General terms of sale: common provisions.

Article 1. Definitions

In these general terms and conditions, the following capitalised terms have the meanings set out below, whether used in the singular or the plural. They have the same meaning in the service annexes referred to in paragraph 2.6.

“Defect”: any behaviour of a Deliverable that does not conform to the Specifications and is documented and reproducible. A Defect is “blocking” where it prevents any use of the Deliverable or of an essential function and no workaround is possible, “major” where it impairs an essential function while leaving a workaround available, and “minor” in all other cases.

“Requirements Document”: the contractual document describing the Specifications of a fixed-price Service, annexed to the Quote or to the specific contract.

“Client”: any legal person, or any natural person acting for purposes within the scope of their commercial, industrial, craft, professional or agricultural activity, who orders a Service from the Provider.

“General Terms”: these general terms and conditions of sale, in the version in force on the date on which the Contract is formed.

“Contract”: the set of contractual documents listed in Article 4, binding the Provider and the Client for a given Service.

“Quote”: the Provider’s written commercial proposal specifying the purpose, scope, Deliverables, timetable, price and, where applicable, service levels of a Service.

“Personal Data”: the data defined in Article 4 of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (the “GDPR”).

“DPA”: the data processing agreement entered into by the Parties under Article 28 of the GDPR where performance of a Service leads the Provider to process Personal Data on behalf of the Client.

“Working Day”: any day from Monday to Friday, excluding statutory public holidays in metropolitan France.

“Deliverables”: all items handed over to the Client under a Service, including source code, executables, configurations, configuration data sets, mock-ups, documentation, reports, notes and training materials. Outputs of an AI Model constitute Deliverables only where they have undergone a distinct human selection, rework or adaptation and are identified as such in the Quote.

“AI System”: an artificial intelligence system within the meaning of Article 3(1) of Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence, namely a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs. An AI System uses one or more AI Models.

“AI Model”: a machine learning model, in particular a language model, operated by the Provider or by a third-party provider through an application programming interface or a self-hosted instance, including a general-purpose AI model within the meaning of Article 3(63) of the same Regulation.

“Party”: the Provider or the Client, taken individually; “Parties”: the Provider and the Client, taken together.

“Provider”: SANFYTECH, whose full identification is set out in Article 3.

“Services”: the consulting, study, audit, project owner support (assistance à maîtrise d’ouvrage), software development, software publishing, integration, hosting, managed services, third-party application maintenance and artificial intelligence consulting and integration services, together with any ancillary service, provided by the Provider to the Client.

“Prompt”: any instruction, directive, query, instruction template or set of examples submitted to an AI Model in order to obtain an Output.

“Acceptance Testing”: all the operations verifying fitness for proper operation by which the Client checks that the Deliverables conform to the Specifications.

“Reversibility”: all the operations by which the Provider returns to the Client, or to the third party designated by the Client, the data, configurations, source code and documentation needed to take over a service at the end of the Contract.

“SLA”: the quantified service levels (availability, guaranteed response time, guaranteed restoration time) subscribed by the Client under the “Maintenance in Operational Condition and Service Levels” annex or under a hosting, managed services or third-party application maintenance contract.

“Output”: any content produced by an AI Model in response to a Prompt, including text, code, images, classifications, extractions or scores.

“Sub-processor”: within the meaning of Article 28(2) of the GDPR, any processor engaged by the Provider to carry out processing activities on behalf of the Client.

“Specifications”: the functional, technical, performance and security requirements documented in the Requirements Document or in the Quote, excluding any unwritten requirement.

Article 2. Purpose and scope

2.1 These General Terms govern all contractual relations between the Provider and the Client, to the exclusion of any other general document. They constitute the sole basis for commercial negotiation within the meaning of Article L441-1 of the French Commercial Code (Code de commerce).

2.2 They apply to all Services, whatever their nature, and in particular to the Provider’s three areas of activity:

• software development and publishing: design, production, integration and enhancement of business applications, information systems, websites and online services, on a time and materials or fixed-price basis;
• hosting and managed services: provision, operation, monitoring, backup and maintenance in operational condition of technical environments whose production is hosted in France by OVHcloud SAS, 2 rue Kellermann, 59100 Roubaix, France (RCS Lille Métropole 424 761 419) and whose backup copies are kept within the European Union, on the terms and subject to the reservations of paragraph 15.3;
• artificial intelligence consulting and integration: scoping of use cases, design of document processing pipelines, assistants and agents, integration of AI Models supplied by third parties or self-hosted, and support in mastering these tools.

2.3 The General Terms are intended exclusively for business clients. They expressly exclude any service provided to a consumer or to a non-professional within the meaning of the preliminary article of the French Consumer Code (Code de la consommation). Consumer law, and in particular the provisions on the right of withdrawal and on consumer mediation, does not apply. The Provider has accordingly not appointed any consumer mediator; the settlement of disputes is governed by Article 24. By way of exception, where a specific contract of the Provider expressly provides for its application to a client that does not have professional status, in particular an association, these terms apply to the extent compatible with the mandatory provisions of the French Consumer Code, and subject to the express provisions of that contract, which prevail.

2.4 By ordering a Service, the Client declares that it is acting for professional purposes and that it has the capacity and authority required to enter into commitments. It declares that, before the Contract was formed, it received from the Provider all the information decisive for its consent within the meaning of Article 1112-1 of the French Civil Code (Code civil).

2.5 Off-premises contracts with very small businesses. By way of exception to paragraph 2.3, where the Contract is concluded off premises within the meaning of Article L221-1 of the French Consumer Code with a Client that employs no more than five (5) employees and whose main activity does not fall within the services covered by the Contract, sections 2, 3 and 6 of chapter I of title II of book II of that code apply, in accordance with its Article L221-3. The Provider then gives the Client, before the Contract is concluded, the information required by Article L221-5, in particular that relating to the right of withdrawal, together with a dated copy of the Contract and the standard withdrawal form. The Client has fourteen (14) days from the conclusion of the Contract to withdraw, without giving reasons and without penalty, by an unambiguous statement sent to contact@sanfytech.com, in accordance with Articles L221-18 and L221-21 of that code. The Provider receives no payment or other consideration before the expiry of a period of seven (7) days from the conclusion of the Contract, in accordance with Article L221-10; by way of derogation from paragraph 7.2 and from the invoicing arrangements of the applicable service annex, the deposit is called at the end of that period, and if the Client asks for work to start before the withdrawal period expires, only the services provided up to the decision to withdraw are payable, in accordance with Article L221-25. Contracts concluded at a distance, in particular by electronic acceptance of a Quote, do not fall within Article L221-3.

2.6 Service annexes. These General Terms form the common basis for every Service, whatever the arrangement chosen. Depending on that arrangement, they are supplemented by one or more service annexes: the “Time and Materials” annex, the “Fixed Price” annex, the “Maintenance in Operational Condition and Service Levels” annex and the “Artificial Intelligence” annex. Each annex applies only to the arrangement it governs; it is physically attached to the Quote and forms an integral part of it. In the event of conflict, these terms prevail over the annex, except on the matters that the annex is specifically intended to govern.

Article 3. Identification of the Provider

3.1 The Services are provided by:

3.2 The Provider carries on its business in France. The detailed legal notice is published at https://www.sanfytech.com/legal/mentions-legales and the privacy policy applicable to the processing for which the Provider is the controller at https://www.sanfytech.com/legal/confidentialite.

3.3 The Provider holds no security certification, qualification or accreditation issued by a third-party body or by a public authority. Any statement to the contrary cannot be relied on against it.

Article 4. Acceptance, enforceability and order of precedence of the contractual documents

4.1 Any order for a Service entails full, complete and unreserved acceptance of these General Terms. The signature of a Quote, a commercial proposal or a purchase order, or the written acceptance of an offer by electronic means, on the terms of paragraph 5.3, constitutes an order. By way of exception, where the Client asks in writing for work to start before the Quote is signed and the Provider acts on that request, the Contract is formed on the date on which work starts, on the terms of the most recent Quote communicated and of these terms, which the Client is deemed to have accepted; the Parties regularise the Quote within thirty (30) days.

4.2 The General Terms are communicated to the Client before the Contract is formed and are permanently accessible at https://www.sanfytech.com/legal/cgv. The Client acknowledges that it has read them.

4.3 The Client’s general terms and conditions of purchase, supplier charters and tender documents are binding on the Provider only if the Provider has expressly accepted them in writing; the Provider’s failure to respond when they are communicated does not constitute acceptance. In accordance with Article 1119 of the French Civil Code, where the general terms relied on by each of the Parties conflict, the incompatible clauses have no effect and the matters they govern are subject to the general law. The Provider makes the formation of the Contract conditional on the Client’s express acceptance of these terms, evidenced by the statement written on the Quote in accordance with paragraph 5.3, subject to the case of early start provided for in paragraph 4.1; any derogation from these terms results from a document signed by both Parties.

