know-how, workflows, templates, forms, taxonomies, processes, schemas, configurations, code, prompts, documentation, reports, training materials, dashboards, models, images, diagrams, system diagrams, graphical representations, visual representations, compilations, meta data, and all derivatives, modifications, improvements, and related materials, whether existing before or after the Effective Date.

2.8 “Feedback”

means all suggestions, requests, corrections, comments, ideas, observations, recommendations, enhancements, refinements, change requests, workflow suggestions, and other input provided by or on behalf of the Nation or its Representatives relating to TKI, TKI Information, TKI IP, the Purpose, or any Work Product.

2.9 “Work Product”

means any deliverable, workflow, template, form, taxonomy, schema, configuration, questionnaire, dashboard structure, report format, playbook, training asset, implementation artifact, documentation, analysis framework, checklist, decision aid, or other material created, configured, adapted, refined, or delivered by or with TKI in connection with the Purpose, including where developed collaboratively, jointly, at the Nation’s request, through iteration with the Nation, or using Nation Information, but excluding the Nation’s underlying Nation Information as such.

2.10 “Master Agreement”

means the then-current Nation Participation, Sovereign Data Treasury, and System-of-Record Agreement, and any related order, schedule, or onboarding agreement, accepted or executed by the Nation with TKI.

3. Confidentiality and Use Obligations

3.1 General Obligations.

Each Party, as a receiving Party, shall:

(a) use the other Party’s Confidential Information solely for the Purpose and for no other purpose;

(b) hold the other Party’s Confidential Information in strict confidence and protect it using at least a commercially reasonable degree of care, and in no event less than the degree of care it uses to protect its own information of similar sensitivity;

(c) not disclose the other Party’s Confidential Information to any person except its Representatives who have a legitimate need to know for the Purpose and who are bound by confidentiality and use restrictions at least as protective as those in this Agreement;

(d) not copy, reproduce, download, store, transmit, summarize, or otherwise retain the other Party’s Confidential Information except to the limited extent reasonably necessary for the Purpose;

(e) ensure that its Representatives comply with this Agreement; and

(f) remain responsible for any act or omission of its Representatives that would constitute a breach of this Agreement if committed by that Party.

3.2 Need-to-Know; Minimum Disclosure.

Each Party shall limit disclosure of the other Party’s Confidential Information to the minimum scope reasonably necessary for the Purpose.

3.3 No Unauthorized AI or Model Use.

Neither Party shall upload, input, submit, expose, or otherwise provide the other Party’s Confidential Information to any public, shared, general-purpose, or third-party artificial intelligence, large language model, code-assist, transcription, summarization, analytics, or training system, nor permit such system to train on, ingest, retain, or use the other Party’s Confidential Information, except where expressly authorized in writing by the disclosing Party or expressly permitted under the Master Agreement and approved subprocessors applicable to the relevant information.

3.4 No Circumvention of Restrictions.

Neither Party shall circumvent any access control, confidentiality legend, restricted-access process, or information barrier imposed by the disclosing Party.

4. Additional Restrictions Applicable to TKI Information and Restricted Materials

4.1 TKI-Specific Access Restrictions.

Without limiting Section 3, and as a material condition of any access to TKI Information or Restricted Materials, the Nation shall not, and shall not permit any Representative or third party to:

(a) access, use, review, or disclose any TKI Information except as expressly permitted by TKI for the Purpose;

(b) reverse engineer, decompile, disassemble, decode, translate, derive, model, extract, scrape, benchmark, map, scan, test, observe for competitive analysis, or otherwise attempt to discover or infer any source code, object code, architecture, methods, workflows, prompts, models, training data, configuration logic, security controls, vulnerabilities, pricing logic, or other Trade Secrets of TKI;

(c) create or assist in creating any competing, substitute, interoperable, or derivative product, service, workflow, or commercial offering using or informed by TKI Information, except where expressly authorized in writing by TKI;

