Intro to CORL’s Portal Use and Confidentiality Agreement (NDA)

To assist your company (the “Data Provider”) in better understanding CORL’s assessment process, please read the information below prior to reviewing the agreement that follows.

Assessment Process

  1. Data Provider fills out the security questionnaire proposed by our shared customer (“Service Recipient”) on CORL’s portal and provides CORL with the underlying documentation related to the security (“Confidential Information”)
  2. CORL reviews the responses to the questionnaire and verifies the accuracy of those responses  
  3. CORL creates a risk profile for Data Provider (“Assessment Content”)
  4. CORL adds that risk profile into a written executive summary (“Assessment”)
  5. CORL send that written executive summary to Service Recipient (#2 – #5 is the “Purpose”)

CORL uses the Confidential Information for the Purpose. CORL does not disclose the Confidential Information to the Service Recipient (unless Data Provider explicitly requests CORL does so). For clarity, the information provided to CORL in the form provided by Data Provider is owned by and remains owed by Data Provider. However, CORL does use the Confidential Information to create the Assessment Content and shares the Assessment Content and Assessment with the Service Recipient. Additionally, CORL is engaged by the Service Recipient to provide the Assessment Content and Assessment. As such, CORL cannot put confidentiality restrictions on the Assessment and needs to own the Assessment Content so that CORL can provide the necessary rights to the Assessment Content to the Service Recipient. CORL’s ENDA, which follows this cover page, is the contract the governs the process described here.

Portal Use and Confidentiality Agreement

This Portal Use and Confidentiality Agreement (“Agreement”) is made effective the __ day of ____, 2025 (“Effective Date”) by and between [____________], a ______________ (“Data Provider”), and CORL Technologies LLC, a Georgia limited liability company, with its principal place of business located at 5256 Peachtree Road NE, Suite 190, Atlanta, Georgia 30341 (“CORL”), regarding CORL’s analysis and assessment of Data Provider’s potential security risks and vulnerabilities, creation of Assessment Content (as defined below), and disclosure of the Assessment (as defined below) with the applicable Service Recipient (as defined below) and as further described in this Agreement (“Purpose”). For and in consideration of the disclosures to be made hereunder and the mutual promises and covenants expressed herein, the parties agree as follows:

1. DEFINITIONS. “Confidential Information” means information of or provided or made available by Data Provider that is of value to its owner and is treated as confidential.  Confidential Information includes, without limitation, trade secrets, pricing, business plans, systems, programs, software products, data systems, inventions, technological know-how, processes, agent and customer lists, product information, proprietary technical documentation and financial data. “Intellectual Property Rights” means any and all rights existing from time to time in any jurisdiction under copyright law, patent law, trade secret law, confidential information law, trademark law, unfair competition law, or other similar proprietary or intellectual property rights. “Representative(s)” means a party’s directors, trustees, officers, employees, agents, consultants, affiliates, advisors or other representatives. “Assessment Content” means the proprietary scoring created by CORL from the information received from Data Provider, which has been used by CORL to create the Assessment(s) for a Service Recipient. For the avoidance of doubt, Assessment Content is not Data Provider’s Confidential Information, but CORL shall protect the Assessment Content using the same degree of care, but no less than a reasonable degree of care, to prevent the unauthorized use or disclosure of the Assessment Content as CORL uses to protect its own proprietary information of a like nature. For the further avoidance of doubt, Assessment Content will not contain any Confidential Information of Data Provider in the form provided to CORL by Data Provider; provided, however, that Assessment Content may be derived from Confidential Information of Data Provider. “Service Recipients” means the current, future or potential service recipients of Data Provider’s products and/or services. “Assessment” means the report or assessment result from CORL’s review of the Confidential Information.

For further clarity, Data Provider retains ownership of the Confidential Information it provides to CORL.

2. LIMITED USE. Data Provider may disclose or make available to CORL certain Confidential Information through the Portal (as defined in Portal Terms of Services attached hereto as Exhibit 1 (the “Terms”), and incorporated herein by reference). CORL shall use the Confidential Information solely for the Purpose and as permitted in this Agreement, and for no other purposes. All Confidential Information of Data Provider shall be, and remain, the exclusive property of Data Provider, unless otherwise agreed to in writing by both parties. CORL acknowledges and agrees that the disclosure of the Confidential Information to CORL does not otherwise confer CORL any license, interest or rights of any kind in or to the Confidential Information not set forth in this Agreement. Nothing in this Agreement shall constitute or be deemed to constitute a partnership between the parties hereto or constitute or be deemed to constitute one party as agent of the other, for any purpose whatsoever, and neither party shall have the authority or power to bind the other, or to contract in the name of or create a liability against the other, in any way or for any purpose.