4.4 The Provider may amend the General Terms at any time. The version applicable to a given Contract is the one in force on the date of signature of the corresponding Quote, a copy of which is kept by the Provider and provided to the Client on simple request. For Contracts with successive performance, a new version becomes binding on the Client on expiry of a period of three (3) months following its written notification. Within that period, the Client may either refuse the amendment by written notice, in which case the Contract continues until its term or until the end of the current renewal period on the previous general terms, or terminate the Contract without compensation with effect from the date on which the new version takes effect. No amendment of the General Terms may affect the price, the scope of the Services or the service levels agreed in the specific contract, which may be amended only by a written amendment (avenant). This paragraph applies in the same terms to the service annexes.

4.4 bis Applicable version. These General Terms and the applicable service annexes are published at https://www.sanfytech.com/legal/cgv. For each of them, the Quote states its reference, version number and date: that version, to the exclusion of any other, binds the Parties. Where the Quote contains no such statement, the version binding on the Client is the one accessible at that address on the date of signature. No version that has not been published at that address, or handed to the Client before signature, is binding on the Client. The Provider keeps a frozen copy of each published version, bearing its date of publication, and supplies a copy on simple request, on paper or on a durable medium; it attaches it to the Quote where the Client so requests before signing.

4.5 In the event of conflict between the contractual documents, they prevail in the following descending order of priority:

1. the DPA, for any matter relating to the processing of Personal Data;
2. the specific contract signed by the Parties (time and materials, fixed-price, hosting, managed services, third-party application maintenance or artificial intelligence consulting contract), and its amendments from the most recent to the oldest;
3. the annexes to the specific contract, in particular the Requirements Document, the security annex, the service levels annex and the “Special conditions relating to artificial intelligence” annex, which prevails over these General Terms for any matter relating to AI Models, Prompts, Outputs and guardrails;
4. the accepted Quote or purchase order;
5. these General Terms;
6. the service annexes referred to in paragraph 2.6, which nevertheless prevail over these General Terms solely on the matters they are specifically intended to govern;
7. the terms of use published at https://www.sanfytech.com/legal/cgu, solely for the online services operated by the Provider.

4.6 The order so defined applies to the resolution of conflicts. Provisions of a lower-ranking document that supplement, without contradicting, those of a higher-ranking document remain applicable.

Article 5. Quote, order and formation of the Contract

5.1 Every Service is the subject of a written Quote specifying the purpose, scope, expected Deliverables, working assumptions, provisional timetable, price and invoicing arrangements. The Quote may refer to a Requirements Document and to annexes that form an integral part of it.

5.2 Unless otherwise stated, Quotes are valid for thirty (30) calendar days from their date of issue. After that period, the Provider may revise its terms, in particular to reflect changes in its costs, its workload or its suppliers’ prices.

5.3 The Contract is formed on the date on which the Provider receives the Quote accepted by an authorised representative of the Client, bearing the words “Bon pour accord, lu et approuvé” (approved, read and agreed), dated and signed, or any reliable electronic equivalent, subject to the case of early start provided for in paragraph 4.1. For routine exchanges relating to performance after the Contract is formed, the Provider is entitled to regard as authorised the person designated as single point of contact under paragraph 11.1, that person’s deputy and any person whom the Client has designated to it in writing.

5.4 The Parties agree to use electronic signatures. In accordance with the second paragraph of Article 1367 of the French Civil Code and Regulation (EU) No 910/2014 of 23 July 2014, only a qualified electronic signature benefits from the presumption of reliability. A simple or advanced electronic signature constitutes a valid and admissible electronic writing between the Parties; the Parties agree between themselves that the evidence file compiled by the trust service provider is sufficient to establish the reliability of the process used, without prejudice to evidence to the contrary.

5.5 The working assumptions set out in the Quote are contractual. If any of them proves inaccurate during performance, in particular as regards the quality of existing data, the availability of a third-party interface or the responsiveness of the Client’s contacts, the Parties confer in order to adjust the scope, timetable or price by amendment. Failing agreement within thirty (30) days, either Party may terminate the Contract, the Client paying for the Services actually performed.

5.6 Any request by the Client exceeding the scope described in the Quote or in the Requirements Document constitutes an out-of-scope request. It is the subject of an additional quote or an amendment before any performance. Performance of an out-of-scope request without an amendment constitutes neither a waiver by the Provider of its remuneration nor an extension of the scope for the future.

5.7 Term and renewal. Unless otherwise provided in the specific contract, one-off Services end on completion of the Deliverables and on expiry of the warranty of proper operation provided for in Article 5 of the “Fixed Price” annex. Services with successive performance are entered into for an initial fixed term of twelve (12) months from their effective date, and are then tacitly renewed for successive periods of twelve (12) months, unless terminated by either Party by registered letter with acknowledgement of receipt at least three (3) months before the end of the current period. Renewal takes place at the prices revised under Article 6. The Provider informs the Client of the termination deadline no later than four (4) months before it.

Article 6. Price and annual revision

6.1 Prices are stated in euros and exclusive of tax. Value added tax and any other applicable tax or levy are invoiced in addition at the rate in force on the date of the chargeable event. Any change in the statutory rate of value added tax is automatically passed on to the prices remaining to be invoiced.

6.2 Prices are exclusive of disbursements. The following are re-invoiced at actual cost, on presentation of supporting documents and, above a threshold agreed in the Quote, with the Client’s prior approval: travel, accommodation and subsistence expenses, third-party software licences, cloud service subscriptions, application programming interface consumption, in particular that of AI Model providers, domain names, certificates and any other commitment made on behalf of the Client.

6.3 For Services with successive performance lasting more than twelve (12) months, in particular hosting, managed services and third-party application maintenance, prices are revised annually on the anniversary of the Contract’s entry into force, upwards or downwards, using the symmetrical formula:

P₁ = P₀ × (S₁ / S₀)

where P₀ is the price in force before revision, P₁ the revised price, S₁ the latest value of the Syntec index published in the month preceding the revision date, and S₀ the latest value published in the month preceding the date of signature of the Contract for the first revision, and thereafter the value used as S₁ at the previous revision. The period of variation of the index so used does not exceed the time elapsing between two revisions.

6.4 The revision is notified to the Client at least thirty (30) days before it takes effect, stating the index values used and their source. It applies automatically, without any need for an amendment. If the Syntec index ceases to be published, the Parties agree in good faith on a replacement index representative of cost trends in the IT consulting and engineering sector; failing agreement within sixty (60) days, the replacement index is designated by the president of the competent court, seised under the accelerated procedure on the merits (procédure accélérée au fond) at the request of the first Party to act.

6.5 Independently of the index-linked revision, the Provider may pass on to the Client, at cost and on presentation of supporting documents, any increase in the price of an upstream supplier whose service is re-invoiced without mark-up, in particular hosting prices and AI Model consumption prices. This pass-through is notified at least thirty (30) days in advance; if it exceeds ten per cent (10%) of the annual fee, the Client may terminate the Contract concerned without compensation by notice sent within thirty (30) days of the notification.

6.6 Schedule of unit prices and price reductions. Prices are derived from the Provider’s schedule of unit prices in force on the date of the Quote, which includes in particular the daily rates per intervention profile, hourly rates outside fixed-price packages, periodic hosting and managed services fees and maintenance packages. In accordance with Article L441-1 of the French Commercial Code, this schedule is provided to any person requesting services for a professional activity who asks for it at contact@sanfytech.com. The Provider grants no general price reductions; any discounts, rebates and special terms are negotiated case by case, justified by volume, length of commitment or recurrence, and are stated in the Quote.

Article 7. Electronic invoicing, payment and late payment

7.1 Electronic invoicing. The Provider issues its invoices in electronic form, on the terms and according to the timetable of Articles 289 bis et seq. of the French General Tax Code (Code général des impôts), where applicable through an e-invoicing platform approved under those rules. The Client, being subject to value added tax and established in France, has been required since 1 September 2026 to accept receipt of invoices in electronic form; it may not, therefore, make payment conditional on delivery of an invoice in another medium. Until the e-invoicing issuance obligation applicable to it comes into force, the Provider may issue its invoices in any electronic format that allows the Client to process them. As soon as the Contract is formed, the Client provides the Provider with the electronic invoicing address, the identifier of its platform and, where relevant, the internal references (order number, service code, commitment code) without which the invoice could not be processed, and informs the Provider of any change of platform at least thirty (30) days in advance. Failure to provide or update this information does not suspend the payment period.

7.2 Invoicing schedule. Unless otherwise provided in the Quote, Services are invoiced according to the arrangements specific to their regime, defined in the applicable service annex. Where no service annex is attached to the Contract, Services are invoiced monthly in arrears.

7.3 Payment period. Invoices are payable thirty (30) days from their date of issue, by bank transfer. The Parties may agree, by an express provision in the Quote, on a different period, which may not exceed the mandatory ceilings of Article L441-10 of the French Commercial Code, namely sixty (60) days from the date of issue of the invoice or, by expressly stipulated derogation, forty-five (45) days end of month from that same date. No discount is granted for early payment.

