Terms & Conditions

1.0

—

Last edited on

July 17, 2024

TERMS OF SALE FOR ON PREMISE / SAAS SUBSCRIPTION OF EGERIE RISK MANAGER AND EGERIE PRIVACY MANAGER

These Terms of Sale (hereafter “Terms of Sale” or “TS”) of the EGERIE Risk Manager Software and/or the EGERIE Privacy Manager Software apply to any order for a right to use the Software and any supply of Services by the company EGERIE SOFTWARE, a simplified joint stock company [société par actions simplifiée] with a registered capital of 388,967.50 euros, having its registered office in Toulon at 44 boulevard de Strasbourg, registered with the Toulon Trade and Companies Register under number 817 640 998, represented by its President (hereinafter referred to as the “Publisher” or “EGERIE”).

ARTICLE 1. PURPOSE

These TS establish the contractual conditions exclusively applicable to any Contract concerning the order of a right to use the Software and/or Services by a Buyer, whether the Buyer is an Authorised Partner or a Customer who concludes a deal directly with the Publisher.

The Buyer acknowledges that these TS take precedence over all other documents such as prospectuses, catalogues, documentation emanating from EGERIE, which are provided for information purposes only and have only an indicative value, and over any document emanating from the Buyer, such as, in particular, purchase orders or general terms and conditions of purchase not expressly accepted by EGERIE.

When the Buyer is an Authorised Partner who endorses the Purchase Order or the accepted quote in order to make the Software and Services available to a Client, the Authorised Partner accepts these Terms of Sale and, where applicable, the conditions communicated by the Publisher for making the Software and Services available to the Client. The Purchase Order or Accepted Quote must indicate the Client’s identity and contact details. In any event, the Authorised Partner undertakes to make the Terms of Use enforceable against the Client and to ensure that the Client accepts them before forwarding the Purchase Order to the Publisher. The Approved Partner may not commit EGERIE in relation to the Client beyond the limits and guarantees provided for in the Terms of Sale and the Terms of Use.

Acceptance of the Quote or the sending of a Purchase Order constitutes acceptance of these Terms of Sale by the Buyer and of the Terms of Use by the Customer.

ARTICLE 2. DEFINITIONS

In these Terms of Use, the terms below used with a capital letter, in the singular or plural, will have the following meaning:

- Buyer: means the legal entity which accepts these Terms of Sale by sending a Purchase Order, namely the Customer in the case of a subscription taken out directly with EGERIE or the Approved Partner.

Purchase Order or Accepted Quote: means any document or exchange stipulating the details of the right to use the Software and Services accepted by EGERIE and the Buyer.
Delivery note: means the document issued by the Publisher recalling all the characteristics of the order made by the Buyer, such as the number of Users, with the exception of the price.
Conditions of Use: conditions of use of the Software provided by EGERIE or the Approved Partner, which the Customer undertakes to accept in order to benefit from access to the Software and Services.
Contract: means these Terms of Sale as well as any document annexed thereto, in particular the Purchase Order or Accepted Quote.
Documentation: means the technical and functional manuals and all information relating to the Software, accessible and updated on the MyEgerie Portal of the Customer or the Approved Partner and/or provided by EGERIE.
Upgrade: means the functional and/or technical upgrade of the Software, as provided by regular updates, identified by the passage from one minor version to the next (the minor version number being identified by the second digit of the version number (Y for a version named x.Yz)) or from one revision of a minor version to the next (the number of a revision being identified by the third digit of the version number (Z for a version named x.yZ)). The term Upgrade does not include Major Versions and new modules.

⁃ Customer: means the legal entity having accepted the Terms of Use and benefiting from the right to use the Software and Services.

Software: refers to the EGERIE Risk Manager and/or EGERIE Privacy Manager software and all the related object code programs, in the version provided for in the Purchase Order or accepted Quote, including the Upgrades as defined above, as well as the related Documentation.
Approved Partner: means the company approved by the Publisher that promotes and markets the right to use the Software and Services to a Customer.

MyEGERIE Portal: means the Publisher's portal giving the Customer or Authorised Partner access to a dedicated area.
Service(s): means all the services associated with the Software provided by EGERIE or an Approved Partner, such as support and maintenance services which may or may not be included in the subscription for the right to use the Software in accordance with what is specified in the Purchase Order or Accepted Quote and the Additional Services.
Additional Service(s): means the services provided by the Authorised Partner or the Publisher not included in the right to use the Software, specifically provided for in the Purchase Order or accepted Quote.
User: means any natural person (such as an employee, subcontractor or consultant of the Licensee) using the Software under the responsibility of the Licensee in accordance with the provisions of the Contract. The Licensee is responsible for the Users' compliance with the Terms of Use and remains solely liable to the Publisher for any breach of the Terms of Use by a User.
Major Version: means a version of the Software launched on the market by the Publisher, including a set of computer programs identified by the version number (the major version number being identified by the first digit of the version number (X for a version named X.yz)). The notion of Major Version does not include new modules.

The notions that are not defined in these Terms of Sale are defined in the Terms of Use, which the Buyer undertakes to read.

ARTICLE 3. CHARACTERISTICS OF THE SOFTWARE AND SERVICES

These Terms of Sale relate to the subscription of a right of access and, where applicable, installation of the Software, for a period specified in the Purchase Order or Accepted Quote.

The Software may be made available to the Customer:

Either by making a downloadable copy of the Software available for local installation at the Customer's premises (On Premise), including (i) access to Upgrades and new Major Versions of the Software and (ii) support and maintenance services as defined in the Terms of Use.
Or by making the Software available as an application which is accessible remotely by the Customer via the Internet (SaaS (Software as a Service)), including (i) access to the Software, (ii) hosting of the Software and data, (iii) access to the Upgrades and new Major Versions of the Software and (iv) support and maintenance services as defined in the Terms of Use.

The characteristics of the right to use the Software and/or the Services appear on the Purchase Order or Accepted Quote. This includes, without this list being exhaustive, the number and types of licenses subscribed to, the number of Users, the modules, the price as well as the description of the Services subscribed to by the Buyer.

The Buyer is informed that the Software programs are standard products that have not been specifically designed for the Buyer. The Buyer has chosen the Software with full knowledge of the facts and according to its needs, its business constraints and its technical environment, with regard to the Documentation and the information received from the Publisher. The Buyer acknowledges that it has received all the necessary information from the Publisher enabling it to assess the suitability of the Software and Services for its needs and to take all appropriate precautions for their use.

Unless specifically ordered as Additional Services, the Contract does not include setup, configuration, installation support, adaptation or training in the use of the Software or the services for integrating the Measurement Software, which must be expressly ordered and accepted by the Publisher as Additional Services.

The rights of use, and where applicable, installation, granted to the Customer as well as the terms and conditions for the provision of the Services, the guarantees associated with the Software and Services and the duration of the Contract are detailed in the Terms of Use.

ARTICLE 4. ACCESS TO THE SOFTWARE

After receipt of the Accepted Quote or Purchase Order by the Publisher, the Publisher makes the Software available in accordance with the provisions of the Terms of Use.

The Buyer shall send the additional technical and organisational information necessary for the provision and use of the Software, such as the attributions and roles of the Users and, where applicable, the Customer's capacity requirements (CPU, network, RAM, disk storage, backups, personnel, etc.).

The Buyer has a period of ten (10) days from the issue of the Delivery Order to dispute access to the Software, concerning the number of licenses or Users or any other element of the order. In the absence of any dispute, the Software shall be deemed to be made available in accordance with the order.

ARTICLE 5. PRICE

The rights to install and use the Software and the Services are provided at the rates indicated in the quote communicated to the Buyer, in euros, excluding taxes, and must be increased by the amount of the taxes and duties in force on the date of invoicing.

Payment of the price constitutes the consideration for the supply of the rights to use the Software and Services mentioned on the Purchase Order or Accepted Quote. The Buyer pays the Publisher the amount appearing on the Purchase Order or Accepted Quote at the indicated intervals.

Any potential price reduction will be indicated on the Purchase Order or Accepted Quote.

ARTICLE 6. TERMS OF INVOICING

The rights to use the Software and Services will be invoiced in accordance with the Purchase Order or Accepted Quote and the Terms of Use.

In the event of an order concerning several Software programs and/or Services, each order may be subject to partial invoicing, relating to each Software program and/or Service.

ARTICLE 7. TERMS OF PAYMENT

The Publisher's invoices will be paid by the Buyer by bank transfer or credit card.

Unless otherwise agreed between the Parties and shown on the Purchase Order or Accepted Quote, payment shall be made within 45 days from the date of issue of the invoice.

ARTICLE 8. PRICE REVISION

Beyond a period of one (1) year from the date of entry into force of this Contract, and in the event of renewal, the price may be revised at the request of the Publisher, subject to notification of the Buyer at least thirty

days before the expiry date, but may not exceed the increase resulting from the application of the following formula: P = Po x S / So where:

P = price after revision.

Po = initial price for the first revision, then price from the previous revision for subsequent revisions.

S = most recent Syntec index published on the price revision date.

So = value of the Syntec index in force on the date of entry into force of the Contract for the first revision, then value of the Syntec index on the day of the previous revision for subsequent revisions.

In the event of the disappearance of the aforementioned index, the Parties shall agree on the new index for the purpose of establishing a formula with a comparable effect.

ARTICLE 9. LATE PENALTIES AND SUSPENSION OF THE CONTRACT

Without prejudice to all other rights and remedies, partial or total non-payment of any sum due will have the effect, from that date, of allowing the Publisher to suspend its obligation to make the Software available or to provide the Services until such time as full payment of the sums due has been made. Beyond a delay in payment of thirty (30) days from a due date, the Publisher may automatically terminate the Contract for the fault of the Buyer. The sums already paid by the Buyer shall remain the property of the Publisher.

In addition, the Publisher may charge interest for late payment equal to three (3) times the legal interest rate without the need for a reminder or prior formal notice. This interest will be calculated, per day of delay, from the first day of delay until the day of full payment by the Buyer of all sums due to the Publisher. In application of Article L441-10 of the French Commercial Code, the Buyer shall also be automatically liable to pay a flat-rate indemnity of forty (40) euros (€) for collection costs incurred by the Publisher. Where applicable, when these costs exceed the amount of this indemnity, the Publisher may claim an additional indemnity from the Buyer, upon presentation of supporting documents specifying the steps taken. These indemnities will not be applied in cases where the Buyer can prove that he is the subject of receivership or liquidation proceedings. All the costs of unpaid debts following a bank’s refusal of a payment by the Buyer will remain at the Buyer's financial expense.

Furthermore, the Buyer’s failure to pay an invoice that has come due will entitle the Publisher to demand payment of all other invoices, including those that are not yet overdue.

The Publisher reserves the right to decide how partial payments made by the Buyer will be off-set against the sums due to the Publisher.

The Buyer shall not off-set any sums that may be owed to it by the Publisher under this Contract, or any other contract that may exist between the parties, without the prior written consent of the Publisher.

ARTICLE 10. MISCELLANEOUS

30.1.Non solicitation of personnel

The Buyer expressly waives, during the performance of this Contract and for two (2) years following its term, for any reason whatsoever, to hire or cause to work,

either directly or indirectly through an intermediary, any of the Publisher's employees who have participate in the performance of the Contract, regardless of their specialisation. Any failure to comply with this obligation shall expose the Buyer to immediately paying the Publisher an indemnity equal to the gross earnings of the last eighteen (18) months of the person concerned, plus employer's charges, without prejudice to damages and interest.

30.2.Independence of the parties

Each Party is a legal entity, legally and financially independent of the other, acting in its own name and under its sole responsibility. The Contract constitutes neither an association nor a mandate given by one of the Parties to the other. Each Party shall therefore refrain from entering into a commitment in the name and on behalf of the other Party, for which it can in no way substitute itself.

30.3.Force Majeure

Neither of the Parties may be held liable for a breach of any of its obligations under the Contract resulting from the occurrence of a case of force majeure, provided, however, that:

The Party invoking such a case notifies the other Party of its existence as soon as possible,
It does everything necessary to limit the consequences, and
It resumes the execution of the Contract immediately after this case of force majeure has disappeared.

The case of force majeure suspends the obligations arising from the Contract for the entire duration of its existence, except for those obligations that can reasonably be interpreted as surviving the suspension. However, if it lasts for more than fifteen (15) consecutive days, it shall entitle either of the Parties to automatically terminate the Contract.

This termination shall be effective fifteen (15) days after receipt by the other party of a registered letter with acknowledgement of receipt giving notice of the termination and without either party being able to claim any compensation or damages.

For the application of this Contract, the following events in particular are included in the definition of force majeure: Breakdowns or failure of the hosting company; Electrical power failure, fire, flood, natural disaster; Strike; War; Epidemic; Attacks; Uprising; Demonstration.

30.4.Titles

The titles are only intended to facilitate the reading of the contractual documents. If the title of a paragraph or clause of a contractual document impedes the understanding of the text, only the text of the paragraph or clause in question will be taken into account and not its title.

30.5.No waiver

The fact that one of the Parties does not take advantage of a breach by the other Party of any of the obligations referred to herein shall not be interpreted in the future as a waiver of the obligation in question.

30.6.Nullity and independence of clauses

The possible annulment of one or more of the clauses herein, by a court decision, an arbitration award or by mutual agreement between the Parties, shall not affect their other stipulations, which shall continue to produce their full and complete effect provided that the general scheme of the agreement can be safeguarded.

30.7.Applicable law, jurisdiction

Any dispute arising from the Contract or the interpretation of its clauses is subject to French law to the exclusion of the conflict of laws rules. In the event of a dispute, and after an attempt has been made to find an amicable solution within a period of thirty (30) days, any dispute relating to the interpretation and performance of the Contract shall be submitted to the court having subject matter jurisdiction within whose geographical jurisdiction the registered office of the Publisher is located, to which the parties attribute territorial jurisdiction regardless of the place of performance and the registered office of the defendant.

TERMS OF USE FOR SAAS MODE SUBSCRIPTION TO EGERIE RISK MANAGER AND EGERIE PRIVACY MANAGER

These Terms of Use of the EGERIE Risk Manager Software and/or the EGERIE Privacy Manager Software (hereinafter referred to as the “Software”) apply to all provisions of the Software in SaaS mode by the EGERIE SOFTWARE company, a simplified joint-stock company [Société par actions simplifiée] with a registered capital of 388,967.50 euros, having its registered office in Toulon at 44 boulevard de Strasbourg, registered with the Trade and Companies Register of Toulon, under the number 817 640 998, represented by its President (hereafter referred to as the “Publisher” or “EGERIE”).

These Terms of Use apply in the event of subscription to the right to use the Software and/or the provision of Services directly with EGERIE or through an Approved Partner.

ARTICLE 1. PURPOSE

The purpose of these Terms of Use is to define the terms and conditions for the provision of the Software and Services by the Publisher and the terms and conditions for non-exclusive access and use by the Customer. This Contract, which is not exclusive, was negotiated in good faith between the Parties. The right granted is a subscription in “SaaS” mode conferring only a right to remote use of the Software in the territory where the Users are located, without authorisation for sub-licensing.

