GLOBALPLATFORM SECURITY LABORATORY RELATIONSHIP AGREEMENT
This document (the “Agreement”) is an agreement between GlobalPlatform, Inc. (“GP”), with offices at
544 Hillside Road, Redwood City, CA 94062, and the undersigned laboratory (“Evaluation Laboratory”), and shallbe effective as of the date that both GP and Evaluation Laboratory (each sometimes referred to herein as a “party”
and collectively as the “parties”) have executed below (the “Effective Date”).
Whereas, Evaluation Laboratory would like to submit for accreditation as a GP Accredited Laboratory(defined below); andWhereas, subject to the terms and conditions of this Agreement, GP is willing to provide a Letter ofAccreditation (defined below) for the Evaluation Laboratory.
For good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the parties
hereby agree to the Terms and Conditions set forth in the following pages of this Agreement.
Evaluation Laboratory
Name:
Business Address:
State/Province:

Country:City:

PostalCode:Laboratory Facility Details (if different than above)
Address:
State/Province:

Country:City:

PostalCode: Please check here if you do not want this accreditation to appear on the GlobalPlatform web site.
Evaluation Laboratory Contact
Name:
Direct Telephone
Number:Location:

Title:
E-mail:Fax:

Finance and Invoice Contact
Name:
Direct Telephone
Number:Location:© GlobalPlatform 2014-2021

Title:
E-mail:Fax:

GP_AGR_203

Page 1 / 15

Terms and Conditions
1.

Definitions. For purposes of this Agreement, the following terms shall have the following meanings:"Certification Process" means the certification process performed by GP Certification Body for assessing
the conformity of the evaluation of a Product detailed in the TEE Certification Process Document.
"Evaluation Process" means the security evaluation process detailed in this Agreement and in the TEE
Certification Process Document.
“Full or Participating GP Member” means a Full Member of GP or a Participating Member of GP, which
has selected the TEE Committee for participation purposes, as each is further defined in the By-laws of GP, andremains in ‘good standing,’ as further defined in the By-laws of GP.
"GP Accredited Laboratory" means a laboratory and/or test facility that performs the Evaluation Process
and has been accredited by GP under this Agreement, pursuant to the TEE Certification Process Document.
"GP Certification Body" means, collectively, the individual(s) and/or entity(ies) designated by GP as
providing the role of certification secretariat for evaluations in connection with the Certification Process. The GP
Certification Body may include individuals employed by GP’s members (or their affiliates) and/or other third parties
engaged by GP.
“GP-related Consulting Services” means any and all consultative, technical or other professional services
performed by Evaluation Laboratory (including without limitation, training, support, customization or other services,
but specifically excluding those security evaluation services performed under or pursuant to the Evaluation
Process that utilize, relate to, or otherwise exploit, Evaluation Laboratory’s knowledge of the Licensed Works or
portion thereof, including without limitation, Evaluation Laboratory’s knowledge of tests, test suites, test plans,
attack catalogs, configurations, or GP qualification, validation, evaluation or certification programs, methodologies
or processes.
“GP Website” means GP’s website located at www.globalplatform.org, and any successor or replacement
web site thereto managed and operated by GP.
“Letter of Accreditation” means the written, formal recognition and acknowledgment of accreditation under
this Agreement, provided by GP to a GP Accredited Laboratory with respect to a specified facility of that GP
Accredited Laboratory.
“Licensed Works” means any and all GP materials, including but not limited to any and all scripts, tools,
test plans, attack catalogs, evaluation methodologies and computer code, and any other materials or informationof GP made available to Evaluation Laboratory in connection with this Agreement or otherwise, any intellectual
property rights therein, and all related documentation, including any subsequent updates, revisions,Improvements, and enhancements of some or all of the Licensed Works, that GP has developed or may develop
in the future and may make available.
"Product" means a TEE product, which includes any device or system-on-chip (SOC) embedding a TEE,
submitted for evaluation under the Evaluation Process.
“Product Vendor” means the entity submitting a Product for evaluation and certification under the
Certification Process, including but not limited to Vendor.
"Security Requirements" means collectively the most recent version (unless GP specifies an earlier
version) of the GP TEE Protection Profile and PP-Modules, GP TEE Evaluation Methodology and GP TEE Attack
Catalog, and all amendments, modifications and upgrades as adopted by GP from time to time.
“TEE” means Trusted Execution Environment.

© GlobalPlatform 2014-2021

GP_AGR_203

Page 2 / 15

"TEE Certification Process Document" means the most recent version (unless GP specifies an earlier
version) of the GlobalPlatform Technology TEE Certification Process, based on the Security Requirements, andall amendments, modifications and upgrades as adopted by GP from time to time. This document is currently
available at https://globalplatform.org/certifications/security-certification/.
2.
Security Evaluation Services. In connection with its performance of security evaluations under or
pursuant to the Evaluation Process and/or this Agreement:
2.1

Accepting Products. During the Term of this Agreement, the Evaluation Laboratory shall accept
Products directly from Product Vendors to perform GP security evaluations, as may be requested
from time to time by GP. Evaluation Laboratory will accept Products for security evaluation
pursuant to this Agreement and negotiate separate agreements between the Product Vendor andthe Evaluation Laboratory. The Evaluation Laboratory is free to establish its own terms andconditions for security evaluation, including, without limitation, pricing, priorities and indemnities;
provided that such terms and conditions are not inconsistent with the Evaluation Laboratory’s
obligations to GP under this Agreement. The Evaluation Laboratory shall perform all Productsecurity evaluations in connection with the Evaluation Process in a professionally competent andtimely manner, through laboratory facilities that are owned and operated by the Evaluation
Laboratory and with respect to which the Evaluation Laboratory has a valid and effective Letterof Accreditation (each an “Accredited Facility” and collectively “Accredited Facilities”).