(d) permit any other vendor, developer, integrator, consultant, or service provider to access TKI Information or Restricted Materials, except professional legal, audit, or compliance advisors of the Nation who are bound by confidentiality obligations no less protective than this Agreement and who are not engaged to build, benchmark, evaluate, or support a competing or substitute solution;

(e) copy, photograph, screenshot, record, transcribe, export, download, mirror, or reproduce Restricted Materials except where expressly permitted in writing by TKI;

(f) remove, obscure, or alter any confidentiality legend, proprietary notice, watermark, or other notice on TKI Information;

(g) use TKI Information or Restricted Materials to file, support, challenge, or assist in any intellectual property registration, claim, objection, invalidity action, or similar proceeding adverse to TKI; or

(h) use TKI Information for any procurement, vendor comparison, competitive evaluation, or replacement exercise not expressly authorized in writing by TKI.

4.2 Supplemental Security Rules.

TKI may impose additional reasonable security, access, credential, watermarking, storage, retention, monitoring, or distribution rules for Restricted Materials, and the Nation shall comply with those rules as a condition of access.

4.3 Revocable Privilege.

Any access to TKI Information or Restricted Materials is a limited, revocable privilege and not a transfer of ownership, license, or broader right except as expressly stated in this Agreement or the Master Agreement.

5. Exclusions

5.1 Exclusions.

A receiving Party’s obligations under this Agreement do not apply to information to the extent the receiving Party can prove through contemporaneous written records that the information:

(a) was lawfully known to the receiving Party without restriction before disclosure by the disclosing Party;

(b) becomes publicly available through no breach of this Agreement and no wrongful act or omission of the receiving Party or its Representatives;

(c) is lawfully received from a third party without breach of any duty of confidentiality; or

(d) is independently developed by the receiving Party without use of or reference to the disclosing Party’s Confidential Information.

5.2 Narrow Construction of Exclusions.

The exclusions in Section 5.1 apply only to the specific information that qualifies for the exclusion and do not apply to any combination, compilation, context, observation, configuration, or derivative understanding of the disclosing Party’s Confidential Information.

6. Legally Required Disclosure

If a receiving Party is required by law, regulation, court order, tribunal order, governmental demand, or similar compulsory process to disclose the disclosing Party’s Confidential Information, the receiving Party shall, to the extent legally permitted:

(a) promptly notify the disclosing Party in writing before disclosure;

(b) disclose only the minimum portion legally required;

(c) reasonably cooperate, at the disclosing Party’s expense, with the disclosing Party’s efforts to seek confidential treatment, protective measures, or other appropriate relief; and

(d) continue to treat the disclosed information as Confidential Information for all other purposes.

7. Ownership, Work Product, Feedback, and Limited License

7.1 Reservation of Rights.

Except as expressly stated in this Agreement, each Party retains all right, title, and interest in and to its own Confidential Information.

7.2 TKI Ownership of TKI IP.

As between the Parties, TKI exclusively owns and shall continue to exclusively own all TKI IP. Nothing in this Agreement or the Purpose transfers to the Nation any ownership interest in TKI IP.

7.3 TKI Ownership of Work Product.

As between the Parties, all Work Product is and shall be exclusively owned by TKI immediately upon creation. To the maximum extent permitted by law, the Nation hereby irrevocably assigns to TKI all right, title, and interest that the Nation now has or later acquires in and to any Work Product. The Nation shall execute, and shall cause its applicable Representatives to execute, any further documents reasonably requested by TKI to confirm, perfect, or evidence TKI’s ownership of Work Product. To the extent any right in Work Product cannot be assigned, the Nation grants to TKI an exclusive, perpetual, irrevocable, worldwide, royalty-free, fully paid, sublicensable license to exercise and exploit that right without restriction, and waives and shall cause its applicable Representatives to waive any moral rights in the Work Product to the maximum extent permitted by law.