The EGERIE Risk Manager Software is a computer software package which makes it possible, in particular, to assess, map and manage the risks and “privacy” impact studies relating to information systems and which provides the following results: modelling of information systems, list of identified risks, estimation of risk levels, list of selected treatments, list of measures programmed within the framework of risk treatments based on a proprietary principle of arbitration clarified by the measures (cost vs. percentage of transversal risk reduction), multi-conformity (conformity of a measure to the requirements of several standards), definition of metrics, editing of reports. The software offers various proprietary calculation elements: calculation of risk reduction, sigma score calculation, calculation and representation of risk exposure (programmed reduction, residual reduction, active reduction).

The EGERIE Privacy Manager Software is a computer software whose function is, in particular, to create, manage and edit processing sheets and registers of personal data, to verify the conformity of the processing operation with best legal and security practices (as well as the multi-conformity of a measure with the requirements of several standards) and to pre-evaluate the “privacy” risk of each processing operation.

We would like to remind you that the Software is not a tool for detecting and treating risks in real time, but that it offers an analysis based on the data entered or imported by the Customer. The Software is a decision-making aid and the decision is and remains the sole responsibility of the Customer.

The Customer hereby acknowledges that they have read the technical and functional information of the Software and Services. The Customer acknowledges that the Software, know-how and Services of EGERIE as well as their developments – including any developments that may be suggested by the Customer or its Users and implemented by EGERIE – are subject to legal protection, in particular with regard to intellectual property rights. As such, the Publisher retains all intellectual property rights over all copyrighted or copyrightable elements relating to the Software and Services.

Likewise, the Customer remains the owner of all rights to its own data and products.

ARTICLE 2. DEFINITIONS

In these Terms of Use, the terms below used with a capital letter, in the singular or plural, will have the following meaning:

Anomaly: means any incident, defect, malfunction or non-conformity of the Software's functionalities in relation to the Documentation, reproducible by the Customer and verified by the Publisher, which prevents the normal operation of all or part of the Software or which causes an incorrect result or inappropriate processing operation when the Software is used in accordance with its Documentation and for its intended purpose.
Blocking Anomaly: means an Anomaly that renders the Software or one of its essential functions totally unavailable.
Non-Blocking Anomaly: means any Anomaly that affects the operation of the Software but does not constitute a Blocking Anomaly or a Semi-Blocking Anomaly.
Semi-Blocking Anomaly: means any Anomaly allowing only partial use of the Software's functions.
Purchase Order or Accepted Quote: means any document or exchange stipulating the details of the right to use the Software and Services accepted by EGERIE (or the Approved Partner) and the Customer;
Delivery note: means the document issued by the Publisher recalling all the characteristics of the order made by the Customer, such as the number of Users, with the exception of the price.
Customer: means the legal entity having accepted the Terms of Use and having acquired the right to use the Software in SaaS mode.
Special Conditions: means the information contained in the Order Form or any other document expressly accepted by the Parties concerning the right to use the Software or the Services.
Terms of Use: means these terms and conditions.
Terms of Sale: means the Publisher's terms applicable to any order for the right to use the Software and/or Services by the Customer, appended to the Order Form, applicable when the Customer enters into a direct agreement with the Publisher.
Contract: means these Terms of Use, including their appendices, the Delivery Note and the Special Conditions or Purchase Order or Accepted Quote.
Documentation: means the technical and functional manuals and all information relating to the Software accessible and updated on the Customer's MyEGERIE Portal and/or provided by EGERIE.
Customer Data: means the information (including Personal Data) owned by the Customer and/or for which they are responsible, which the Customer enters, fills in, transmits, collects, stores and/or processes and, where applicable, communicates to EGERIE within the context of the Support and the use of the Software and the MyEGERIE Portal.
Personal data: means the personal data that the Customer processes in their capacity as data controller and that EGERIE is likely to process in its capacity as data processor, within the meaning of Law No. 78-17 of 6 January 1978, as amended, known as the law on “Information Technology, Data Files, and Civil Liberties” (French Data Protection Act) 2016/679 of the European Parliament and of the Council of 27 April 2016 (known as the “GDPR”), this set of regulations being referred to hereinafter as the “Applicable Regulations”.
Upgrade: means the functional and/or technical upgrade of the Software, as provided by regular updates, identified by the passage from one minor version to the next (the minor version number being identified by the second digit of the version number (Y for a version named x.Yz)) or from one revision of a minor version to the next (the number of a revision being identified by the third digit of the version number (Z for a version named x.yZ)). The term Upgrade does not include Major Versions and new modules.
Working day: means a day between Monday and Friday which is not a public holiday in mainland France.
Software: refers to the EGERIE Risk Manager and/or EGERIE Privacy Manager software and all the related object code programs, in the version provided for in the Purchase Order or Accepted Quote, including the Upgrades as defined above, as well as the related Documentation.
Maintenance: means all the services and actions provided by the Publisher with a view to the continuous operation, the revision and improvement of the Software, described in Appendix 1.
Approved Partner: means the company approved by the Publisher that promotes and markets the right to use the Software and Services to a Customer.
MyEGERIE Portal: means the space made available to the Customer by the Publisher.
Service(s): means all the services associated with the Software provided by EGERIE or an Approved Partner, such as Support and Maintenance services which are included in the subscription for the right to use the Software and the Additional Services expressly provided for in the Purchase Order or accepted Quote.
Additional Service(s): means the services provided by the Authorised Partner or the Publisher not included in the right to use the Software, specifically provided for in the Purchase Order or accepted Quote.
Support: means all the technical or functional services provided by the Publisher or its Authorised Partner following a support request described in Appendix 1.
User: means any natural person (such as an employee, subcontractor or consultant of the Customer) using the Software under the responsibility of the Customer in accordance with the provisions of the Contract. The Customer is responsible for the Users' compliance with the Terms of Use and remains solely liable to the Publisher for any breach of the Terms of Use by a User.
Designated User: means any natural person using the MyEGERIE Portal and the Support service described in writing to EGERIE at the time of the order.
Major Version: means a version of the Software launched on the market by the Publisher, including a set of computer programs identified by the version number (the major version number being identified by the first digit of the version number (X for a version named X.yz)). The notion of Major Version does not include new modules.

ARTICLE 3. HIERARCHICAL ORDER OF CONTRACTUAL DOCUMENTS

In the event of a contradiction between one and/or more provisions contained in any of these documents, the higher-ranked document shall prevail.

ARTICLE 4. ENTRY INTO FORCE – DURATION – RENEWAL

The Contract comes into force upon the acceptance of the Purchase Order or any document or exchange materialising the order placed with the Publisher by the Customer, or where applicable, the Authorised Partner.

Unless otherwise stipulated in the Purchase Order or Accepted Quote, the Contract will be renewed by tacit agreement for a period of 12 months, without the total duration of the Contract exceeding 5 years unless the Customer gives notice of termination by registered letter with acknowledgement of receipt three (3) months before the end of the current period. However, the right to use this solution shall terminate under the terms of the legal copyright period”.

The Customer has a period of ten (10) days from the issue of the Delivery Order to dispute access to the Software, concerning the number of licenses or users or any other element of the order. In the absence of any dispute, the Software shall be deemed to be made available in accordance with the order.

At the end of the initial term, unless otherwise stated in the Purchase Order or Accepted Quote, the Contract may only be renewed by written agreement of both Parties.

The Customer undertakes to pay the Publisher or its Authorised Partner in accordance with the applicable terms of sale.

ARTICLE 5. RIGHTS AND LIMITATIONS OF SOFTWARE USE, INTELLECTUAL PROPERTY

The Contract grants the Customer the right to access and use the Software remotely via the Internet for a specified period of time, including:

Access to the Software,
Hosting of the Software and Customer Data,
Access to Software Upgrades and Major Versions
The Support and Maintenance services provided for in this Contract, and
Where applicable, the Additional Services appearing in the Order Form or Accepted Quote.

The right to access and use the Software, granted under the Contract and for its duration, allows the Customer to use the Software in accordance with its purpose and the Documentation, and for his own needs. The number of Users is indicated in the Delivery Note.

In the event that the Customer wishes to modify the terms of the rights of use subscribed to as specified in the Delivery Note (number of Users, subscription to a new module, etc.), it shall notify the Publisher or the Authorised Partner in writing. The latter will propose a new quote which must be accepted before the requests are actually updated.

Apart from, and without prejudice to, the rights granted in this Contract, the Customer is not authorised hereunder to:

Copy, print, transfer, forward or display all or part of the Software;
Permanently or temporarily reproduce the Software in whole or in part, by any means and in any form;
Sell, rent, sub-license, distribute or make the Software available to third parties in any way whatsoever;
Modify the Software and/or merge all or part of the Software into other computer programs without prior authorisation from the Publisher;
Intervene or have a third party intervene on the Software, in particular for maintenance purposes;
Compile, decompile, disassemble, translate, analyse, reverse engineer or attempt to reverse engineer the Software, except to the extent permitted by law;
Carry out any processing or IT services whatsoever for third parties using the Software, in particular contract work.

It is specified that the Publisher reserves the right to correct any errors that the Software may contain.

The Customer and the Users shall refrain from damaging the Software in any way whatsoever, and in particular from using the Software in a manner that is not in accordance with its intended purpose and the conditions set forth in the Contract.

These Terms of Use only grant the Customer a right of use and do not grant the Customer any property rights relating to the Software, its technology or the intellectual property rights held by the Publisher.

The Customer agrees that nothing in this Contract shall confer upon it any right, title or interest in the Publisher's distinctive signs.

ARTICLE 6. OBLIGATIONS OF THE CUSTOMER

General Obligations of the Customer

The Customer undertakes to comply with the prerequisites communicated by EGERIE for the access and use of the Software.

The Customer:

Undertakes to use the Software only in accordance with its professional purpose and with its Documentation, and for the sole needs of its activity;
Is solely responsible for the content disseminated and/or downloaded and assumes full responsibility for the nature, content, accuracy, integrity and legality of the data processed, stored or transmitted within the context of using the Software, as well as for the exploitation thereof. In particular, given the intended use of the Software, the Customer shall refrain from sending or storing data of a non-professional nature and, more generally, data of an illicit, obscene, or defamatory nature or data that is illegal or in violation of the rights of a third party, of the protection of minors or of privacy;
Undertakes not to distribute the Software, make it available to third parties or rent it;
Undertakes not to alter or disrupt the integrity or execution of the Software or the data contained therein;
Undertakes not to attempt to obtain unauthorised access to the Software or the systems or networks associated with it.

In order to verify the integrity of the Software and compliance with this article, the Software generates requests to the MyEGERIE Portal. The anonymised and encrypted data obtained only enable the Publisher to compare the hashes with the associated access keys.

Use of the Software by the Customer

The Software will be used by the Customer under its sole control, direction and responsibility. The Customer guarantees compliance with this Contract by the Users.

Consequently, the Customer is responsible, in particular, for the following:

The implementation of all appropriate procedures and measures designed to protect workstations, hardware, software packages, software, passwords, in particular against viruses and intrusions;
The choice of access provider or telecommunications medium, the Customer must handle administrative requests and take out the necessary subscriptions, the cost of which it will bear;
The appointment, among its staff, of a privileged contact person for the Publisher acting as administrator for the Customer, and in particular as regards Support;
The use of the usernames or access codes given to him/her in connection with the performance of the Contract.

It will ensure that no one it has not authorised has access to the Software;

Errors committed by its personnel in the use of the Software and the procedures that enable it to connect to the Software, particularly concerning the means of Internet access and navigation.

The Publisher and the Customer declare that the technical information provided and used by the Software as well as that concerning the connections are deemed authentic between them until proven otherwise.

The Publisher shall bear no responsibility concerning the quality and electronic transmission of data when it uses telecommunications networks and more generally the quality and reliability of the telecommunications links between the Customer's workstations and the Software access point. Furthermore, the Publisher shall not be held liable for the accidental destruction of Customer Data by the Customer or a third party having accessed the Software through no fault of the Publisher.

The Customer's duty of care

Any use of Users' usernames and passwords is deemed to constitute use of the Software by the Customer, which the latter expressly acknowledges. The Customer remains responsible for its personnel at all times and is subject to an obligation to supervise it.

The Customer is solely responsible, in particular, for:

The content of the data, their compliance with applicable regulations, and more generally, any information that it deposits on the MyEGERIE Portal that it distributes or keeps on its behalf within the framework of the Contract;
Any possible fraudulent use of the username and/or password or any usurpation of the identity of one of the Users;
Depositing documents or libraries on the MyEGERIE Portal, such as risk analysis models to contribute to the enrichment of the shared resource base. It is the responsibility of the Customer to ensure their anonymisation and the absence of confidential, sensitive or strategic data in the documents made available;
Ensuring that Users have the necessary level of knowledge to use the Software;
Providing Users with the information necessary for the secure use of the Software, and in particular, the obligation to keep their access usernames and passwords strictly personal and confidential;
Notifying the Publisher of any modification or change likely to affect the operation of the Software.

User Administration

The Customer has the right to access and use the Software for the number of Users specified in the Delivery Note.

The creation of the initial “SuperAdministrator” account is the sole responsibility of the Publisher. The Publisher

creates this account and assigns it an initial password.

The management of the initial “SuperAdministrator” account is the sole responsibility of the Customer. The Customer undertakes to change the authenticator’s password, which was sent to it by the Publisher, as soon as it logs on for the first time.

The creation of the other accounts and the attribution of the associated rights are the responsibility of the Customer. It is the sole responsibility of the Customer and its Users to choose usernames and passwords that comply with best security practices. In general, the Customer assumes responsibility for the security of the usernames and passwords allowing access to the Software as well as the security of the individual workstations allowing access to the Software.

The Customer must ensure the non-disclosure of accounts and associated passwords to unauthorised persons. In the event that the Customer becomes aware of unauthorised access to the Software, the Customer shall inform the Publisher without delay and confirm this by registered letter. In the event of the loss of one of the usernames, the Customer will use the procedure set up by the Publisher to recover its usernames.

DATA

7.1.Data ownership

Each Party is and shall remain the owner of its own data. Each Party remains the sole owner of the know-how that it possesses independently of this Contract or that it acquires during the performance of this Contract and therefore remains free to use it. The Publisher shall therefore be free to perform similar services on behalf of other clients. Neither of the Parties may claim any right whatsoever over the know-how of the other Party.

They shall refrain from using, modifying, assigning or transferring to a third party, in whole or in part, whether in return for payment or free of charge, any data that may have been exchanged during the performance of the Contract for purposes other than its implementation.

In particular, the Customer shall refrain from using documents made available on the MyEGERIE Portal for commercial purposes.

The Publisher is prohibited from using, modifying, assigning or transferring to a third party, in whole or in part, whether in return for payment or free of charge, any data that may have been communicated to it by the Customer during the performance of the Contract, for purposes other than those of this Contract (including the operations necessary for the Publisher to prepare its invoices and statistics on use and to provide any explanation concerning the performance of the Support).

The Customer acknowledges that the Publisher may compile aggregated and anonymised statistical information and may make it public, provided that it does not identify the Customer's confidential information and does not include any Personal Data. The Publisher retains all intellectual property rights to the results of such statistical processing.

7.2.Location

Customer Data is hosted in France.