3. ASSESSMENTS.

a. Subject to the terms and conditions of this Agreement, Data Provider hereby grants to CORL a non-exclusive license to copy, reproduce, store, distribute, publish, export, adapt, edit and translate its Confidential Information to the extent reasonably required for Purpose both during and following the termination or expiration of this Agreement.

b. Subject to the terms and conditions of this Agreement, Data Provider hereby grants CORL a non-exclusive, worldwide, irrevocable, royalty-free license to use, copy, transmit, store, and otherwise use its Confidential Information solely (i) as instructed by Data Provider with its express consent (ii) to prepopulate questionnaires in the Portal for Data Provider; or (iii) as compelled or required to do so by applicable law or governmental authority, both during and following the term of this Agreement.

c. Data Provider acknowledges and agrees that CORL may copy, reproduce, store, distribute, publish, export, adapt, translate, share and otherwise use the Assessment Content solely: (i) as requested by a Service Recipient with the express permission of Data Provider; (ii) in the event of an audit of its performance of the Assessment on behalf of a Service Recipient; or (iii) as compelled or required to do so by applicable law or governmental authority, both during and following the term this Agreement.

4. NON-DISCLOSURE; STANDARD OF CARE. Except as otherwise expressly set forth in this Agreement, CORL shall hold in confidence and not disclose (including without limitation distribute, transmit or transfer) or use the Confidential Information or any portion thereof except for the Purpose without the prior written consent of Data Provider. CORL shall only disclose the Confidential Information to its Representatives to the extent such persons have a need to know such information for the purposes described in this Agreement, and provided each such Representative shall be obligated in writing to comply with the terms and conditions of this Agreement. CORL shall be responsible for any breach of this Agreement by its Representatives. For the avoidance of doubt, Representatives do not include Service Recipients. CORL shall protect the Confidential Information using the same degree of care, but no less than a reasonable degree of care, to prevent the unauthorized use or disclosure of the Confidential Information as CORL uses to protect its own confidential information of a like nature, provided that the foregoing does not limit CORL’s obligations under Section 2 or Section 4. CORL shall notify Data Provider in writing immediately upon discovery of unauthorized use or disclosure of Confidential Information or any breach of this Agreement and shall reasonably cooperate with Data Provider to regain possession of such Confidential Information and prevent the Confidential Information’s further unauthorized use and disclosure.

5. LIMITATION & EXCEPTIONS. Information shall not constitute Confidential Information if the information communicated was received by CORL in good faith from a third party lawfully in possession thereof and having no obligation to keep such information confidential. Additionally, CORL may disclose the Data Provider’s Confidential Information if the information is disclosed by CORL pursuant to a requirement of a governmental agency or by operation of law; provided however, that CORL shall first notify Data Provider prior to disclosure, if allowed by law, in order to give Data Provider a reasonable opportunity to seek an appropriate protective order or waive compliance with the terms of this Agreement and shall disclose only that part of the Confidential Information which CORL is required to disclose.

6. RETURN/DESTRUCTION OF INFORMATION; TERM. Upon receipt of Data Provider’s written request, CORL shall return or destroy, as directed by Data Provider, all Confidential Information in its possession or under its control, subject to the rights granted to CORL herein. Either party may terminate this Agreement upon written notice to the other party.

7. WARRANTY; DISCLAIMER. DATA PROVIDER ACKNOWLEDGES AND AGREES THAT CORL IS NOT RESPONSIBLE FOR THE ACTS OR OMISSIONS OF A SERVICE RECIPIENT, INCLUDING, BUT NOT LIMITED TO, ANY DECISION TO DO BUSINESS WITH DATA PROVIDER AND CORL HAS NO LIABILITY FOR ANY HARM OR DAMAGE ARISING OUT OF OR IN CONNECTION WITH ANY SERVICE RECIPIENT OR AN ASSESSMENT.

8. LIABILITY CAP. EXCEPT AS OTHERWISE PROVIDED IN THIS AGREEMENT, (A) IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER OR TO ANY THIRD PARTY FOR ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, SPECIAL OR PUNITIVE DAMAGES, INCLUDING LOSS OF USE, REVENUE, PROFIT, OR DATA, WHETHER ARISING OUT OF BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE) OR OTHERWISE, REGARDLESS OF WHETHER SUCH DAMAGE WAS FORESEEABLE AND WHETHER OR NOT SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (B) IN NO EVENT WILL EITHER PARTY’S LIABILITY ARISING OUT OF OR RELATED TO THE AGREEMENT, WHETHER ARISING OUT OF OR RELATED TO BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE) OR OTHERWISE, EXCEED ONE MILLION DOLLARS ($1,000,000). IN NO EVENT WILL EITHER PARTY’S LIABILITY ARISING OUT OF OR RELATED TO DAMAGES OR OTHER LIABILITIES ARISING OUT OF OR RELATING TO A PARTY’S FAILURE TO COMPLY WITH ITS OBLIGATIONS UNDER THE NON-DISCLOSURE AND CONFIDENTIALITY SECTION HEREUNDER EXCEED TWO MILLON DOLLARS ($2,000,000).