2.2

Certain Prohibitions. The Evaluation Laboratory is prohibited from prescribing, or directing the
Product Vendor to use, any particular Product design, or otherwise evaluating any Productdesigned to its own specifications. All Evaluation Laboratory activities shall be conducted in amanner as to not show partiality or provide for outside influence on test and evaluation processes.
The Evaluation Laboratory shall not perform security evaluations on any Product in which it has
any ownership or vested interest. The Evaluation Laboratory will limit its activities for ProductVendors requesting security evaluations under the Evaluation Process to assessing thecompliance of designs proposed by the Product Vendor. The Evaluation Laboratory will notprovide design solutions or concepts to any Product Vendor to which it also provides security
evaluation services under or pursuant to the Evaluation Process or this Agreement. Employeesof the Evaluation Laboratory shall not perform design activities on any products for which the
Evaluation Laboratory is also performing security evaluations. Specifically, Evaluation Laboratory
personnel shall not have: a) designed, b) developed original documentation for, or c) built, coded,
or implemented any part of the Product to be tested. If the corporate group to which Evaluation
Laboratory belongs has a design organization, that corporate group shall be organized such that:a) the Evaluation Laboratory has no ownership in the design organization, b) the Evaluation
Laboratory has completely separate management from the design organization, and c) businessbetween the Evaluation Laboratory and the design organization is performed under contractual
agreements. For purposes of the foregoing, “corporate group” means a group of affiliated legal
entities and/or the respective divisions, units and/or departments of any such entity or group ofaffiliated entities; and “design organization” means any legal entity or division, unit or department
within a corporate group, which engages in product design.

2.3

Security Guidelines. The Evaluation Laboratory shall conduct all Evaluation Process tests throughits Accredited Facilities and in accordance with this Agreement and the Security Requirements.

2.4

Security Evaluation Laboratory Requirements. The Evaluation Laboratory shall comply with GP’ssecurity evaluation laboratory requirements, as set forth herein and in the TEE Certification
Process Document as may be amended from time to time. As further described in the TEE
Certification Process Document, an Evaluation Laboratory must (among other things): (a) be a
Full or Participating GP Member in good standing; (b) be a participant in the TEE Security
Laboratory and TEE Attack Expert Working Groups within the GP TEE Committee; (c) have avalid ISO 17025 certificate and accreditation of a recognized certification scheme; (d) haveappropriate TEE expertise and training; and (e) maintain Insurance as defined in this Agreement.
The TEE Certification Process Document specifies certain business and other requirements thatmust also be met and adhered to.

© GlobalPlatform 2014-2021

GP_AGR_203

Page 3 / 15

2.5

Results of Test. For all Products tested under this Agreement using GP’s Security Requirements,
the Evaluation Laboratory shall communicate the corresponding results (interim or final, as thecase may be) to the Product Vendor and, upon authorization by such Product Vendor, to GP, allin accordance with such communication procedures as may be specified and amended by GP
from time to time. The Evaluation Laboratory shall produce and provide to the Product Vendor,
with respect to each Product tested, an evaluation report on the observations of the evaluation.
GP Certification Body, not the Evaluation Laboratory, shall be the final party to determine whether
there is sufficient evidence that a particular Product conforms to the Security Requirements basedon the test results and to make the certification decision. Under no circumstances shall the
Evaluation Laboratory communicate or disclose to any third party, including to a Productmanufacturer or any Product Vendor that a Product has or has not been approved by GP. All
security evaluation observations and associated calculations by the Evaluation Laboratory shallbe permanently recorded at the time they are made irrespective of whether they are subsequently
transcribed. The Evaluation Laboratory shall record the status of GP Product security evaluations
in such a manner as to ensure provision of an accurate status of progress throughout the security
evaluation when requested by GP Certification Body. All records (e.g., documents submitted by
the Product Vendor and test results (e.g. reports generated during the evaluation) shall bemaintained and made available (if authorized by the Product Vendor) to GP Certification Body
upon request as set forth in the TEE Certification Process Document. The Evaluation Laboratory
shall ensure through its agreements with Product Vendors that the Evaluation Laboratory has allrights, permissions and authorizations of the Product Vendor that are reasonable, necessary andappropriate in order to enable it to fully comply with all of its disclosure and related obligations
under this Agreement and in connection with the Evaluation Process.

3.
Risk of Loss. The Evaluation Laboratory shall be solely responsible for the physical safekeeping of all
Products and Security Requirements in its possession and shall maintain at all times during the Term of thisAgreement, the insurance policies required pursuant to this Agreement.
4.