7.3.Protection of personal data

Within the meaning of the Applicable Regulations, in particular the GDPR, the Publisher acts as a data processor, solely on behalf and on the instructions of the Customer, who is qualified as the person responsible for the processing of Personal Data.

The obligations of the Publisher and the Customer, relating to the protection of personal data, are set out in Appendix 2.

7.4.Protection of strategic data

Strategic data corresponds to the non-personal data that is of particular importance to the Customer.

The Customer declares that the Customer Data does not contain any strategic data. Likewise, the Customer declares that it will not forward strategic data to the Publisher, including within the context of Support services.

The Publisher shall bear no responsibility in the event of the storage, loading or sharing of strategic data by the Customer.

7.5.Recovery of Customer Data

The Customer has the option to export its Customer Data in XML format and to store it via the Software.

The Publisher makes its best efforts to make regular data backups and to keep a copy of the Customer Data for the recovery of service. This being said, as the Software is not backup software, it is the Customer's responsibility to regularly export and back up its Customer Data. As such, it is important for the Customer to define a data backup and recovery strategy within its overall data security and management model. Whenever possible, the Publisher's data recovery service is a process to be used as a last resort only, when no other copy of the data is available.

In addition, the Customer is informed that the Customer Data will be deleted by the Publisher after a period of sixty

days from the date of termination of the Contract.

It is therefore up to the Customer to export or request the return of its Customer Data within that period, without additional charge.

The Publisher may propose the restitution of the Customer Data to the Customer at the Customer's request made by registered letter with acknowledgement of receipt to EGERIE. The Publisher will proceed with the restitution of the data thus required within five (5) working days.

Any restitution will be made in a format and on a medium that complies with the standards in use at the time of restitution. For example, the format in use is XML transmitted in an encrypted medium.

Under no circumstances does recovery confer any access, use or other rights to the Customer on the Software after the date of termination of the Contract.

OBLIGATIONS OF THE PUBLISHER

The Contract will be executed and in particular the Services will be provided in accordance with the provisions of Appendices 1 and 2, which describe the conditions of availability of the Software, the conditions of the Support services as well as the applicable provisions concerning the protection of Personal Data.

8.1.Provision of the Software

The Publisher sends the Delivery Note with a link enabling access the Software, as well as the usernames and access codes that enable access to the Software and MyEGERIE Portal via a dedicated access.

Access to the MyEGERIE Portal enables Designated Users to download and consult the Documentation (in particular the technical prerequisites and user manual of the Software), as well as all functional documents relating to the Software.

Under no circumstances may the Publisher be held liable in the event of a failure to make the Software available attributable to the Customer or in case of force majeure.

8.2.Credits

In the event that the Publisher does not comply with the availability rate agreed to in Appendix 1, the Publisher shall, after written notification from the Customer, grant a credit consisting of a free extension of the term of the Contract for a period corresponding to the period the Software was unavailable, to the exclusion of any other compensation.

The Customer shall notify the Publisher in writing within thirty (30) days following the last day of the month in which the availability rate was not reached. If the Customer does not notify the Publisher within the said period, the Customer is deemed to have waived the credit for the month concerned.

8.3.Exclusions

The following shall be excluded from the Contract: Works and interventions concerning the installation and proper functioning of the Customer's workstation, IT environment and infrastructure (telecommunications, networks, security equipment) enabling the Customer to access and use the Software, as well as services for modifying the Software to meet the Customer's needs. These services are not included in this Contract and may be the subject of Additional Services with specific pricing by the Publisher or the Authorised Partner.

COLLABORATION BETWEEN THE PARTIES

The proper performance of the Contract requires loyal, active and permanent collaboration between the Parties. Therefore, each of the Parties undertakes to:

Be actively involved in the fulfilment of its obligations;
Refrain from any behaviour which may affect and/or hinder the performance of the other Party;
Provide each other, in a timely manner, with all the information and documents necessary for the performance of the Contract.

The Parties shall meet as often as necessary to ensure the proper performance of the Contract and, in particular, to verify the proper performance of the Contract.

In addition, the Customer undertakes to maintain sufficiently competent, qualified and trained Users throughout the duration of the execution of these terms and conditions.

LIABILITY

The Publisher may under no circumstances be held liable for any indirect damage suffered by the Customer that may arise from or during the performance of this Contract and its consequences.

Indirect damage includes, but is not limited to, loss of profits or gains, loss of data other than that recorded in the software, loss of opportunity, commercial damages, the consequences of complaints or claims by third parties against the Customer, notwithstanding the fact that the Publisher would have been warned of the possibility of its occurrence.

With the exception of the provisions of the article relating to the hold harmless clause or in the event of gross negligence or wilful misconduct on the part of the Publisher, the liability of the latter, in the event of damage occurring to the Customer, for any reason whatsoever and whatever the legal basis invoked or retained, all combined and cumulative damages, shall be expressly limited and may under no circumstances exceed 75% of the sums actually collected over the current year.

The Publisher shall bear no responsibility in case of:

Use of the Software in a manner not provided for in the User Documentation or use not expressly authorised by these Terms of Use;

Modification of all or part of the functions or information accessible via the Software not carried out by the Publisher or by one of the Authorised Partners designated by the latter;
Use of all or part of the Software when the Publisher, following a problem or for any other reason whatsoever, had recommended that its use be suspended;
Use of the Software in an environment or configuration that does not comply with the Publisher's technical prerequisites, or in connection with programs or data from third parties not expressly approved by the Publisher;
Loss of Customer data following an intervention by the Publisher or a third-party Publisher appointed by the Customer or by the Publisher, where the Customer has not taken the precaution of backing up its data prior to this intervention when requested to do so in writing;
The occurrence of any damage resulting from the Customer's fault or negligence, or which the Customer could have avoided by asking for the Publisher's advice;
Use in connection with programs not supplied or endorsed by the Publisher and likely to affect the Customer's data;
Loss by the Customer of the usernames and passwords of the SuperAdministrator accounts,
Failure by the Users to save Customer Data;
Failure to download Upgrades made available by the Publisher;
Updates not recommended by the Publisher.

In light of the highly technical nature of the Software and the limitations of the state of the art, EGERIE cannot guarantee the fault-free or uninterrupted operation of the Software. EGERIE will intervene within the framework of an obligation of means and under the conditions provided for in these Terms of Use.

HOLD HARMLESS CLAUSE

The Publisher guarantees the Customer that it holds all the rights enabling it to enter into the Contract.

In this respect, the Publisher undertakes to defend the Customer at its own expense against any action for infringement of copyright or other intellectual property rights brought by a third party, and relating to the Software, provided that it has been notified immediately in writing by the Customer that the alleged infringement is not attributable to the Customer.

The Publisher shall have exclusive control over the manner of conducting the defence to the action and shall be free to settle or continue any proceedings of its choice. The Customer shall provide the Publisher with all the information, elements and assistance needed to enable it to carry out its defence or to reach a settlement agreement.

If all or part of the Software is acknowledged by a final court decision as constituting an infringement or if the Publisher considers that it is likely that the Software, in whole or in part, will be considered as infringing, the Publisher may either provide the Customer with non-infringing software having the same functions, or obtain the right for the Customer to continue to use and exploit said Software, or terminate the Contract and refund theamounts paid in advance by the Customer for the remaining period, with the amounts paid by the Customer for the use of the Software for the elapsed period being retained by the Publisher.

TERMINATION

The Contract may be terminated automatically and without formalities by one of the Parties in the event of a breach by the other Party of any of its obligations under the terms of the Contract, and in particular the obligations set out in Articles 5 to 8, 14, 15.1 and 15.5, if this breach is not remedied within thirty (30) days following receipt by the Party in breach of a registered letter with acknowledgement of receipt giving notification of this breach and without prejudice to any damages to which the Party having initiated the termination may be entitled.

In the event of termination of this contractual relationship for any reason whatsoever, the Customer undertakes to export its Customer Data or, at the Customer's written request, the Publisher undertakes to return to the Customer the Customer Data stored on its servers in connection with the use of the Software, in accordance with Article 7.5 of these Terms of Use.

In the event of termination of the Contract for any reason whatsoever or at the end of its term, the rights granted hereunder shall cease and the Customer shall cease using the Software. It must return to the Publisher, at its own expense, within thirty (30) days of the end of the contractual relationship, all the documents in its possession (information media, marketing materials etc.).

REFERENCES

The Customer grants the Publisher a non-exclusive worldwide license, free of charge and subject to sub-licensing, for the duration of this Contract, to use the Customer's distinctive signs as a reference on its commercial media (paper and electronic) for the purpose of promoting and marketing the Publisher's offer.

The Parties may mention their collaboration and use their contact details as a commercial reference. As such, the Parties expressly authorise themselves to link their respective websites by hypertext links.

CONFIDENTIALITY

For the purposes of this Contract, these Terms of Use, all information or data of any nature whatsoever, including technical, commercial, strategic, financial, economic, legal information in any form or medium whatsoever, which is received and/or exchanged between the Parties during the negotiation and/or performance of the Contract, shall be considered confidential information (hereinafter “Confidential Information”).

The Customer expressly agrees to consider as confidential the creations relating to the intellectual property rights or the elements of know-how belonging to EGERIE as well as all information forwarded to it within the framework of the Contract and in particular, without this list being exhaustive:

The User and Administrator documentation transferred by EGERIE,
The technical documentation of the Software,
Libraries of risk analysis or modelling examples,
The user interface and visual representations associated with risk modelling,
The original functions of the Software.

The Publisher expressly agrees to treat the Customer Data as confidential.

Confidential Information is not considered to be information that:

Is, as of the signature date of the Contract, publicly known, or which will become publicly known subsequently to the Contract, but, in any event, in the absence of any fault of the parties in its obligation of confidentiality;
Was in the lawful possession of the other Party prior to its disclosure and was not obtained by it directly or indirectly from the disclosing Party, and if that Party can prove such prior personal possession;
Is received from a third party in a lawful and unrestricted manner, the Parties acknowledge that any Confidential Information remains in any case the exclusive property of the party communicating it, and that its transmission does not confer any ownership or right of use over all or part of the content of the Confidential Information to the party receiving it.

In this respect, the Parties undertake within the framework of the Contract:

To use the Confidential Information only for the purposes of the Contract;
To take all necessary measures to protect the confidentiality of the Confidential Information;
To keep confidential and not to disclose or publish the Confidential Information – by any means whatsoever and for any purpose whatsoever directly or indirectly – to third parties to the contract to which they are parties, without the prior written authorisation of the party who communicated it, which the latter may refuse at its sole discretion.

Confidential Information may be communicated only to the Parties' employees, within the limit of what they need to know to perform their duties under this Contract. Each of the Parties concerned shall remain responsible for the latter's compliance with their obligations. Any breach of this obligation of confidentiality by one of the Parties shall entitle the other Party to automatically terminate these Terms of Use, subject to 30 days' notice, without the defaulting Party being entitled to claim compensation of any kind, and notwithstanding any damages to which the non-defaulting Party may be entitled.

Notwithstanding the foregoing, each party concerned may disclose the Confidential Information, to the extent that such disclosure has been imposed by the application of a mandatory legal or regulatory provision or by the application of a court decision. In this case, the disclosing party must inform the other party.

This obligation of confidentiality applies for the entire duration of this Contract, and survives the end of the contractual relationship, regardless of the cause, for a period of 5 years or, if this period is longer, as long as the Confidential Information has not come into the public domain.

Upon termination or expiration of this Contract, each party holding Confidential Information belonging to the other party agrees to destroy all copies and return the Confidential Information upon first request.

MISCELLANEOUS

Non solicitation of personnel

The Customer expressly waives, during the performance of this Contract and for two (2) years following its term, for any reason whatsoever, to hire or cause to work, either directly or indirectly through an intermediary, any of the Publisher's employees who have participated in the performance of the Contract, regardless of their specialisation. Any failure to comply with this obligation shall expose the Customer to immediately paying the Publisher an indemnity equal to the gross earnings of the last eighteen (18) months of the person concerned, plus employer's charges, without prejudice to damages and interest.

Independence of the parties

Each Party shall be a legally and financially independent legal entity, acting in its own name and under its sole responsibility. The Contract constitutes neither an association nor a mandate given by one of the Parties to the other. Each Party shall therefore refrain from entering into a commitment in the name and on behalf of the other Party, for which it can in no way substitute itself.

Force Majeure

Neither of the Parties may be held liable for a breach of any of its obligations under the Contract resulting from the occurrence of a case of force majeure, provided, however, that:

The Party invoking such a case notifies the other Party of its existence as soon as possible;
It does everything necessary to limit the consequences; and
It resumes the execution of the Contract immediately after this case of force majeure has disappeared.

The case of force majeure suspends the obligations arising from the Contract for the entire duration of its existence, with the exception of those obligations that may reasonably be interpreted as surviving the suspension, in particular the obligations of confidentiality and respect for the Publisher's property rights over the Software.

If the case of force majeure persists for more than fifteen (15) consecutive days, it shall give rise to the right to automatically terminate the Contract.

Amendments to the Contract

The Contract may only be modified or amended by means of a written amendment signed by a person duly authorised to represent each of the Parties.

Assignment of the contract

The Publisher reserves the right to transfer the rights and obligations of this Contract to any other person.

The Customer who wishes to assign the Contract, in particular in the event of restructuring or a change of control, undertakes to inform the Publisher in writing without delay and prior to the transaction of the terms and conditions of such assignment, and the Publisher reserves the right to object in the event of assignment, either directly or indirectly, to a competitor of the Publisher.

Titles

No waiver

Nullity and independence of clauses

Applicable law, jurisdiction

APPENDIX 1 SERVICE LEVEL AGREEMENT (SLA)

ARTICLE 1. DESCRIPTION OF THE SERVICES INCLUDED IN THE SUBSCRIPTION OF THE RIGHT OF USE IN SAAS MODE.

Maintenance

Maintenance refers to all the services and actions provided by the Publisher on its infrastructures, with a view to making the Software available on the basis of an uninterrupted connection 7 days a week and 24 hours a day under the conditions specified in Article 1.3, as well as the Software's ongoing maintenance services.

The Publisher reserves the right to make changes to the Software, but only with a view to its constant improvement.

The Customer automatically benefits from the Upgrades and new Major Versions, made available remotely. The Customer is responsible for downloading these Upgrades and new Major Versions.

Unless otherwise stated in the Purchase Order or Accepted Quote, the Contract does not include the new modules. These may be subject to specific pricing by the Publisher or the Authorised Partner.

Upon the release of any Upgrade or new Major Version of the Software, the Publisher undertakes to make the new User and Administrator documentation available to the Customer on the MyEGERIE Portal.

Support

As part of the Support services, the Publisher (or, where applicable, the Authorised Partner) undertakes to provide assistance to the designated Users and to take into account any Anomalies affecting the Software in order to remedy them.