EACH PROVISION OF THIS AGREEMENT THAT PROVIDES FOR A LIMITATION OF LIABILITY OR EXCLUSION OF DAMAGES IS TO ALLOCATE THE RISKS OF THE AGREEMENT BETWEEN THE PARTIES. THIS ALLOCATION IS AN ESSENTIAL ELEMENT OF THE BASIS OF THE BARGAIN BETWEEN THE PARTIES. EACH OF THESE PROVISIONS IS SEVERABLE AND INDEPENDENT OF ALL OTHER PROVISIONS OF THIS AGREEMENT. THE LIMITATIONS IN THIS SECTION AND THE SECTION ABOVE WILL APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY IN THE AGREEMENT.

9. GENERAL. THIS AGREEMENT SHALL BE GOVERNED BY AND CONSTRUED AND INTERPRETED IN ACCORDANCE WITH THE LAWS OF THE STATE OF DELAWARE, WITHOUT GIVING EFFECT TO ITS LAWS GOVERNING CONFLICTS OF LAW. The parties expressly and unconditionally agree that any dispute, case, or controversy in any way related to, arising under, or in connection with this Agreement, including extra-contractual claims (a “Proceeding”), shall only be instituted in the State of Georgia and in the Georgia State-Wide Business Court, provided that if the Georgia Business Court shall lack jurisdiction over any Proceeding, such Proceeding shall be brought in any appropriate state court sitting in Fulton, Georgia or in the United States District Court for the Northern District of Georgia (Atlanta Division) (collectively, the “Permitted Courts”).  Each party irrevocably: (a) consents to the jurisdiction of the Permitted Courts in such Proceedings, (b) agrees not to plead or claim that litigation brought in the Permitted Courts has been brought in an improper or inconvenient forum, and (c) waives the right to object, with respect to such Proceedings, that such court does not have jurisdiction over such party. In any suit, arbitration, mediation, or other proceeding to enforce any right or remedy under this Agreement or to interpret any provision of this Agreement, the prevailing party will be entitled to recover its costs, including reasonable attorneys’ fees, and all costs and fees incurred on appeal or in a bankruptcy or similar action. TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY HEREBY EXPRESSLY WAIVES (ON BEHALF OF ITSELF AND ON BEHALF OF ANY PERSON OR ENTITY CLAIMING THROUGH THAT PARTY) ANY RIGHT TO A TRIAL BY JURY IN ANY ACTION, SUIT, PROCEEDING, OR COUNTERCLAIM OF ANY KIND ARISING OUT OF OR IN ANY MANNER CONNECTED WITH THIS AGREEMENT. This Agreement shall be binding upon and inure to the benefit of the parties hereto and their respective successors, assigns, heirs, and legal representatives. No failure of any party to exercise or enforce any of its rights under this Agreement will act as a waiver of such or any other rights. This Agreement may only be modified, or any rights under it waived, by a written document executed by authorized representatives of both parties. If any provision hereof is declared invalid by a court of competent jurisdiction, such provision shall be ineffective only to the extent of such invalidity, so that the remaining of that provision and all remaining provisions of this Agreement will continue in full force and effect. Headings of particular Sections are inserted only for convenience and are not to be used to define, limit or construe the scope of any term or provision of this Agreement. Should any provision of this Agreement require judicial interpretation, the parties agree that the court interpreting or construing the same shall not apply a presumption that the terms of this Agreement shall be more strictly construed against one party than against another party. This Agreement represents the entire understanding between the parties with respect to the subject matter hereof and supersedes all other written or oral agreements heretofore made by or on behalf of Data Provider or CORL with respect to the subject matter hereof. This Agreement may be executed in one or more counterparty, each of which shall for all purposes be deemed to be an original and all of which shall constitute the same instrument. Facsimile and electronic signatures shall be deemed original signatures.

Exhibit 1

Portal Terms

As used in these Terms, “CORL” or “we” or “us” means CORL Technologies LLC and “Data Provider” or “you” or “your” means [INSERT LEGAL NAME]. Capitalized terms used and not defined in these Terms shall have the meanings given to such terms in the Agreement.

