Mutual NDA

v1.9 — September 2026

This Mutual Non-Disclosure Agreement (the “Agreement”) is entered into between:

Professional Services Consulting AS, a private limited company (aksjeselskap) incorporated in Norway, organisation number 917 281 513 as recorded in the Norwegian Register of Business Enterprises (Foretaksregisteret), with its registered office at Professor Olav Hanssens vei 7A, 4021 Stavanger, Norway, trading as Valor Consulting (the “Consultancy”); and

the client identified below, with its registered office at the address stated below (the “Client”),

Client legal name: ______________________________

Legal form and country of incorporation: ______________________________

Registration number and register: ______________________________

Client registered address: ______________________________

each a “Party” and together the “Parties”. A Party disclosing Confidential Information is the “Disclosing Party”; a Party receiving it is the “Receiving Party”.

1. Background and purpose

1.1 The Parties are discussing, evaluating, and may enter into an engagement under which the Consultancy assesses and helps optimise the Client’s Microsoft Azure costs (the “Purpose”). In connection with the Purpose, each Party may disclose information to the other that is confidential or commercially sensitive.

1.2 The Parties expect that the Client will share, among other things, Azure invoices, cost and usage exports, and related billing metadata. The Parties also expect that the Consultancy may be granted access to parts of the Client’s Azure environment: read-only access for measurement and analysis, and, where the scope agreed for the engagement so provides, access permitting the Consultancy to implement changes. The Consultancy may in turn disclose its methods, pricing, and commercial terms. This Agreement governs how each Party must treat such information. The terms on which any such access is granted are a matter for the engagement agreement under which it is granted. Neither Party is liable under this Agreement for acts or omissions within the Client’s Azure environment except to the extent they constitute a breach of this Agreement.

2. Definition of Confidential Information

2.1 “Confidential Information” means all information, in any form or medium, disclosed by or on behalf of the Disclosing Party to the Receiving Party (including information disclosed by or on behalf of its Affiliates, in respect of which the Disclosing Party may enforce this Agreement as if the information were its own), or otherwise obtained or observed by the Receiving Party through access granted, in connection with the Purpose, whether before or after the date of this Agreement, that is marked confidential or that a reasonable person would understand to be confidential given its nature or the circumstances of disclosure.

2.2 In respect of the Client, Confidential Information includes without limitation:

• Azure billing and usage data, including invoices, cost exports, cost and usage reports, reservation and savings-plan details, subscription and resource identifiers, and tags;
• cloud architecture details, including resource inventories, network topology, service configurations, and capacity or scaling information observed through access granted to the Consultancy;
• commercial terms, including Microsoft or reseller agreements, discount levels, budgets, and forecasts; and
• business plans, personnel information, and any personal data contained in the foregoing (for example, names and business contact details of the Client’s staff appearing in invoices or account metadata).

2.3 In respect of the Consultancy, Confidential Information includes without limitation its assessment methodology, analytical models, report templates, the structure, logic, scoring, benchmarks and savings-estimation approaches embodied in any analysis or deliverable, tooling, scripts and queries, the identity of and terms with its subcontractors, pricing, proposals, and commercial terms.

2.4 Confidential Information also includes copies, summaries, analyses, and other materials prepared by the Receiving Party to the extent they contain or are derived from the Disclosing Party’s Confidential Information, provided that the Consultancy’s Confidential Information described in Clause 2.3 remains the Consultancy’s Confidential Information to the extent it is embodied in any such materials.

2.5 “Affiliate” means, in relation to a Party, any entity that directly or indirectly controls, is controlled by or is under common control with that Party, whether the control is held by an entity or by one or more natural persons; control means holding, directly or indirectly, more than half of the voting rights in an entity or the right to appoint or remove a majority of its board or equivalent governing body.

3. Exclusions

3.1 Confidential Information does not include information that the Receiving Party can demonstrate:

• was or becomes publicly available other than through a breach of this Agreement;
• was lawfully known to the Receiving Party, free of any confidentiality obligation, before disclosure by the Disclosing Party;
• is lawfully received from a third party who is not, to the Receiving Party’s knowledge, under a confidentiality obligation to the Disclosing Party; or
• is independently developed by the Receiving Party without use of or reference to the Disclosing Party’s Confidential Information.

3.2 The exclusions in Clause 3.1 do not apply to personal data. Personal data remains subject to applicable data protection law, including Regulation (EU) 2016/679 (the “GDPR”), whether or not it is also Confidential Information.