7.4 Late payment. Any failure to pay on the due date automatically entails, without any need for prior formal notice:

• liability for late payment penalties calculated on the amount inclusive of all taxes of the unpaid invoice, at the rate applied by the European Central Bank to its most recent refinancing operation plus ten (10) percentage points, which rate may not be lower than three times the statutory interest rate, in accordance with Article L441-10 II of the French Commercial Code; these penalties run from the day following the due date until payment in full;
• payment of a fixed indemnity for recovery costs of forty euros (EUR 40) per unpaid invoice, pursuant to Articles L441-10 II and D441-5 of the French Commercial Code; where the recovery costs actually incurred exceed this fixed amount, the Provider may claim additional compensation on presentation of supporting documents;
• the capitalisation of interest due for a full year, on the terms of Article 1343-2 of the French Civil Code.

These penalty terms and this fixed indemnity are stated on every invoice issued by the Provider.

7.5 Suspension and acceleration. If payment has not been made within fifteen (15) days following a formal notice sent by registered letter with acknowledgement of receipt that has remained without effect, the Provider may suspend all or part of the Services in progress, without compensation to the Client and without prejudice to its right of termination. The sums due and unpaid under the Contract concerned then become immediately payable. The same applies to the sums due under the other Contracts in progress between the Parties where the default concerns two (2) consecutive instalments or an amount exceeding twenty per cent (20%) of the annual amount excluding tax of all those Contracts. Sums corresponding to Services not yet performed are not affected by this acceleration. The provisions of this paragraph apply subject to Article L622-13 of the French Commercial Code and the provisions referring to it: the opening of safeguard, receivership or judicial liquidation proceedings against the Client does not authorise suspension of the Services, acceleration or refusal to perform solely on the ground of non-payment of instalments due before the opening judgment, claims arising regularly after that judgment having to be paid when due.

7.6 Set-off and retention of title. The Client may not set off against the Provider a claim that is not certain, liquidated and payable. It may, however, set off any certain, liquidated and payable claim against the Provider, in particular a credit note issued under Article 6 of the “Maintenance in Operational Condition and Service Levels” annex, a refund due under paragraph 4.5 of the “Fixed Price” annex or a sum acknowledged in writing by the Provider, provided that it informs the Provider in writing before the relevant due date. The rights granted or assigned in the Deliverables remain subject to the conditions of Article 12.

Article 8. Performance deadlines

8.1 The deadlines stated in the Quote are indicative for time and materials, consulting and assistance Services, and contractual for fixed-price Services where the Requirements Document sets a delivery date.

8.2 Any delay by the Client in providing the information, content, data, access, environments, authorisations, approvals or decisions needed for performance automatically and without formality postpones the milestones and the delivery date by a period equal to the delay observed, plus the rescheduling time actually needed to remobilise the personnel, which the Provider substantiates and which may not exceed fifteen (15) Working Days, all without compensation to the Client. Where the delay exceeds thirty (30) days, the Provider may also invoice the idle-time and rescheduling costs that it substantiates.

8.3 No late-delivery penalty may be applied to the Provider in the absence of an express provision in the specific contract and in the absence of a prior formal notice sent by registered letter with acknowledgement of receipt that has remained without effect for fifteen (15) days. Where provided for, late-delivery penalties are liquidated damages within the meaning of Article 1231-5 of the French Civil Code, are exclusive of any other compensation for the same event and count towards the liability cap in Article 17.

8.4 Deadlines are suspended for the duration of a legitimate suspension of the Services, an event of force majeure or a renegotiation procedure initiated under Article 19.

Article 9. Obligations of the Provider

9.1 Nature of the commitments. The nature of the Provider’s commitment is assessed according to the regime of the Service. It is defined, for each regime, in Article 2 of the applicable service annex: a best-efforts obligation (obligation de moyens) for Services performed on a time-spent basis (“Time and Materials” annex), an obligation of result (obligation de résultat) limited to the Specifications for fixed-price Services (“Fixed Price” annex), and an enhanced best-efforts obligation (obligation de moyens renforcée) for hosting, managed services and maintenance in operational condition with SLAs (“Maintenance in Operational Condition and Service Levels” annex). Where no service annex is attached to the Contract, the Provider is bound by a best-efforts obligation within the meaning of Article 1231-1 of the French Civil Code.

9.2 Performance. The Provider performs the Services in accordance with good industry practice, with the diligence of an informed professional. It assigns personnel with the required skills to their performance and remains responsible for their work.

9.3 Alert. The Provider informs the Client in writing, no later than the Working Day following detection, of any event, technical difficulty, external dependency or inadequacy of the items provided that is likely to jeopardise compliance with the scope, timetable or price, and proposes the corrective measures that could be taken.

9.4 Confidentiality and security. The Provider complies with the confidentiality obligations of Article 13, the obligations relating to Personal Data of Article 14 and the security measures of Article 15.

9.5 Limits. The Provider assumes no obligation of result as regards the search engine ranking of a website, the commercial performance of an application, the completeness of regulatory monitoring, the continued availability of an application programming interface operated by a third party, or the accuracy of the Outputs of an AI Model, which are governed by the “Artificial Intelligence” annex.

Article 10. Duty to advise and to warn

10.1 Scope. The Provider owes the Client a duty to advise, inform and warn, including where the Client has its own IT expertise. This duty applies within the limits of the scope of the Service as defined by the Quote and the Requirements Document. It does not extend to the Client’s strategic, functional, business, budgetary, legal, tax or organisational choices, which are its sole responsibility.

10.2 Content. Under this duty, the Provider draws the Client’s attention to the technical risks identified, to the foreseeable consequences of a choice of architecture or technology, to the particular obligations attached to the licences of third-party components, to the known limitations of the AI Models used and to the security prerequisites on which the proper operation of the Deliverables depends.

10.3 Cooperation of the Client. The effectiveness of the duty to advise requires the Client to provide complete, truthful and up-to-date information on its needs, its existing technical and organisational environment, its regulatory and sector-specific constraints, its volumes and the expected performance. The Provider is not liable for a failure to advise resulting from incomplete, late or incorrect information from the Client.

10.4 Limits. The Provider does not substitute itself for the Client in decisions of expediency and does not act as a permanent project owner’s assistant in the absence of an express engagement to that effect. Its recommendations are professional opinions whose implementation remains at the discretion of the Client, which bears the consequences. Where the Client, having been duly informed, overrides a written warning from the Provider, the Provider is not liable for the consequences specifically pointed out, provided that it has repeated its warning in writing and, where the instruction is manifestly unlawful or likely to seriously compromise the security of systems or data, has refused to carry it out on the terms of paragraph 20.1.

10.5 Form and evidence. Recommendations given under the duty to advise are set down in writing and communicated to the Client. The Parties agree that, as between themselves, the contemporaneous written record is evidence of the content and date of the recommendation, without prejudice to the freedom of evidence and to the duty to inform under Article 1112-1 of the French Civil Code.

Article 11. Obligations of the Client

11.1 The Client undertakes to:

• designate a single point of contact authorised to take operational decisions and to commit the Client on functional trade-offs, together with a deputy;
• provide within the agreed deadlines all the information, content, documents, data sets, technical environments, accounts and access rights needed for performance, and maintain this access throughout the term of the Contract;
• give the approvals requested within ten (10) Working Days; failing a reasoned written response within that period, the Provider sends a written reminder and, if that reminder remains unanswered for five (5) Working Days, approval is deemed given and the Service continues on the basis of the item submitted;
• test the Deliverables and report any Defect in writing on the terms provided for in the applicable service annex;
• pay the price on the agreed due dates.

11.2 Warranty of items supplied. The Client warrants that it holds all the necessary rights in the content, data, trade marks, distinctive signs, images, fonts, databases and code that it sends to the Provider or asks the Provider to integrate. It indemnifies the Provider against any claim, action or judgment by a third party based on these items, and bears the corresponding defence costs.

The Parties’ reciprocal warranties against third-party claims relating to intellectual property rights (that of the Client under this paragraph, and those of the Provider under paragraphs 12.6 and 12.9) are exercised under an identical procedure: the Party against which proceedings are brought informs the other without delay, leaves it to conduct the defence and refrains from any settlement without its written consent. They are not subject to the cap in paragraph 17.2 and remain governed by the general law on compensation.

11.3 Lawful use. The Client is solely responsible for the lawfulness of the purposes it pursues, the compliance of its data processing, the classification of its artificial intelligence use cases under Regulation (EU) 2024/1689, and compliance with the sector-specific regulations applicable to it.

11.4 Security on the Client’s side. The Client ensures the security of its own workstations, networks and accounts. It keeps the credentials given to it confidential, does not share them, reports any suspected compromise without delay and applies the Provider’s written security recommendations. It keeps, under its sole responsibility, a copy of the data and content it sends to the Provider for as long as they are not covered by a hosting contract that includes a backup commitment.

11.5 Breach. A breach by the Client of any of the obligations in this Article releases the Provider from the resulting consequences, allows deadlines to be postponed on the terms of Article 8 and, if it persists after a formal notice of thirty (30) days that has remained without effect, gives rise to a right of termination on the terms of Article 20.