Portal

Subject to the terms and conditions herein, CORL will provide Data Provider, and its authorized employees, contractors and other personnel authorized by Data Provider (“End Users”) with access CORL’s proprietary portal provided by CORL via a web browser (or mobile application) (“Portal”). During the Term (as defined below) and subject to Data Provider’s compliance with the Agreement, CORL grants Data Provider the non-exclusive, nontransferable, non-assignable, and limited right to allow End Users to remotely access the Portal to provide data and information as requested by CORL to in accordance with the terms of the Agreement. CORL may provide the Portal from any facility and may from time to time transfer any or all of the Portal provided hereunder to any new facility(ies) or relocate the personnel, equipment and other resources used in providing those Portal. If CORL’s performance of its obligations under the Agreement is prevented or delayed by any act or omission of Data Provider or its agents, subcontractors, consultants or employees, CORL shall not be deemed in breach of its obligations under the Agreement or otherwise liable for any costs, charges or losses sustained or incurred by Data Provider, in each case, to the extent arising directly or indirectly from such prevention or delay, and CORL’s obligation to perform will be extended by the same number of days as Data Provider’s contingent action is delayed. Data Provider shall cooperate with CORL in all matters relating to the support Portal and appoint a Data Provider employee to serve as the primary contact with respect to support Portal under the Agreement.

Technical Requirements

Data Provider must have required equipment, software, and Internet access to be able to use the Portal. Acquiring, installing, maintaining and operating equipment and Internet access is solely Data Provider’s responsibility. CORL neither represents nor warrants that the Portal will be accessible through all web browser releases. It is your responsibility to keep your account and profile information accurate and updated. We are not responsible for any disputes or claims related to any inaccurate, incomplete, or untimely information provided by you to us.

Use of Portal

Data Provider shall not and shall not permit others in using the Portal to: (i) defame, abuse, harass, stalk, threaten or otherwise violate or infringe the legal rights (such as rights of privacy, publicity and intellectual property) of others or CORL; (ii) publish, ship, distribute or disseminate any harmful, inappropriate, profane, vulgar, infringing, obscene, false, fraudulent, tortuous, indecent, unlawful, immoral or otherwise objectionable material or information (including any unsolicited commercial communications); (iii) publish, ship, distribute or disseminate material or information that encourages conduct that could constitute a criminal offense or give rise to civil liability; (iv) engage in any conduct that could constitute a criminal offense or give rise to civil liability for CORL; (v) misrepresent or in any other way falsely identify Data Provider’s identity or affiliation, including through impersonation or altering any technical information in communications using the Portal; (vi) transmit or upload any material through the Portal that contains viruses, trojan horses, worms, time bombs, cancelbots, or any other programs with the intent or effect of damaging, destroying, disrupting or otherwise impairing CORL’s, or any other person’s or entity’s, network, computer system, or other equipment; (vii) interfere with or disrupt the Portal, networks or servers connected to the CORL systems or violate the regulations, policies or procedures of such networks or servers, including unlawful or unauthorized altering of any of the information submitted through the Portal; (viii) attempt to gain unauthorized access to the Portal, other CORL customers’ computer systems or networks using the Portal through any means; or (ix) interfere with another party’s use of the Portal, including any parties Data Provider has done business with or choose not to do business with through the Portal. CORL has no obligation to monitor Data Provider’s use of the Portal. However, CORL may at any time monitor, review, retain and disclose any information as necessary to satisfy or cooperate with any applicable law, regulation, legal process or governmental request. Data Provider shall use commercially reasonable efforts, including reasonable security measures relating to administrator account access details, to ensure that no unauthorized person may gain access to the Portal. You are solely responsible for all interactions with other users. You acknowledge and agree that we do not have an obligation to verify any Data Provider Data or other information provided by users on the Portal. CORL cannot guarantee that users of the Portal will not use the information that you share on CORL, nor the manner of use. CORL is not responsible for another user’s or other third party’s misappropriation or misuse of your Data Provider Data or other information. You are solely responsible for your interactions with other users. Additionally, CORL is not responsible for the truthfulness, accuracy, authenticity, or completeness of any of the Data Provider Data or any other information provided by other users or any other third party. You hereby release CORL from all claims, demands, or damages of every kind, known or unknown, in any way connected with (i) any relationship arising between users of the Portal, (ii) any dispute between you and another user, or (iii) arising out of any Portal which originated through the Portal or were otherwise provided by a user. Additionally, you agree to immediately report to us any false information provided or misconduct by any user of the Portal.