4. Permitted use

4.1 The Receiving Party shall use Confidential Information solely for evaluating, negotiating, and performing the engagement contemplated by the Purpose, and for no other purpose.

4.2 The Receiving Party shall not use Confidential Information to develop competing services, to solicit the Disclosing Party’s customers, or for any commercial benefit outside the Purpose. For clarity, each Party may use general know-how, skills, and experience of a non-confidential nature gained in connection with the Purpose, provided this does not involve disclosure or use of the other Party’s Confidential Information. Notwithstanding the first sentence of this Clause 4.2 and Clauses 4.1, 8 and 9.1, the Consultancy may create, use and retain aggregated and anonymised statistical information derived from the Client’s Confidential Information to maintain and improve its methodology and benchmarks, provided that neither the Client, any of its Affiliates nor any individual can be identified from it.

5. Protecting Confidential Information and who may see it

5.1 The Receiving Party shall protect Confidential Information using at least the same degree of care it uses for its own confidential information of a similar nature, and in no event less than reasonable care, including appropriate technical and organisational measures against unauthorised access, loss, or disclosure. The Receiving Party shall notify the Disclosing Party without undue delay after becoming aware of any unauthorised access to, or loss or unauthorised disclosure of, the Disclosing Party’s Confidential Information, and shall cooperate reasonably with the Disclosing Party to contain it.

5.2 The Receiving Party may disclose Confidential Information only to the employees, directors, individual contractors (including individuals engaged through a company owned or controlled by that individual) and professional advisers of the Receiving Party and of its Affiliates who need to know it for the Purpose and who are bound by confidentiality obligations at least as protective as those in this Agreement.

In the case of the Consultancy, each individual given access to the Client’s Confidential Information or environment shall have signed an Individual Confidentiality Undertaking referencing this Agreement; such an Undertaking satisfies the requirement in Clause 5.2 that the individual be bound by confidentiality obligations at least as protective as those in this Agreement, and does not displace the need-to-know requirement. The Consultancy shall provide copies to the Client on request.

The Receiving Party is responsible for any act or omission of any person to whom it discloses Confidential Information under this Clause 5.2, or whom it permits to access the Disclosing Party’s environment, that would be a breach of this Agreement if it were the Receiving Party’s own act or omission.

5.3 Neither Party shall disclose Confidential Information to any subcontractor or other third party without the Disclosing Party’s prior written consent (email sufficing); consent is deemed given for any subcontractor named in the engagement agreement between the Parties (including any statement of work under it), without prejudice to any authorisation required under a data processing agreement; individuals covered by Clause 5.2 (and any company owned or controlled by such an individual through which the individual is engaged) are not subcontractors or other third parties for this purpose, and nor is an Affiliate of the Receiving Party to whose personnel disclosure is permitted under Clause 5.2. Where either Party processes personal data on the other Party’s behalf in connection with the Purpose, the Parties shall in addition enter into a data processing agreement under Article 28 GDPR before that processing begins.

6. Compelled disclosure

6.1 The Receiving Party may disclose Confidential Information to the extent required by law, regulation, court order, or a competent supervisory or regulatory authority, provided that, where legally permitted, it: (a) promptly notifies the Disclosing Party before disclosure; (b) reasonably cooperates with the Disclosing Party’s efforts to limit or contest the disclosure or obtain protective treatment; and (c) discloses only the portion of the Confidential Information legally required to be disclosed.

7. Term and duration of obligations

7.1 This Agreement takes effect on the date of the last signature below and remains in force until terminated by either Party on thirty (30) days’ written notice.

7.2 The confidentiality and use obligations in this Agreement survive for three (3) years after the later of (a) termination of this Agreement and (b) the last disclosure of Confidential Information, except that:

• obligations relating to trade secrets survive for as long as the information remains a trade secret under applicable law; and
• obligations relating to personal data survive without time limit, save that obligations concerning the safeguarding of personal data held by the Receiving Party end when that personal data has been returned or deleted in accordance with Clause 8 and applicable data protection law.

8. Return or destruction

8.1 On the Disclosing Party’s written request, or on termination or expiry of this Agreement, the Receiving Party shall promptly, at the Disclosing Party’s option, return or securely destroy all Confidential Information in its possession or control, including all copies, extracts, and derived materials, and shall confirm in writing that it has done so.