Article 12. Intellectual property

12.1 Specific developments. The Provider assigns to the Client, on an exclusive basis, the economic copyright in the developments produced specifically for it and identified in the Quote or in its scope annex. The rights of reproduction, performance, adaptation, translation, distribution and derivative exploitation are each assigned separately. The assignment is granted for the whole world and for the statutory term of protection, for the purpose of exploiting the Deliverables in the course of the Client’s business, including their maintenance and enhancement by any third party. It takes effect on payment in full of the corresponding price; until then, the Client enjoys a licence for internal use, revocable thirty (30) days after a formal notice that has remained without effect.

12.2 Pre-existing and reusable components of the Provider. For the components, libraries, templates and know-how that the Provider developed before or independently of the Contract and incorporates into the Deliverables, the Provider grants the Client a non-exclusive, perpetual, irrevocable, worldwide licence, transferable together with the business to which the Deliverables relate, to use, exploit, enhance and have the Deliverables maintained by any third party of its choice. The Provider retains the right to reuse these components for other clients.

12.3 Moral rights. The authors’ moral rights, in particular the right of attribution and the right to the integrity of the work, are non-assignable and remain reserved in accordance with Article L121-1 of the French Intellectual Property Code (Code de la propriété intellectuelle). In the case of software, these rights are exercised within the limits of Article L121-7 of that code.

12.4 Third-party components and free software. The Deliverables may include libraries, frameworks, software components, fonts or creative resources belonging to third parties, in particular components under a free software licence. These components remain the property of their authors and remain governed by their own licences; the assignment in paragraph 12.1 does not extend to them. The Provider gives the Client, at Acceptance Testing and on request, the list of third-party components and their licences. It informs the Client of the inclusion of components subject to a copyleft licence, in particular the GNU GPL, AGPL, LGPL, MPL and EUPL, and of the obligations these licences may impose on the Client in the event of redistribution or public availability. The Client remains solely responsible for complying with these obligations in the course of its exploitation.

12.5 Delivery of source code. The Provider delivers to the Client the source code of the specific Deliverables, the build and deployment scripts and the technical operating documentation, by deposit on a code forge designated by the Client or by time-stamped archive. This delivery takes place at each milestone, at the end of each invoicing period and at any time at the Client’s request; it forms an integral part of the Deliverables.

If the licence for internal use is revoked on the terms of paragraph 12.1, the Client ceases all exploitation of the Deliverables and destroys, within thirty (30) days, the copies of the source code and technical documentation delivered under this paragraph, with the exception of copies kept in its backup systems until the end of their retention cycle and those needed as evidence in the event of a dispute. This provision is without prejudice to the prerogatives reserved in paragraph 12.7.

12.6 Warranty against eviction. The Provider warrants that the specific Deliverables it develops do not, to its knowledge, infringe the rights of any third party. In the event of a third-party action, the Client informs the Provider without delay and leaves it to conduct the defence. The Provider may, at its option, obtain the right to continue exploitation, replace or modify the disputed item or, if none of these options is reasonably practicable, take back the item against reimbursement of the corresponding price, less straight-line depreciation over three (3) years. This warranty does not apply where the action results from an item supplied or imposed by the Client, a modification made without the Provider’s consent, or exploitation not in accordance with the Contract. The restriction “to its knowledge” has no effect where the eviction results from the Provider’s own act. This warranty is not subject to the cap in Article 17.

12.7 Rights of the lawful user. The prerogatives that Articles L122-6 and L122-6-1 of the French Intellectual Property Code confer on the lawful user of software, in particular error correction and interoperability, remain reserved.

12.8 Commercial reference. The Provider is authorised to cite the Client’s name and the general nature of the Service as a commercial reference, on its website and in its presentation materials, excluding any confidential information. Use of the Client’s logo or any other distinctive sign requires its prior written consent. By way of derogation from paragraph 13.1, the existence of the contractual relationship is not covered by the confidentiality obligation solely for the purposes of this citation. The Client may at any time request withdrawal of this reference, which takes place within thirty (30) days.

12.9 Warranty of title to the rights. The Provider warrants that it holds, from its officers, partners, employees, interns and subcontractors, all the economic copyright needed for the assignment granted in paragraph 12.1. It is solely responsible for concluding, with every natural person who took part in creating the Deliverables, the required deeds of assignment or vesting. It indemnifies the Client against any claim made on this ground and bears the corresponding defence costs, on the terms and within the limits of paragraph 12.6.

12.10 Databases. Where the Deliverables include a database, the assignment in paragraph 12.1 extends, on the same terms and subject to the same condition of payment in full, to the database producer’s rights provided for in Articles L341-1 and L342-1 of the French Intellectual Property Code. The Client is and remains the producer of the databases built from the data it supplies or that its exploitation generates; the Provider claims no rights in them and refrains from any extraction or reuse outside the performance of the Contract.

Article 13. Confidentiality and trade secrets

13.1 Each Party undertakes to treat as strictly confidential the commercial, technical, financial, strategic or organisational information communicated by the other Party, in whatever medium, as well as the existence and content of the pre-contractual exchanges. Each Party limits access to this information to those members of its staff and subcontractors who need it, and binds them to an equivalent obligation.

13.2 This obligation applies throughout the term of the Contract and for five (5) years after it ends, for whatever reason. It is without prejudice to the protection afforded to trade secrets by Articles L151-1 et seq. of the French Commercial Code, which remains applicable without time limit for as long as the conditions of Article L151-1 are met.

13.3 The confidentiality obligation does not apply to information:

• that has entered the public domain without any breach by the receiving Party;
• that was already lawfully known to the receiving Party before it was communicated, the burden of proof lying on that Party;
• that was developed independently by the receiving Party without use of the confidential information;
• that was lawfully received from a third party not bound by a confidentiality obligation;
• whose disclosure is required by a statutory or regulatory provision, or by a decision of a competent administrative or judicial authority, the Party required to disclose informing the other in advance where the law permits and limiting disclosure to what is strictly necessary.

13.4 At the end of the Contract, and at the written request of the disclosing Party, each Party returns or destroys the confidential information in its possession, with the exception of copies kept under a statutory retention obligation, in backup systems until the end of their retention cycle, or for evidential purposes in the event of a dispute. Information so retained remains subject to this Article.

13.5 Where the nature of the exchanges warrants it, in particular at the pre-contractual or audit stage, the Parties enter into a stand-alone confidentiality agreement whose provisions supplement, without contradicting, those of this Article.

Article 14. Personal data

14.1 Allocation of roles. The Provider acts as a processor within the meaning of Article 28 of the GDPR for the processing it carries out on behalf of the Client in the course of the Services. It acts as controller for its own management processing, in particular customer relationship management, prospecting, invoicing, support and the security of its information system, and for the technical and security logging of the systems it administers; this processing is described in the privacy policy published at https://www.sanfytech.com/legal/confidentialite. The Client refers to it in its own information to data subjects, using the text supplied to it by the Provider. The audience measurement that the Provider deploys, where applicable, on the Client’s services is not part of this processing for its own purposes: the Provider operates it as a processor, on documented instructions and exclusively on behalf of the Client, which remains the controller and in control of both the purpose and the configuration. The Provider makes available to the Client a configuration that meets the conditions of the consent exemption accepted for audience measurement and sends it the details in writing. The data of the different websites are not cross-referenced and each publisher has access only to the statistics of its own service; the arrangements are those of the DPA. If the Provider were to determine the purposes and means of processing entrusted to it, it would be considered a controller in respect of that processing within the meaning of Article 28(10) of the GDPR.

14.2 Data processing agreement. Where performance of a Service leads the Provider to process Personal Data on behalf of the Client, their relationship is governed by the DPA, which complies with Article 28(3) of the GDPR. The DPA is published by the Provider at https://www.sanfytech.com/legal/dpa and incorporated by reference into the Quote or the specific contract, which designates its version; it is not attached. Article 28(3) requires a written and binding act, not a document physically handed over or a separate signature. The DPA prevails over these General Terms for all matters relating to the processing of Personal Data. It sets out the subject matter, duration, nature and purposes of the processing, the categories of data and of data subjects, the Client’s documented instructions, the technical and organisational measures, the list of Sub-processors, the assistance arrangements and what happens to the data at the end of the Contract.

The DPA comes into force on the effective date of the Quote or the specific contract that incorporates it, without formality or separate signature. The version binding on the Parties is the one that act designates by its number and date; failing such designation, the one published at https://www.sanfytech.com/legal/dpa on the date of its acceptance. Publication of a later version has no effect on Contracts in progress. For as long as no act incorporating the DPA is in force, the Provider processes no Personal Data on behalf of the Client and the Client refrains from communicating any to it; the resulting postponement falls under paragraph 8.2.

The elements that Article 28(3) of the GDPR requires to be defined (subject matter, duration, nature, purposes, categories of Data and of data subjects) are set out in Article 5.1 of the DPA for all of the Provider’s Services. The Quote or the specific contract states what, for the matter in question, derogates from or supplements it.

