NON-DISCLOSURE AGREEMENT FOR VULNERABILITY DISCLOSURE PROGRAMME OF CARS24

This Non-Disclosure Agreement (the "Agreement") is applicable to all security experts (“Participants”) participating in Vulnerability Disclosure Programme of Cars24 Services Private Limited having its corporate office at Plot no. 65, Sector 44, Gurugram, Haryana-122003(“hereinafter referred to as “Company”).

Purpose

The Company has introduced its Vulnerability Disclosure Programme (the "Program") wherein the Participants may Participate to identify and report vulnerabilities in the Company’s Website www.cars24.com or its mobile application or any other asset of the Company (the “Systems”). In connection with the Program, the Participants may discover certain bugs or vulnerability during its research and/or the Company may disclose certain confidential information to the Participant. The purpose of this Agreement is to protect the confidentiality of such information (hereinafter “Purpose”).

Confidential Information

“Confidential Information” means (a) any technical and non-technical information submitted and/or disclosed by Participant to the Company whether orally or in writing related to Company infrastructure, network, storage, products, user interfaces, source code, specifications, or other Company properties (the “Company Assets”) and potential bugs, vulnerabilities, or other security weaknesses in Company Assets or Systems (the “Submissions”), including for example and without limitation, information concerning software bugs identified by Participant in Companys Assets or System; and (b) technical and non-technical information disclosed by Company to Participants whether orally or in writing, and whether or not marked confidential or proprietary, related to Company's Assets or System; business; current, future and proposed products and services; or security status, including for example and without limitation, remediation plans for any identified bugs, development, design details, or specifications. Confidential Information shall also include the terms and conditions of this Agreement and the terms and conditions of the Vulnerability Disclosure Program.

Non-Disclosure and Nonuse Obligation:

Participant shall (a) securely maintain the Confidential Information in trust and confidence; (b) not disseminate, or in any way disclose any of the Confidential Information to any third party, other than authorised representatives of the Company or otherwise as authorized by Company in writing; and (c) not use any such Confidential Information for any purpose other than the Purpose. Participant shall ensure that it prevents the unauthorized use, dissemination, or publication of the Confidential Information. Furthermore, Participant shall not disclose the existence of any discussions or consultations in progress between the parties to any form of public media without the prior written approval of the Company.

Ownership of Information

All Confidential Information, and any Derivatives (defined below) are the sole and exclusive property of the Company and no license or other rights to such Confidential Information, Derivatives or any intellectual property rights of the Company are granted or implied hereby. For purposes of this Agreement, “Derivatives” shall mean: (a) for copyrightable or copyrighted material, any translation, abridgment, revision or other form in which an existing work may be recast, transformed or adapted; (b) for patentable or patented material, any improvement thereon; and (c) for material that is protected by trade secret, any new material derived from such existing trade secret material, including new material which may be protected under copyright, patent and/or trade secret laws.

Remedies

The Participant by Participating in the Company’s Vulnerability Disclosure Programme acknowledges that any breach of this Agreement by it will cause irreparable harm to the Company for which monetary damages may not be an adequate remedy. Accordingly, the Company shall be entitled to seek injunctive relief and any other remedies available to it at law or in equity, without the requirement to post a bond or other security.

Governing Law and jurisdiction

This Agreement shall be governed by and construed in accordance with the laws of the India and the Courts at New Delhi shall have the exclusive jurisdiction to entertain any or all matters arising out of this agreement.