APEX GLOBAL SOLUTIONS

"Confidential Information" shall encompass all data, knowledge, methods, or documents of technical, architectural, operational, commercial, financial, legal, or strategic nature disclosed directly or indirectly by either Party (the "Disclosing Party") to the other (the "Receiving Party"), in any form whatsoever (oral, written, electronic, network topologies, cloud architectures, Active Directory schemas, vulnerability matrices, firewall policies, AI prompt templates, RAG pipelines, and proprietary source codes).

Each Party strictly covenants, throughout the term of this Agreement and thereafter:

• To maintain absolute secrecy regarding all Confidential Information received from the Disclosing Party;
• Not to disclose or disseminate, directly or indirectly, any portion of such information to third parties without prior written consent;
• To restrict internal dissemination strictly to employees, consultants, and auditors with a legitimate need-to-know, bound by confidentiality covenants no less stringent than this Agreement;
• To use the Confidential Information solely for evaluating, scoping, and executing the Project, to the strict exclusion of any competitive exploitation.

The Parties undertake to enforce state-of-the-art technical and organizational measures (including TLS 1.3 in-transit and AES-256 at-rest encryption, least-privilege role-based access controls, and audit logging) to safeguard Confidential Information against unauthorized access, loss, or alteration, in compliance with NIST CSF 2.0 and ISO/IEC 27001 standards.

To the extent that exchanges involve personal data, both Parties undertake to strictly abide by applicable privacy laws, notably Tunisian Law No. 2004-63 (National Authority for Personal Data Protection - INPDP) and, where applicable for European counterparts, the General Data Protection Regulation (GDPR - Regulation EU 2016/679).

Confidential Information shall not include information that the Receiving Party can establish by written evidence:

• Has lawfully entered the public domain without breach of this Agreement;
• Was already in its lawful possession prior to disclosure by the Disclosing Party;
• Was legitimately obtained from an independent third party without restriction;
• Is required to be disclosed pursuant to a valid judicial or regulatory order, subject to immediate prior notification to the Disclosing Party.

This Agreement shall take effect upon execution for an initial term of twelve (12) months. Confidentiality obligations shall survive termination or expiration for a period of three (3) years from the date discussions cease (and indefinitely with respect to trade secrets, proprietary algorithms, and cryptographic keys).

Upon written request from the Disclosing Party or upon Project completion, the Receiving Party covenants to promptly return or irreversibly destroy all physical and electronic records containing Confidential Information and certify such destruction in writing within fifteen (15) business days.

This Agreement shall be governed by and construed in accordance with applicable laws. Any dispute arising out of or in connection with its validity, interpretation, or performance that cannot be amicably resolved within thirty (30) days shall be submitted to the exclusive jurisdiction of the competent courts of Tunis (Tunisia), without prejudice to the Parties' right to seek injunctive relief or engage in mutually agreed international commercial arbitration.