14.3 Instructions. The Provider processes Personal Data only on the Client’s documented instructions. It informs the Client if it considers that an instruction infringes the GDPR or another data protection provision, in accordance with the last subparagraph of Article 28(3).

14.4 Security and confidentiality. The Provider implements appropriate technical and organisational measures within the meaning of Article 32 of the GDPR, described in Article 15 and detailed in the security annex to the DPA. The persons authorised to process the data are bound by a confidentiality obligation within the meaning of Article 28(3)(b).

14.5 Sub-processors. The Provider is authorised to engage Sub-processors on the terms of Article 28(2) of the GDPR. The current list is set out in an annex to the DPA. Any addition or replacement of a Sub-processor is notified to the Client in writing at least ten (10) days before it takes effect, stating the identity of the sub-processor, the activity entrusted, the categories of Data concerned, the country of processing and the applicable transfer safeguard. The Client has that period in which to raise a reasoned objection based on data protection considerations; if the objection is maintained and there is no reasonable alternative, either Party may terminate the Service concerned without compensation. In the event of failure, security breach or cessation of business of a Sub-processor making it impossible to comply with this notice period, the Provider may replace it with a provider offering at least equivalent guarantees and informs the Client no later than seventy-two (72) hours afterwards, the right to object then being exercised after the event.

14.6 Transfers outside the European Union. The Provider favours processing carried out within the European Union. It nevertheless expressly informs the Client that it cannot guarantee that no transfer outside the European Union will take place: certain third-party services needed to perform Services, in particular AI Model providers and payment or notification services, may involve such a transfer. Where a transfer takes place, the Provider undertakes to carry it out only under an adequacy decision adopted pursuant to Article 45 of the GDPR or, failing that, a mechanism under Article 46, in practice the standard contractual clauses of Commission Implementing Decision (EU) 2021/914 of 4 June 2021, supplemented by the necessary additional measures. On written request sent to rgpd@sanfytech.com, the Provider informs the Client of the safeguard applicable to each flow; it informs the Client of any transfer for which the safeguard is not yet in place and suspends the flow concerned at the Client’s first written request. The Client is informed, in the annex to the DPA, of each transfer, its destination and its safeguard. The Parties acknowledge that the extraterritorial legislation of certain third countries, in particular the Clarifying Lawful Overseas Use of Data Act (18 U.S.C. § 2713), constitutes a residual risk that cannot be entirely neutralised by a contractual mechanism.

14.7 Assistance and breaches. The Provider assists the Client, within the limits of its means and taking into account the nature of the processing, in responding to requests from data subjects to exercise their rights, in carrying out data protection impact assessments and in demonstrating compliance with security obligations. It notifies the Client of any personal data breach of which it becomes aware without undue delay, within the time limits and in the form laid down in the DPA, so as to enable the Client to comply with Articles 33 and 34 of the GDPR. The Provider does not itself notify the supervisory authority on behalf of the Client, as this step is a matter for the controller.

14.8 End of processing. At the end of the Service, the Provider returns or deletes the Personal Data on the terms of the DPA and of Article 20 of these terms.

Article 15. Information security

15.1 General commitment. For the environments it operates, the Provider implements technical and organisational measures proportionate to the risks, taking into account the state of the art, the costs of implementation and the nature of the data processed. These measures are detailed, for each Service concerned, in a security annex attached to the specific contract or to the DPA.

15.2 Measures in place. Solely for the environments it operates under a specific contract, the Provider describes below the following measures, for information on the state of its arrangements at the date of these terms and without this description in itself constituting a service level commitment. The frequency of backups, the retention cycle, the location of copies, the frequency of restoration tests and the recovery point and recovery time objectives constitute an obligation of the Provider only where they are stipulated in the specific contract or in Article 7 of the “Maintenance in Operational Condition and Service Levels” annex.

• daily backups encrypted at source before transfer, automatically verified, purged according to a defined retention cycle, with an off-site copy; the copies are located as follows: backups encrypted at source before transfer; primary copy kept within the European Union (Germany) and mirror copy kept in France;
• network segregation: the environments that the Provider operates on behalf of the Client are placed on a private network, not directly reachable from the internet, and published where applicable through a shared filtering entry point. Environments made available to the Client without administration by the Provider, in particular those falling under Article 9 of the “Maintenance in Operational Condition and Service Levels” annex, do not benefit from this segregation: their application exposure is the Client’s responsibility under the responsibility allocation matrix;
• encryption in transit: TLS protocol versions 1.2 and 1.3 on all published services, with automatically renewed certificates;
• administration through named accounts authenticated by cryptographic key, without password authentication; administrative access by the Provider through its centralised access point is subject to session recording; access in emergency or bypass situations is logged and reported;
• tool-supported patch management, with a centralised inventory of systems and tracking of available patches;
• centralised logging of security events collected by an agent deployed on each administered machine, and recording of administration sessions carried out through the centralised access point;
• protection of published forms by a self-hosted anti-bot mechanism, without cookies or third-party services.

15.3 Location. The production environments operated by the Provider are hosted in France, in the data centres of OVHcloud SAS, 2 rue Kellermann, 59100 Roubaix, France (RCS Lille Métropole 424 761 419) located in Strasbourg, Roubaix and Gravelines (France). Backup copies are kept within the European Union, on the terms set out in paragraph 15.2. The Provider does not claim that all data are located exclusively in France.

15.4 Scope and limits. At the date of these terms, the arrangements described in paragraph 15.2 have limits which the Provider brings to the Client’s attention under its duty to advise and which the Client declares that it accepts. They relate in particular to the extent of encryption at rest, the absence of permanent on-call support and of a security operations centre operating continuously, the log retention period, the self-assessed nature of the audits conducted by the Provider on its own information system, and the gradual roll-out of certain administration and logging measures. The detailed list of these limits, the deadline of each implementation plan and the associated evidence are set out in the security annex handed to the Client before the Contract is formed, which forms an integral part of the Contract and which the Client declares that it has received. The Provider informs the Client, on the terms of paragraph 15.7, of any new limit affecting a commitment in this Article.

15.5 Security incidents. The Provider informs the Client, without undue delay after becoming aware of it, of any security incident affecting the Client’s environments or data, provides it with the information it has and involves it in the remediation measures. Where the incident constitutes a Personal Data breach, paragraph 14.7 and the DPA apply.

15.6 Verification by the Client. Once a year and on thirty (30) days’ written notice, the Client may request the documentary evidence of compliance with this Article (security policy, backup procedure, up-to-date security annex) and send the Provider a written questionnaire, to which the Provider replies within the same period. An on-site audit or a penetration test may be conducted only in the event of a proven breach of the obligations in this Article, at the requesting party’s expense, on thirty (30) days’ written notice, by the Client or by an independent third party that is not a competitor of the Provider and is bound by a confidentiality obligation, within a scope limited to the systems and processing concerning the Client, during working days and hours and without affecting the environments of other clients. The Provider may invoke the measures needed to protect the data of its other clients, the security of its infrastructure and its trade secrets, and then proposes an alternative means of verification. This paragraph applies without prejudice to the rights the Client derives from Article 28(3)(h) of Regulation (EU) 2016/679 and, if it is a financial entity, from Article 30 of Regulation (EU) 2022/2554; the provisions of the DPA prevail as regards Personal Data.

15.7 Truthfulness of statements. Every security statement made by the Provider under this Article, the applicable security annex or in response to a questionnaire from the Client is supported by dated evidence, provided on first request; failing that, the Provider states the actual status of the measure and the deadline for its implementation. It informs the Client, within thirty (30) days, of any significant adverse change in a commitment under this Article.

Article 16. Clients subject to NIS 2 or DORA

16.1 Prior information. Before the Contract is formed, the Client informs the Provider whether it is an essential or important entity within the meaning of Directive (EU) 2022/2555 of 14 December 2022, or a financial entity within the meaning of Regulation (EU) 2022/2554 of 14 December 2022, and whether the services provided are classified as critical or important information and communication technology services.

16.2 Cooperation. Where the Client falls under one of these regimes, the Provider cooperates in good faith in the performance of its obligations. It provides the Client with the information needed to enter the service in its register of information and notifies it of any significant incident affecting the service as soon as possible after becoming aware of it; the quantified notification deadline, on which the Client’s ability to meet its own obligations depends, is agreed in the specific contract or in the DPA and is deemed subscribed only where it is expressly stated there. Before the Contract is formed, the Provider informs the Client of the status of its detection and alerting capabilities in relation to the deadline requested, gives it access once a year to the documentary evidence provided for in paragraph 15.6, and informs it of any substantial change in subcontracting or location.

16.3 Limits. At the date of these terms, the Provider belongs to a sector listed in Annex I to Directive (EU) 2022/2555 of 14 December 2022, as a provider of business-to-business information and communication technology service management, but does not meet any of the size criteria of Article 2 of that Directive that would lead to its classification as an essential or important entity, and the French transposing law has not been enacted. It accordingly claims no compliance with that Directive. It informs the Client, within thirty (30) days, of any change in this classification. Additional contractual requirements that the Client may wish to impose under these regulations, in particular enhanced audit rights or digital operational resilience commitments, are the subject of an amendment and, where appropriate, a price adjustment.

