Operations and service levels annex.

Article 1. Purpose and scope

1.1 Purpose. This annex supplements the Provider’s general terms and conditions of sale, hereinafter the “Common Provisions”. It governs the matters specific to hosting, managed services, maintenance in operational condition (MCO) and third-party application maintenance services: the structure of the service levels, their exclusions, credit notes, backups and operational reversibility.

1.2 Scope. It applies only to Services of this nature, as designated in the Quote. The service levels, their measurement method, the exclusions, the quantified scales and the backup parameters are set by the “Service levels” annex, hereinafter the “Technical Annex”, where it is attached; failing that, by the Quote or by the specific contract. Where these Services are the subject of a specific contract, that contract also defines the operated scope and the reversibility arrangements; the Common Provisions and this annex then apply on a supplementary basis.

1.3 Order of precedence. The terms defined in Article 1 of the Common Provisions have the same meaning in this annex. The Common Provisions remain applicable in all their provisions and prevail over this annex in the event of conflict, except on the matters that this annex is specifically intended to govern, for which it prevails. This annex is physically attached to the Quote and forms an integral part of it.

Article 2. Nature of the commitment and support hours

2.1 Nature of the commitment. The Provider is bound by an enhanced best-efforts obligation (obligation de moyens renforcée) for hosting and managed services where SLAs are subscribed, the measure of that obligation then being those SLAs. Where no SLAs are subscribed, the Provider’s obligation in respect of these Services is a best-efforts obligation (obligation de moyens) within the meaning of Article 1231-1 of the French Civil Code (Code civil), assessed solely by reference to the measures described in paragraph 15.2 of the Common Provisions and to the limits in paragraph 15.4 of the Common Provisions.

2.2 Support hours. Support is provided on Working Days, within the hours set by the Technical Annex, the Quote or the specific contract. Outside those hours the Provider operates no continuous staffed presence, no on-call support and no monitoring, and promises none.

Article 3. Invoicing of the fee

3.1 Pursuant to paragraph 7.2 of the Common Provisions, the periodic fee for hosting, managed services and third-party application maintenance is invoiced in advance; services outside the fixed package are invoiced in arrears.

Article 4. Structure of the service levels

4.1 Where subscribed, the SLAs take the form of a monthly availability commitment, a guaranteed response time and a guaranteed restoration or workaround time expressed per severity level, and a severity grid. The Technical Annex defines these indicators, their measurement method and the severity grid; failing that, they are defined by the Quote or by the specific contract.

4.2 The quantified thresholds attached to each of these indicators are set out in the Technical Annex, the Quote or the specific contract. Failing that, no threshold is subscribed and the second limb of the sentence in paragraph 2.1 applies.

Article 5. Exclusions and maintenance windows

5.1 The only periods of unavailability excluded from the calculation of availability and of the time guarantees are those exhaustively listed in the Technical Annex or, where there is no Technical Annex, those listed in the Quote or the specific contract. No other exclusion may be relied on against the Client.

5.2 The scheduled maintenance window, the advance notice and the ceiling on cumulative scheduled interruptions are set by the Technical Annex, the Quote or the specific contract. An operation carried out outside that window, or announced with shorter notice, is not excluded from the calculation.

Article 6. Credit notes

6.1 Mechanism. Failure to meet a subscribed service level gives rise to credit notes set against the fee for the service concerned. The credit is applied automatically by the Provider where its own measurements establish the failure. The scale, the arrangements for applying and requesting credits, the cap on credits and the Client’s right to terminate in the event of repeated failures are set by the Technical Annex or, failing that, by the Quote or the specific contract. This cap is expressed as a proportion of the fee for the month in question and as a number of months of fees per contractual year; it may not be expressed as an absolute amount. No time limit imposed on the Client for requesting a credit is a time bar extinguishing its right of action.

6.2 Regime. These credits constitute fixed and full compensation for the failure to meet the service level itself, within the meaning of Article 1231-5 of the French Civil Code, without prejudice to the court’s power to reduce or increase a penalty that is manifestly excessive or derisory. They are exclusive of any other claim based solely on failure to meet that service level; they do not preclude an action by the Client based on a proven fault of the Provider that has caused separate damage, which remains governed by Article 17 of the Common Provisions, and they count towards the cap in that Article. This Article does not apply in the event of fraud (dol) or gross negligence (faute lourde) of the Provider, in the event of personal injury, or in cases where the law prohibits any limitation, compensation then being governed by the general law.

Article 7. Backups and restorations

7.1 In addition to the general backup measures described in the “Technical and organisational security measures” annex (A2.12) and in paragraph 15.2 of the Common Provisions, the Technical Annex, the Quote or the specific contract may set binding recovery point and recovery time objectives, an enhanced retention cycle, a dedicated location for copies, a frequency of restoration tests and a number of restorations included in the fee. In the absence of such a provision, the Provider assumes, under this annex, no binding restoration time objective and no penalty on that account; it nevertheless remains bound, under the Common Provisions and the security annex, to perform the daily encrypted backups described in A2.12, without that measure in itself constituting a service level commitment. In any event, it is for the Client to keep its own copies of the data that are essential to it.

7.2 The technical measures actually in place at the date of these terms, and their limits, are described in paragraphs 15.2 to 15.4 of the Common Provisions.

Article 8. Continuity and operational reversibility

8.1 Given the size of its organisation, the Provider draws up and keeps up to date operating documentation intended to allow a competent third party to take over the service, and provides it to the Client on written request. At the Client’s request, it hands over, under seal or in an electronic safe, the emergency access credentials for the environments dedicated to the Client, and facilitates the transfer into the Client’s name of the domain names and certificates belonging to it. For any Contract relating to hosting, managed services or maintenance in operational condition, the Provider designates a backup operator. This designation results from a written and dated decision of the President (Président), delegating powers in the name of the company: it names the backup operator, defines their scope (access to the environments concerned, protective acts, communication with the Client) limited to what is necessary to maintain and return the Client’s data and configurations, and sets the conditions for its activation, in the event of the Provider’s incapacity or unavailability for more than thirty (30) days. As it emanates from the company and not from the person of the President, the delegation survives any impediment affecting the President. The Provider informs the Client of the identity of the backup operator and of any subsequent change, and provides the decision on written request.

8.2 End-of-Contract Reversibility, reversibility assistance and data deletion remain governed by paragraphs 20.6 to 20.8 of the Common Provisions.

Article 9. Rental of unmanaged infrastructure

9.1 Where the Provider makes available to the Client a server or environment whose operating system, hosting control panel and applications are administered by the Client itself, or by a third party it designates, responsibilities are allocated as follows:

9.2 The Provider does not provide monitoring, patch tracking or incident detection inside the rented machine; the measures in paragraph 15.2 of the Common Provisions do not apply to it, with the exception of the filtering and image backup mentioned above. Any change to the filtering implemented by the Provider that is likely to affect the availability of a Client service requires the Client’s prior written consent; failing a response within fifteen (15) days of a written request justified by a specific security risk, the Provider may implement the filtering and informs the Client immediately. The Client indemnifies the Provider against the consequences of any exposure resulting from a configuration within its scope.