Confidentiality.
4.1

Generally. Restrictions on Use and Disclosure. Except as set forth in this Section 4, each party andtheir respective employees, officers, directors, and authorized agents (“Personnel”) shall use
Confidential Information of the other party only for the purpose of performing Evaluation Laboratory’s
obligations under this Agreement, and GP Certification Body assessing conformance of Products with
the Security Requirements and/or Evaluation Laboratory’s conformance with the Laboratory
Requirements (including but not limited to reporting such conformance as contemplated by the
Security Requirements and Evaluation Process), and for no other purpose whatsoever. Neither party
nor any of its personnel shall disclose any Confidential Information of the other party to any third party
without the other party’s prior express written consent in each instance except as otherwise permitted
herein. Evaluation Laboratory shall restrict disclosure of Confidential Information to those of its
Personnel who have a need to know such Confidential Information for the purposes of this Agreement
and have agreed in writing to restrict their use and disclosure thereof in a manner consistent with theterms of this Agreement. Without limiting the foregoing obligations, Evaluation Laboratory shall takeall reasonable precautions to prevent the unauthorized use or disclosure of any Confidential
Information in its possession or control during the term of this Agreement and thereafter, subject toSection 4.2 below.

4.2

Exceptions. Either party’s obligations under Section 4.1 above shall not apply to Confidential
Information to the extent that the receiving party can prove by written documentation that such
Confidential Information:
4.2.1

Was already known to the receiving party or its Personnel prior to its first disclosure
to receiving party in connection with this Agreement; or

4.2.2

is disclosed to receiving party or its Personnel without obligation of confidentiality froma third party who has the right to disclose such information without restriction;© GlobalPlatform 2014-2021

GP_AGR_203

Page 4 / 15

4.2.3is or becomes publicly available through no fault of the receiving party or its Personnel;
or

4.2.4

is independently developed by receiving party or its Personnel without any use ofConfidential Information disclosed pursuant to this Agreement.

4.2.5

Notwithstanding anything contained herein or any other agreement to the contrary,
the receiving party may disclose Confidential Information to:

4.2.6

5.

(a)

the extent that it is so ordered by a court of competent jurisdiction or by
any other governmental, administrative or quasi-judicial entity; and(b)the extent it is subject to a request in any litigation in which recipient is aparty provided, however, that recipient provides to discloser prompt written
notice of such request prior to such disclosure and provides reasonable
information and assistance to discloser, at discloser’s request, to contest
or limit such request.

In addition, notwithstanding anything contained herein or any other agreement to thecontrary, and regardless of whether such information constitutes Confidential
Information of the Evaluation Laboratory, GP may disclose to:(a)GP’s personnel: (i) a list of evaluation laboratories that have scheduled or
submitted Products for security evaluation and (ii) with respect to all
Products submitted under this Agreement, the corresponding security
evaluation status, results and issues; and(b)

any third party that is subject to confidentiality obligations similar to those
set forth in this Section 4, any summary or cumulative information (suchas, but not limited to, test benchmarking and processes) that GP, in its sole
discretion, deems appropriate in connection with aligning security
evaluation standards and platforms.

4.3

Return or Destruction. Upon the earliest of the termination of this Agreement or GP’s demand,
unless and to the extent otherwise agreed by GP pursuant to a separate written agreement,
Evaluation Laboratory shall promptly return to GP all GP property and all Confidential Informationof GP. Alternatively, if so directed by GP, Evaluation Laboratory shall destroy all Confidential
Information, and all copies thereof, in Evaluation Laboratory’s possession or control, and shallprovide a certificate signed by an officer of Evaluation Laboratory that certifies such destruction
in detail acceptable to GP.

4.4

Confidential Information. "Confidential Information" means all information or material that (i)relates to (A) the Product Vendor or any Products, (B) the Security Requirements, or (C) the
testing or test results of any Products under or in connection with the Evaluation Process (exceptthat notwithstanding anything to the contrary herein or elsewhere, GP shall be permitted to
publicly disclose whether a particular Product has satisfactorily complied with the Security
Requirements and related Product listing information as contemplated by the Certification
Process) and (ii) is provided by GP or is marked confidential or bears a marking of like importance.
Such marking must be sufficiently specific to enable the recipient to identify the informationconsidered to be Confidential Information by the discloser. Information disclosed by Evaluation
Laboratory in a non-tangible form will be considered Confidential Information only if the discloser
identifies such information in writing to the recipient within thirty (30) days of the initial disclosure.

Competency.

© GlobalPlatform 2014-2021

GP_AGR_203

Page 5 / 15

6.

5.1

GP Recognition. Neither the Evaluation Laboratory nor any Accredited Facility thereof shallaccept any Products for security evaluation under the Evaluation Process unless the Evaluation
Laboratory, and all physical facilities that will be involved in the security evaluation, have firstundergone an assessment and been formally recognized as an Accredited Facility by GP under
the Certification Process, which assessment may be carried out directly by GP Certification Bodyor through a third party assessor selected by GP Certification Body. GP Certification Body shallbe free to establish the terms and conditions of the assessment, the purpose of which is to ensurethat the Evaluation Laboratory and the facilities engaged in the security evaluation meets GP’s
generally applicable standards for test facilities performing Product security evaluations.
Evaluation Laboratory agrees to pay all fees incurred to conduct such assessment. Oncesatisfactory assessment is completed, GP shall be permitted to identify the Evaluation
Laboratory’s name, and its recognized facilities and related information, on the GP Website, or insuch other publications as may be released by GP from time to time, which detail all Productsecurity evaluation facilities that have satisfactorily met GP’s security evaluation standards.