Article 17. Liability

17.1 Principle. The Provider may be held liable only in the event of proven fault in the performance of its obligations, excluding damage resulting from the act of the Client, the act of a third party unconnected with the Contract, an event of force majeure within the meaning of paragraph 19.1 or the failure of a third-party service chosen, imposed or administered by the Client. In accordance with paragraph 22.2, the Provider remains liable for the performance of the Services entrusted to its own subcontractors; the failure of one of them releases the Provider only where, in relation to that subcontractor, it meets the conditions of paragraph 19.1. The specific contract may, however, allocate differently the risk relating to providers of infrastructure, network, domain name resolution, certification and artificial intelligence models; such a provision prevails over this paragraph. Liability is assessed according to the nature of the obligation in question as classified in Article 9 of these terms and in Article 2 of the applicable service annex.

17.2 Cap. The Provider’s liability under the Contract, for all causes combined, is limited to the higher of the following two amounts: the amount excluding tax actually paid by the Client under the Contract during the twelve (12) months preceding the event giving rise to liability, or the amount of cover stated in the Provider’s professional liability insurance certificate with Hiscox SA, French branch (49 avenue de l’Opéra, 75002 Paris, RCS Paris 833 546 989), in force on the date of the Contract and provided under Article 18.

A different cap agreed in the specific contract replaces the above formula in its entirety. This cap is single and overall: it covers the Contract and the data processing agreement entered into pursuant to Article 28 of Regulation (EU) 2016/679, without being cumulative between them. It has no effect with regard to third parties, in particular data subjects exercising the right to compensation conferred on them by Article 82 of that Regulation, or with regard to penalties imposed on the Provider by a supervisory authority.

17.3 Excluded heads of loss. The Parties expressly agree, whatever the legal classification such losses might receive, to exclude the following heads of loss, and only these, from the compensation payable by the Provider: loss of turnover, loss of margin, loss of customers, operating loss, loss of data not backed up by the Client where it was the Client’s responsibility to do so within the meaning of paragraph 11.4, damage to image or reputation, loss of profit and commercial loss. Judgments against the Client in favour of a third party and administrative penalties imposed on it are compensable only to the extent that their direct and exclusive cause is a proven fault of the Provider, and within the limit of the cap in paragraph 17.2, without prejudice to the warranty against eviction in paragraph 12.6.

17.4 Exceptions to the cap. The limitations in paragraphs 17.2 and 17.3 do not apply in the event of fraud (dol), gross negligence (faute lourde), personal injury or wilful breach of confidentiality, nor under the warranty against eviction in paragraph 12.6, nor in cases where the law prohibits any limitation.

17.5 Balance of the cap. The Parties acknowledge that the cap so agreed, having regard to the nature of the Services and the level of the prices charged, does not deprive the Provider’s essential obligation of its substance within the meaning of Article 1170 of the French Civil Code and does not create any significant imbalance within the meaning of Article 1171 of that code. The Client remains free to negotiate a higher cap in the specific contract, subject to a price adjustment.

17.6 Liability of the Client. The Client is liable for the content it publishes, the data it processes, the use it makes of the Deliverables and the Outputs, and compliance with the obligations imposed on it by Articles 11 and 16 of these terms and by the “Artificial Intelligence” annex.

17.7 Limitation period. The Parties agree, pursuant to Article 2254 of the French Civil Code, to reduce to twelve (12) months the limitation period for any action by one against the other based on the performance or non-performance of a Contract. This period runs from the day on which the Party bringing the action knew or ought to have known the facts enabling it to bring its action; it is suspended for the duration of the attempt at amicable resolution initiated on the terms of paragraph 24.2. This reduction applies reciprocally, excluding actions for payment of sums payable annually or at shorter periodic intervals, actions based on fraud, gross negligence or personal injury, actions based on the warranty against eviction in paragraph 12.6, actions based on a breach of Articles 13, 14 and 15, and actions for which the law prohibits any adjustment of the limitation period.

Article 18. Insurance

18.1 The Provider declares that it holds a valid professional liability insurance policy taken out with Hiscox SA, French branch (49 avenue de l’Opéra, 75002 Paris, RCS Paris 833 546 989).

18.2 At the Client’s written request and no more than once a year, it provides evidence of this by producing an up-to-date certificate issued by the insurer, stating the activities covered, the amounts of cover and the period of validity. The activities and territorial scope actually covered are those stated in that certificate; under these terms, the Provider makes no statement on the extent of its cover other than that resulting from that document.

18.3 The Provider undertakes to keep this insurance in force throughout the term of the Services and to inform the Client, within thirty (30) days, of any cancellation or any significant reduction of its cover.

18.4 Taking out this insurance does not constitute an undertaking to cover any loss and does not extend the liability cap in Article 17. Any assistance services the policy may include are a matter between the Provider and its insurer; they create no direct right for the Client, which may rely on them only if the Contract expressly so provides.

18.5 Limits and scope of cover. The Client is expressly informed that the Provider’s cover extends to the activities (in particular development, consulting, managed services and data hosting), the cyber events and the territories listed in the certificate in force, and that it excludes damage occurring or claimed in the United States of America and Canada. Before the Contract is formed, the Provider informs the Client of any of the Services ordered that are not expressly listed in the certificate in force. Where the Client exploits the Deliverables in one of the excluded territories or requires specific cover exceeding the policy taken out, the Parties agree in the specific contract on the applicable liability cap and, where appropriate, on the additional cover to be taken out, the cost of which is re-invoiced to the Client on the terms of paragraph 6.2.

Article 19. Force majeure and hardship

19.1 Force majeure. An event of force majeure, within the meaning of Article 1218 of the French Civil Code, is an event beyond the control of the obligor, which could not reasonably have been foreseen when the Contract was concluded and whose effects cannot be avoided by appropriate measures, preventing performance of its obligation.

19.2 The following, in particular, may constitute an event of force majeure, provided that the conditions of paragraph 19.1 are met: a natural disaster, a fire or flood affecting a data centre, war, insurrection, a terrorist attack, a decision of a public authority prohibiting or preventing performance, a declared epidemic accompanied by binding measures, a lengthy national or cross-industry strike, a major and prolonged failure of telecommunications networks or of the electricity supply not attributable to the obligor, or a cyberattack of systemic scale targeting essential infrastructure.

19.3 The following do not constitute an event of force majeure: the obligor’s financial difficulties, a strike limited to its own business, an insufficiency of technical or human resources that it could have anticipated, the failure of a subcontractor where that failure does not itself constitute an event of force majeure in respect of that subcontractor, or the loss of data attributable to a failure to make backups by the Party responsible for doing so.

19.4 The Party invoking force majeure informs the other in writing as soon as possible and no later than seven (7) days after the event occurs, providing evidence of its existence, its effects and its foreseeable duration. For the duration of the impediment, performance of the affected obligations is suspended and deadlines are extended accordingly. If the impediment continues beyond sixty (60) consecutive days, either Party may terminate the Contract automatically by registered letter with acknowledgement of receipt, without compensation, subject to payment for the Services actually performed.

Failure to notify or late notification does not forfeit the right to invoke force majeure; it merely deprives the Party invoking it of the benefit of suspension for the period before actual notification, and obliges it to compensate the loss that the delay caused to the other Party. Where the impediment is permanent, the Contract is automatically terminated on the terms of the second paragraph of Article 1218 of the French Civil Code; the Services actually performed and accepted remain payable, and sums paid in advance for Services not performed are refunded within thirty (30) days.

19.5 Hardship. If a change of circumstances that was unforeseeable when the Contract was concluded makes performance excessively onerous for a Party that had not agreed to bear that risk, that Party may ask the other to renegotiate, in accordance with Article 1195 of the French Civil Code. The Parties continue to perform their obligations during the renegotiation. If the renegotiation is refused or fails within ninety (90) days, the Parties may agree to terminate the Contract, on the date and on the terms they determine, or jointly ask the court to adapt it; failing agreement within a reasonable time, either Party may ask the court to revise the Contract or bring it to an end.

Article 20. Suspension, termination and reversibility

20.1 Suspension. The Provider may suspend all or part of the Services, after a formal notice that has remained without effect for fifteen (15) days, in the event of non-payment on the terms of paragraph 7.5. It may suspend them without notice where continued performance is likely to undermine the security of its information system or that of other clients, in the event of manifestly unlawful use of the service, or where a purpose amounting to a practice prohibited by Article 5 of Regulation (EU) 2024/1689 comes to light. The suspension is notified to the Client, with reasons, and lifted as soon as its cause has ceased. It does not suspend the Client’s payment obligations. Suspension for non-payment and acceleration are exercised subject to the reservation stated in paragraph 7.5 concerning Article L622-13 of the French Commercial Code.