7.4 Underlying Nation Information.

For clarity, the Nation retains ownership of its underlying Nation Information as such. However, inclusion of Nation Information in, or use of Nation Information to inform, shape, request, test, refine, or create, any Work Product does not give the Nation any ownership interest in the Work Product, its structure, format, compilation, arrangement, logic, method, or TKI additions. Any TKI use of Nation Information remains subject to the Master Agreement and this Agreement.

7.5 Limited License to Nation.

Subject to the Nation’s compliance with this Agreement and the Master Agreement, TKI grants the Nation a limited, non-exclusive, non-transferable, non-sublicensable license to internally retain, review, and use final Work Product delivered by TKI to the Nation solely for the Nation’s internal governance, compliance, recordkeeping, training of its own personnel, and authorized use of TKI’s products and services. This license does not include any right to commercialize, publish, reproduce for external distribution, provide to another vendor, use to build or support a substitute solution, or disclose Work Product except:

(a) to the Nation’s internal personnel with a need to know;

(b) to the Nation’s legal, audit, or compliance advisors under confidentiality obligations; or

(c) where required by law.

Where any Work Product includes access-controlled software, features, environments, or services, the Nation’s right to use those elements remains subject to the applicable service term and access rights under the Master Agreement.

7.6 Feedback.

The Nation acknowledges that TKI may use Feedback freely for any purpose. To the extent the Nation has or acquires any rights in Feedback, the Nation hereby assigns to TKI all right, title, and interest in and to such Feedback and waives, and shall cause its applicable Representatives to waive, any moral rights in such Feedback to the maximum extent permitted by law. To the extent any such rights cannot be assigned, the Nation grants TKI a perpetual, irrevocable, worldwide, royalty-free, fully paid, transferable, sublicensable license to use, modify, exploit, and incorporate the Feedback without restriction or obligation.

7.7 No Implied Rights.

Except for the limited license expressly granted in Section 7.5, no license, immunity, waiver, or other right is granted by implication, estoppel, exhaustion, or otherwise.

8. Security and Access Controls

8.1 General Safeguards.

Each Party shall maintain reasonable administrative, technical, physical, and organizational safeguards appropriate to the nature and sensitivity of the other Party’s Confidential Information in its possession or control.

8.2 Nation Controls for TKI Restricted Materials.

With respect to any TKI Information or Restricted Materials accessed by the Nation, the Nation shall:

(a) limit access to specifically authorized named users;

(b) require strong authentication measures, including multi-factor authentication where available;

(c) promptly disable access for any Representative who no longer requires access, changes role, leaves engagement, or is no longer authorized;

(d) prohibit credential sharing and shared user accounts;

(e) use secure devices and secure network practices appropriate for the sensitivity of the material;

(f) not store TKI Restricted Materials in public, consumer, or personal file-sharing, collaboration, or messaging tools unless expressly approved in writing by TKI;

(g) comply with all reasonable written access, handling, retention, export, and deletion instructions issued by TKI; and

(h) promptly notify TKI if the Nation becomes aware of any unauthorized access, attempted access, suspicious activity, credential compromise, or policy violation involving TKI Information.

8.3 Certification of Compliance.

Upon reasonable written request by TKI, the Nation shall provide a written certification from an authorized representative confirming the Nation’s compliance with this Agreement with respect to TKI Information and Restricted Materials.

8.4 Suspension Rights.

TKI may immediately suspend or limit access to any TKI Information, Restricted Materials, system, environment, or feature if TKI reasonably believes there has been or may be a breach of this Agreement, a security issue, an unauthorized use, or a risk to TKI’s Confidential Information, Trade Secrets, systems, or other customers or Nations.

9. Unauthorized Use, Security Incidents, and Cooperation

9.1 Notice.

Each Party shall notify the other Party in writing without undue delay, and in any event no later than twenty-four (24) hours after becoming aware of any unauthorized access, use, disclosure, loss, compromise, or suspected compromise of the other Party’s Confidential Information.