Levels of support:

As regards Support services, the Publisher undertakes to implement three-levels of Support:

Level 1 support: this is the functional support that is exclusively handled by the Authorised Partner or the Publisher. The purpose of functional support is to assist the Customer, through the intermediary of the Designated Users, on issues relating to the use of the Software and its functions in accordance with its purpose. The support does not constitute training services, which are not included in the subscription, but only for the resolution of questions that cannot be resolved by reading the Documentation.
Level 2 Support: this is the technical support provided by the Publisher to take into account complex technical issues or Anomalies that do not require the modification of the Software's source codes.
Level 3 Support: this is the technical support provided by the Publisher to take into account complex technical issues or Anomalies requiring an Upgrade of the Software.

Purpose of and contact details for Support:

In this regard, the Designated User may make any request relating to a reproducible incident or complex technical issues encountered during use of the Software, as well as any anomaly that cannot be resolved by reading the Documentation:

By the Help Desk service available through the MyEGERIE Portal (an account is created at the request of the Customer's designated User);
By an e-mail sent to the address support@egerie-software.com;

– By telephone at +33(0) 494 638 105.

The User contacting the Publisher must be trained in the use of the Software.

Unless otherwise agreed, the Customer has only one (1) Designated User included in the agreement who can contact the Support team. It is possible to have more than one Designated User who can contact the Support team at the current rate. In the event of a change of contact person for the Customer's Designated User, the Customer may request the Publisher to reassign him/her during the term of the Contract.

The Support department is open from Monday to Friday 9am-6pm Paris time, excluding public holidays. The technical and commercial contacts of the Parties are documented before the Software is made available.

ARTICLE 2. TERMS AND CONDITIONS FOR PROVIDING SUPPORT

The grid below presents the contractual deadlines for taking into account and resolving Anomalies following the declaration of an Anomaly by the User according to the level of criticality of the Anomaly.

Anomaly

Guaranteed Intervention Time

Guaranteed Recovery Time

Blocking anomaly

0.5 business day

1 business day

Semi-blocking anomaly

1 business day

3 business days

Non-blocking anomaly

2 business days

5 business days

The classification of Anomalies as blocking, semi-blocking or non-blocking is carried out by the Publisher on the basis of the information provided by the Customer and the reproducibility of the Anomaly.

The Guaranteed Intervention Time (GIT) corresponds to the time between the declaration of the Anomaly and the first response given by the Publisher.

The Guaranteed Recovery Time (GRT) indicates the time required to provide the Customer with an Upgrade, if necessary, or any other solution that will restore the system to working order in accordance with the Documentation. The GRT is a commitment of resources.

The Customer undertakes to cooperate with the Publisher by placing all necessary means and resources at its disposal. The Customer is required to communicate all pertinent information in its possession and necessary for the execution of the Support services, where applicable, to allow remote access to its information system by the Publisher. Failing this, the preceding deadlines shall not apply.

The method of correcting the Anomalies shall be determined by EGERIE and may include, in particular, but shall not be limited to, a bypass solution, patch, teletransmission, on-site intervention at the Customer’s site or an Upgrade of the Software. Any on-site intervention at the Customer’s site will be subject to the invoicing of additional charges.

The implementation of the Support service will be done in consultation with the Customer, and may result in the interruption of the operation of the Software during the intervention. If necessary, the Customer must install the Upgrades provided by the Publisher as part of the Support service. If the Customer fails to do so, the Publisher shall be held harmless in this respect.

The Publisher reserves the right to cease providing the Services for any Software having a Major Version number of more than one Major Version prior to the Major Version number currently being marketed.

ARTICLE 3. COMMITMENT OF AVAILABILITY

The Software is made available to the Customer by remote access through the MyEGERIE Portal.

The Parties declare that they have implemented a rigorous security policy in order to protect themselves from any computer disaster generated, in particular, by viruses, logic bombs, worms or Trojan horses.

Furthermore, given that no one can guarantee the functioning of the Internet as a whole, the Customer declares that it is familiar with the Internet, in particular its characteristics and limitations, and therefore acknowledges that data transmissions on the Internet only benefit from relative technical reliability, as it circulates on heterogeneous networks with various characteristics and technical capacities that are sometimes saturated at certain times of the day.

Generally speaking, the term “available” (or “availability”) refers to the fact that the Software is accessible to Users. The term “unavailable” (or “unavailability”) refers to the occurrence of Blocking Anomalies.

Calculation basis - Availability rate

The Publisher uses its best efforts to achieve a 99.99% availability rate of the Software (hereinafter the “Availability Rate”) according to the following calculation method:

(Total hours for the period - Hours of non-availability) / (Total hours for the period) x 100.

In case of failure to comply with the Availability Rate not due to one of the cases detailed in Article 4.3, clause 8.3 of the Terms of Use shall apply.

Unavailability Rate

The Software's downtime is calculated excluding:

The time required for planned maintenance and regular software upgrades as well as the installation of security patches. This time may correspond to one hundred and twenty (120) minutes per calendar week and one hundred and twenty

(120) minutes per calendar month;

Planned Maintenance and regular upgrades will be carried out as necessary, at the discretion of the Publisher. The Publisher will be required, insofar as these operations would impact the continuity of access to the Software, to inform the Customer at least five (5) working days before the said operations are carried out.

Interruptions due to any circumstance beyond the Publisher's control, including but not limited to Internet malfunctions, network saturation, ISP malfunctions attributable to the Customer's systems, etc.;
Interruptions due to the occurrence of Non-Blocking and Semi-Blocking Anomalies.
Interruptions to the Publisher's infrastructure lasting less than 60 minutes;
Interruptions due to breakdowns in the Customer's software or hardware.

Notwithstanding the provisions of (i) above, it is specified that in the event of a security flaw of any kind, an Upgrade or New Version of the Software may be rolled out without having to comply with a specific notice period in relation to the Customer. The Publisher nevertheless undertakes to notify the Customer without delay, specifying the modifications made that may affect the use of the Software.

ARTICLE 4. SECURITY

The Publisher undertakes to take all appropriate precautions in accordance with the state of the art to preserve the security of the Data so that they are not, by its own doing, distorted, damaged or communicated to unauthorised third parties.

Consequently, the Publisher undertakes to respect and ensure that its staff respect the following obligations:

To take all appropriate measures in accordance with the state of the art to avoid any misappropriated or fraudulent use of Customer Data;
Not to make copies of the documents and media of the Customer Data entrusted to it, except those strictly necessary for the execution of the Contract;
To implement code audits of each New Major Version of the Software;
To implement regular testing of EGERIE applications and infrastructures;
To respect confidentiality and not to disclose Customer Data to other persons, whether private or public, natural persons or legal entities, unless such disclosure is required by law or by a competent judicial or administrative authority or is necessary within the context of legal proceedings.

This level of security is ensured only in the event that the Customer uses the Software exclusively in accordance with its intended purpose and the tools offered by the Publisher for the creation of the Support.

APPENDIX 2 COMPLIANCE WITH THE GDPR (DATA PROCESSING ADDENDUM)

It is reminded that, within the meaning of the Applicable Regulations, the Publisher acts as a data processor, solely on behalf and on the instructions of the Customer, who is qualified as the person responsible for the processing of Personal Data. The said instructions must comply with the Applicable Regulations.

The Customer guarantees that it shall comply with all of its obligations and shall process the Personal Data in accordance with the Applicable Regulations. Consequently, it is up to the Customer, under its sole responsibility, to carry out the steps, declarations and requests for authorisation provided for by the Applicable Regulations concerning any processing operation that it performs and data that it processes using the Software.

Taking into account the current state of knowledge, consistent with the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risks, the degree of probability and severity of which varies, to the rights and freedoms of natural persons, the Customer undertakes to implement the appropriate technical and organisational measures to guarantee a level of security appropriate to the risks.

ARTICLE 1. DESCRIPTION OF THE PROCESSING OPERATION

As a data processor, the Publisher is authorised to process, on behalf of the Customer, the Personal Data necessary to perform the Contract, in particular to host and allow access to the Software and Customer Data as well as the use of the MyEGERIE Portal and to provide the Support services.

In this case, the nature of the operations performed on the Personal Data is: collection, recording, organisation, structuring, conservation, modification, extraction, communication by transmission, making available, deletion.

The purpose(s) of the processing is/are the execution of the Contract, i.e. the hosting and provision of the Software and Customer Data, of the MyEGERIE Portal and the creation of Support.

The Personal Data processed within the context of using the Software by the Customer are the identification data and professional contact details (surname, given name, e-mail address, job title, telephone).

In principle, the provision by EGERIE and the use by the Customer of the MyEGERIE Portal as well as the performance of Support services does not imply the processing by EGERIE of Personal Data. However, the Personal Data which would nevertheless be communicated by the Customer within this context will be subject to this Appendix, the category of such Personal Data then being determined by the Customer.

The categories of persons concerned are: employees, collaborators and agents of the Customer, external persons such as suppliers or contacts.

It is understood that the duration of the processing of Personal Data is equivalent to the duration of the Contract, increased by one year with regard to the backups of Customer Data made by EGERIE.

ARTICLE 2. OBLIGATIONS OF THE PUBLISHER

The Publisher undertakes to process the Personal Data in accordance with the Customer's documented instructions, unless it is required to do so under Union law or the law of the Member State to which the data processor is subject. In this case, the data processor shall inform the controller of this legal obligation prior to the processing operation, unless the law concerned prohibits such notification on important grounds of public interest.

The Customer's instructions consist of the provisions set out in this Contract, the operations carried out by the Contract itself within the context of using the MyEGERIE Portal and the Support services and any written instructions from the Contract communicated by the Contract to the Publisher within the context of performing the Contract.

The Publisher ensures that persons authorised to process personal data are committed to confidentiality or are subject to an appropriate legal obligation of confidentiality.

In addition to the Customer Data security clauses, and taking into account the state of knowledge in accordance with the state of the art, the implementation costs and the nature, scope, context and purposes of the processing operation as well as the risks, the degree of probability and severity of which vary, for the rights and freedoms of natural persons, the Publisher undertakes to implement the appropriate technical and organisational measures to guarantee a level of security appropriate to the risks.

In view of the nature of the processing of Personal Data, the Publisher undertakes to assist the Customer, by means of appropriate technical and organisational measures, to the extent possible, in fulfilling its obligation to comply with requests to exercise the rights of individuals pursuant to Articles 15 to 22 of the GDPR.

In addition, the Publisher shall assist the Customer in ensuring compliance with the obligations set out in Articles 32 to 36 of the GDPR, taking into account the nature of the processing operation and the information available to the Publisher, and in particular, shall provide the Customer with any pertinent information in its possession, at the Customer's expense, concerning the impact assessments relating to the protection of Personal Data carried out by and under the sole responsibility of the Customer as well as any prior consultations with the competent supervisory authority that may result therefrom.

The Publisher shall notify the Customer as soon as possible after becoming aware of any breach of security of the Personal Data leading, either accidentally or unlawfully, to the destruction, loss, alteration, unauthorised disclosure of or access to Personal Data transmitted, stored or otherwise processed in any other way, or unauthorised access to such Personal Data.

As soon as possible after notification of the breach of security of the Personal Data and, to the extent possible, the Publisher shall provide the Customer with the following information:

The categories and approximate number of persons affected by the breach;
The categories and approximate number of personal data records concerned.

The Customer authorises the Publisher to use subcontractors to carry out activities involving the processing of Personal Data on behalf of the Customer that are strictly necessary for the performance of the Contract.

The Publisher undertakes to use subcontractors with sufficient guarantees that they will implement appropriate technical and organisational measures to meet the requirements of the Applicable Regulations.

The Publisher undertakes to contractually impose on its subcontractors obligations at least equivalent to those set out in this Contract and in the Applicable Regulations with regard to the protection of Personal Data.

The Publisher remains liable to the Customer for the performance by the said subcontractor of its obligations.

The Publisher shall inform the Customer of any planned changes concerning the addition or replacement of other subcontractors before any action on the Personal Data by the subcontractor. If, within ten (10) working days from receipt of notification of the said change, the Customer objects by registered letter with acknowledgement of receipt to this addition or replacement or makes detailed and justified objections to this subcontractor, the Publisher undertakes to examine them in good faith.

The Publisher shall refrain from transferring Personal Data outside the European Union, the European Economic Area and countries recognised as having an adequate level of security by the European Commission, including companies established in the United States of America certified as “Privacy Shield”, without putting in place adequate tools to supervise these transfers in application of Article 46 of the GDPR and outside the needs which are strictly necessary in application of the Contract.

The Publisher shall make available to the Customer, at the Customer's expense and upon written request, a set of documents to demonstrate and verify compliance with the Publisher's obligations as a data processor under the Applicable Regulations. The Publisher shall immediately inform the Customer if, in its opinion, an instruction constitutes a breach of this Regulation or of other provisions of Union law or of the law of the Member States relating to data protection.

Upon termination of the Contract, the Publisher will return (under the conditions provided for in the Contract) or delete, at the Customer's discretion, the Personal Data and any copies thereof, unless European Union law or French law requires the retention of such Personal Data (it being specified that the backups made by EGERIE shall be deleted within one year from the end of the Contract).

The Customer undertakes to indicate to the Publisher, at the time the Contract is signed, the person to be contacted for any information, communications, notifications or requests. If the Customer does not indicate this contact person, the Designated User will be considered as the said contact person.

The Publisher undertakes to cooperate with the competent data protection authorities, in particular in the event of a request for information or audit.

