These “General Terms” are an integral part of the provision of services by the Service Provider to the Client in accordance with the main Agreement.
- Definitions and Interpretation
- The following capitalised terms and acronyms shall have the meanings assigned to them below, unless the context requires otherwise:
- Account means the central means of access to the Services;
- Affiliate means an entity that is (a) directly or indirectly owning or controlling a Party; (b) under the same direct or indirect ownership or control as a Party; or (c) directly or indirectly controlled by a Party; for so long as such ownership or control lasts. Ownership or control shall exist through direct or indirect ownership of fifty per cent (50%) or more of the nominal value of the issued equity share capital or of fifty per cent (50%) or more of the shares entitling the holders to vote for the election of the members of the board of directors or persons performing similar functions;
- Agreement means this software as a services agreement including all its Annexes and other attached documents which may be amended and/or modified from time to time;
- Annex means an annex which is incorporated into this Agreement;
- Applicable Laws means all local, state, national, and international laws, regulations, and treaties that apply to the Parties, the Agreement, and the subject matter of the Agreement. This includes, without limitation, all forms of statutes, regulations, judgments, injunctions, orders, and decrees, as well as any governmental authorizations, licenses, and permits;
- Business Day means any day which is not Saturday, Sunday or a public holiday in Estonia;
- Client Data means all data, information, and materials provided, disclosed, or submitted by or on behalf of the Client to the Service Provider in connection with this Agreement. This includes, but is not limited to, personal data, confidential business information, customer details, technical data, and any other information provided by the Client for the purpose of enabling the Service Provider to perform its obligations under this Agreement or as otherwise agreed upon by the Parties;
- Confidential Information means the Agreement, the data and documentation related to the businesses and clients of the Party and its Affiliates, including know-how and all other specifications, trade secrets, technical information, software, models, designs, business information, unpatented technology, research information, statistical information and analyses, information on methods, processes and facilities related either to any software or business activities of any of the Parties. For the avoidance of doubt, client information shall be deemed to be confidential. However, information that was in the possession of the disclosing Party without an obligation of confidentiality, before its disclosure and information that is generally available to the public shall not be deemed confidential;
- Contract Year means a period of 12 (twelve) months commencing on the Effective Date and any anniversary thereof;
- Control means the direct or indirect ownership of more than 50% of the share capital of a company or more than 50% of the voting power;
- Deliverables means all results of work performed and specifically tailored by the Service Provider to the Client under this Agreement or a SoW in whatever form;
- Documentation means manuals, user guides, technical documentation, and any other relevant material related to the Services and/or Deliverables provided by the Service Provider to the Client under the Agreement and/or the SoWs;
- Effective Date means the date of concluding the Agreement;
- Fees means the service or other fees payable by the Client in consideration for the Services, further specified in Section 6 and the Special Terms;
- Force Majeure Event means unforeseeable circumstances which the Party, who has violated the obligation, is unable to control and the prevention of which by the same cannot be expected proceeding from the principle of reasonableness. Force majeure events include but are not limited to severe acts of nature, war, riot, acts of terrorism, the activities of public authorities (e.g. the state, local government) and other circumstances independent of the parties (e.g. strike, the general failure of the computer system, failure of communications lines or power failure, denial-of-service attack);
- GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) as well as other applicable data protection laws;
- Intellectual Property rights or IPR means all intellectual and industrial property rights and similar rights of whatever nature anywhere in the world whether currently existing or coming into existence in the future, whether recorded or registered in any manner or otherwise, including (but not limited to) any copyrights and related rights, industrial design rights and other design rights, registered designs, patents, utility models, inventions (whether or not patentable), trademarks, service marks, database and software rights, rights to layout-designs of integrated circuits, trade secrets, know-how, confidential information, business names, trade names, brand names, domain names and all other legal rights anywhere in the world protecting such property including, where applicable, all renewals, extensions and applications for registration, the right to apply for registration, and the right to sue for damages for past and then-current infringement in respect of any of the same;
- Open Source Software means software that is, contains or is derived from software distributed as freeware, shareware or open source software, or under similar licensing or distribution models that: (a) require the licensing, disclosure or distribution of source code to any other person; (b) prohibit or limit the receipt of consideration in connection with licensing or distributing any software; (c) allow any person to decompile, disassemble or reverse engineer any software; (d) require the licensing or distribution of any software to any other person for the purpose of making derivative works; (e) are identified by the open source initiative as open source licensing or distribution models at www.opensource.org; or (f) is identified by the Free Software Foundation as free software licenses at www.gnu.org;
- Personal Data means any information relating to an identified or identifiable natural person defined in the GDPR;
- Renewal Period means the renewal period provided in Section 2.
- Service Levels means the target performance levels applicable to the Services and any other service levels provided in the Service Level Agreement;
- Services means services provided by the Service Provider under this Agreement, including the intelligent transport management solution, as well as any other services and SoWs agreed upon by the Parties from time to time;
- SoW means a statement of work defining the services performed or to be performed and/or any Deliverables. All such statements of works shall be deemed as separate agreements between the Parties;
- Term means the term of the Agreement provided in Section 1;
- User means any individual who is authorized by the Client to access and use the Services under this Agreement. This includes, but is not limited to, the Client’s employees, representatives, consultants, contractors, agents, or other entities authorized by the Client;
- In this agreement, the following rules of interpretation apply:
- references to words “include” or “including” (or any similar term) are not to be construed as implying any limitation and general words introduced by the word “other” (or any similar term) shall not be given a restrictive meaning because they are preceded or followed by words indicating a particular class of acts, matters or things;
- references to “hereby”, “herein”, “hereof”, “hereunder” or any similar expression shall refer to the Agreement as a whole and not to any particular provision thereof;
- except where the context specifically requires otherwise, words importing one gender shall be treated as importing any gender, words importing the singular shall be treated as importing the plural and vice versa, and words importing the whole shall be treated as including a reference to any part thereof;
- references to “form reproducible in writing” include electronic mail (including pdf);
- references to “persons” or “individuals” include private individuals, legal entities, unincorporated associations and partnerships and any other organisations, whether or not they have separate legal personality;
- the section and paragraph headings used in this Agreement are inserted for ease of reference only and shall not in any way affect or define the construction, meaning, or scope of any of the provisions thereof;
- any reference to a section, paragraph, or an Annex means a reference to a section, paragraph, or an Annex of this Agreement;
- the Annexes form an integral part of this Agreement and shall have effect as if set out in full in the body of this Agreement. Any reference to this Agreement includes its Annexes.