9.2 Required Actions.

The receiving Party shall promptly:

(a) investigate the incident;

(b) take all reasonable steps to contain, mitigate, and remediate the incident;

(c) preserve relevant evidence and logs;

(d) provide the disclosing Party with reasonably requested information regarding the nature, scope, timing, impact, and status of the incident; and

(e) cooperate with the disclosing Party’s reasonable requests relating to containment, recovery, remediation, and enforcement.

9.3 No Prejudicial Statements.

The receiving Party shall not make any public statement naming the disclosing Party or describing the incident without the disclosing Party’s prior written consent, except where legally required.

10. Return, Destruction, and Retention

10.1 Return or Destruction.

Upon the earlier of:

(a) written request by the disclosing Party;

(b) completion of the Purpose; or

(c) termination of this Agreement,

the receiving Party shall promptly cease use of the disclosing Party’s Confidential Information and, within ten (10) business days, return or securely destroy all copies of the disclosing Party’s Confidential Information in its possession or control, except as permitted under Section 10.2.

10.2 Limited Retention.

A receiving Party may retain:

(a) one archival copy to the extent required by law, regulation, bona fide document retention policy, or legal hold; and

(b) routine system backup copies created automatically in the ordinary course,

provided that any retained Confidential Information remains subject to this Agreement for so long as retained and is not used for any purpose other than legal compliance, backup integrity, or enforcement of rights.

10.3 Certification.

Upon request, the receiving Party shall certify in writing its compliance with this Section 10.

11. Publicity, References, and Use of Names

Neither Party shall, without the other Party’s prior written consent, issue any press release, public statement, testimonial, case study, marketing material, or other public communication that names or identifies the other Party, uses the other Party’s logos or marks, or describes the Parties’ relationship, activities, or exchanged information, except as required by law.

12. No Warranty; No Obligation to Proceed

12.1 No Warranty.

All Confidential Information is provided “as is.” Except as expressly stated in the Master Agreement, neither Party makes any representation or warranty, express or implied, as to the accuracy, completeness, merchantability, fitness for a particular purpose, non-infringement, or usefulness of its Confidential Information.

12.2 No Obligation.

Nothing in this Agreement obligates either Party to disclose any information, continue discussions, grant access, proceed with any transaction, or enter into any further agreement.

13. Remedies

The Parties acknowledge that any unauthorized use or disclosure of Confidential Information may cause immediate and irreparable harm for which monetary damages alone may be inadequate. Accordingly, in addition to any other remedies available at law or in equity, the disclosing Party is entitled to seek injunctive relief, specific performance, equitable relief, and other appropriate remedies, without the necessity of posting bond except where mandatory law requires otherwise. All rights and remedies are cumulative and not exclusive.

14. Term and Survival

14.1 Term.

This Agreement begins on the Effective Date and continues until terminated by either Party on written notice, provided that termination does not affect any rights or obligations accrued before termination and does not terminate any surviving obligations.

14.2 Survival of Confidentiality Obligations.

The obligations in this Agreement survive as follows:

(a) with respect to ordinary Confidential Information, for ten (10) years after the later of termination of this Agreement or the last disclosure of the relevant Confidential Information;

(b) with respect to Trade Secrets, Restricted Materials, source code, security-related information, pricing logic, private operations, and other highly sensitive TKI Information, for so long as such information remains non-public through no wrongful act or omission of the receiving Party or its Representatives; and

(c) with respect to non-public Indigenous Knowledge, Traditional Knowledge, cultural materials, and other Nation Information that is non-public and confidential in nature, for so long as such information remains non-public through no wrongful act or omission of the receiving Party or its Representatives.

14.3 Additional Surviving Provisions.

Sections 4, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, and 18 survive termination or expiration of this Agreement.

15. Representations and Authority

15.1 Mutual Authority.

Each Party represents and warrants that:

(a) it has the power and authority to enter into this Agreement;

(b) execution and performance of this Agreement do not violate any binding obligation applicable to it; and

(c) it has the right to disclose any information it discloses under this Agreement, subject to applicable law and any rights of third parties.