Appendix 3: Open source software used for EGERIE RISK MANAGER AND EGERIE PRIVACY MANAGER software

SERVER LIBRARIES

silex/silex (v1.2) —> MIT License
twig/twig (v1.16) —> BSD License
symfony/monolog-bridge (v2.4) —> MIT License
silex/web-profiler (v1.0) —> MIT License
symfony/translation (v2.3) —> MIT License
symfony/config (v2.3) —> MIT License
symfony/yaml (v2.3) —> MIT License
symfony/security (v2.8.33) —> MIT License
symfony/twig-bridge (v2.4) —> MIT License
symfony/validator (v2.8) —> MIT License
dflydev/doctrine-orm-service-provider (v1.0) —> MIT License
knplabs/console-service-provider (v1.0) —> MIT License
saxulum/saxulum-webprofiler-provider (v1.1) —> MIT License
dominikzogg/doctrine-orm-manager-registry-provider (v1.2) —> MIT License
doctrine/doctrine-bundle (v1.5) —> MIT License
gedmo/doctrine-extensions (v2.4) —> MIT License
jms/serializer (v1.1) —> MIT License
kriansa/h2p (v2.0) —> MIT License
jakoch/phantomjs-installer (v2.1) —> MIT License
gargron/fileupload (v1.5.1) —> MIT License
symfony/form (v2.8) —> MIT License
symfony/serializer (v3.1) —> MIT License
symfony/doctrine-bridge (v2.7) —> MIT License
ezyang/htmlpurifier (v4.9) —> LGPL License -2.1-or-later
behat/mink-goutte-driver (v1.2) —> MIT License
behat/mink-browserkit-driver (v1.3) —> MIT License
swiftmailer/swiftmailer (v5.4) —> MIT License
dmore/behat-chrome-extension (v1.2) —> MIT License
jumbojett/openid-connect-php (v0.3.0) —> Apache-2.0 License
cnam/security-jwt-service-provider (v1) —> GNU License General Public License v2.0
ramsey/uuid-doctrine (v1.4) —> MIT License
saxulum/saxulum-doctrine-orm-manager-registry-provider (v2.2) —> MIT License
onelogin/php-saml (v3.2) —> MIT License
symfony/browser-kit (v2.4) —> MIT License
symfony/css-selector (v2.4) —> MIT License
phpunit/phpunit (v5.6) —> 3-Clause BSD License
behat/behat (v3.5) —> MIT License
behat/mink (v1.7) —> MIT License
behat/mink-extension (v2.3) —> MIT License
behat/mink-selenium2-driver (v1.3) —> MIT License
behat/mink-sahi-driver (v1.2) —> MIT License

CLIENT LIBRAIRIES (BROWSER)

select2 (v2 4.0.3) —> MIT License
bootstrap-slider.min.js (v10.0.0) —> MIT License
jquery.fileDownload (v1.4.4) —> MIT License
jquery.slimscroll (v1.2.0) —> MIT License
bootstrap-toggle.min (v2.2.0) —> MIT License
tinymce (v4.7.4) —> LGPL-2.1-only License
bootstrap-multiselect.min (v2.0) —> Apache License-2.0
jquery (v1.9) —> MIT License
bootstrap (v3.3.5) —> MIT License
reactJS (v15.0.0) —> MIT License
react-dom (v15.0.0) —> MIT License

PURCHASED CLIENT LIBRAIRIES (BROWSER)

RappidJS https://www.jointjs.com/
HichChart https://shop.highsoft.com/
Theme Color Admin https://wrapbootstrap.com/theme/color-admin-5-admin-template-4-frontend- WB0N89JMK

SYSTEM COMPONENTS

Debian —> GPL License
MySQL —> GPL License
PHP —> Non Copyleft License
Apache —> GPL License
Samba —> GPL License

ON PREMISE SOFTWARE SUBSCRIPTION TERMS OF USE EGERIE RISK MANAGER AND EGERIE PRIVACY MANAGER

These Terms of Use for the EGERIE Risk Manager Software and/or the EGERIE Privacy Manager Software (hereinafter referred to as the “Software”) apply to all provisions of the Software in On-Premise mode by the EGERIE SOFTWARE company, a simplified joint-stock company [Société par actions simplifiée] with a registered capital of 388,967.50 euros, having its registered office in Toulon at 44 boulevard de Strasbourg, registered with the Trade and Companies Register of Toulon, under the number 817 640 998, represented by its President (hereafter referred to as the “Publisher” or “EGERIE”).

These Terms of Use apply in the case of a subscription to the right to use the Software and/or the provision of Services directly from EGERIE or through an Approved Partner.

PURPOSE

The purpose of these Terms of Use is to define the terms and conditions for the provision of the Software and the supply of Services by the Publisher to the Licensee and to the Users, and for the non-exclusive granting of rights to use the Software, without authorisation for sub-licensing. These rights to use the Software are non-assignable and non-transferable. The license granted is an “On Premise” mode subscription license that may be used under the conditions defined below.

The EGERIE Privacy Manager Software is a computer software whose function is, in particular, to create, manage, and edit processing sheets and registers of personal data, to verify the conformity of the processing operation with best legal and security practices (as well as the multi-conformity of a measure with the requirements of several standards) and to pre-evaluate the “privacy” risk of each processing operation.

We would like to remind you that the Software is not a tool for detecting and treating risks in real time, but that it offers an analysis based on the data entered or imported by the Licensee. The Software is a decision-making aid and the decision is and remains the sole responsibility of the Licensee.

The Licensee hereby acknowledges that they have read the technical and functional information of the Software and Services. The Licensee acknowledges that the Software, know-how and Services of EGERIE as well as their developments – including any developments that may be suggested by the Licensee or its Users and implemented by EGERIE – are subject to legal protection, in particular with regard to intellectual property rights. As such, the Publisher retains all intellectual property rights over all copyrighted or copyrightable elements relating to the Software and Services.

Likewise, the Licensee remains the owner of all rights to its own data and products.

DEFINITIONS

In these Terms of Use, the terms below used with a capital letter, in the singular or plural, will have the following meaning:

− Anomaly: means any incident, defect, malfunction or non-conformity of the Software's functions in relation to the Documentation, reproducible by the Licensee and verified by the Publisher, which prevents the normal operation of all or part of the Software or which causes an incorrect result or inappropriate processing operation when the Software is used in accordance with its Documentation and for its intended purpose.

− Blocking Anomaly: means an Anomaly that renders the Software or one of its essential functions totally unavailable.

− Non-Blocking Anomaly: means any Anomaly that affects the operation of the Software but does not constitute a Blocking Anomaly or a Semi-Blocking Anomaly.

− Semi-Blocking Anomaly: means any Anomaly allowing only partial use of the Software's functions.

− Purchase Order or accepted Quote: means any document or exchange stipulating the details of the right to use the Software and Services accepted by EGERIE (or the Approved Partner) and the Licensee.

− Delivery note: refers to the document issued by the Publisher listing all the characteristics of the order placed by the Licensee, with the exception of the price.

− Source Code: means the code of the Software filed to date by the Publisher for the EGERIE Risk Manager software and/or EGERIE Privacy Manager software with the Agency for the Protection of Programmes and its versions of the Software.

− Special Conditions: means the information contained in the Purchase Order or any other document expressly accepted by the Parties concerning the right to use the Software or the Services.

− Terms of Use: means these terms and conditions.

− Terms of Sale: means the Publisher's terms applicable to any order for the right to use the Software and/or Services by the Customer, appended to the Purchase Order, applicable when the Customer enters into a direct agreement with the Publisher.

− Contract: means these Terms of Use, including their appendices, the Delivery Note and the Special Conditions or Purchase Order or accepted Quote as well as the Terms of Sale, in case of a direct sale by EGERIE.

− Documentation: means the technical and functional manuals and all information relating to the Software accessible and updated on the Licensee's MyEGERIE Portal and/or provided by EGERIE.

− Licensee Data: means the information (including Personal Data) owned by the Licensee and/or for which they are responsible, which the Licensee enters, fills in, transmits, collects, stores and/or processes and, where applicable, communicates to EGERIE within the context of the Support and the use of the Software and the MyEGERIE Portal.

− Personal data: means the personal data that the Client processes in their capacity as data controller and that EGERIE is likely to process in its capacity as data processor, within the meaning of Law No. 78-17 of 6 January 1978, as amended, known as the law on “Information Technology, Data Files, and Civil Liberties” (French Data Protection Act) 2016/679 of the European Parliament and of the Council of 27 April 2016 (known as the “GDPR”), this set of regulations being referred to hereinafter as the “Applicable Regulations”.

− Upgrade: means the functional and/or technical upgrade of the Software, as provided by regular updates, identified by the passage from one minor version to the next (the minor version number being identified by the second digit of the version number (Y for a version named x.Yz)) or from one revision of a minor version to the next (the number of a revision being identified by the third digit of the version number (Z for a version named x.yZ)). The term Upgrade does not include Major Versions and new modules.

− Working day: means a day between Monday and Friday which is not a public holiday in mainland France.

− Licensee: means the legal entity having accepted the Terms of Use and having acquired the right to install and use the Software On Premise.

− Software: means the EGERIE Risk Manager and/or EGERIE Privacy Manager software and all the related object code programs, in the version provided for in the Purchase Order or accepted Quote, including the Upgrades as defined above, as well as the related Documentation.

− Maintenance: means all the services and actions provided by the Publisher with a view to revising and improving the Software described in the Terms of Use.

− Approved Partner: means the company approved by the Publisher that promotes and markets the right to use the Software and Services to the Licensee.

− MyEGERIE Portal: means the space made available to the Licensee by the Publisher.

− Service(s): means all the services associated with the Software provided by EGERIE or an Approved Partner, such as Support and Maintenance services which are included in the subscription for the right to use the Software and the Additional Services expressly provided for in the Purchase Order or accepted Quote.

− Additional Service(s): means the services provided by the Authorised Partner or the Publisher not included in the right to use the Software, specifically provided for in the Purchase Order or accepted Quote.

− Support: means all the technical or functional services provided by the Publisher or its Authorised Partner following a support request described in the Terms of Use.

− User: means any natural person (such as an employee, subcontractor or consultant of the Licensee) using the Software under the responsibility of the Licensee in accordance with the provisions of the Contract. The Licensee is responsible for the Users' compliance with the Terms of Use and remains solely liable to the Publisher for any breach of the Terms of Use by a User.

− Designated User: means any natural person using the MyEGERIE Portal and the Support service described in writing to EGERIE at the time of the order.

− Major Version: means a version of the Software launched on the market by the Publisher, including a set of computer programs identified by the version number (the major version number being identified by the first digit of the version number (X for a version named X.yz)). The notion of Major Version does not include new modules.

HIERARCHICAL ORDER OF CONTRACTUAL DOCUMENTS

The Contract consists of the following contractual documents presented in descending order of legal value: these Terms of Use, and where applicable, the Terms of Sale, the appendices, the Delivery Note, the Purchase Order or accepted Quote. In the event of a contradiction between one and/or more provisions contained in any of these documents, the higher-ranked document shall prevail.

ENTRY INTO FORCE – DURATION – RENEWAL

The Contract comes into force upon the acceptance of the Purchase Order or any document or exchange materialising the order placed with the Publisher by the Licensee, or where applicable, the Authorised Partner.

Unless otherwise stipulated in the Purchase Order or accepted Quote, the Contract is concluded for a period of one

(1) year from the date of issue of the Delivery Note by the Publisher.

The Licensee has a period of ten (10) days from the issue of the Delivery Order to dispute access to the Software, concerning the number of licenses or users or any other element of the order. In the absence of any dispute, the Software shall be deemed to be made available in accordance with the order.

At the end of the initial term, unless otherwise stated in the Purchase Order or accepted Quote, the Contract may only be renewed by a written agreement between both Parties.

The Licensee undertakes to pay the Publisher or its Authorised Partner in accordance with the applicable terms of sale.

RIGHTS AND LIMITATIONS OF SOFTWARE USE, INTELLECTUAL PROPERTY

Rights and limitations of use

The Contract grants the Licensee the right to install and use the Software, including access to Software Upgrades, new Major Versions and the Support and Maintenance services provided for in this Contract, as well as, where applicable, the Additional Services of the Publisher contained in the Purchase Order or accepted Quote, for a specified period.

The right to install and use the Software, granted under the Contract and for its duration, allows the Licensee to use the Software and the Documentation for its own needs, in accordance with its intended purpose. The number of Users is indicated in the Delivery Note.

In the event that the Licensee wishes to modify the terms of the rights of use subscribed to as specified in the Delivery Note (number of Users, subscription to a new module, etc.), the Licensee shall notify the Publisher or Authorised Partner in writing. The latter will propose a new quote which must be accepted before the requests are actually updated.

Pursuant to the right of use granted by this Contract, the Licensee may reproduce the Software on its production servers (with the exception of pre-production and validation requirements, unless otherwise specified on the Purchase Order or accepted Quote), on a permanent or temporary basis, for the purposes of loading, displaying, running, transmitting or storing the Software for the purposes of performing this Contract, i.e. for the use of the Software in accordance with its Documentation and for its intended purpose. The Licensee may make a backup copy of the Software, unless said copy is provided by the Publisher. The Licensee shall have the same rights and obligations on the backup copy as on the licensed copy of the Software.

Apart from, and without prejudice to, the rights granted in this Contract, the Licensee is not authorised hereunder to:

Copy, print, transfer, forward or display all or part of the Software;
Sell, rent, sub-license or distribute the Software in any way whatsoever;
Modify the Software and/or merge all or part of the Software into other computer programs without prior authorisation from the Publisher;
Intervene or have a third party intervene on the Software, in particular for maintenance purposes;
Compile, decompile, disassemble, translate, analyse, reverse engineer or attempt to reverse engineer the Software, except to the extent permitted by law;
Carry out any processing or IT services whatsoever for third parties using the Software, in particular contract work.

It is specified that the Publisher reserves the right to correct any errors that the Software may contain.

The Licensee and the Users shall refrain from damaging the Software in any way whatsoever, and in particular from using the Software in a manner that is not in accordance with its intended purpose and the conditions set forth in the Contract.

These Terms of Use grant the Licensee a right to install and a right to use the Software and do not grant the Licensee any property right relating to it, its technology, or the intellectual property rights held by the Publisher.

The Licensee agrees that nothing in this Contract shall confer upon it any right, title or interest in the Publisher's distinctive signs.

Source code

The Publisher guarantees that it has filed the source codes of the Software with the Programme Protection Agency under the names EGERIE Risk Manager and EGERIE Privacy Manager and whose IDDN numbers are: IDDN.FR.001.360008.000.S.P.2019.000.20700, IDDN.FR.001.360008.001.S.P.2019.000.30000, IDDN.FR.001.140014.000.S.P.2018.000.10000, IDDN.FR.001.070014.000.R.C.2013.000.10000.

The Publisher allows the Licensee access to the Software’s source codes in the following cases:

In the event of the Publisher's receivership without the Publisher's commitments to the Licensee being included in the decision or judgement ordering the receivership;
In the event of voluntary or compulsory liquidation of the Publisher without the Publisher's commitments towards the Licensee being included in the decision or judgement ordering the liquidation;
In the event of transfer of the Software to a third party without the Publisher's commitments to the Licensee being included in the transfer deed;
In the event of transfer of the Publisher's business and/or goodwill to a third party without the Publisher's commitments to the Licensee being included in the transfer deed.

Access to the filed elements will take place in the cases provided for above and in accordance with the procedure for access to elements filed with the APP [French Program Protection Agency].

Access to the filed elements will be authorised by the APP Access Committee upon presentation of a copy of the Contract containing the access clause and the elements showing indisputably that criteria of one or more of the cases listed above have been met.

Duplication of the source codes will be carried out identically from the last update filed by an APP agent, unless the Licensee expressly requests access to a previous filing. The Licensee shall bear the costs associated with the access request and the procedure for making the source codes available.

The Licensee may only use the filed elements within the limits of the rights granted to him by the Publisher, access to the filed elements does not transfer any other rights.

It is understood between the Parties that, in addition to the annotated Software programs that can be read and interpreted by any person familiar with the language in which they are written, the source codes include detailed design documentation.

With the exception of the assumptions previously stated in this article, the Licensee undertakes not to carry out any processing, including consulting the source code of the Software. The Licensee undertakes to ensure that this obligation is respected by its employees and agents, and by any third party placed under its responsibility. He/she shall ensure that this obligation is respected.

OBLIGATIONS OF THE LICENSEE

General Obligations of the Licensee

The Licensee undertakes to comply with the prerequisites communicated by EGERIE for the installation and use of the Software.

The Licensee:

Undertakes to use the Software only in accordance with its professional intended purpose and with its Documentation, and for the sole needs of its activity;
Is solely responsible for the content disseminated and/or downloaded and assumes full responsibility for the nature, content, accuracy, integrity and legality of the data processed, stored or transmitted within the context of using the Software, as well as for the exploitation thereof. In particular, given the intended purpose of the Software, the Licensee shall refrain from sending or storing data of a non-professional nature and, more generally, data of an illicit, obscene, or defamatory nature or data that is illegal or in violation of the rights of a third party, of the protection of minors or of privacy;
Undertakes not to distribute the Software, make it available to third parties or rent it;
Undertakes not to alter or disrupt the integrity or execution of the Software or the data contained therein
Undertakes not to attempt to obtain unauthorised access to the Software or the systems or networks associated with it.