- Order of Precedence
- The following Annexes form an integral part of this Agreement:
- Service Level Agreement;
- Data Processing Agreement;
- Technical and Organisational Measures;
- Platform Security.
- In the event of any discrepancy between any of the provisions of an Annex and of the General Terms, the provisions of the General Terms shall prevail, unless explicitly stated otherwise in the applicable Annex. This does not apply to the Data Processing Agreement and its provisions, which shall prevail in case of conflict with the provisions of any part of this Agreement.
- The following Annexes form an integral part of this Agreement:
- Access To and the Use of the Services
- Subject to all limitations and restrictions contained herein, the Service Provider grants the Client a non-exclusive and non-transferable subscription right to access and use the Services. The Client can:
- use the Services via the HTTPS protocol and API endpoints;
- make the Services available to Users via the mobile application.
- To access and use the Services, the Client shall have the right to an Account with administrative control. The Service Provider shall create such an Account for the Client and disclose the credentials to the Client. The Client shall retain ultimate administrative control over their Account for the Term.
- The Client shall have the right to create, designate, and terminate User accounts. Users shall be permitted to access the Services subject to User rights assigned to them by the Client. The Client agrees and acknowledges that they approve all creation, designation, and termination of User accounts.
- The Client is responsible for keeping the Account secure while using the Services. The Client is responsible for all Client Data uploaded and all activity that occurs under the Account. The Service Provider cannot and will not be liable for any loss or damage from the Client’s failure to comply with this obligation. The Client will promptly notify the Service Provider if the Client becomes aware of any unauthorised use of, or access to, the Services through the Account, including any unauthorised use of the password or the Account.
- The Client is responsible for obtaining any communication means necessary to use the Services. The Client’s mobile network’s data and messaging rates and fees may apply if the Client accesses or uses the Services from their device. The Client is responsible for acquiring and updating compatible hardware or software necessary to access and use the Services and applications and any updates thereto. The Service Provider does not guarantee that the Services, or any portion thereof, will function on any particular hardware or devices. In addition, the Services may be subject to malfunctions and delays inherent in the use of internet and electronic communications.
- The Client shall use the Services only in accordance with this Agreement and Applicable Laws. Unless expressly otherwise agreed upon between the Parties, the Client shall not:
- modify, copy, enhance, improve, alter, reverse engineer, decompile, disassemble, deconstruct, translate, decrypt, reverse compile or convert into human readable form the Services or any part thereof, except to the extent permitted by Applicable Laws;
- work around any technical limitations of the Services or restrictions in the product documentation of the Services;
- modify, enhance, improve, alter or (other than to Users) distribute the product documentation of the Services;
- remove, deface, cover or otherwise obscure any proprietary rights notice or identification from the Services or documentation of the Services (including without limitation any copyright notice);
- authorize or permit any third party to engage in the aforementioned activities.
- The Client agrees to refrain from conducting any activity harmful to the Service Provider and/or the Services. The Client shall not:
- use the Services in a manner that interferes with, corrupts, damages, or destroys the Services, including any software or the servers that administer the Services; or the data and information in the Services;
- use the Services in any way that is or may be unlawful, illegal, fraudulent, harmful or in connection with any unlawful, illegal, fraudulent or harmful purpose or activity;
- transmit malware to the Services or use the Services maliciously;
- significantly increase the workload of the Services above what is reasonably expected from the Client;
- use the Services in any other way that is reasonably likely to result in damage to the Service Provider or another client of the Services.
- Subject to all limitations and restrictions contained herein, the Service Provider grants the Client a non-exclusive and non-transferable subscription right to access and use the Services. The Client can:
- Intellectual Property Rights
- All IPR to the Services, including its components, any upgrades, additions, corrections, improvements, and any other proprietary software made available by the Service Provider to the Client will at all times remain the sole property of the Service Provider or its licensors. This Agreement does not transfer or convey any IPR from the Service Provider to the Client, nor does it grant the Client any rights in or to the Service Provider’s IPR, except for the limited rights expressly granted under this Agreement.
- Subject to full and timely payment of all Fees, the Service Provider grants the Client a non-exclusive, non-transferable, non-sublicensable, limited right and license to access and use the Services for the duration of the Term. This license is provided solely for the Client’s internal business purposes, and the Client agrees to use the Services in accordance with the terms and conditions set forth in this Agreement.
- The Parties acknowledge and agree that the Client and/or its Affiliates shall retain sole ownership of all IPR in and to the Client Data. This Agreement does not constitute a transfer of any IPR over the Client Data from the Client to the Service Provider. The Service Provider is authorized to use the Client Data exclusively for the purpose of rendering the Services as stipulated in this Agreement. Any such use shall be in compliance with the terms of this Agreement, the GDPR, and the Service Provider’s privacy policy. The Service Provider acknowledges that it has no right to disclose, replicate, or use the Client Data for any purpose other than as expressly permitted in this Agreement.
- Availability
- In accordance with the terms of this Agreement, the Service Provider commits to maintaining the availability of the Services as detailed in the Service Level Agreement annexed hereto.
- The Service Provider shall use commercially reasonable efforts to ensure that the Services are available with the uptime and performance standards specified in the Service Level Agreement. However, the Service Provider does not warrant uninterrupted or error-free operation of the Services and does not guarantee that the Services will be available 24/7, year-round.
- The Service Provider agrees to perform any maintenance or support activities for the Services with reasonable skill and care, in accordance with the terms outlined in the Service Level Agreement.
- The Service Provider’s obligations regarding availability levels, incident management, support services, and maintenance of the Services are exhaustively defined in the Service Level Agreement. The Service Level Agreement also provides the Client’s sole and exhaustive remedies for the Service Provider’s breach of such obligations.
- The Parties may, from time to time, agree on additional work relating to the Services based on the Client’s needs and requirements. Such additional work shall be agreed upon by the Parties in separate SoWs, which will detail the scope, usage, and fees associated with such additional work.
- Fees
- The Client shall pay to the Service Provider as consideration for the Services the Fees specified in the Service Provider’s website. The Fees cover the total fees for all Services to be performed under this Agreement. The Parties may agree on any additional fees payable by the Client for ancillary services.
- All Fees are exclusive of ancillary fees and taxes. If VAT or any other taxes are applicable to any Fee, such taxes shall be added to the respective invoice pertaining to the relevant Fee.
- The Service Provider shall issue invoices to the Client per the sums disclosed on the Service Provider’s website. All invoices shall be sent electronically to the Client’s invoicing address.