5.2

Periodic Audits. In addition to any audit rights that may exist in the TEE Certification Process
Document, and unless GP otherwise has good cause for additional periodic audits, GP
Certification Body may require periodic assessments (not more often than once every 12 months)
to assess whether the Evaluation Laboratory, and each of its Accredited Facilities engaged insecurity evaluations, continues to meet GP’s generally applicable standards for test facilities
performing Product security evaluations. The Evaluation Laboratory shall pay all the assessment
fees incurred.

5.3

Interim Proficiency Assessments. In addition to the audit described in Section 5.2, from time totime, and not more than once per calendar year, the Evaluation Laboratory, and each of its
Accredited Facilities engaged in security evaluations, shall perform proficiency tests requested
by GP Certification Body. GP shall be free to establish the terms and conditions of theassessment, the purpose of which is to assess whether the Evaluation Laboratory, and each of
the Accredited Facilities engaged in security evaluations, is performing Product security
evaluations in accordance with GP’s Security Requirements.

5.4

Witnessing Security Evaluations. The Evaluation Laboratory shall (a) permit GP Certification Body
to observe any Product security evaluation performed under this Agreement and shall follow any
reasonable requests made by GP Certification Body in connection with such visits regarding themanner of conducting any or all such security evaluations, in each case, at Evaluation
Laboratory’s sole cost and expense.

5.5

Accreditations and Certifications. The Evaluation Laboratory shall provide evidence of all
accreditations claimed. These may include accreditation under the relevant national
implementation of ISO/IEC 17025 (Criteria for the competence of testing and calibrationlaboratories), ISO 9000 (Quality management systems), ISO 15408 (Common Criteria for IT
security evaluations) or other similar international, national, or industry standards.

5.6

Related Equipment. Equipment used to drive Products under security evaluation or to carrysignals transmitted from or received by the Products under security evaluation under the
Evaluation Process shall be under the control of the Evaluation Laboratory for the duration of thetest. The Evaluation Laboratory shall obtain periodic calibration certificates for all such equipment
at the Evaluation Laboratory’s cost. Where the Evaluation Laboratory uses equipment that is
owned by a third party, the Evaluation Laboratory shall secure the right for GP Certification Bodyor the Evaluation Laboratory to periodically check the calibration records of such equipment, toassure that equipment has been calibrated to manufacturer’s specifications. Where it is notpracticable to conduct all security evaluations on a single test sample, security evaluations may
be performed on representative samples. Where more than one test sample is used and whereseparate samples are tested, each security evaluation sample shall be separately identified
together with precise details of the tests performed on it.

Consulting Services.

© GlobalPlatform 2014-2021

GP_AGR_203

Page 6 / 15

6.1

Grant of License. Subject to the terms and conditions of this Agreement, GP hereby grants to
Evaluation Laboratory a limited, non-exclusive, worldwide, non-transferable, revocable license to
use the Licensed Works solely on an internal basis as necessary for purposes of providing GPrelated Consulting Services (the “License”).

6.2

Restrictions.

6.3

6.2.1

No Copying, Modification, Distribution or Sublicensing. Except as otherwise
expressly provided herein or agreed by GP in writing, under no circumstanceshall Evaluation Laboratory copy or otherwise use the Licensed Works or any
portion thereof for any purpose, including without limitation, for purposes ofcreating or developing any test Product or providing GP testing services.
Notwithstanding anything to the contrary in this Agreement, under nocircumstances shall Evaluation Laboratory sublicense, publish, modify,
distribute, demonstrate, sell, offer for sale, disclose or create derivative works
based upon the Licensed Works or any portion thereof without the express
written approval of GP.

6.2.2

Copyright/Patent Notice. All reproductions or embodiments of any of theLicensed Works, related documentation or portion of any of the foregoing shallincorporate the legends that appear on such Licensed Works or such otherlegends as GP may instruct Evaluation Laboratory from time to time.

6.2.3

Restricted Rights. Use, duplication or disclosure by or to the United States
government may be subject to Restricted Rights as set forth in the Rights inTechnical Data and Computer Software Clauses in DFARS 252.227-7013 (c)(1)and FAR 52.227-19(a)-(d) as applicable (or successor regulations thereto) and
Evaluation Laboratory agrees to comply with all such Restricted Rights inconnection with its use of any of the Licensed Works.

6.2.4

No Warranties or Guaranties. Under no circumstances shall Evaluation
Laboratory make or publish any representation, warranty or guarantee by or on
behalf of GP concerning any Licensed Works or portion thereof.