20.2 Termination for breach. The following are commitments whose non-performance entails termination of the Contract within the meaning of Article 1225 of the French Civil Code: for the Client, payment of the price on the agreed due dates, provision of the access, information and approvals needed for performance, compliance with the obligations of Article 11, the warranty of rights in the items it supplies and compliance with Article 13; for the Provider, delivery of Deliverables conforming to the Specifications, compliance with Articles 13, 14 and 15, repeated failure to meet service levels in the cases provided for in Article 6 of the “Maintenance in Operational Condition and Service Levels” annex, and implementation of Reversibility. In the event of non-performance of any of these commitments, not remedied within thirty (30) days following a formal notice sent by registered letter with acknowledgement of receipt, stating the breach complained of and expressly referring to this termination clause, the other Party may terminate the Contract automatically, in accordance with Articles 1224 and 1225 of the French Civil Code, without prejudice to any damages. Other breaches give rise only to the remedies of Articles 1226 and 1227 of that code. This paragraph applies subject to paragraph 20.4.

20.3 Termination for convenience. For Contracts with successive performance concluded for, or having become of, indefinite duration, the Client may terminate without cause on three (3) months’ notice and the Provider on six (6) months’ notice, given by registered letter with acknowledgement of receipt, unless a different period is stipulated in the specific contract. For fixed-term Contracts, and by contractual adjustment of Article 1794 of the French Civil Code, termination for convenience by the Client gives rise to payment for the Services performed and the expenses irreversibly incurred, together with an indemnity which the Parties set contractually at thirty per cent (30%) of the amount excluding tax of the Services remaining to be performed. The Parties agree that this indemnity constitutes the fixed assessment of what the Provider could have earned from the undertaking, that it is exclusive of any other claim on that ground and that it is not cumulative with compensation for the same loss in another form. This indemnity applies only in the absence of a different indemnity or express exclusion stipulated in the specific contract; it is not payable where the price is based on time spent with no volume commitment from the Client, or where termination results from a breach by the Provider. During the notice period, the Services continue on the terms of the Contract.

The first subparagraph of this paragraph applies only to Contracts expressly concluded for an indefinite duration by the specific contract, by way of derogation from paragraph 5.7. Where the commercial relationship between the Parties is an established relationship within the meaning of Article L442-1 II of the French Commercial Code, the notice of termination provided for in paragraph 5.7 is increased by one (1) month per full year of the relationship beyond the third, up to a maximum of twelve (12) months. The Parties agree that the notice so determined takes account of the length of the commercial relationship and of the practices of the sector. This provision does not preclude termination without notice in the event of non-performance by the other Party or of force majeure.

20.3 bis Early exit by the Provider. By way of exception to the six (6) month notice period, the Provider may terminate a Contract of indefinite duration on three (3) months’ notice where the Client has refused, on the terms of paragraph 6.5, a pass-through of upstream costs exceeding ten per cent (10%) of the annual fee, or where it objects to a technical change needed for the security of the service. The Provider then offers the Client, free of charge, the reversibility assistance provided for in paragraph 20.7, up to a limit of two (2) days.

20.4 Insolvency proceedings. In accordance with Article L622-13 of the French Commercial Code, the opening of safeguard, receivership or judicial liquidation proceedings against either Party does not entail automatic termination of the Contract; no provision of these terms may be interpreted to that effect. The rights of the court-appointed administrator and of the liquidator to require continuation of the Contract remain reserved, as does the right of the co-contracting Party to be paid for services provided after the opening judgment.

20.5 Effects. The end of the Contract, for whatever reason, entails: the immediate payability of the sums due for the Services performed and the expenses incurred; the revocation, in the event of non-payment of the price, of the licence for internal use in paragraph 12.1, the licence for pre-existing components in paragraph 12.2 remaining vested in the Client in proportion to the Deliverables paid in full; the return or destruction of confidential information on the terms of paragraph 13.4; and the implementation of Reversibility.

20.6 Reversibility. At the end of a Contract relating to the hosting, managed services or operation of a service, and for whatever reason, the Provider hands over to the Client or to the third party it designates, within a period not exceeding thirty (30) days from the written request: the Client’s data in a standard, usable and documented format, the configurations and deployment scripts, the source code of the specific Deliverables, the operating documentation, and the access, administration accounts, domain names and certificates needed for continuity. The handover is deemed completed on the date of availability notified to the Client.

The Client gives written notice of its request for Reversibility within thirty (30) days of the effective date of the end of the Contract. Failing this, the Provider sends it a written reminder; the data remain stored and protected by the measures of Article 15, without any processing other than their technical storage, for thirty (30) days from that reminder, after which the Provider carries out the deletions in paragraph 20.8. A request made after that deadline is carried out to the extent that the data still exist.

20.7 Reversibility assistance. Transfer operations going beyond simple handover, in particular support for a successor provider, takeover of an architecture or migration assistance, are invoiced at the daily rate agreed in the Quote or the specific contract and, failing that, at the daily rate in the schedule referred to in paragraph 6.6 in force on the date of the Quote, revised where applicable only on the terms of paragraph 6.3. The Provider provides a prior quote within five (5) Working Days of the Client’s request.

The reversibility assistance invoiced under this paragraph and the delivery of the source code of the specific Deliverables, governed by the condition precedent in paragraph 12.1, are conditional on payment of the sums due and not disputed in good faith. By contrast, the return of the Client’s data in a standard, usable and documented format, provided for in paragraph 20.6, takes place in all circumstances and may not be withheld on account of non-payment; the same applies to the return of Personal Data processed on behalf of the Client, which takes place on the terms of the DPA and of Article 28(3)(g) of Regulation (EU) 2016/679, and to data that the Client needs to hold in order to comply with a statutory or regulatory obligation.

20.7 bis Data processing services. Where the Service constitutes a data processing service within the meaning of Regulation (EU) 2023/2854 of 13 December 2023, the provisions of paragraph 20.7 apply subject to Chapter VI of that Regulation and according to the timetable it sets. The Provider assists the Client in the process of switching provider or returning to on-premises infrastructure, makes available to it the information on the applicable procedures, raises no contractual, commercial or technical obstacle likely to prevent or delay the switch, and applies to switching operations only the charges that the Regulation still permits on the date of the request. Support services going beyond what the Regulation requires of the Provider remain chargeable on the terms of paragraph 20.7.

20.8 Data deletion. The Provider deletes the Client’s data from its production environments within thirty (30) days after their return. Residual copies in backup systems are deleted at the end of their retention cycle, and in any event within a maximum of twelve (12) months after deletion of the data from the active database. A certificate of deletion is issued to the Client on written request. Data that the Provider is required to keep under a statutory obligation, in particular for accounting or evidential purposes, are excluded from this deletion, are kept only for the duration of that obligation and only for the purpose on which it is based, and remain subject to Articles 13 and 14 and to the DPA.

20.9 Survival. The following provisions survive the end of the Contract for their own duration: Articles 7 (for sums remaining due and related amounts), 11.2 (warranty of items supplied by the Client), 12 (intellectual property), 13 (confidentiality and trade secrets), 14 (personal data), 15 (information security, until complete deletion of the Client’s data within the meaning of paragraph 20.8), 17 (liability), 18.2 (evidence of insurance), 20.5 to 20.8 (effects, reversibility and deletion), 21.4 (non-solicitation), 23 (notices, electronic evidence and general provisions) and 24 (settlement of disputes, governing law and jurisdiction). In the service annexes, Article 5 of the “Fixed Price” annex (warranty of proper operation) and Articles 5 (Outputs) and 8 (data and training) of the “Artificial Intelligence” annex also survive.

Article 21. Independence of the Parties, due diligence and non-solicitation

21.1 Independence. The Provider acts as an independent professional. It is neither an employee, nor an agent, nor a representative of the Client, and these terms create no company, consortium or joint venture. No relationship of legal subordination exists between the Parties, whatever the regime of the Service. The arrangements for this independence in the performance of Services on a time-spent basis are set out in Article 5 of the “Time and Materials” annex.

21.2 Due diligence. In accordance with Articles L8222-1 and L8222-2 of the French Labour Code (Code du travail), where the amount of the Contract reaches the threshold set by Article R8222-1 of that code, the Client verifies, when the Contract is concluded and then every six (6) months until it ends, that the Provider is meeting its obligations to file returns and pay social security contributions. To that end, the Provider gives the Client the documents listed in Article D8222-5 of that code, namely the certificate of filing of social security returns and payment of contributions, known as the due diligence certificate (attestation de vigilance), issued by the collection body and less than six (6) months old, together with an extract of registration in the Trade and Companies Register less than three (3) months old.

21.3 Freedom to do business. The Provider remains free to perform services for other clients, including competitors of the Client, subject only to compliance with Article 13 and to not reusing the specific items assigned under Article 12.