- If the Client receives an invoice which it reasonably believes includes a sum which is not valid and properly due, the Client shall notify the Service Provider in writing within 10 days from the receipt of such invoice. The Service Provider shall review the disputed invoice and notify the Client whether the disputed invoice is correct, or if incorrect, the Service Provider shall issue a corrected invoice.
- The Fee shall be deemed to be paid if such Fee is credited to the Service Provider’s bank account indicated on the invoice. The Client shall pay any additional costs required for payment of the Fee, such as bank transfer fees.
- The payment term is 14 calendar days for each invoice, unless otherwise agreed upon by the Parties. The Client agrees to pay the Service Provider a late payment fee for undue delay of payment. The late payment fee shall be calculated per each day that the Client is in delay, and the daily amount shall constitute 0.06 % of the principal debt.
- All sums payable under this Agreement shall be paid in euros (EUR) and shall be paid in full without any set-off, counterclaim, deduction or withholding unless required by law or unless the Service Level Agreement requires otherwise.
- The Service Provider may unilaterally increase the Fees each Contract Anniversary, provided that such increase does not exceed 10% or the increase of Harmonized Consumer Prices Index (HCPI) per year in euro area as calculated by the Eurostat, whichever is smaller, unless agreed otherwise between the Parties.
- Confidentiality
- The Parties shall maintain and keep confidential and shall not disclose directly or indirectly to any third party the other Party’s Confidential Information and shall prevent the third parties’ access to such information. Either Party shall:
- use Confidential Information only for performing the Agreement;
- treat all Confidential Information as being strictly confidential and implement and maintain all such technical and organizational security measures as may be reasonably available (having regard to technical developments at the time) and as are appropriate in the circumstances to protect Confidential Information against unauthorized or unlawful processing, accidental loss, distribution or damage;
- in case Confidential Information includes personal data, follow the disclosing Party’s instructions on processing personal data and adhere to the GDPR;
- not, without the express prior written consent of the disclosing Party, disclose any Confidential Information to any person other than its advisers and members of governing bodies, directors, officers, members, employees, agents, managers, consultants, and individuals required to perform the Agreement, and will ensure that all those to whom Confidential Information is disclosed are aware of and observe the terms of this Agreement in all respects as if they were a party to this Agreement;
- procure confidentiality undertakings from any third party to whom Confidential Information is disclosed under this Agreement;
- only make physical copies of Confidential Information to the extent strictly necessary for the Purpose;
- not copy or store Confidential Information electronically or transmit it outside the receiving Party’s usual place of business, unless otherwise agreed between the Parties in writing; and
- not, without the disclosing Party’s prior written consent, use Confidential Information for its advantage, commercial or otherwise.
- Notwithstanding the foregoing, disclosure of Confidential Information is not considered a breach of this Agreement if the receiving Party is required to disclose it by applicable law or a court of competent jurisdiction, but only to the minimum extent of such requirement and provided that the receiving Party, to the extent permitted by applicable law, gives the disclosing Party prior advance notice before making such disclosure so as to afford the disclosing Party a reasonable opportunity to object to and obtain a protective order or other appropriate relief regarding such disclosure.
- The receiving Party shall notify the disclosing Party immediately in writing if it becomes aware that Confidential Information has been disclosed to an unauthorised third party and take all reasonable measures to prevent or reduce damage to the disclosing Party.
- In case of any reasonable doubt, whether the particular information shall be treated as Confidential Information and whether and to what extent it might be disclosed to third parties, the Parties shall consider such information as Confidential Information.
- Except for the limited right to use Confidential Information for performing this Agreement, this Agreement does not grant the receiving Party any right to such information, including to use, sell, copy, further develop or create derivative works based on such information. The disclosing Party remains the owner of the Confidential Information, regardless of any disclosure of the same.
- The disclosing Party makes no representation or warranty as to the accuracy, completeness or otherwise of Confidential Information supplied, and the receiving Party agrees that it is responsible for making its own evaluation of such information.
- Upon termination of this Agreement, each Party shall:
- return to the other Party all documents and materials (and any copies) containing, reflecting, incorporating or based on the other Party’s Confidential Information; and
- erase all the other Party’s Confidential Information from computer and communications systems and devices used by it, including such systems and data storage services provided by third parties (to the extent technically practicable).
- The confidentiality obligation in this Section 7 shall remain effective for an indefinite term after the termination of the Agreement due to whatever reason.
- The Parties shall maintain and keep confidential and shall not disclose directly or indirectly to any third party the other Party’s Confidential Information and shall prevent the third parties’ access to such information. Either Party shall:
- Data Security
- The Service Provider shall implement technical and organisational measures to ensure the security, confidentiality, and integrity of the Client Data, including any Personal Data. The Service Provider shall at least meet or exceed:
- the requirements of this Agreement, especially those detailed in Technical and Organisational Measures annexed hereto;
- the requirements of the Data Processing Agreement annexed hereto, if it processes Personal Data; and
- good industry standards and practices.
- The Service Provider shall:
- ensure at all times the confidentiality, integrity, availability, backup, and resilience of systems and services processing Client Data as per Platform Security requirements annexed hereto;
- restore the availability and access to Client Data in a timely manner in the event of a security breach involving Client Data;
- regularly test, assess and evaluate the effectiveness of technical and organizational measures for ensuring the security of the Client Data; and
- as regards to Personal Data, pseudonymize and/or encrypt the Personal Data where so required in accordance with the Data Processing Agreement annexed hereto.
- The Service Provider shall inform the Client without undue delay about any incidents in which the security of the Client Data has been compromised, including any events of accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to, the Client Data transmitted to, stored or processed by the Service Provider. The Service Provider shall inform the Client of Personal Data breaches in accordance with the Data Processing Agreement. The Service Provider shall take due measures in response to security incidents in order to restore the confidentiality, integrity, and availability of the Client Data.
- The Service Provider shall implement technical and organisational measures to ensure the security, confidentiality, and integrity of the Client Data, including any Personal Data. The Service Provider shall at least meet or exceed:
- Subcontracting
- The Service Provider shall be entitled to use subcontractors in the performance of the Services under the condition that:
- prior to engaging any subcontractor, the Service Provider shall conduct a thorough vetting process, which shall include, but not be limited to, an assessment of the subcontractor’s technical capabilities, compliance with relevant legal and regulatory requirements, financial stability, reputation in the industry, and history of service quality and reliability;
- the Service Provider informs the Client 30 days in advance of contracting a major subcontractor, i.e. those subcontractors that maintain crucial infrastructure for the provision of Services; and
- the Client shall have the right to object to any proposed major subcontractor based on reasonable grounds related to data security, confidentiality, or service quality. Such objection must be communicated to the Service Provider in writing within 14 days of receiving the notification. In the absence of any objection within this period, the Client is deemed to have no objection to the proposed subcontractors. The Service Provider shall not engage any major subcontractor to which the Client has reasonably objected.