Payment and Reporting. In addition to any applicable payment or other obligations arising from
Evaluation Laboratory’s status as a member of GP, Evaluation Laboratory shall, as and in themanner specified below, record, report to GP regarding, and pay to GP the Consulting Fees
specified below with respect to, all GP-related Consulting Services performed or provided by
Evaluation Laboratory:
6.3.1

Reporting. Within fifteen (15) days after the end of each calendar quarter,
Evaluation Laboratory shall provide to GP a report identifying and enumerating
all GP-related Consulting Services performed by Evaluation Laboratory during
such calendar quarter (each a “Report”), in each case detailing all such GPrelated Consulting Services and the corresponding amount Evaluation
Laboratory charged to perform such GP-related Consulting Services.

6.3.2

Fees. On a calendar quarterly basis, with respect to all GP-related Consulting
Services performed by Evaluation Laboratory during the applicable calendar
quarter, GP will invoice Evaluation Laboratory for an amount (“Consulting Fees”)
equal to the product of (a) GP’s then current consulting rate (the “Consulting
Rate”) multiplied by (b) the amount Evaluation Laboratory charged for such GPrelated Consulting Services. Evaluation Laboratory shall pay each of theforegoing invoices within thirty (30) days of the applicable invoice date. A late feeof 1% per month will apply to all late payments. The current Consulting Rate is
set forth on Appendix B hereto. Evaluation Laboratory acknowledges and agrees© GlobalPlatform 2014-2021

GP_AGR_203

Page 7 / 15

that GP may change such rate at any time and from time to time upon at leastten (10) days’ notice (which notice may be delivered by email and shall bedeemed delivered upon transmission regardless of anything to the contrary) orby posting a revised fee schedule on the GP Website.
6.3.3

Access to Books and Records. Evaluation Laboratory shall prepare and maintaincomplete and accurate books and records relating to all GP-related Consulting
Services, related fees and its use of the Licensed Works. While this Agreement
is in effect, and for a period of six (6) months thereafter, GP shall have the right,
at its expense and upon reasonable notice, twice per calendar year, to examine,or have examined by an accountant designated by GP, Evaluation Laboratory’sbooks and records in order to determine and verify performance under thisAgreement (each such examination, an “Audit”). In the event GP determines, in
its reasonable discretion, that Evaluation Laboratory has underpaid the amountof fees owed in accordance with this Agreement, Evaluation Laboratory shall
reimburse GP for all costs incurred in connection with the applicable Audit, andshall promptly pay to GP the amount of such underpayment, along with allapplicable late fees.

6.4

Support and Maintenance. GP shall have no obligation (to Evaluation Laboratory or otherwise) to
support or maintain the Licensed Works or any portion thereof.

6.5

Intellectual Property. Notwithstanding anything to the contrary in this Agreement, Evaluation
Laboratory acknowledges and agrees that the Licensed Works and all intellectual property rights
in or thereto shall, at all times, be and remain the exclusive property of GP. Except for the licenses
expressly granted herein, nothing in this Agreement shall be construed to convey or license to
Evaluation Laboratory or any third party any right, title or other interest whatsoever, and GP
hereby expressly reserves all other rights. For purposes of this Agreement, “intellectual property
rights” means, on a worldwide basis, any and all: (i) rights associated with works of authorship,including copyrights thereof; (ii) trade secrets or any data or information which provides value or
a competitive advantage to its holder by not being publicly known; (iii) patents, patent applications,continuations, divisionals, reexaminations, reissues; (iv) designs, algorithms and other industrial
property rights; (v) other intellectual and industrial property rights of every kind and nature,
however designated, whether arising by operation of law, contract, license or otherwise; and (vi)applications, registrations, renewals, extensions, continuations, continuations-in-part, divisions orreissues thereof now or hereafter in force of the foregoing (including any rights in any of theforegoing) and foreign equivalents thereof.

7.
Public Statements. GP shall have the right to publicly announce that the Evaluation Laboratory hasentered into this agreement with GP, as well as any subsequent accreditations provided by GP. Subject to GP’s
prior written approval, during the Term only, the Evaluation Laboratory may publicly announce that it has enteredinto this Agreement with GP. Unless otherwise authorized by GP in writing, the Evaluation Laboratory shall notmake any other public statements regarding this Agreement or the arrangements contained herein. GP may
publish, in connection with documentation supporting the Evaluation Process, contact information about thosefacilities including the Evaluation Laboratory, and each of its Accredited Facilities engaged in security evaluations,recognized by GP to perform certain GP Product security evaluations. The Evaluation Laboratory acknowledges
that GP intends to enter into agreements similar to this Agreement with other Evaluation Laboratories, and thatsuch other Evaluation Laboratories may also be listed by GP.
8.
Indemnity. Except to the extent solely caused by GP’s gross negligence or willful misconduct, theEvaluation Laboratory shall indemnify, defend and hold harmless GP, GP’s members, and each of GP’s and GP
Member’s subsidiaries, member financial institutions, and their respective directors, officers, employees, agents,
successors and assigns (collectively, the “Indemnified Parties”) from all claims, losses, liabilities, damages, suits,
actions, government procedures, taxes, penalties, or other costs brought against the Indemnified Parties arisingfrom: (i) any breach of this Agreement or failure by Evaluation Laboratory or any of its facilities to perform any
tests in accordance with or to otherwise comply with GP’s Security Requirements; (ii) any negligent act or omission
by Evaluation Laboratory or any of its facilities or its or their willful misconduct; and (iii) any action or the use of© GlobalPlatform 2014-2021