To verify the integrity of the Software's source code, the Publisher reserves the right to carry out a code audit at the Licensee's premises after giving fifteen (15) days' prior notice.

Use of the Software by the Licensee

The Software will be used by the Licensee under its sole control, direction and responsibility. The Licensee guarantees compliance with this Contract by the Users.

Consequently, the Licensee is responsible, in particular, for the following:

The implementation of all appropriate procedures and measures designed to protect workstations, hardware, software packages, software, passwords, in particular against viruses and intrusions;
The choice of access provider or telecommunications medium, the Licensee must handle administrative requests and take out the necessary subscriptions, the cost of which it will bear;
Prerequisites for the workstations or server as defined in the Documentation;
The appointment, among its staff, of a privileged contact person for the Publisher acting as department administrator, for the Licensee, and in particular as regards Support;
The use, storage and management of the usernames and/or access codes given to it when the Software is made available.

It shall ensure that no one it has not authorised has access to the Software;

Errors committed by its personnel in the use of the Software and the procedures that enable it to connect to the Software, particularly concerning the means of Internet access and navigation;
The Licensee declares that it is personally responsible for the backup of the Data.

The Publisher and the Licensee declare that the technical information provided and used by the Software as well as that concerning the connections are deemed authentic between them until proven otherwise.

With regard to the Licensee Data, used in the context of access to the MyEGERIE Portal, the Publisher shall bear no responsibility concerning the quality and electronic transmission of the data when it uses the telecommunication networks and more generally the quality and reliability of the telecommunication links between the Licensee's workstations and the Software access point. Furthermore, the Publisher shall bear no responsibility for the accidental destruction of the Licensee Data by the Licensee.

The Licensee's duty of care

Any use of Users' usernames and passwords is deemed to constitute use of the Software by the Licensee, which the Licensee expressly acknowledges. The Licensee remains responsible for its personnel at all times and is subject to an obligation to supervise it.

The Licensee is solely responsible, in particular, for:

The content of the data, their compliance with applicable regulations, and more generally, any information that it deposits on the MyEGERIE Portal that it distributes or keeps on its behalf within the context of using the Software;
The regular backup of its data;
Any possible fraudulent use of the username and/or password or any usurpation of the identity of one of the Users;
Depositing documents or libraries on the MyEGERIE Portal, such as risk analysis models to contribute to the enrichment of the shared resource base. It is the responsibility of the Licensee to ensure their anonymisation and the absence of confidential, sensitive or strategic data in the documents made available;
Ensuring that Users have the necessary level of knowledge to use the Software;
Providing Users with the information necessary for the secure use of the Software, and in particular, the obligation to keep their access usernames and passwords strictly personal and confidential;
Notifying the Publisher of any modification or change likely to affect the operation of the Software.

During the term of the Contract, the Licensee has the option to export all Licensee Data. As the Software is not backup software, it is the responsibility of the Licensee to regularly export and back up its Licensee Data.

Installation

The Licensee is required to check the proper functioning of the Software when the Software is made available. The installation of the Software remains the responsibility of the Licensee, unless otherwise specified on the Purchase Order.

User Administration

The Licensee has the right to use the Software for the number of Users specified in the Delivery Note.

The creation of the account with the “SuperAdministrator” profile is the sole responsibility of the Licensee during the Software initialisation phase, based on the instructions provided by the Publisher. The Licensee undertakes to create and keep the username and password for the “SuperAdministrator” profile. The Licensee assumes sole responsibility for the security and availability of the “SuperAdministrator” administration accounts enabling the administration of the Software.

The creation of the other accounts and the attribution of the associated rights are the responsibility of the Licensee. It is the sole responsibility of the Licensee and its Users to choose usernames and passwords that comply with best security practices. In general, the Licensee assumes sole responsibility for the security of the usernames and passwords enabling access to the Software, as well as the security of the individual workstations from which Users access the Software.

The Licensee must ensure the non-disclosure of accounts and associated passwords to unauthorised persons.

DATA

Data ownership

In particular, the Licensee shall refrain from using documents made available on the MyEGERIE Portal for commercial purposes.

The Publisher is prohibited from using, modifying, assigning or transferring to a third party, in whole or in part, whether in return for payment or free of charge, any data that may have been communicated to it by the Licensee during the performance of the Contract, for purposes other than those of this Contract (including the operations necessary for the Publisher to prepare its invoices and statistics on use and to provide any explanation concerning the performance of the Support).

The Licensee acknowledges that the Publisher may compile aggregated and anonymised statistical information and may make it public, provided that it does not identify the Licensee's confidential information and does not include any Personal Data. The Publisher retains all intellectual property rights to the results of such statistical processing.

Location

The Licensee Data, exploited within the framework of using the MyEGERIE Portal and the Support, are hosted in France.

Protection of personal data

In principle, the provision by EGERIE and the use by the Licensee of the MyEGERIE Portal as well as the performance of Support services does not imply the processing by EGERIE of Personal Data and the Licensee undertakes not to communicate Personal Data to EGERIE in this context.

However, should Personal Data be communicated, in order to comply with the Regulations in Force, the following provisions shall apply: within the meaning of the Applicable Regulations, in particular the GDPR, the Publisher acts, for the Support and the provision of the MyEGERIE Portal, as a data processor, solely on behalf and on the instructions of the Licensee, who is qualified as the person responsible for the processing of Personal Data.

The obligations of the Publisher and the Licensee, relating to the protection of personal data, are set out in Appendix 2.

Protection of strategic data

Strategic data corresponds to the non-personal data that is of particular importance to the Licensee.

The Licensee declares that the Licensee Data does not contain any strategic data. Likewise, the Licensee declares that it will not forward strategic data to the Publisher, including within the context of Support services.

The Publisher shall bear no responsibility in the event of the storage, loading or sharing of strategic data by the Licensee.

OBLIGATIONS OF THE PUBLISHER

Provision of the Software

The Publisher sends the Delivery Note with the address of the MyEGERIE Portal, as well as the usernames and access codes of the designated users of the MyEGERIE Portal and of the Support services. The Licensee will receive a separate e-mail containing the Software license activation key in accordance with the number of subscribed Users.

Access to the MyEGERIE Portal enables designated Users to download the Software and to consult the Documentation, in particular the installation guides (technical prerequisites and installation procedure), the user and administration guides for the Software as well as all the functional documents relating to the Software.

Under no circumstances may the Publisher be held liable in the event of a failure to make the Software available attributable to the Licensee or in case of force majeure.

Maintenance

Maintenance refers to all the services and actions provided by the Publisher on its Software and infrastructures, with a view to making the Software available. The Publisher undertakes to ensure a connection to the MyEGERIE Portal based on an uninterrupted connection 7 days a week and 24 hours a day.

The following will not be taken into account:

Outages of the Licensee's software;
Outages of the Licensee's equipment;
Outages due to the Internet or the operators' connections connecting the Licensee to the Internet,
Interruptions to the Publisher's infrastructure lasting less than 60 minutes.

The Publisher reserves the right to make changes to the Software, but only with a view to its constant improvement.

The Licensee benefits from the Upgrades and new Major Versions of the Software, made available on the MyEGERIE Portal. The Licensee is responsible for downloading and installing these Upgrades and new Major Versions.

Unless otherwise stated in the Purchase Order or Accepted Quote, the Contract does not include the new modules. These may be subject to specific pricing by the Publisher or the Authorised Partner.

Upon the release of any Upgrade or new Major Version of the Software, the Publisher undertakes to make the new User and Administrator documentation available to the Licensee on the MyEGERIE Portal.

Support

Levels of support:

As regards Support services, the Publisher undertakes to implement three-levels of Support:

Level 1 support: this is the functional support that is exclusively handled by the Authorised Partner or the Publisher. The purpose of functional support is to assist the Licensee, through the intermediary of the Designated Users, on issues relating to the use of the Software and its functions in accordance with its intended purpose. The support does not constitute training services, which are not included in the subscription, but only for the resolution of questions that cannot be resolved by reading the Documentation.
Level 2 Support: this is the technical support provided by the Publisher to take into account complex technical issues or Anomalies that do not require the modification of the Software's source codes.
Level 3 Support: this is the technical support provided by the Publisher to take into account complex technical issues or Anomalies requiring an Upgrade of the Software.

Purpose of and contact details for Support:

By the Help Desk service available through the MyEGERIE Portal (an account is created at the request of the Licensee's designated User);

By an e-mail sent to support@egerie-software.com;

– By telephone at +33(0) 494 638 105.

The User contacting the Publisher must be trained in the use of the Software.

Unless otherwise agreed, the Licensee has only one (1) Designated User included in the agreement who can contact the Support team. It is possible to have more than one Designated User who can contact the Support team at the current rate. In the event of a change of contact person for the Licensee's Designated User, the Licensee may request the Publisher to reassign him/her during the term of the Contract.

Terms and conditions for providing Support

Anomaly

Guaranteed Intervention Time

Guaranteed Recovery Time

Blocking anomaly

0.5 business day

3 business days

Semi-blocking anomaly

1 business day

5 business days

Non-blocking anomaly

2 business days

7 business days

The classification of Anomalies as blocking, semi-blocking or non-blocking is carried out by the Publisher on the basis of the information provided by the Licensee and the reproducibility of the Anomaly.

The Guaranteed Intervention Time (GIT) corresponds to the time between the declaration of the Anomaly and the first response given by the Publisher.

The Guaranteed Recovery Time (GRT) indicates the time required to provide the Licensee with an Upgrade, if necessary, or any other solution that will restore the system to working order. The GRT is a commitment of resources.

The Publisher reserves the right to use the most appropriate means to correct anomalies: patch, Upgrade, remote transmission, on-site intervention at the Licensee’s site. Any on-site intervention at the Licensee’s site will be subject to the invoicing of additional charges.

The Licensee undertakes to cooperate with the Publisher by placing all necessary means and resources at its disposal. The Licensee is required to communicate all pertinent information in its possession and necessary for the execution of the Support services, where applicable, to allow remote access to its information system by the Publisher. Failing this, the preceding deadlines shall not apply.

The implementation of the Support service(s) will be done in consultation with the Licensee, and may result in the interruption of the operation of the Software during the intervention.

The Licensee must install the Upgrades provided by the Publisher as part of the Support service. If the Licensee fails to do so, the Publisher shall be held harmless in this respect.

Exclusions from Services

Services do not include any work and interventions relating to the installation and proper functioning of the Licensee's workstation and the Licensee's infrastructure (telecommunications, networks, security equipment) enabling the Licensee to install and use the Software, or services for implementing the Software (e.g. installation, customisation, recovery of existing elements). These services are not included in this Contract and may be the subject of Additional Services with specific pricing by the Publisher or the Authorised Partner.

Credits

In the event that the Publisher does not comply with the agreed contractual recovery deadlines in Article 8.4, the Publisher will grant, after written notification from the Licensee, a defined credit consisting of a free extension of the term of the right to use the Software granted under this Contract for a period corresponding to the time the Software is unavailable due to Blocking Anomalies, to the exclusion of any other compensation.

The Licensee shall notify the Publisher in writing within thirty (30) days of the last day of the month in which the recovery period was not reached. If the Licensee does not notify the Publisher within the said period, the Licensee is deemed to have waived the credit for the month concerned.

COLLABORATION BETWEEN THE PARTIES

The proper performance of the Contract requires loyal, active and permanent collaboration between the Parties.

Therefore, each of the Parties undertakes to:

Be actively involved in the fulfilment of its obligations;
Refrain from any behaviour which may affect and/or hinder the performance of the other Party's obligations
Provide each other, in a timely manner, with all the information and documents necessary for the performance of the Contract.

The Parties shall meet as often as necessary to ensure the proper performance of the Contract and, in particular, to verify the proper performance of the Service.

In addition, the Licensee undertakes to maintain sufficiently competent, qualified and trained Users throughout the duration of the execution of these terms and conditions.

LIABILITY

The Publisher may under no circumstances be held liable for any indirect damage suffered by the Licensee that may arise from or during the performance of this Contract and its consequences.

Indirect damage includes, but is not limited to, loss of earnings or profits, loss of opportunity, commercial damages, the consequences of complaints or claims by third parties against the Licensee, notwithstanding the fact that the Publisher would have been warned of the possibility of its occurrence.

With the exception of the provisions of the article relating to the hold harmless clause or in the event of gross negligence or wilful misconduct on the part of the Publisher, the liability of the latter, in the event of damage occurring to the Licensee, for any reason whatsoever and whatever the legal basis invoked or retained, all combined and cumulative damages, shall be expressly limited and may under no circumstances exceed 75% of the sums actually collected over the current year.

The Publisher shall be held harmless in case of:

Use of the Software in a manner not provided for in the User Documentation or use not expressly authorised by these Terms of Use;
Modification of all or part of the functions or information accessible via the Software not carried out by the Publisher or by one of the Authorised Partners designated by the latter;
Use of all or part of the Software when the Publisher, following a problem or for any other reason whatsoever, had recommended that its use be suspended;
Use of the Software and Services in an environment or configuration that does not comply with the Publisher's technical prerequisites in connection with programs or data from third parties not expressly approved by the Publisher
Loss of the Licensee's Licensee Data following an intervention by the Publisher or an Approved Partner, where the Licensee has not taken the precaution of backing up its Licensee Data prior to this intervention when requested to do so;
The occurrence of any damage resulting from the Licensee's fault or negligence, or which the Licensee could have avoided by asking for the Publisher's advice;
Use in connection with programs not provided or endorsed by the Publisher and likely to affect the Licensee's services or data;
Loss by the Licensee of the usernames and passwords of the SuperAdministrator accounts,
Failure to back up data by Users;
Failure to download Upgrades made available by the Publisher;
Updates not recommended by the Publisher.

HOLD HARMLESS CLAUSE

The Publisher guarantees the Licensee that it holds all the rights enabling it to enter into the Contract.

In this respect, the Publisher undertakes to defend the Licensee at its own expense against any action for infringement of copyright or other intellectual property rights brought by a third party, and relating to the Software, provided that it has been notified immediately in writing by the Licensee and that the alleged infringement is not attributable to the Licensee.

The Publisher shall have exclusive control over the manner of conducting the defence to the action and shall be free to settle or continue any proceedings of its choice. The Licensee shall provide the Publisher with all the information, elements and assistance needed to enable it to carry out its defence or to reach a settlement agreement.

If all or part of the Software is acknowledged by a final court decision as constituting an infringement or if the Publisher considers that it is likely that the Software, in whole or in part, will be considered as infringing, the Publisher may either provide the Licensee with non-infringing software having the same functions, or obtain the right for the Licensee to continue to use and exploit said Software, or terminate the Contract and refund the amounts paid in advance by the Licensee for the remaining period, with the amounts paid by the Licensee for the use of the Software for the elapsed period being retained by the Publisher.