- Where the subcontractor will have access to Personal data, the Service Provider shall:
- only use such subcontractors that can provide appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subject; and
- impose to the subcontractor the same confidentiality obligation and security requirements as it has under this Agreement.
- The Service Provider shall evaluate its subcontractors on a regular basis, at least annually, to ensure ongoing compliance with the standards set forth in this Agreement and any changes in legal or regulatory requirements.
- The Service Provider shall be entitled to use subcontractors in the performance of the Services under the condition that:
- Change Management
- The Client may at any time request a change of the scope of the Agreement, the ordered Services and/or new services by submitting a change request to the Service Provider (the Change Request), which shall include:
- purpose of the change;
- description of the content of the change;
- functional requirements;
- non-functional requirements, if applicable;
- dependencies, if applicable; and
- requested timetable for the implementation.
- The Service Provider shall acknowledge receipt of the Change Request within 14 Business Days, responding either with:
- a decline of the Change Request;
- a tentative acceptance of the Change Request;
- a recommendation for the pre-analysis of the Change Request; or
- a draft SoW detailing the change.
- The Service Provider may at its sole discretion reject any Change Request.
- If the Service Provider responds with a tentative acceptance, it adds the requested changes to their product roadmap to be implemented free of charge but with no time commitment. In this instance, the Service Provider reserves the right to change the scope of the requested changes.
- If the Service Provider responds with a recommendation for the pre-analysis, its response will contain a recommendation to the Client, containing:
- details of the pre-analysis, including its scope, the Client’s contributions and outcome;
- price of the pre-analysis;
- terms for the performance of the pre-analysis;
- a preliminary timetable for the pre-analysis; and
- the deadline for the Client’s acceptance.
- The Client shall respond to the recommendation within the predetermined time limit. If the Parties agree on the terms of the pre-analysis, the Service Provider will conduct the pre-analysis as specified in its recommendation or as otherwise agreed. Upon completion of the pre-analysis, the Service Provider will, at its sole discretion, decline the Change Request, tentatively accept the Change Request, or prepare a draft SoW.
- Where the Service Provider responds to the Change Request with a draft SoW, the response shall include:
- purpose of the change;
- description of the change;
- dependencies;
- deliverables; and
- cost and timeline.
- The Client shall within 10 Business Days respond to the draft SoW. If the Client accepts the draft SoW, the Service Provider shall arrange the SoW to be signed by authorised representatives of the Parties.
- The changes shall be implemented in the scope and within the timeframe stated in the SoW. Implementation includes analysis, development, testing of the change, and any other terms agreed upon in the SoW. Upon delivery and acceptance of the change, the change is launched in accordance with the Service Provider’s release timeline.
- The Client may at any time request a change of the scope of the Agreement, the ordered Services and/or new services by submitting a change request to the Service Provider (the Change Request), which shall include:
- Indemnification
- The Service Provider shall defend and indemnify at its own expense the Client against claims and actions that the use of the Services infringes the IPR of a third party (the IPR Claim), provided that the Client notifies the Service Provider without delay, in writing, after becoming aware of such claims, permits the Service Provider to independently defend or settle the claims, gives the Service Provider all reasonably necessary information and assistance available and all necessary authorizations and does not agree to the settlement of any such claim prior to a final judgment thereon, or make any admission in relation to the claim, without the prior written consent of the Service Provider. The Service Provider shall, to the extent possible, endeavour to protect the goodwill and reputation of the Client in connection with such claims.
- If it is established that, or if in the justified opinion of the Service Provider, the use of the Services infringes the IPR of a third party, the Service Provider shall at its own expense either:
- obtain the continued right to the use of the Services for the Client in accordance with the terms of this Agreement; or
- modify or replace the Services in order to eliminate the infringement.
- The Service Provider shall, however, not be liable to the Client for any IPR Claim if it:
- results from the use of the Services in combination with any hardware, product, software or service of a third party not furnished by the Service Provider;
- results from compliance with the Client’s instructions;
- is based on or arising out of the use of the Services outside the scope set forth in the Agreement or in violation of this Agreement; or
- results from compliance with international standards.
- This Section 11 states the entire liability of the Service Provider and the Client’s sole and exclusive remedies for any IPR Claim. The Service Provider shall indemnify the Client and pay all direct damages, costs and expenses (including reasonable legal costs and expenses) awarded against or incurred by the Client as a result of any IPR Claim but shall not be responsible under this indemnity for any settlement or compromise made by the Client without its consent.
- Without prejudice to the indemnity under Section 4, the Client shall indemnify and hold the Service Provider harmless from any damages, costs or fines awarded against or claimed from the Service Provider in respect of any legal action by the Client’s customers in connection with a breach of an agreement between the Client and its customers, provided that the Service Provider notifies the Client without delay, in writing, after becoming aware of such claims.
- Limitations of Liability
- Neither Party shall be liable to the other Party for any loss of profits, use, goodwill, revenue, or profits or for any incidental, indirect, special, consequential, or exemplary damages. However, neither Party limits its liability for causing death or personal injury, fraud, and any other act, error, or omission, for which liability may not be limited under Applicable Laws.
- The Service Provider shall not be liable for any errors, unavailability, or malfunctions of the Services due to:
- Force Majeure Events;
- the fault or failure of computer systems or networks (including fault or failure of the internet or any public telecommunications network, network overload, disturbances or malfunctions);
- third party integrations or the software or systems that make the Services available;
- loss, alteration, or unauthorised access to the Client Data; or
- any errors, bugs or any inappropriate functioning or malfunctioning of the Services which results from any changes or modifications to the Services made by the Client or any third party acting on behalf of the Client.
- The Service Provider’s liability for the availability of the Services shall be defined, governed, and limited by the terms set forth in the Service Level Agreement. The Parties expressly acknowledge and agree that the Service Level Agreement contains specific provisions related to liabilities, including but not limited to, representations, warranties, remedies, and limitations of liability. In the event of any inconsistencies or conflicts between the terms of this Agreement and the Service Level Agreement concerning liability, the terms of the Service Level Agreement shall prevail.