GP_AGR_203

Page 8 / 15

any device, product, system or methodology that has not been expressly required by GP. EXCEPT FORDAMAGES CAUSED BY WILLFUL MISCONDUCT OF A PARTY OR BY BREACH OF SECTION 4 OF THISAGREEMENT, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER FOR ANYCONSEQUENTIAL, INCIDENTAL, INDIRECT OR SPECIAL DAMAGES, HOWEVER CAUSED, WHETHERUNDER THEORY OF CONTRACT, TORT (INCLUDING NEGLIGENCE) OR OTHERWISE, EVEN IF THE
OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION OF
LIABILITY DOES NOT APPLY TO INDEMNIFICATION OWED BY EVALUATION LABORATORY TO GP FOR
THIRD PARTY CLAIMS. NOTWITHSTANDING ANYTHING IN THIS AGREEMENT TO THE CONTRARY, GP’STOTAL LIABILITY UNDER THIS AGREEMENT SHALL NOT EXCEED ONE THOUSAND DOLLARS ($1,000).
9.
Insurance. The Evaluation Laboratory shall comply with the insurance requirements set forth in Appendix
A, as may be amended from time to time in writing by GP, and shall maintain all other insurance as required byapplicable law.
10.

11.

Technology License.
10.1

Grant. GP hereby grants the Evaluation Laboratory a royalty-free, revocable, non-transferable,
non-assignable license to use all Licensed Works delivered by GP to the Evaluation Laboratory
in connection with this Agreement (including Security Requirements), as may be necessary topermit Product security evaluations under the Evaluation Process during the Term. Except asotherwise expressly provided in this Agreement or in a separate written agreement with GP, theEvaluation Laboratory may use such Licensed Works solely for purposes of carrying out Productsecurity evaluations under this Agreement or to facilitate Evaluation Laboratory’s efforts to assist
vendors in developing products that will be submitted for GP Product security evaluation. ALL
LICENSED WORKS ARE PROVIDED ON AN “AS IS” BASIS, “WITH ALL FAULTS” KNOWNAND UNKNOWN, AND WITH NO WARRANTIES OF ANY KIND. TO THE MAXIMUM EXTENTPERMITTED BY APPLICABLE LAW, GP EXPRESSLY DISCLAIMS AND EVALUATIONLABORATORY EXPRESSLY WAIVES, ALL IMPLIED WARRANTIES OF ANY KIND, EXPRESSOR IMPLIED, INCLUDING WITHOUT LIMITATION, ANY WARRANTY OF FITNESS FOR ANY
PURPOSE, MERCHANTABILITY AND NON-INFRINGEMENT.

10.2

Avoidance of Claims and Mitigation of Damages. In the event that GP becomes aware of apotential claim of infringement with respect to the Licensed Works or any portion thereof that has
been or may be asserted against GP, Evaluation Laboratory or any third party, GP may in its sole
discretion (i) modify such Licensed Works so as to avoid such infringement or potential claim, (ii)procure for Evaluation Laboratory the right to continue using such Licensed Works or (iii)
terminate any or all of the licenses granted in this Agreement with respect to such Licensed Works
upon written notice. In the event that GP modifies the Licensed Works pursuant to this Section,
Evaluation Laboratory shall promptly upon written notice thereof from GP cease providing security
evaluations under the Evaluation Process and/or GP-related Consulting Service that incorporate,
reference or implement the unmodified version of the Licensed Works.

Term.
11.1

Term. This Agreement shall commence on the Effective Date and shall continue thereafter for aterm ending as of the effective date of termination pursuant to this Section 11 (the “Term”).

11.2

Termination. Either party shall have the right to terminate the Agreement at any time during theTerm, with or without cause, by delivering written notice of its intent to terminate with 30 calendar
days’ notice. Additionally, (a) either party may terminate this Agreement immediately upon noticeto the other if the other becomes insolvent or files a voluntary or involuntary proceeding inbankruptcy, or has a receiver appointed to administer its assets, or if the other party becomessubject to a dissolution, liquidation or other winding-up of its business and (b) GP may terminate
this Agreement immediately upon notice to Evaluation Laboratory in the event GP suspects,
determines or receives notice that the Licensed Works, any part thereof or any evaluation
services or GP-related Consulting Services provided by Evaluation Laboratory infringe any thirdparty intellectual property right.

© GlobalPlatform 2014-2021

GP_AGR_203

Page 9 / 15

11.3

12.

Effect of Termination. Upon termination of this Agreement: (a) Evaluation Laboratory will
immediately (i) cease all evaluation services in connection with the Evaluation Process (provided,
however, that if and to the extent instructed by GP, Evaluation Laboratory shall complete all workin progress in connection with security evaluations under the Evaluation Process pursuant to thisAgreement) and (unless and to the extent approved in writing pursuant to a separate writtenagreement with GP) cease all GP-related Consulting Services, and in either case destroy all
marketing and other materials relating to such ceased services, (ii) while Evaluation Laboratory
remains a Full or Participating GP Member, cease all use of the Licensed Works other than such
use as is generally permitted for Members of GP of the same class as Evaluation Laboratory and(iii) at such time as Evaluation Laboratory is no longer a Full or Participating GP Member, cease
all use of the Licensed Works and (b) all rights and obligations of the parties hereunder shallterminate, except that Evaluation Laboratory’s obligation to pay GP any amounts then due
hereunder and the parties’ respective rights and obligations under Sections 2.5, 2.6, 3, 4, 7, 8,
11.3 and 12 of this Agreement shall survive.