TERMINATION

In the event of termination of this contractual relationship for any reason whatsoever, the Licensee undertakes either to return to the Publisher, within thirty (30) days of the end of the contractual relationship, all of the constituent components of the Software, including the license activation key, the media and all copies that may have been made of it, guaranteeing in writing the entirety of this return, or provide in writing a certificate attesting to the destruction of the Software, the license activation key, its media and all copies that may have been made.

The Licensee undertakes to export its Licensee Data or upon written request from the Licensee, the Publisher may return the Licensee Data to the Licensee, forwarded within the framework of Support services or on the MyEGERIE Portal, in accordance with Article 6.3 of these Terms of Use.

REFERENCES

The Licensee grants the Publisher a non-exclusive worldwide license, free of charge and subject to sub-licensing, for the duration of this Contract, enabling it to use the Licensee's distinctive signs as a reference on its (paper and electronic) commercial media for the purpose of promoting and marketing the Publisher's services.

CONFIDENTIALITY

For the purposes of this Contract, these Terms of Use, all information or data of any nature whatsoever, including technical, commercial, strategic, financial, economic, legal information, regardless of the form or medium, which is received and/or exchanged between the Parties during the negotiation and/or performance of the Contract, shall be considered as confidential information (hereinafter “Confidential Information”).

The Licensee expressly agrees to consider as confidential the creations relating to the intellectual property rights or the elements of know-how belonging to EGERIE as well as all information forwarded to it within the framework of the Contract and in particular, without this list being exhaustive:

The User and Administrator documentation transferred by EGERIE,
The technical documentation of the Software,
Libraries of risk analyses or modelling examples,
The user interface and visual representations associated with risk modelling,
The original functionality of the Software,
If applicable, the Source Code of the Software.

Confidential Information is not considered to be information that:

Is, as of the signature date of the Contract, publicly known, or which will become publicly known subsequently to the Contract, but, in any event, in the absence of any fault of the parties in its obligation of confidentiality;
Was in the lawful possession of the other Party prior to its disclosure and was not obtained by it directly or indirectly from the disclosing Party, and if that Party can prove such prior personal possession;
Is received from a third party in a lawful and unrestricted manner, the Parties acknowledge that any Confidential Information remains in any case the exclusive property of the party communicating it, and that its transmission does not confer any ownership or right of use over all or part of the content of the Confidential Information to the party receiving it.

In this respect, the Parties undertake within the framework of the Contract:

To use the Confidential Information only for the purposes of the Contract;
To take all necessary measures to protect the confidentiality of this Confidential Information;
To keep confidential and not to disclose or publish such Confidential Information - by any means whatsoever and for any purpose whatsoever, either directly or indirectly - to third parties to the contract to which they are parties, without the prior written authorisation of the Party that communicated it and which the latter may refuse at its sole discretion.

Confidential Information may be communicated only to the Parties' employees, within the limit of what they need to know to perform their duties under this Contract. Each of the Parties concerned shall remain responsible for the latter's compliance with their obligations. Any breach of this obligation of confidentiality by one of the Parties shall entitle the other Party to automatically terminate these Terms of Use, subject to thirty (30) days' notice, without the defaulting Party being entitled to claim compensation of any kind, and notwithstanding any damages to which the non-defaulting Party may be entitled.

MISCELLANEOUS

Non solicitation of personnel

The Licensee expressly waives, during the performance of this Contract and for two (2) years following its term, for any reason whatsoever, to hire or cause to work, either directly or indirectly through an intermediary, any of the Publisher's employees who have participated in the performance of the Contract, regardless of their specialisation. Any failure to comply with this obligation shall expose the Licensee to immediately paying the Publisher an indemnity equal to the gross earnings of the last eighteen (18) months of the person concerned, plus employer's charges, without prejudice to damages and interest.

Independence of the parties

Force Majeure

Neither of the Parties may be held liable for a breach of any of its obligations under the Contract resulting from the occurrence of a case of force majeure, provided, however, that:

The Party invoking such a case notifies the other Party of its existence as soon as possible;
It does everything necessary to limit the consequences; and
It resumes the execution of the Contract immediately after this case of force majeure has disappeared.

If the case of force majeure persists for more than fifteen (15) consecutive days, it shall give rise to the right to automatically terminate the Contract.

For the application of this Contract, the following events in particular are included in the definition of force majeure: Breakdown or failure of the hosting company; Electrical power failure, fire, flood, natural disaster; Strike; War; Epidemic; Attacks; Uprising; Demonstration.

Amendments to the Contract

The Contract may only be modified or amended by means of a written amendment signed by a person duly authorised to represent each of the Parties.

Assignment of the contract

The Publisher reserves the right to transfer the rights and obligations of this Contract to any other person.

The Licensee who wishes to assign the Contract, in particular in the event of restructuring or a change of control, undertakes to inform the Publisher in writing without delay and prior to the transaction of the terms and conditions of such assignment, and the Publisher reserves the right to object in the event of assignment, either directly or indirectly, to a competitor of the Publisher.

Titles

No waiver

Nullity and independence of clauses

Applicable law, jurisdiction

Appendix 1: Open source software used for EGERIE RISK MANAGER AND EGERIE PRIVACY MANAGER software

SERVER LIBRARIES

silex/silex (v1.2) —> MIT License
twig/twig (v1.16) —> BSD License
symfony/monolog-bridge (v2.4) —> MIT License
silex/web-profiler (v1.0) —> MIT License
symfony/translation (v2.3) —> MIT License
symfony/config (v2.3) —> MIT License
symfony/yaml (v2.3) —> MIT License
symfony/security (v2.8.33) —> MIT License
symfony/twig-bridge (v2.4) —> MIT License
symfony/validator (v2.8) —> MIT License
dflydev/doctrine-orm-service-provider (v1.0) —> MIT License
knplabs/console-service-provider (v1.0) —> MIT License
saxulum/saxulum-webprofiler-provider (v1.1) —> MIT License
dominikzogg/doctrine-orm-manager-registry-provider (v1.2) —> MIT License
doctrine/doctrine-bundle (v1.5) —> MIT License
gedmo/doctrine-extensions (v2.4) —> MIT License
jms/serializer (v1.1) —> MIT License
kriansa/h2p (v2.0) —> MIT License
jakoch/phantomjs-installer (v2.1) —> MIT License
gargron/fileupload (v1.5.1) —> MIT License
symfony/form (v2.8) —> MIT License
symfony/serializer (v3.1) —> MIT License
symfony/doctrine-bridge (v2.7) —> MIT License
ezyang/htmlpurifier (v4.9) —> LGPL License -2.1-or-later
behat/mink-goutte-driver (v1.2) —> MIT License
behat/mink-browserkit-driver (v1.3) —> MIT License
swiftmailer/swiftmailer (v5.4) —> MIT License
dmore/behat-chrome-extension (v1.2) —> MIT License
jumbojett/openid-connect-php (v0.3.0) —> Apache-2.0 License
cnam/security-jwt-service-provider (v1) —> GNU License General Public License v2.0
ramsey/uuid-doctrine (v1.4) —> MIT License
saxulum/saxulum-doctrine-orm-manager-registry-provider (v2.2) —> MIT License
onelogin/php-saml (v3.2) —> MIT License
symfony/browser-kit (v2.4) —> MIT License
symfony/css-selector (v2.4) —> MIT License
phpunit/phpunit (v5.6) —> 3-Clause BSD License
behat/behat (v3.5) —> MIT License
behat/mink (v1.7) —> MIT License
behat/mink-extension (v2.3) —> MIT License
behat/mink-selenium2-driver (v1.3) —> MIT License
behat/mink-sahi-driver (v1.2) —> MIT License

CLIENT LIBRAIRIES (BROWSER)

select2 (v2 4.0.3) —> MIT License
bootstrap-slider.min.js (v10.0.0) —> MIT License
jquery.fileDownload (v1.4.4) —> MIT License
jquery.slimscroll (v1.2.0) —> MIT License
bootstrap-toggle.min (v2.2.0) —> MIT License
bootstrap-multiselect.min (v2.0) —> Apache License-2.0
jquery (v1.9) —> MIT License
bootstrap (v3.3.5) —> MIT License
reactJS (v15.0.0) —> MIT License
react-dom (v15.0.0) —> MIT License

PURCHASED CLIENT LIBRAIRIES (BROWSER)

RappidJS https://www.jointjs.com/

HichChart https://shop.highsoft.com/

Theme Color Admin https://wrapbootstrap.com/theme/color-admin-5-admin-template-4-frontend-WB0N89JMK

SYSTEM COMPONENTS

Debian —> GPL License
MySQL —> GPL License
PHP —> Non Copyleft License
Apache —> GPL License
Samba —> GPL License

APPENDIX 2 COMPLIANCE WITH THE GDPR (DATA PROCESSING ADDENDUM)

If, however, Personal Data is communicated, in order to comply with the Applicable Regulations, the following provisions shall apply.

You are reminded that, within the meaning of the Applicable Regulations, the Publisher acts as a data processor, solely on behalf and on the instructions of the Licensee, who is qualified as the person responsible for the processing of Personal Data. The said instructions must comply with the Applicable Regulations.

The Licensee guarantees that it shall comply with all of its obligations and shall process the Personal Data in accordance with the Applicable Regulations. Consequently, it is up to the Licensee, under its sole responsibility, to carry out the steps, declarations and requests for authorisation provided for by the Applicable Regulations concerning any processing operation that it performs and data that it processes using the Software.

Taking into account the current state of knowledge consistent with the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risks, the degree of probability and severity of which varies, to the rights and freedoms of natural persons, the Licensee undertakes to implement the appropriate technical and organisational measures to guarantee a level of security appropriate to the risks.

DESCRIPTION OF THE PROCESSING OPERATION

In its capacity as data processor, the Publisher is authorised to process the Personal Data necessary to execute the Contract on behalf of the Licensee, within the context of the Licensee’s use of the MyEGERIE Portal and to carry out the Support services in the event that the Licensee communicates Personal Data within this context.

In this case, the nature of the operations carried out on the Personal Data is: collection, recording, organisation, structuring, conservation, modification, extraction, communication by transmission, making available, deletion.

The purpose(s) of the processing operation is/are the performance of the Contract, namely ensuring the availability of the MyEGERIE Portal and providing Support.

The personal data processed are the Personal Data communicated by the Licensee on the MyEGERIE Portal or during Support services.

The categories of persons concerned are: employees, collaborators and agents of the Licensee, external persons such as suppliers or contacts.

It is understood that the duration of the processing of Personal Data is equivalent to the duration of the Contract, increased by one year with regard to the backups made by EGERIE.

OBLIGATIONS OF THE PUBLISHER

The Publisher undertakes to process the Personal Data in accordance with the Licensee's documented instructions, unless it is required to do so under Union law or the law of the Member State to which the data processor is subject. In this case, the data processor shall inform the controller of this legal obligation prior to the processing operation, unless the law concerned prohibits such notification on important grounds of public interest.

The Licensee's instructions consist of the provisions set out in this Contract, the operations carried out by the Licensee itself within the context of using the MyEGERIE Portal and the Support services and any written instructions from the Licensee communicated by the Licensee to the Publisher within the context of performing the Contract.

The Publisher ensures that persons authorised to process personal data are committed to confidentiality or are subject to an appropriate legal obligation of confidentiality.

In addition to the security clauses of the Licensee Data, and taking into account the state of knowledge consistent with the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing operation as well as the risks, the degree of probability and seriousness of which varies, to the rights and freedoms of individuals, the Publisher undertakes to implement the appropriate technical and organisational measures in order to guarantee a level of security appropriate to the risks.

In view of the nature of the processing of Personal Data, the Publisher undertakes to assist the Licensee, by means of appropriate technical and organisational measures, to the extent possible, in fulfilling its obligation to comply with requests to exercise the rights of individuals pursuant to Articles 15 to 22 of the GDPR.

In addition, the Publisher shall assist the Licensee in ensuring compliance with the obligations set out in Articles 32 to 36 of the GDPR, taking into account the nature of the processing operation and the information available to the Publisher, and in particular, shall provide the Licensee with any pertinent information in its possession, at the Licensee's expense, concerning the impact assessments relating to the protection of Personal Data carried out by and under the sole responsibility of the Licensee as well as any prior consultations with the competent supervisory authority that may result therefrom.

The Publisher shall notify the Licensee as soon as possible after becoming aware of any breach of security of the Personal Data leading, either accidentally or unlawfully, to the destruction, loss, alteration, unauthorised disclosure of or access to Personal Data transmitted, stored or otherwise processed.

As soon as possible after notification of the breach of security of the Personal Data and, to the extent possible, the Publisher shall provide the Licensee with the following information:

The categories and approximate number of persons affected by the breach;
The categories and approximate number of personal data records concerned.

The Licensee authorises the Publisher to use subcontractors to carry out Personal Data processing activities on behalf of the Licensee that are strictly necessary for the performance of the Contract.

The Publisher remains liable to the Licensee for the performance by the said subcontractor of its obligations.

The Publisher shall inform the Licensee of any planned changes concerning the addition or replacement of other subcontractors before any action on the Personal Data by the subcontractor. If, within ten (10) working days from receipt of notification of the said change, the Licensee objects by registered letter with acknowledgement of receipt to this addition or replacement or makes detailed and justified objections to this subcontractor, the Publisher undertakes to examine them in good faith.

The Publisher shall make available to the Licensee, at the Licensee's expense and upon written request, a set of documents to demonstrate and verify compliance with the Publisher's obligations as a data processor under the Applicable Regulations. The Publisher shall immediately inform the Licensee if, in its opinion, an instruction constitutes a breach of this Regulation or of other provisions of Union law or of the law of the Member States relating to data protection.

Upon termination of the Contract, the Publisher will return (under the conditions provided for in the Contract) or delete, at the Licensee's discretion, the Personal Data and any copies thereof, unless European Union law or French law requires the retention of such Personal Data (it being specified that the backups made by EGERIE shall be deleted within one year from the end of the Contract).

The Licensee undertakes to indicate to the Publisher, at the time the Contract is signed, the person to be contacted for any information, communications, notifications or requests. If the Licensee does not indicate this contact person, the Designated User will be considered as the said contact person.

The Publisher undertakes to cooperate with the competent data protection authorities, in particular in the event of a request for information or audit.

SOFTWARE ACQUISITION TERMS OF USE

EGERIE RISK MANAGER AND EGERIE PRIVACY MANAGER

These Terms of Use for the EGERIE Risk Manager Software and/or the EGERIE Privacy Manager Software (hereinafter referred to as the “Software”) apply to all provision of the Software in Acquisition mode by the EGERIE SOFTWARE company, a simplified joint-stock company [Société par actions simplifiée] with registered capital of 388,967.50 euros, having its registered office in Toulon at 44 boulevard de Strasbourg, registered with the Trade and Companies Register of Toulon under the number 817 640 998, represented by its President (hereafter referred to as the “Publisher” or “EGERIE”).

These Terms of Use apply in the case of a subscription to the right to use the Software directly from EGERIE or through an Approved Partner. The terms under which the Services associated with the Software are provided are described in the Maintenance Contract and, where applicable, the Purchase Order or Accepted Quote.

ARTICLE 1. PURPOSE

The purpose of these Terms of Use is to define the terms and conditions for the provision of the Software and the granting by the Publisher to the Licensee and to the Users of non-exclusive rights to use the Software, without authorisation for sub-licensing. These rights to use the Software are non-assignable and non- transferable. The licence granted is an acquisition licence that may be used under the conditions defined below.