Personal Use; Limited License; Ownership.

The license granted in the Terms is personal to you, and you may not resell our Portal, permit other users access to our Portal through your account, or use the Portal to host content for others. You may not copy or download any content from the Portal except with the prior written approval of CORL. You acknowledge that, except as otherwise expressly provided, the Terms are solely between you and CORL. Furthermore, without the prior written approval of CORL, you may not distribute, publicly perform or display, lease, sell, transmit, transfer, publish, edit, copy, create derivative works from, rent, sub-license, distribute, decompile, disassemble, reverse engineer or otherwise make unauthorized use of the Portal. Any commercial use not expressly authorized is prohibited. You agree not to remove, obscure, or alter copyright, patent, trademark, or other proprietary rights notices affixed to the Portal. Your rights are subject to your compliance with the Terms as well as any other agreements applicable to the Portal you are using. The Portal provided by CORL are licensed, not sold. The Portal, and all copies of the Portal, are owned by CORL or its third party licensors and are protected by various intellectual property laws, including, without limitation, copyright and trade secret laws. CORL reserves all rights not expressly granted to you herein. You agree that you have no right to any CORL trademark or service mark and may not use any such mark in any way unless expressly authorized by CORL as set forth in these Terms. Making unauthorized copies or distribution of Portal content or otherwise violating the Terms may result in the termination of your CORL account, prohibition on use of the Portal, and further legal action. CORL reserves the right to limit your use of or access to the Portal, in its sole discretion in order to maintain the performance and availability of the Portal and to enforce the Terms. CORL is not liable for the loss, corruption, alteration or removal of any content transmitted using our Portal. By using our Portal, you expressly waive the right to seek damages and agree to hold CORL harmless for any such loss, alteration, corruption or removal. You acknowledge and agree that you are solely responsible for retaining all records and reconciling all transaction information relating to your use of the Portal.

Compliance with Law

Data Provider agrees not to use (and will use its best efforts not to allow its end users to use) the Portal for illegal purposes or for the transmission of material that is unlawful, harassing, libelous (untrue and damaging to others), invasive of another’s privacy, abusive, threatening, or obscene, or that infringes the rights of others. Data Provider is solely responsible for any and all improper use of the Portal that occurs as a direct or indirect result of any act or omission of Data Provider. Data Provider will notify CORL immediately of any unauthorized use of the Portal or any other breach of security that is known or suspected by Data Provider.

Security

You acknowledge and agree that you are solely responsible for protecting your password and other personal information and for the consequences of not protecting such data. Access to our Portal and to certain online transactions may involve the use of identification numbers, passwords, payment accounts or other individualized nonpublic information (“Private Documentation”). You shall use your best efforts to prevent unauthorized use of our Portal, your account, or of any Private Documentation, and shall promptly report to CORL any suspected unauthorized use or other breach of security. You shall be responsible for any unauthorized use of your account, identification numbers or passwords until we receive written notice of a breach of security and a request to block further access for such numbers and passwords. CORL shall not be liable for any unauthorized use of payment accounts.

Additionally, Data Provider shall not lease, license, sell, sublicense or otherwise transfer its access to or use of the Portal. The Portal may only be used by Data Provider. In addition, Data Provider shall not modify, create derivative works of, or attempt to decipher, decompile, disassemble or reverse engineer the Portal. Nothing in the Agreement confers upon either party any right to use the other party’s trademarks, except in CORL’s performance of its obligations in the Agreement. All use of such trademarks by either party will inure to the benefit of the owner of such marks, use of which will be subject to specifications controlled by the owner.

Right to Restrict or Terminate Access

CORL may deny or restrict your access to all or part of the Portal without notice in its reasonable discretion if it deems that you have engaged in any conduct or activities that CORL in its reasonable discretion believes violates the letter or spirit of any of the Terms. If CORL denies or restricts your access to the Portal because of such a violation, you shall have no right to obtain any refund or credit for the subscriptions fees you have paid. In the event that the Terms or the Portal are terminated for any reason or no reason, you acknowledge and agree that you will continue to be bound by the Terms. Following termination, you shall immediately cease use of the Portal and any license granted to you under any agreement related to your use of the Portal shall immediately terminate. Upon termination, CORL reserves the right to delete all of your data, and other information stored on CORL’s servers. CORL will not be liable to you or any third party as a result of the termination of the Terms or the Portal or for any actions taken by CORL pursuant to the Terms as a result of such termination. Without limiting the generality of the foregoing, CORL will not be liable to you or any third party for damages, compensation, or reimbursement relating to your use of the Portal, or the termination thereof.

Also of Interest