Mutual Confidentiality Agreement

This agreement is between TIMPIA S.R.L., operating as Noda Energy ("Noda"), and the customer whose account accepted it ("you").

• Company: TIMPIA S.R.L., operating as Noda Energy
• Legal form: Societate cu răspundere limitată (S.R.L.), a limited liability company incorporated in Romania
• Registered office: Str. Zizinului nr. 6, bl. 40, sc. A, et. 5, ap. 15, camera 3, Brașov 500414, Romania
• Operating address: Coresi Business Campus, Str. Zaharia Stancu nr. 6, Brașov, Romania
• Trade Register: J08/2046/2023
• EU VAT: RO53544402
• Email: [email protected]
• Phone: +40 787 578 482

You enter into it by accepting the Terms and Conditions, which incorporate this agreement by reference, at the point your account is created. Where the platform presents a specific agreement for you to accept in-product, it records your name, email address, organisation, IP address, the date and time, and the version of the document, and we will provide a copy of that record on request.

If your organisation wants this agreement executed as a signed document, or wants its own confidentiality agreement used instead, write to [email protected] and we will sign.

It applies to information exchanged before, during and after any screening, whether or not you go on to purchase.

Yours. The site geometry and coordinates you draw or upload, the project type and capacity, your questions and notes, the documents you upload, the reports produced for you, the existence and content of your pipeline, and anything else you provide that is marked confidential or would reasonably be understood to be.

Ours. The Noda platform, its models, methodology, screening logic, prompts, evidence framework and report structure, together with any non-public commercial information we share with you.

The reports produced for you are your confidential information. You may use and share them as Section 10 of the Terms and Conditions permits, including with your advisers, financiers and counterparties, without asking us.

Information that is already public without breach of this agreement, that the receiving party already lawfully held, that it develops independently without reference to the other's confidential information, or that it lawfully receives from a third party free to disclose it.

Where disclosure is required by law, a court or a regulator, the disclosing party may make it, and will tell the other party first where it is lawfully able to do so, so that protective measures can be sought.

This agreement also does not restrict your disclosure of a report, or of our confidential information embodied in a report, where Section 10 of the Terms and Conditions permits it — including sharing it with your advisers and financiers, and filing it with a grid operator or a permitting authority.

We use your confidential information only to produce and deliver your reports, to operate and support your account, and to meet our legal obligations. Access inside Noda is limited to the people who need it to do that work, and they are bound by confidentiality obligations at least as protective as these.

We do not sell your material. We do not use your project material to train models for other customers. We do not disclose your identity, your sites or your reports to another customer.

Producing a report requires the platform to send information to external providers, and you should know exactly what leaves and what does not.

What is sent. To generate a report, the site geometry and coordinates, the project type and requested capacity, and the questions and notes you wrote are sent to our model routing provider and to the model operator behind it. During a run the system also queries public web, map and geospatial sources to answer your questions, and those requests carry the site coordinates and search terms derived from what you asked. Uploaded documents are read by the platform and their relevant content may form part of what is sent.

What is not sent. Your name, your email address and your company name are not included in requests to the model provider. Requests carry an opaque run identifier instead, so the provider receives the project values without the identity behind them.

Training. Our agreement with the routing provider prohibits retention of request content and prohibits training on it, and passes the same prohibition to the model operator. The instruction is also set on every request and re-applied on every retry. We can show you both the signed agreement and the configuration.

Product telemetry. While you use the workspace we record which pages and controls you used and whether an action succeeded, together with error reports from the browser and from our own servers. We do not record your screen and we do not capture the contents of your project material through telemetry. Section 11 of the Privacy Policy sets out exactly what is collected and how to be excluded.

Storage. Your project material and the documents you upload are held on our own servers in Germany, in a private storage bucket that refuses anonymous access. They are encrypted at rest and in transit; Section 7 of the Privacy Policy sets out what protects them. The companies involved, what each receives and the transfer safeguards that apply are named on the Sub-processors page, which is dated against the software build it describes.

We would rather tell you this plainly than describe the platform as a closed system. It is not one, and no useful screening product could be.

The measures we operate are set out in Section 7 of the Privacy Policy. We state them there rather than repeat a summary here, so that there is one description of our security and it is the accurate one.

We keep your project material for as long as your account is open, so that you can return to a screening, and we delete it when you ask. Write to [email protected] and we will delete it within 30 days and confirm when it is done. Retention periods for everything else are in the Privacy Policy.

Deletion of your project material, your reports and your account data is carried out on request rather than on a fixed clock, and it is complete: documents, reports, sites and runs are all removed, and we confirm when it is done. Several technical retentions run automatically in addition: the scratch workspace a run uses is collected after seven days, workflow histories after thirty, and server logs after fourteen.

These confidentiality obligations continue for three years after the later of the end of your account and the last exchange of confidential information between us. Obligations in respect of anything that is a trade secret continue for as long as it remains one.

Nothing here transfers ownership of anything. Neither party is obliged to disclose any particular information, to purchase, to supply, or to enter into any further agreement.

Each party may seek injunctive relief to prevent a breach of this agreement, in addition to any other remedy, because damages alone may not be adequate.

Romanian law governs this agreement. The courts of Brașov, Romania have exclusive jurisdiction, save that either party may seek injunctive relief in any competent court.

Questions about this agreement or about how we handle your data: [email protected].