- Without limiting the above, the Service Provider’s liability shall be strictly limited to damages arising directly from its own wilful misconduct. The Service Provider shall not be liable for any acts, errors, or omissions that do not constitute wilful misconduct as defined under Applicable Laws. The Service Provider is not liable for any damages suffered by third parties.
- The Service Provider’s liability is limited whether or not the Service Provider has been informed of the possibility of such damages, even if a remedy set forth in the Agreement is found to have failed its essential purpose. The Service Provider will have no liability for any failure or delay due to matters beyond the Service Provider’s reasonable control. Subject to Sections 1 and 12.2, the maximum aggregate liability of the Service Provider shall in no event exceed the amount that is equal to the Fees the Client paid to the Service Provider in the course of the previous three months from the occurrence of the event that resulted in the Service Provider’s liability, or if fewer than three months have passed since the Effective Date, 100% of the Fees attributable to the full calendar months that have passed since the Effective Date.
- Representations and Warranties
- Each Party represents and warrants to the other that:
- the Party is properly constituted and incorporated under the respective Applicable Laws;
- the Party has full authority to enter into and perform this Agreement;
- the representative of the Party has all rights, including necessary internal corporate approvals (if applicable), necessary to enter into this Agreement;
- the obligations of the Party set forth in this Agreement are valid, binding on and enforceable against the relevant Party; and
- neither the signing nor the performance of this Agreement conflicts with or results in a violation of any provisions of: (a) any legal acts to which the Party is subject; (b) any agreement or obligation binding on the Party (if applicable); (c) any judgment, order, injunction, decree or ruling of any court or governmental or local authority to which the Party is subject; (d) the terms and conditions of any licence or permit granted to the Party.
- The Service Provider represents and warrants that:
- elements of the Services which constitute Open Source Software, if any, are delivered in a manner which is compliant with their licence terms; and
- the Services are delivered in a manner which complies with Applicable Laws.
- The Services are provided “as is” and, except as expressly set forth in this Agreement, without any warranties or representations of any kind, either express or implied. The Service Provider specifically disclaims all implied warranties, including but not limited to warranties of merchantability, non-infringement, and fitness for a particular purpose. Furthermore, the Service Provider makes no warranties or representations regarding the use of the Services, or results obtained or intended to be obtained in the course of using the Services. The Client acknowledges that it has relied on no warranties other than the express warranties in this Agreement and that no warranties are made by any of the Service Provider’s agents, employees, or representatives.
- The Client acknowledges and agrees that, while the Service Provider endeavours to deliver high-quality services, no software service can be guaranteed to be completely free from bugs or errors. Accordingly, the Service Provider does not represent or warrant that the Services will operate with 100% uptime or be entirely free from bugs and errors. Furthermore, the Service Provider disclaims any warranties regarding the acts and omissions of third-party vendors and hosting partners, including but not limited to their ability to provide the necessary hardware, software, networking, storage, and related technology required to deliver the Services. The Service Provider’s obligations with respect to service availability and performance are solely as expressly set forth in the Service Level Agreement annexed to this Agreement.
- Each Party represents and warrants to the other that:
- Notices and Communications
- Any notices, requests, or other communications to be given or made under this Agreement to a Party shall be directed to the respective designated contact person(s). Each Party is obliged to promptly notify the other of any changes in their designated contact person(s).
- All documents to be furnished or communications to be given or made under this Agreement shall be at least in a form that can be reproduced in writing and in the English language, unless the Parties agree otherwise.
- The Parties have designated the contact persons in a separate communication.
- Term and Termination
- This Agreement shall become effective and binding upon the Parties as of Effective Date, irrespective of the factual date of signing by the Parties. The initial Term of this Agreement is 1 (one) year.
- This Agreement is subject to a Renewal Period of 1 (one) year. Unless the Parties have terminated this Agreement or expressly state otherwise, this Agreement will automatically renew for the Renewal Period at the end of the Term and the end of each subsequent Renewal Period.
- Either Party may terminate the Agreement for any cause, by giving 90 days’ advance notice to the other Party.
- Either Party may terminate this Agreement by giving 30 days’ advance notice upon the occurrence of a material breach committed by the infringing Party:
- which it is not capable of being remedied; or
- which is remediable, but is not remedied within 30 days, or such other period as may be agreed between the Parties, of the infringing Party’s receipt of a notice from the aggrieved Party relating to such breach and requiring such breach to be remedied.
- In the event of termination:
- the Service Provider agrees to provide reasonable assistance to the Client for the smooth transition of the Services to another provider or to the Client itself, for a period not exceeding 3 months after termination. This assistance may include transferring data, providing necessary documentation, and support in migrating services;
- the Client shall be responsible for notifying the Users of the change in service provision. The Service Provider shall cooperate with the Client to ensure that such notifications are consistent with the terms of the Agreement and do not unfairly or inaccurately represent the Service Provider’s role or responsibilities;
- the Service Provider shall provide the Client with all Client Data including Users’ data in its possession in a commonly used format, ensuring compliance with data protection laws and regulations. The Service Provider shall delete or anonymize any Users’ data in its possession upon confirmation of successful transfer, unless legally required to retain it; and
- any final settlements, including outstanding payments or refunds, between the Parties shall be completed within 30 days following the effective date of termination. The terms for such settlements shall be based on the pre-existing contractual obligations and any additional agreements made during the termination process.
- Termination of the Agreement does not release the Parties from their outstanding obligations arising from the Agreement and does not affect the rights or remedies of a Party arising out of breach of the Agreement.
- Termination of this Agreement shall, however, not affect the validity of such terms which by their nature survive the termination of this Agreement.
- Final Provisions
- This Agreement constitutes the entire agreement between the Parties relating to the subject matter hereof, and supersedes any previous communications, whether oral or written, between the Parties in respect of the subject matter hereof.
- The Service Provider is an independent contractor and nothing in the Agreement shall render the Service Provider an employee or agent of the Client and the Service Provider shall not present themselves towards third persons as such.
- No amendment to this Agreement shall be effective unless formalized in writing and signed by the Parties.
- The Parties may not transfer or otherwise assign any of their rights or obligations arising from the Agreement to a third party without the prior written consent of the other Party.
- The invalidity of any portion of this Agreement shall not render this Agreement itself or any other portion hereof invalid. If any provision of the Agreement is held invalid or unenforceable, the remaining provisions will remain in full force and effect. The Parties shall take due measures to replace the invalid or unenforceable provision with a provision that best reflects the intent of both Parties.