21.4 Non-solicitation. During the term of the Contract and for twelve (12) months after it ends, each Party refrains, directly or through an intermediary, from soliciting, poaching or employing, in any form whatsoever, any staff member, employee or independent contractor of the other Party who has taken part in performing the Services, without that Party’s prior written consent. In the event of breach, the defaulting Party pays the other a fixed indemnity equal to twelve (12) months of the gross remuneration of the person concerned, or, for an independent contractor, of their average monthly billing multiplied by twelve. The Parties agree that this indemnity constitutes a penalty clause within the meaning of Article 1231-5 of the French Civil Code, that it discharges the non-solicitation obligation and that it is exclusive of any other claim for the same event. It is payable by each Party on the same terms, is incurred only after a formal notice that has remained without effect for thirty (30) days and is not subject to the cap in paragraph 17.2. This clause does not prevent recruitment resulting from an unprompted spontaneous application or from a response to a public job advertisement.

Article 22. Subcontracting and assignment of the Contract

22.1 Subcontracting. The Provider may, under its full and entire responsibility, use subcontractors to perform all or part of the Services, in particular:

• for hosting and infrastructure: OVHcloud SAS, 2 rue Kellermann, 59100 Roubaix, France (RCS Lille Métropole 424 761 419);
• for the delivery of transactional and application e-mails sent by the services and of alert messages: Sweego, a brand of Mindbaz SAS (Lille, France);
• for third-party services integrated into the Deliverables: application programming interfaces, cloud services, AI Model providers and payment services, designated in the Quote or in the architecture documentation.

The designation and replacement of a person named in the Contract are governed by Article 3 of the “Time and Materials” annex.

22.2 Liability. The Provider remains solely liable to the Client for the performance of the Services, including those entrusted to a subcontractor. Where subcontracting involves the processing of Personal Data, paragraph 14.5 and the DPA apply.

22.3 Assignment. The Contract is entered into in consideration of the identity of each Party. Neither Party may assign the Contract, or the rights and obligations arising from it, without the prior written consent of the other, except in the case of a universal transfer of assets and liabilities resulting from a merger, a demerger or a partial transfer of assets subject to the demerger regime. In that case, the Contract automatically continues with the beneficiary company, subject to prior notification to the other contracting party, which may, within thirty (30) days of that notification, terminate the Contract without compensation if the beneficiary does not offer equivalent guarantees of performance or is a direct competitor.

22.4 Change of control. In the event of a change of control of the Provider within the meaning of Article L233-3 of the French Commercial Code, the Provider informs the Client in writing at least thirty (30) days in advance, or without delay where the transaction was not foreseeable. Within sixty (60) days of being so informed, the Client may terminate the Contract without compensation and without having to give reasons, on three (3) months’ notice for Services with successive performance, Reversibility being carried out on the previous financial terms and the assistance in paragraph 20.7 then not being invoiced; for one-off Services in progress, it pays for the Services performed and the irreversible commitments made on its behalf. The same right is available to it, within the same period, in the event of a universal transfer of the Provider’s assets and liabilities, by way of derogation from paragraph 22.3.

Article 23. Notices, electronic evidence and general provisions

23.1 Notices. Any notice between the Parties is validly given by e-mail sent to the addresses designated in the Quote, with a request for acknowledgement of receipt, except for the following acts, which require a registered letter with acknowledgement of receipt: formal notice, termination, notification of an event of force majeure and a request for renegotiation on grounds of hardship. The Provider’s address for notices is contact@sanfytech.com; the address for data protection matters is rgpd@sanfytech.com; the postal address is that of the registered office stated in Article 3. Each Party informs the other of any change of address within fifteen (15) days. A notice sent by e-mail is deemed received on the first Working Day following its dispatch, unless an automatic non-delivery message is returned; a notice sent by registered letter with acknowledgement of receipt is deemed received on the date of first presentation, the postmark being proof of dispatch.

23.2 Electronic evidence. In accordance with Articles 1366 and 1367 of the French Civil Code, the Parties agree that the e-mails exchanged, the documents signed electronically under Regulation (EU) No 910/2014, the tickets in the Provider’s request management system and the technical logs it operates have, as between them, the same evidential value as writing on paper, provided that the person from whom they emanate can be duly identified and that they are drawn up and stored in conditions such as to guarantee their integrity. This evidence agreement is made without prejudice to each Party’s right to adduce evidence to the contrary by any means.

23.3 Entire agreement and precedence of the Contract over commercial documents. The Contract constitutes the entire agreement of the Parties on its subject matter. It cancels and supersedes any prior exchange, offer or agreement on the same subject matter. Advertising documents, brochures, service sheets, publications and pages of the website https://www.sanfytech.com are for information only and do not define the contractual scope, which results exclusively from the Quote, the Requirements Document, the specific contract and its annexes, the service annexes and these terms; in the event of discrepancy, the latter prevail, in particular as regards the scope of the Services, service levels, warranty periods, data location and the extent of the rights assigned. This provision neither limits nor excludes the duty to inform under Article 1112-1 of the French Civil Code, the fourth paragraph of which places the burden of proving performance on the party bound by it, nor the Provider’s liability for the decisive information it communicated before the Contract was formed.

23.4 Partial invalidity. If a provision of the Contract is declared void, unlawful or unenforceable by a competent court or authority, the other provisions remain in full force. The Parties negotiate in good faith a replacement provision producing an economic effect as close as possible to that of the provision set aside.

23.5 No waiver. A Party’s failure to rely on a breach by the other, or its toleration of a practice different from that provided for in the Contract, does not constitute a waiver of its right to rely on it subsequently or an amendment of the Contract.

23.6 Tolerances and amendment. Any amendment of the Contract requires a written amendment signed by the authorised representatives of the Parties, subject to the price revisions taking effect automatically under Article 6 and to changes to the General Terms under paragraph 4.4.

23.7 Language and headings. The Contract is drawn up in French, which is the only authentic version. Any translation is provided for information only. Article headings are for ease of reading only and may not be relied on for interpretation.

23.8 Good faith. The Parties perform the Contract in good faith, in accordance with Articles 1103 and 1104 of the French Civil Code, and provide each other with all information useful for its proper performance.

Article 24. Settlement of disputes, governing law and jurisdiction

24.1 Governing law. These General Terms and any Contract concluded on their basis are governed by French law, excluding its conflict of laws rules.

24.2 Prior amicable resolution. In the event of a dispute relating to the formation, interpretation, performance or termination of the Contract, the first Party to act refers it to the other in writing, setting out the subject of the dispute and the proposed resolution. The Parties meet, in person or remotely, within fifteen (15) days of that referral and endeavour in good faith to reach a negotiated settlement. This amicable attempt is deemed closed on expiry of a period of thirty (30) days from the written referral, unless extended by written agreement. It is a means of performing the Contract in good faith within the meaning of Articles 1103 and 1104 of the French Civil Code and not a mandatory precondition for bringing proceedings: failure to observe it does not constitute a ground of inadmissibility (fin de non-recevoir) within the meaning of Article 122 of the French Code of Civil Procedure (Code de procédure civile) and does not prevent an application to the judge hearing urgent applications (juge des référés), the taking of protective measures, an order for payment procedure or an action on the merits.

24.3 No consumer mediation. As the Provider’s business is intended exclusively for business clients, consumer mediation schemes do not apply and no consumer mediator is appointed. The Parties may, by mutual agreement and with costs shared, resort to contractual mediation before bringing any court proceedings.

24.4 The Parties make no contractual choice of jurisdiction. Failing amicable resolution on the terms of paragraph 24.2, the dispute is brought before the competent court under the general rules of law.

Article 25. Public sector clients and public procurement contracts

25.1 Where the Client is a legal person governed by public law and the Contract falls under the French Public Procurement Code (Code de la commande publique), the Contract is an administrative contract pursuant to Article L6 of that code: disputes fall within the jurisdiction of the administrative courts, territorial jurisdiction being determined by the rules of the Code of Administrative Justice (code de justice administrative), from which the Parties may not derogate. The prior amicable procedure in paragraph 24.2 is without prejudice to each Party’s right to refer the matter to the territorially competent advisory committee for the amicable settlement of public procurement disputes (comité consultatif de règlement amiable).

25.2 By way of derogation from paragraph 7.3, the principal sums due are paid within the thirty (30) day period provided for by Articles L2192-10 and R2192-10 of the French Public Procurement Code. By way of derogation from paragraph 7.4, late payment automatically triggers default interest at the interest rate applied by the European Central Bank to its most recent main refinancing operations, in force on the first day of the half of the calendar year in which the interest began to run, plus eight (8) percentage points, together with the fixed indemnity for recovery costs provided for by that code, without prejudice to additional compensation for costs actually incurred on presentation of supporting documents.

25.3 The documents making up the public contract, in particular the deed of commitment (acte d’engagement), the special administrative terms (cahier des clauses administratives particulières) and, where the contract refers to it, the general administrative terms for public contracts for information and communication technologies (cahier des clauses administratives générales des marchés publics de techniques de l’information et de la communication) approved by the order (arrêté) of 30 March 2021, take precedence over these General Terms and their service annexes, which apply only on a supplementary basis and to the extent that they do not conflict with them. Paragraph 4.5 is applied subject to this reservation.