15.2 Nation Acceptance Authority.

The individual accepting this Agreement on behalf of the Nation represents and warrants that they are duly authorized to bind the Nation and to authorize access by the Nation’s Representatives consistent with this Agreement.

16. Relationship to Master Agreement

16.1 Supplemental; Not Replacement.

This Agreement is supplemental to the Master Agreement.

16.2 Order of Precedence.

In the event of any conflict between this Agreement and the Master Agreement:

(a) this Agreement controls to the extent necessary to provide greater protection to TKI Information, Trade Secrets, Restricted Materials, TKI IP, Work Product, Feedback, and TKI’s access and security controls; and

(b) the Master Agreement controls with respect to service scope, fees, service levels, data governance, privacy, permitted use of Nation Information, and other matters expressly governed there.

16.3 No Reduction of Existing Protections.

Nothing in this Agreement reduces any confidentiality, privacy, intellectual property, or use restriction already owed by either Party under the Master Agreement or otherwise.

17. Electronic Acceptance and Records

17.1 Electronic Acceptance.

The Nation agrees that checking the acceptance box, clicking “Accept and Continue,” electronically signing, or accessing TKI Information or Restricted Materials after being presented with this Agreement constitutes valid acceptance of and agreement to this Agreement.

17.2 Electronic Records.

The Nation agrees that TKI may maintain this Agreement and records of acceptance in electronic form, including records showing the accepted version, date, time, user identity, account, IP address, and related acceptance metadata maintained in the ordinary course.

17.3 Copy of Agreement.

By accepting this Agreement electronically, the Nation acknowledges that it has had the opportunity to review, save, and print this Agreement.

18. General

18.1 Assignment.

The Nation may not assign, transfer, delegate, or sublicense this Agreement or any rights or obligations under it without TKI’s prior written consent. TKI may assign this Agreement, in whole or in part, to an affiliate, successor, purchaser of assets, or in connection with a merger, acquisition, reorganization, or similar transaction.

18.2 Notices.

Any notice under this Agreement shall be given in the manner specified in the Master Agreement. If the Master Agreement does not specify notice mechanics, notice may be given by email to the designated business or legal contact of the receiving Party and is deemed given when sent, provided no delivery failure notice is received.

18.3 Governing Law and Dispute Resolution.

The governing law, forum, venue, arbitration, and dispute resolution provisions of the Master Agreement are incorporated into this Agreement by reference and apply to this Agreement. If no Master Agreement is then in effect, this Agreement shall be governed by the laws of Ontario and the federal laws of Canada applicable therein, without regard to conflict of laws rules, and the Parties attorn to the exclusive jurisdiction of the courts located in Ottawa, Ontario.

18.4 Entire Agreement.

This Agreement, together with the Master Agreement to the extent applicable, states the entire agreement of the Parties with respect to its subject matter and supersedes all prior or contemporaneous discussions, understandings, or agreements on that subject matter, except that this Agreement supplements rather than replaces the Master Agreement.

18.5 Amendments.

No amendment to this Agreement is effective unless made in writing and accepted by both Parties, including by electronic acceptance where TKI presents an amended version for re-acceptance.

18.6 Severability.

If any provision of this Agreement is held invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect, and the invalid provision shall be enforced to the maximum extent permitted by law.

18.7 No Waiver.

No failure or delay by either Party in exercising any right or remedy operates as a waiver, nor does any single or partial exercise preclude any further exercise of that or any other right or remedy.

18.8 Interpretation.

Headings are for convenience only and do not affect interpretation. The words “including,” “include,” and similar terms mean “including without limitation.” This Agreement shall be interpreted fairly according to its terms and not strictly for or against either Party as drafter.

18.9 Counterparts and Electronic Signatures.

If manually executed, this Agreement may be executed in counterparts, including electronically transmitted counterparts, each of which is deemed an original and all of which together form one instrument.