- This Agreement is governed by and construed in accordance with the laws of the Republic of Estonia, except for the conflict of laws rule.
- All disputes arising from the Agreement shall be settled via negotiations. If an amicable settlement cannot be reached, the dispute shall be exclusively settled in accordance with the laws of the Republic of Estonia, in Harju County Court in Tallinn.
- This Agreement is executed in a single electronic copy in the English language.
DATA PROCESSING AGREEMENT
This “Data Processing Agreement” (the DPA) is an integral part of the provision of services by the Service Provider to the Client in accordance with the main Agreement. The capitalised terms used in this Data Processing Agreement shall have the meaning assigned to them in the main Agreement.
- Subject Matter
- Subject matter of the DPA, type and purpose of the data processing, types of personal data and categories of data subjects are described in Schedule 1 to this DPA.
- This DPA shall, unless otherwise agreed upon by the Parties, apply as long as the Service Provider processes Personal Data as a data processor on behalf of the Client as a data controller.
- Processing of Data Bound by Instructions
- The Service Provider shall process the personal data based on the instructions provided by the Client using the Software as a Service (SaaS) platform as defined in the main Agreement.
- The Client is responsible for the transparency and information provided to its customers in its service terms, privacy policies and contracts regarding the details of the services provided by the Service Provider.
- Commitment to Confidentiality
- The Service Provider shall engage for the implementation of this DPA only the persons authorised to process the personal data, who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
- The Service Provider shall work with due care towards accomplishing that its employees comply with all applicable legal requirements for data protection and that the information obtained from the Client is not released to unauthorised third parties or otherwise used/exploited.
- Security of Processing / Technical and Organisational Measures (TOMs)
- The Service Provider takes all TOMs required pursuant to Article 32 GDPR.
- TOMs are subject to technical progress and development. During the duration of this DPA, the Service Provider shall continuously adapt the TOMs to the requirements of this DPA and according to technological progress.
- Insofar as the Service Provider provides a technical system/ solution for the Client; the Service Provider has to ensure that the technical system/ solution meets the requirements of the GDPR.
- Engaging Another Processor
- The Service Provider may engage Subprocessors listed in Schedule 2. The Client gives the authorisation of engaging these Subprocessors.
- The Service Provider shall inform the Client of any intended changes concerning the addition or replacement of Subprocessors by updating Schedule 2.
- The Service Provider shall impose on the Subprocessors the same data protection obligations, which are set out in this DPA. Where the Subprocessor fails to comply with the data protection obligations set out in this DPA, the Service Provider shall remain fully liable to the Client for compliance with the data protection obligations of the Subprocessor.
- The Service Provider shall properly verify compliance with the data protection obligations by the engaged Subprocessor on a regular basis.
- Any transfer into a third country (incl. giving access to personal data) either by the Service Provider itself or any Subprocessor is subject to prior written approval, including in electronic form, by the Client. The Client gives the authorisation for third-country transfers to engaged Subprocessors, which are listed in Schedule 2.
- Where personal data is transferred from the Service Provider located in the European Union (EU) or the European Economic Area (EEA) to a Subprocessor located in a country not recognised by the European Commission as providing an adequate level of protection for personal data, the Client appoints the Service Provider and the Service Provider assures to enter into the EU Standard Contractual Clauses on the Client’s behalf with such Subprocessor based outside of the EEA or the EU. The Service Provider will accede to these Standard Contractual Clauses concluded between the Service Provider and the Subprocessor.
- Cooperation and Support Obligations
- The Service Provider assists the Client with all necessary and economically appropriate means as well as by appropriate technical and organisational measures for the fulfilment of the Client’s obligation to respond to requests for exercising the data subject’s rights.
- Direct communication with the data subject shall only take place with the prior written permission of the Client. The Service Provider shall forward all inquiries related to the data subject’s rights to the Client without undue delay.
- Assistance in Ensuring Compliance with the Obligations of the Client
- The Service Provider is aware that in case of a personal data breach, the Client must notify the personal data breach the supervisory authority and/or the data subject without undue delay and, where feasible, not later than 72 hours after having become aware of the personal data breach. In the event of a personal data breach, the Service Provider will support the Client by all necessary and economically reasonable means in performing its notification duties pursuant to Art. 28 (3) (f) GDPR. The Service Provider will inform the Client of any personal data breach as well as suspected cases and provide at least the following information:
- the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and of personal data records concerned;
- the name and contact details of the data protection officer or another contact point, where more information can be obtained;
- the likely consequences of the personal data breach;
- the measures taken or proposed to be taken by the Client to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
- The Service Provider is aware that in case of a personal data breach, the Client must notify the personal data breach the supervisory authority and/or the data subject without undue delay and, where feasible, not later than 72 hours after having become aware of the personal data breach. In the event of a personal data breach, the Service Provider will support the Client by all necessary and economically reasonable means in performing its notification duties pursuant to Art. 28 (3) (f) GDPR. The Service Provider will inform the Client of any personal data breach as well as suspected cases and provide at least the following information:
- Deletion and Return of Personal Data
- The Client has the option to configure how personal data is stored on the Software as a Service (SaaS) platform and set a retention policy specifying the duration after which the data is automatically deleted.
- Demonstrating Compliance with the Obligations and Contributing to Audits
- The Service Provider makes available to the Client all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR.
- Further Obligations
- In the event of suspicion of violations of the data protection obligations or other data breaches or complaints regarding the processing of personal data or resulting from inspections or other measures taken by the supervisory authorities, the Client shall be immediately notified.
- Where required by law, the Service Provider shall appoint in writing a data protection officer according to Art. 37 GDPR and a representative according to Art. 27 GDPR.
- Other Provisions
- The Parties shall keep confidential all business secrets and data security measures they gain knowledge of in the context of the contractual relationship. Business secrets are all (but not limited to) business-related facts, circumstances and activities which are not generally accessible, but only accessible to a limited group of persons unless the Service Provider has no legitimate interest in non-proliferation. Data security measures are all TOMs taken by one contracting party. This obligation of secrecy remains effective after the termination of this DPA.
- The liability of the Parties for data protection violations is regulated in Art. 82 GDPR.
- In the event of contradictions, inconsistencies, or discrepancies between this DPA and the Agreement, the provisions of this DPA shall take precedence over the provisions of the main Agreement. Furthermore, the provisions of the standard contractual clauses/standard data protection clauses shall take precedence, if applicable.
- Should any of the provisions of this DPA be or become invalid, the remaining provisions shall remain valid and unaffected.
- Any modification of this DPA, including its termination and this clause, must be in a written form.