General.
12.1

Compliance with Laws and Export Regulations. To the extent applicable, Evaluation Laboratory
agrees to comply with the US Export Administration Regulations and all other applicable laws andregulations governing export, import or use of encryption products and technology.

12.2

Governing Law. This Agreement shall be governed by the internal laws of the state of Delaware,without regard to its choice of law provisions, as such laws are applied to agreements enteredinto and fully performed in Delaware. The Evaluation Laboratory consents to the non-exclusive
jurisdiction of the Federal and State courts located in Delaware, U.S.A., for purposes of resolving
disputes that may arise under this Agreement.

12.3

Injunctive Relief. The parties acknowledge that a violation of Section 4 (Confidentiality) or any
license provision or restriction hereof would cause irreparable injury and that damages at law for
any such breach would be inadequate, and would impossible to ascertain. In the event of thebreach or threatened breach of any such obligations, in addition to any and all other remedies at
law or in equity, the non-breaching party shall have the right to injunctive relief enjoining any andall threatened or actual activities in violation thereof; and each party hereby consents and agrees
that temporary and permanent injunctive relief may be granted in any proceedings which might
be brought to enforce any such rights without the necessity of posting bond.

12.4

Amendments. No modification or amendment to this Agreement shall be effective unless madein writing, executed by both parties. No waiver under this Agreement in one instance shall effecta waiver in any other instance.

12.5

Entire Agreement. This Agreement, together with its appendices, represents the parties’ entire
agreement with respect to Product security evaluations, superseding all prior written or otheragreements pertained thereto.

12.6

Independent Contractor. This Agreement establishes the terms upon which the Evaluation
Laboratory will act as an independent contractor to Product Vendors, but does not establish any
partnership, fiduciary, employment or other relationship between GP and the Evaluation
Laboratory.

12.7

Force Majeure. The Evaluation Laboratory shall not have any liability to GP in respect of any
delay in carrying out or failure to carry out any of its obligations under this Agreement, caused byfire, strikes or other industrial action or dispute, acts of Government, or any other circumstances
outside the reasonable control of the Evaluation Laboratory.

12.8

Compliance with Applicable Law. The Evaluation Laboratory shall comply with all applicable laws
in carrying out its obligations under this Agreement and its agreements with Product Vendor in© GlobalPlatform 2014-2021

GP_AGR_203

Page 10 / 15

connection with this Agreement. In the event the Evaluation Laboratory is unable to perform anyof its obligations hereunder due to applicable law, the Evaluation Laboratory shall promptly inform
GP of such law. In the event any provision of this Agreement is unenforceable under applicablelaw, that provision will be stricken from this Agreement for so long, and only to the extent
necessary, to make the remaining portions of this Agreement effective, but only if by doing so,
the essential purposes of this Agreement remain in effect.
12.9

Assignment and Subcontracting. This Agreement may not be assigned by the Evaluation
Laboratory, including subcontracting or delegating to any third party any obligation in connection
with any Product security evaluation under or pursuant to the Evaluation Process, without GP’s
prior written consent, which consent may be withheld for any or no reason. GP may assign its
obligations under this Agreement with written notice to Evaluation Laboratory.

12.10

No Inconsistent Agreements. Evaluation Laboratory shall not enter into any agreements orunderstandings with any third-party or entity that would subject Evaluation Laboratory to any
obligation or responsibility, expressed or implied, that would prevent Evaluation Laboratory fromproviding GP with the full benefit of the obligations and responsibilities set forth herein, including
but not limited to Sections 2.5 and 4.2 of this Agreement. Further, Evaluation Laboratory
represents and warrants that as of the Effective Date, Evaluation Laboratory is not subject to any
agreements or understandings that would subject Evaluation Laboratory to any obligation or
responsibility, expressed or implied, that would prevent Evaluation Laboratory from providing GP
with the full benefit of the obligations and responsibilities set forth herein, including but not limited
to Sections 2.5 and 4.2 of this Agreement.

12.11

Attorneys' Fees. In the event of a dispute between the parties regarding the enforcement orinterpretation of any terms of this Agreement, the non-prevailing party shall pay the reasonable
costs and attorneys' fees of the prevailing party, including the reasonable costs and attorneys'
fees incurred in the appeal of any final or interlocutory judgment.

12.12

Rights and Remedies. The rights and remedies provided by this Agreement are cumulative andthe use of any one right or remedy shall not preclude or waive the right to use any or all otherremedies. These rights and remedies are given in addition to any other rights the parties may
have by law, statute, ordinance or otherwise.

12.13

Notices. Except as otherwise stated in this Agreement, any notices required or permitted by thisAgreement shall be in writing and shall be delivered as follows, with notice deemed given as
indicated: (i) by electronic mail, sent with a confirming receipt, effective when such confirming
receipt is received by sending party; (ii) by personal delivery when delivered personally; (iii) byovernight courier upon written verification of receipt; (iv) by certified or registered mail, return
receipt requested, upon verification of receipt; (v) by a facsimile transmission with a return receipt
and written confirmation of such transmission sent to the recipient. Notice shall be sent to theaddresses first set forth above or such other address as either party may specify in writing.