8.2 By exception to Clause 8.1, the Receiving Party may retain Confidential Information to the extent required by law, may retain one copy to the extent required by its bona fide internal record-keeping policies, and may retain copies held in routine backups taken in the ordinary course. Anything so retained remains subject to this Agreement for as long as it is held and may not be used for any purpose other than that for which it is retained; backup copies are deleted in the ordinary course of the Receiving Party’s backup cycles.

8.3 The Client shall revoke any access credentials, tokens, or role assignments granted to the Consultancy, and the Consultancy shall not attempt to retain or re-establish such access after the Purpose has ended.

9. No licence; no warranty

9.1 All Confidential Information remains the property of the Disclosing Party. Nothing in this Agreement grants the Receiving Party any licence or other right, express or implied, to any intellectual property of the Disclosing Party, other than the limited right to use Confidential Information for the Purpose.

9.2 Confidential Information is provided “as is”. The Disclosing Party makes no warranty as to its accuracy or completeness, and accepts no liability for the Receiving Party’s reliance on it, except as may be agreed in a definitive engagement agreement.

10. No obligation to proceed

10.1 This Agreement does not oblige either Party to disclose any particular information, to negotiate, or to enter into any further agreement. Each Party may end discussions at any time without liability, subject to the surviving obligations of this Agreement.

11. Remedies

11.1 The Parties acknowledge that unauthorised use or disclosure of Confidential Information may cause harm for which damages alone would not be an adequate remedy. The Disclosing Party is therefore entitled to seek interim measures (in Norway, midlertidig forføyning under the Dispute Act (tvisteloven) chapter 34) and a prohibitory order (forbud) before a competent court, in addition to any other remedy available at law, without prejudice to its right to claim damages.

12. General

12.1 Neither Party may assign this Agreement without the other Party’s prior written consent, except, on written notice to the other Party, (a) to an Affiliate, or (b) to a successor in connection with a merger, a transfer of all or substantially all of its business or assets, or a transfer of the part of its business to which this Agreement relates, provided in each case that the assignee assumes the assigning Party’s rights and obligations under this Agreement in writing and the assigning Party remains liable for any breach occurring before the assignment.

12.2 This Agreement constitutes the entire agreement between the Parties regarding the confidentiality of information exchanged for the Purpose and supersedes prior discussions on that subject and any earlier confidentiality agreement or undertaking between the Parties relating to the Purpose, including any non-disclosure agreement issued by the Consultancy for the protection of its own information, which ceases to apply from the date this Agreement takes effect and does not revive on its termination. Amendments must be in writing and signed by both Parties.

12.3 If any provision of this Agreement is held invalid or unenforceable, the remaining provisions remain in full force, and the Parties shall replace the invalid provision with a valid one that most closely reflects its intent.

12.4 A failure or delay in exercising any right under this Agreement does not operate as a waiver of that right.

12.5 Notices. Written notice under this Agreement may be given by email to the notice email addresses stated on the signature page (or to such other address as a Party notifies in writing), and notice so given is sufficient written notice for the purposes of this Agreement. An email notice is treated as received on the next business day at the registered office of the addressee, and any notice period runs from that day, unless the sender receives an automated delivery-failure message, in which case the notice is not received. Either Party may change its notice address by notice to the other.

12.6 This Agreement may be signed electronically and in counterparts; each counterpart is an original and together they constitute one agreement. A signature applied through an electronic-signature service, or a scanned signed copy sent by email, has the same effect as an original signature.

12.7 Publicity. Neither Party shall disclose the existence or subject matter of this Agreement or of the Parties’ discussions, or use the other Party’s name or marks in any publicity, reference list, case study or marketing material, without the other Party’s prior written consent (email sufficing), except as permitted by Clauses 5.2, 5.3 and 6.1. The Consultancy may request such consent once an engagement has concluded; the Client will consider the request in good faith but is not obliged to give it.

12.8 This Agreement is made in English, which is the authoritative text; any translation is for convenience only and the English text prevails. Norwegian terms in brackets identify the concept intended under Norwegian law.

13. Governing law and venue

13.1 This Agreement is governed by the laws of the jurisdiction stated below, excluding its conflict-of-law rules. The courts stated below have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement, without prejudice to either Party’s right to seek interim relief in any competent court.

Governing law: ______________________________

Venue — courts: ______________________________

Signatures

Notice email addresses (Clause 12.5):

Consultancy notice email: ______________________________

Client notice email: ______________________________

For the Consultancy

Signature: ______________________________

Name: ______________________________

Title: ______________________________

Date: ______________________________

For the Client

Signature: ______________________________

Name: ______________________________

Title: ______________________________

Date: ______________________________