- Irrespective of the provisions concerning the duration of the DPA, both Parties shall be entitled to termination upon good cause in the event of serious violations of the data protection provisions laid down in this DPA.
Schedule 1. Subject Matter of this DPA
Subject matter (of this DPA)
CONTROLLER
PROCESSOR | The Client (as defined in the Agreement) |
The Service Provider (as defined in the Agreement) | |
Nature and purpose of the processing
Processing operations | Account management Vehicle registrations Booking management Notifications Location tracking Statistics Feedback Analytics Technical support |
Type/Categories of personal data Categories of data | User account data Vehicle registration data Booking data Feedback data Notification data Location data Communication logs Technical logs and usage data Technical support data |
Data subjects Data subjects | The Client’s employees, agents, subcontractors |
Schedule 2. List of Engaged Subprocessors
Subprocessor | Location of the processing | Type of Service |
CITIC Telecom CPC Estonia OÜ | Estonia | Server hosting and network connections |
AS LHV PANK | Estonia | Payment collection |
AS LHV Paytech (Everypay) | Estonia | Payment collection solution |
Google Maps | Ireland | Navigation, Location tracking |
Google Play | Ireland | Mobile App |
App Store | US | Mobile App |
Ireland | WhatsApp notifications | |
Telia Eesti AS | Estonia | SMS notifications |
PLATFORM SECURITY
This “Platform Security” is an integral part of the provision of services by the Service Provider to the Client in accordance with the main Agreement. The capitalised terms shall have the meaning assigned to them in the main Agreement.
- Infrastructure
- The Service Provider uses a separate instance for the provision of the Services. The Service Provider does not run its own routers, load balancers, DNS servers, or physical servers.
- A list of all cloud providers used to maintain security and provide services can be found www.goswift.eu.
- Application security
- All code is reviewed by a senior engineer before being deployed to production systems. Code reviews are designed to ensure the security, performance and quality of code released to production.
- The Service Provider protects user login against a number or attack vectors including brute force attacks, by utilising third party services. Passwords are cryptographically hashed and salted based on industry best practises by the authorisation provider and user authorisation tokens to manage connections to the Services.
- The deployment of the Services is entirely automated. Changes to both infrastructure and code are subject to automated testing using a Continuous Integration (CI) tool before being released to production. A change that passes the review and testing process is then deployed to production using a CI tool.
- The Service Provider performs regular penetration test audits with a contracted third party.
- The Service Provider encrypts data both at rest and in transit. All network communication uses TLS encryption to protect it in transit. The Service Provider leverages the encryption tools included in public cloud data stores to encrypt data at rest.
- Policies and Compliance
- The Service Provider is committed to protecting Users’ information. While the Service Provider has not undergone a 3rd party security audit for SOC-2 or ISO27001, 27018, it holds to the security controls present in those frameworks and has chosen cloud hosting providers that are SOC and ISO compliant.
- The Service Provider enables access to systems and infrastructure only to personnel who require access as part of their job responsibilities. Access removal processes are used to revoke access to personnel who no longer need it.
- The Service Provider enforces a password policy and a requirement for multi-factor authentication when available to protect its accounts.
- The Service Provider manages all of its infrastructure as code, allowing it to audit and peer review any changes and to provide a secure and automated process for applying these changes.
- The Service Provider complies with GDPR requirements for data breach notification standards. In the event of a security breach, the Service Provider will take actions to contain, investigate and mitigate the breach. The Service Provider will notify the Client in the event of a breach in writing within 72 hours of a breach being confirmed.
- A security incident with no repercussions will not be subject to notification, i.e. that results in no unauthorised access to Personal Data or to any equipment or facilities storing Personal Data, and may include, without limitation, pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorised access to traffic data that does not result in access beyond headers) or similar incidents.
- Regular Security Updates and Audits
- The Service Provider commits to regular security reviews and updates of the Services to address evolving cyber threats and technology advancements. This includes, but is not limited to, updates to encryption standards, access controls, and threat detection mechanisms.
- The Service Provider shall conduct annual or bi-annual third-party security audits to verify the effectiveness of the implemented security measures and identify areas for improvement. The findings of these audits will be used to inform and guide subsequent security enhancements.
- Training and Security Awareness Programs
- The Service Provider shall implement ongoing training programs for all employees, focusing on cybersecurity best practices, emerging threats, and the importance of data protection. This training will be updated regularly to reflect the latest security trends and threats.
- The Service Provider will foster a culture of security awareness through regular communications, updates, and workshops. This includes ensuring that all employees are aware of their roles and responsibilities in maintaining platform security and data protection.
SERVICE LEVEL AGREEMENT
This “Service Level Agreement” is an integral part of the provision of services by the Service Provider to the Client in accordance with the main Agreement. The capitalised terms used in this Service Level Agreement shall have the meaning assigned to them in the main Agreement.
- Scope and Subject
- The Service Provider undertakes to provide the Client with the following ancillary services regarding the Services:
- Availability;
- Incident Management;
- Support;
- Maintenance and Updates.
- The Service Provider undertakes to provide the Client with the following ancillary services regarding the Services:
- Availability
- The Service Provider shall ensure that the Services are available at least 99% of the total time. The Services availability is calculated as the cumulative availability of all requests of the Services, by taking into account successful requests divided by total requests in a calendar month (excluding time spent under maintenance) (the Availability).
- Service Credits
- In the event that the Service Provider fails to meet the Availability, Service Credits will be granted to the Client at the latter’s request.
- The following sums shall be credited to the Client if the Service Provider fails to meet the following availability criteria (the Service Credits):
- if below 99% availability – 5% of the monthly fee;
- if below 95% availability – 10% of the monthly fee;
- if below 90% availability – 15% of the monthly fee.
- The Service Credits are not cash refunds but are instead applied to the next month’s invoice issued to the Client for payment of the Fee.
- To be eligible for Service Credits, the Client must notify the Service Provider of its intent to claim such Service Credits within fifteen (15) days following the end of the calendar month during which the Client first became entitled to the Service Credit. Failure to comply with this notification requirement within the specified timeframe will result in the Client forfeiting the right to receive the Service Credit for that particular incident.
- This Section 3 states the entire liability of the Service Provider and the Client’s sole and exclusive remedies regarding the Availability.
- Maintenance and Scheduled Interruptions
- The Service Provider shall maintain the Services and its availability during the term of the Agreement.
- The Service Provider shall maintain the Solution in a cloud server. The maintenance costs are borne by the Client as part of the Fee.