12.14

Counterparts. This Agreement may be executed in two or more counterparts, each of which shallbe deemed an original, but all of which together shall constitute one and the same instrument.
For purposes hereof, a facsimile copy of this Agreement, including the signature pages hereto,
shall be deemed to be an original.

[remainder of page intentionally left blank]© GlobalPlatform 2014-2021

GP_AGR_203

Page 11 / 15

IN WITNESS WHEREOF, the duly authorized officers of the parties have executed this Agreement onbehalf of the parties for effectiveness as of the date first written above.
GLOBALPLATFORM, INC.

EVALUATION LABORATORY

By:

By:

Name:

Name:

Title:

Title:

Date:

Date:

© GlobalPlatform 2014-2021

GP_AGR_203

Page 12 / 15

GLOBALPLATFORM SECURITY LABORATORY RELATIONSHIP AGREEMENTAPPENDIX A – INSURANCE
Evaluation Laboratory shall maintain in effect at all times during the Term of this Agreement with respect tothe Evaluation Laboratory, its Accredited Facilities and all other facilities utilized by any of the foregoing inconnection with the Evaluation Process (collectively, the “Laboratory”), at the Evaluation Laboratory’s solecost and expense, the following insurance coverage with respect to Laboratory’s (and its employees’)
performance under this Agreement. Unless provided by a government-run system, such insurance shall be
issued by financially responsible and properly licensed insurance carriers rated at least A- VII by AM Best(or the reasonable equivalent by another reputable rating agency).
1. WORKERS’ COMPENSATION OR EMPLOYERS’ LIABILITY INSURANCE covering all Laboratory
employees for employment-related injury or illness in accordance with applicable legal andregulatory requirements in the jurisdictions where Laboratory’s services are performed.
2. COMMERCIAL GENERAL LIABILITY INSURANCE or PUBLIC LIABILITY INSURANCE written on
an occurrence form and including coverage for bodily injury, property damage, products andcompleted operations, personal injury, advertising injury and contractual liabilities with minimum
limits of US$1,000,000 per occurrence and US$2,000,000 annual aggregate (or equivalent value
in foreign currency).
3. If automobiles will be used in connection with this Agreement in any way, AUTOMOBILE LIABILITY
INSURANCE including owned, leased, hired or non-owned autos subject to minimum limits of
US$1,000,000 (or equivalent value in foreign currency) for bodily injury and physical damage.
4. TECHNOLOGY ERRORS & OMISSIONS/PROFESSIONAL LIABILITY INSURANCE covering
liabilities for financial loss resulting or arising from acts, errors or omissions in rendering ofevaluations and Laboratory’s performance under this Agreement or from any related data
damage/destruction/corruption with a minimum limit of US$2,000,000 (or equivalent value inforeign currency) each claim and annual aggregate.
5. All other insurance required by the applicable laws or regulations in the jurisdictions whereLaboratory’s services are performed.
If any of the above insurance is written on a claims-made basis, then Laboratory shall maintain suchinsurance with separate limits for this Agreement for five (5) years after the termination of this Agreement.
To the extent permissible by law, Laboratory agrees to waive subrogation against GP for any injuries toLaboratory’s employees arising out of or in any way related to Laboratory’s performance under thisAgreement. Further, unless prohibited by law or commercially unavailable in the applicable jurisdiction
where Laboratory’s services are performed, Laboratory agrees that it shall ensure that the Workers’
Compensation/Employer’s Liability coverage required above agree to waive all rights of subrogation against
GP for any claims arising out of or in any way connected to Laboratory’s performance under this Agreement.
Upon execution of this Agreement, or as otherwise agreed by GP, and annually thereafter, Laboratory shallfurnish one or more certificates, satisfactory to GP, from each insurer (or its authorized agent) evidencingthat the coverage required herein is in full force and effect in compliance with this Agreement. Each suchcertificate shall state, at a minimum, the relevant policy number(s), the insurer(s), date(s) of expiration andlimits of coverage. Unless otherwise instructed by GP, Laboratory shall cause such certificates to be sent
to GP at the mailing address stated in this Agreement. Laboratory shall obtain replacement insurancecomplying with these requirements immediately upon any cancellation or material revision of its coverage.
Fulfillment of obligations to procure insurance shall not otherwise relieve Laboratory of any liability
hereunder or limit Laboratory’s obligations to indemnify GP.
In the event that Laboratory subcontracts or assigns any portion of its services under this Agreement,
Laboratory shall require any such subcontractor to purchase, maintain and evidence insurance coverageof such types and in such amounts as are reasonably appropriate for the services being provided by suchsubcontractor.

GP does not in any way represent that the insurance or limits of insurance required above are sufficient or
adequate to protect Laboratory’s interests. Laboratory is responsible at its sole expense for obtaining any
additional insurance Laboratory deems necessary to protect its interests.

APPENDIX B – CONSULTING RATE
Consulting Rate:0%*.

*Subject to change at any time upon at least ten (10) days prior notice in accordance with the Agreement.