- The Service Provider shall notify the Client in advance of planned interruptions to improve the functionality, add new features, solve errors, or otherwise improve the operation of the Services.
- Incident Management
- The Service Provider provides an incident management service to the Client (the Incident Management), which is differentiated based on incidents occurring within or outside of working time:
Priority
Severity
Description
Time To Own
Rectification of error
Time To Resolve
Process
09:00-17:00 (EET)
1
Blocking
1) Usage completely blocked for all
2) Major business-critical functions unavailable for all
30 minutes
Continuously during support hours until:
The problem is solved or degraded to a lower severity.
2 hours
Manual
2
Critical
1) Critical function with a major impact on usage
2) Completely blocked usage for a moderate number of users
3) Critical error but workaround available
2 hours
Continuously during support hours until:
The problem is solved or degraded to a lower severity.
24 hours
Manual
3
Normal (default)
1) Malfunction is minor; not critical
2) Minimal number of users affected and/or not in a significant way
8 hours
Continuously during support hours until:
The problem is solved or degraded to a lower severity.
120 hours
Manual
4
Trivial
Cosmetic
40 hours
The Developer will provide the resolution with the next update, if feasible.
n/a
Manual
Stand by, on request 24/7/365
1
Blocking
1) Usage completely blocked for all
2) Major business critical functions unavailable for all
30 minutes
Continuously 24/7/365 until degraded to a lower severity.
2 hours
Manual
- If the Client discovers any errors in the Services, the designated persons of the Client shall inform the Service Provider, providing at least the following information:
- time of occurrence;
- detailed description of the error (with pictures), log extract, relevant technical identifiers;
- description of activities performed immediately prior to the error occurring.
- The Service Provider shall use all commercially reasonable efforts to respond to the Client’s error reports in accordance with the above response times.
- In the event that the Service Provider fails to meet the targets outlined in Section 1, the Client shall be entitled to compensation based on the incident severity:
- Blocking – 20% of the monthly fee;
- Critical – 15% of the monthly fee;
- Normal – 10% of the monthly fee;
- Trivial – no credit.
- The maximum limit on the compensation that the Client can accrue in a given month is 50%.
- To claim the compensation, the Client has to submit a notification to the Service Provider, detailing the percentage of compensation the Client is eligible for the calendar month.
- The compensation for Incident Management is not a cash refund but is instead applied to the next invoice for payment of the Fee issued to the Client.
- This Section 5 provides the entire liability of the Service Provider and the Client’s sole and exclusive remedies regarding the Incident Management.
- Support
- The Client may require support from the Service Provider from time to time (the Support) such as:
- manned telephone support;
- monitored email support;
- proactive real-time monitoring of the software;
- remote assistance in the event of system failure;
- software troubleshooting.
- Fees for these Support services, if any, are detailed on the Service Provider’s website.
- The Client may require support from the Service Provider from time to time (the Support) such as:
- Final Provisions
- The terms and conditions of the main Agreement shall apply to this Service Level Agreement accordingly.
- In the event of any discrepancy between the provisions of this Service Level Agreement and the main Agreement, the provisions of this Service Level Agreement shall prevail.
- Maintenance and Scheduled Interruptions
TECHNICAL AND ORGANISATIONAL MEASURES
This “Technical and Organisational Measures” is an integral part of the provision of services by the Service Provider to the Client in accordance with the main Agreement. The capitalised terms shall have the meaning assigned to them in the main Agreement.
- Overview
- The following Technical and Organisational Measures are being provided in compliance with Article 32(1) of the GDPR. The Service Provider maintains its production environment with Web Services and, as such, it relies in large part on the technical security measures adopted by Web Services. All physical security controls are managed by the cloud hosting providers the Service Provider uses. To the extent that the Service Provider processes Personal Data outside the Web Services system, the following technical and organisational measures have been implemented with respect to the Personal Data. The structure of the content below is derived from Article 32(1) of the GDPR.
- Pseudonymisation and Encryption
- Client Data is encrypted both at rest and in transit. The Service Provider uses TLS encryption to protect the data in transit and leverages industry-standard encryption tools to encrypt data at rest.
- The Service Provider employs automatically activated Confidentiality
- The Service Provider has access controls designed to manage access to Client Data and system functionality based on authority levels and job functions. Documented access removal processes are utilised to revoke access of personnel who no longer need it.
- The Service Provider enforces password policies and requires multi-factor authentication when available to protect its accounts.
- All personnel laptops are encrypted and password protected enforced through a centralised endpoint protection solution that enforces best practices on devices. The Service Provider employs automatically activated and password-protected computer-locking solutions.
- The Service Provider protects user login against a number of attack vectors including brute force attacks by utilising industry-standard third-party services. Passwords are cryptographically hashed and salted based on industry best practices by its authorisation provider and user authorisation tokens to manage connections to the Services.
- The Service Provider has implemented procedures and rules for the safe and permanent destruction of data that is redundant.
- The Service Provider logs and monitors activity on its system. The Service Provider actively stores these logs from such systems and analyses them for unusual activity. Processes are in place to alert the dedicated security team of any suspicious activity for review.
- Integrity
- The deployment of the Services is entirely automated and changes to both infrastructure and code are subject to automated testing using the Continuous Integration (CI) tool before being released to production.
- The infrastructure is provisioned via code solutions, enabling consistent, reliable, and secure deployments of cloud infrastructure.
- Changes to the Services are reviewed by peers, and such code reviews are designed to ensure the security, performance, and quality of code released to production.
- The Service Provider engages an independent organisation to assess the security of the Services, which is reviewed no less than once every 6 months.
- Availability and Resilience
- The Service Provider leverages fully managed services to deliver the Services is responsible for administering and patching their service.
- All Client Data is stored in Cloud storage services and is backed up on at least on a daily basis.
- The Service Provider has a written Business Continuity and Disaster Recovery Plan setting forth processes to restore the Services.
- Processes of Regular Testing, Assessing and Evaluating the Effectiveness of Technical and Organisational Measures for Ensuring the Security of the Processing
- The Service Provider regularly reviews data privacy measures.
- The Service Provider has a dedicated security team that works with all teams to provide security in all aspects of the Services.
- All members of the team (including both full-time employees and independent contractors) are required to comply with internal security policies and practices, including but not limited to, an Information Security Incident Management Policy, and Information Security Policy and Standards – Data Encryption Policy, an Acceptable Use Policy, an Email Policy and a Data Classification and Access Control Policy.
- The Service Provider performs regular penetration test audits with a contracted third party.