The EGERIE Privacy Manager Software is computer software whose function is, in particular, to create, manage, and edit processing sheets and registers of personal data, to verify the conformity of the processing operation with best legal and security practices (as well as the conformity of a measure with the requirements of several standards) and to pre-evaluate the “privacy” risk of each processing operation.

The Software is not a tool for detecting and treating risks in real time, but it offers an analysis based on the data entered or imported by the Licensee. The Software is a decision-making aid and the decision is and remains the sole responsibility of the Licensee.

The Licensee hereby acknowledges that they have read the technical and functional information about the Software. The Licensee acknowledges that the Software and know-how as well as their developments – including any developments that may be suggested by the Licensee or its Users and implemented by EGERIE – are subject to legal protection, in particular with regard to intellectual property rights. As such, the Publisher retains all intellectual property rights over all copyrighted or copyrightable elements relating to the Software and Services.

Likewise, the Licensee remains the owner of all rights to its own data and products.

ARTICLE 2. DEFINITIONS

In these Terms of Use, the terms below used with a capital letter, in the singular or plural, will have the following meaning:

Purchase Order or Accepted Quote: means any document or exchange stipulating the details of the right to use the Software accepted by EGERIE (or the Approved Partner) and the Licensee.
Delivery Note: means the document issued by the Publisher summarising all the characteristics of the order placed by the Licensee, such as the number of Users, with the exception of the price.
Source Code: means the code of the Software deposited with the Agency for the Protection of Programs (APP) by the Publisher for the EGERIE Risk Manager and/or EGERIE Privacy Manager software and the current versions of the Software.
Special Conditions: means the information contained in the Purchase Order or any other document expressly accepted by the Parties concerning the right to use the Software.
Terms of Use: means these terms and conditions.
Terms of Sale: means the Publisher's terms applicable to any order for the right to use the Software and/or Services by the Customer, appended to the Purchase Order, applicable when the Customer enters into a direct agreement with the Publisher.
Contract: means these Terms of Use, including their appendices, the Delivery Note and the Special Conditions or Purchase Order or Accepted Quote, as well as the Terms of Sale in the event of a direct sale by EGERIE.
Documentation: means the technical and functional manuals and all information relating to the Software accessible and updated on the Licensee's MyEGERIE Portal and/or provided by EGERIE.
Licensee Data: means the information (including Personal Data) owned by the Licensee and/or for which it is responsible, which the Licensee enters, fills in, transmits, collects, stores and/or processes and, where applicable, communicates to EGERIE within the context of the use of the Software and the MyEGERIE Portal.
Personal Data: means the personal data that the Customer processes in its capacity as data controller and that EGERIE is likely to process in its capacity as data processor, within the meaning of Law No. 78-17 of 6 January 1978, as amended, known as the law on “Information Technology and Civil Liberties” (the French Data Protection Act), and the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (known as the “GDPR”), this set of regulations being referred to hereinafter as the “Applicable Regulations”.
Licensee: means the legal entity having accepted the Terms of Use and having acquired the right to install and use the Software in Acquisition mode.
Software: means the EGERIE Risk Manager and/or EGERIE Privacy Manager software and all the related object code programs, in the version provided for in the Purchase Order or Accepted Quote, including the Upgrades as defined above, as well as the related Documentation.
Approved Partner: means the company approved by the Publisher that promotes and markets the right to use the Software and Services to the Licensee.
MyEGERIE Portal: means the space made available to the Licensee by the Publisher.
User: means any natural person (such as an employee, subcontractor or consultant of the Licensee) using the Software under the responsibility of the Licensee in accordance with the provisions of the Contract. The Licensee is responsible for the Users' compliance with the Terms of Use and remains solely liable to the Publisher for any breach of the Terms of Use by a User.
Designated User: means any natural person using the MyEGERIE Portal designated in writing to EGERIE at the time of the order.

ARTICLE 3. HIERARCHICAL ORDER OF CONTRACTUAL DOCUMENTS

The Contract consists of the following contractual documents presented in descending order of legal value: these Terms of Use, and where applicable, the Terms of Sale, the appendices, the Delivery Note, the Purchase Order or Accepted Quote. In the event of a contradiction between one and/or several provisions contained in any of these documents, the higher-ranked document takes precedence.

ARTICLE 4. ENTRY INTO FORCE

The Contract comes into force upon the acceptance of the Purchase Order or any document or exchange giving concrete form to the order placed with the Publisher by the Licensee, or where applicable, the Approved Partner. It will remain in force throughout the duration of the intellectual property rights applicable to the Software, unless it is terminated early under the conditions specified below.

The Licensee undertakes to pay the Publisher or its Approved Partner in accordance with the applicable terms of sale.

ARTICLE 5. RIGHTS AND LIMITATIONS OF SOFTWARE USE, INTELLECTUAL PROPERTY

Rights and limitations of use

The Contract gives the Licensee a right to install and use the Software, for the duration of the Contract, which allows the Licensee to use the Software in accordance with its purpose and the Documentation, for its own needs. The number of Users is indicated in the Delivery Note.

In the event that the Licensee wishes to modify the terms of the rights of use subscribed to as specified in the Delivery Note (number of Users, new modules, new versions etc.), the Licensee shall notify the Publisher or Approved Partner in writing. The latter will propose a new quote which must be accepted before the requests are actually updated.

i.e. for the use of the Software in accordance with its Documentation and for its intended purpose. The Licensee may make a backup copy of the Software, unless said copy is provided by the Publisher. The Licensee shall have the same rights and obligations with regard to the backup copy as with regard to the licensed copy of the Software.

Apart from, and without prejudice to, the rights granted in this Contract, the Licensee is not authorised hereunder to:

Copy, print, transfer, pass on or display all or part of the Software;
Sell, rent, sub-license or distribute the Software in any way whatsoever;
Modify the Software and/or merge all or part of the Software into other computer programs without prior authorisation from the Publisher;
Intervene or have a third party intervene on the Software, in particular for maintenance purposes;
Compile, decompile, disassemble, translate, analyse, reverse engineer or attempt to reverse engineer the Software, except to the extent permitted by law;
Carry out any processing or IT services whatsoever for third parties using the Software, and particularly contract work.

The Publisher reserves the right to correct any errors that the Software may contain.

These Terms of Use grant the Licensee a right to install and use the Software for the duration of the intellectual property rights applicable to the Software, and do not grant the Licensee any property right relating to it, its technology, or the intellectual property rights held by the Publisher.

The Licensee agrees that nothing in this Contract shall confer upon it any right, title or interest in the Publisher's distinctive signs.

Source code

The Publisher guarantees that it has deposited the source code of the Software with the Agency for the Protection of Programs under the names EGERIE Risk Manager and EGERIE Privacy Manager with the IDDN numbers: IDDN.FR.001.360008.000.S.P.2019.000.20700, IDDN.FR.001.360008.001.S.P.2019.000.30000, IDDN.FR.001.140014.000.S.P.2018.000.10000, IDDN.FR.001.070014.000.R.C.2013.000.10000.

The Publisher allows the Licensee access to the Software’s source code in the following cases:

In the event of the Publisher's receivership without the Publisher's commitments to the Licensee being included in the decision or judgement ordering the receivership;
In the event of voluntary or compulsory liquidation of the Publisher without the Publisher's commitments towards the Licensee being included in the decision or judgement ordering the liquidation;
In the event of transfer of the Software to a third party without the Publisher's commitments to the Licensee being included in the transfer deed;
In the event of transfer of the Publisher's business and/or goodwill to a third party without the Publisher's commitments to the Licensee being included in the transfer deed.

Access to the deposited elements will take place in the cases provided for above in accordance with the APP’s procedure for access to deposited elements.

Access to the deposited elements will be authorised by the APP Access Committee upon presentation of a copy of the Contract containing the access clause and documents showing indisputably that the criteria of one or more of the cases listed above have been met.

Duplication of the source code will be carried out by an APP agent identically from the last update deposited, unless the Licensee expressly requests access to a previous deposit. The Licensee shall bear the costs associated with the access request and the procedure for making the source code available.

The Licensee may only use the deposited elements within the limits of the rights granted to it by the Publisher; access to the deposited elements does not transfer any other rights.

It is agreed between the Parties that, in addition to the annotated Software programs that can be read and interpreted by any person familiar with the language in which they are written, the source code includes detailed design documentation.

With the exception of the hypotheses previously stated in this article, the Licensee undertakes not to carry out any processing, including consultation, of the source code of the Software. The Licensee undertakes to ensure that this obligation is respected by its employees and agents, and by any third party placed under its responsibility. It shall ensure that this obligation is respected.

ARTICLE 6. OBLIGATIONS OF THE LICENSEE

General obligations of the Licensee

The Licensee undertakes to comply with the prerequisites communicated by EGERIE for the installation and use of the Software.

The Licensee:

⁃ Undertakes to use the Software only in accordance with its professional intended purpose and with its Documentation, and for the sole needs of its activity;

Is solely responsible for the content disseminated and/or downloaded and assumes full responsibility for the nature, content, accuracy, integrity and legality of the data processed, stored or transmitted within the context of the Software, as well as for the exploitation thereof. In particular, given the intended purpose of the Software, the Licensee shall refrain from sending or storing data of a non- professional nature and, more generally, data of an illicit, obscene, or defamatory nature or data that is illegal or in violation of the rights of a third party, of the protection of minors or of privacy;
Undertakes not to distribute the Software, make it available to third parties or rent it;
Undertakes not to alter or disrupt the integrity or execution of the Software or the data contained therein;
Undertakes not to attempt to obtain unauthorised access to the Software or the systems or networks associated with it.

In order to verify the integrity of the Software and compliance with this article, the Software generates requests to the MyEGERIE Portal. The anonymised and encrypted data obtained only enables the Publisher to compare hashes with the associated licence keys.

To verify the integrity of the Software's source code, the Publisher reserves the right to carry out a code audit at the Licensee's premises after giving fifteen (15) days' prior notice.

Use of the Software by the Licensee

The Software will be used by the Licensee under its sole control, direction and responsibility. The Licensee guarantees compliance with this Contract by the Users.

Consequently, the Licensee is responsible, in particular, for the following:

The implementation of all appropriate procedures and measures designed to protect workstations, hardware, software packages, software and passwords, particularly against viruses and intrusions;
The choice of access provider or telecommunications medium; the Licensee must handle administrative requests and take out the necessary subscriptions, the cost of which it will bear;
Prerequisites for the workstations or server as defined in the Documentation;
The appointment, among its staff, of a privileged contact person for the Publisher, acting as the Software administrator for the Licensee;
The use, storage and management of the user names and/or access codes given to it in connection with the performance of the Contract. It shall ensure that no one it has not authorised has access to the Software;
Errors committed by its personnel in the use of the Software and the procedures that enable it to connect to the Software, particularly concerning the means of Internet access and navigation;
The Licensee declares that it is personally responsible for the backup of the data.

With regard to the Licensee Data used in the context of access to the MyEGERIE Portal, the Publisher shall bear no responsibility concerning the quality and electronic transmission of the data when it passes through telecommunication networks, or more generally for the quality and reliability of the telecommunication links between the Licensee's workstations and the Software access point. Furthermore, the Publisher shall bear no responsibility for the accidental destruction of the Licensee Data by the Licensee.

The Licensee's duty of care

Any use of Users’ user names and passwords is deemed to constitute use of the Software by the Licensee,

which the Licensee expressly acknowledges. The Licensee remains responsible for its personnel at all times and is subject to an obligation to supervise them.

The Licensee is solely responsible, in particular, for:

The content of the data, its compliance with applicable regulations, and more generally, any information that the Licensee deposits on the MyEGERIE Portal that it distributes or keeps on its behalf within the context of using the Software;
The regular backup of its data;
Any possible fraudulent use of the user name and/or password or any usurpation of the identity of any of the Users;
Depositing documents or libraries on the MyEGERIE Portal, such as risk analysis models to contribute to the enrichment of the shared resource base. It is the responsibility of the Licensee to ensure their anonymization and the absence of confidential, sensitive or strategic data in the documents made available;
Ensuring that Users have the necessary level of knowledge to use the Software;
Providing Users with the information necessary for the secure use of the Software and, in particular, the obligation to keep their access user names and passwords strictly personal and confidential;
Notifying the Publisher of any modification or change likely to affect the operation of the Software.

Given the nature of the Contract, these Terms of Use do not contain any mechanism for reversibility in the event of the termination of the Contract.

Installation

User Administration

The Licensee has the right to use the Software for the number of Users specified in the Delivery Note. The creation of the account with the “SuperAdministrator” profile is the sole responsibility of the Licensee during the Software initialisation phase, based on the instructions provided by the Publisher. The Licensee undertakes to create and keep the user name and password for the “SuperAdministrator” profile. The Licensee assumes sole responsibility for the security and availability of “SuperAdministrator” administration accounts enabling the administration of the Software.

The creation of the other accounts and the attribution of the associated rights are the responsibility of the Licensee. It is the sole responsibility of the Licensee and its Users to choose user names and passwords that comply with best security practices. In general, the Licensee assumes sole responsibility for the security of the user names and passwords enabling access to the Software, as well as the security of the individual workstations from which Users access the Software.

The Licensee must ensure the non-disclosure of accounts and associated passwords to unauthorised persons.

ARTICLE 7. DATA

Data ownership

Each Party is and shall remain the owner of its own data. Each Party remains the sole owner of the know-how that it possesses independently of this Contract, or that it acquires during the performance of this Contract, and therefore remains free to use it. The Publisher shall therefore be free to perform similar services on behalfof other clients. Neither of the Parties may claim any right whatsoever over the know-how of the other Party.

In particular, the Licensee shall refrain from using documents made available on the MyEGERIE Portal for commercial purposes.

The Publisher is prohibited from using, modifying, assigning or transferring to a third party, in whole or in part, whether in return for payment or free of charge, any data that may have been communicated to it by the Licensee during the performance of the Contract, for purposes other than those of this Contract (including the operations necessary for the Publisher to prepare its invoices and statistics on use and to provide any explanation concerning the performance of the services provided for in the Maintenance Contract where applicable).

Location

The Licensee Data exploited within the framework of using the MyEGERIE Portal is hosted in France.

Protection of personal data

In principle, the provision by EGERIE and the use by the Licensee of the MyEGERIE Portal does not imply the processing by EGERIE of Personal Data and the Licensee undertakes not to communicate Personal Data to EGERIE within this context.

However, should Personal Data be communicated, in order to comply with the Regulations in Force, the following provisions shall apply: within the meaning of the Applicable Regulations, in particular the GDPR, the Publisher acts, in terms of the provision of the MyEGERIE Portal, as a data processor, solely on behalf and on the instructions of the Licensee, who is qualified as the data controller for the Personal Data.

The obligations of the Publisher and the Licensee, relating to the protection of personal data, are set out in Appendix 2.

Protection of strategic data

Strategic data corresponds to the non-personal data that is of particular importance to the Licensee.

The Licensee declares that the Licensee Data processed in the context of the use of the MyEGERIE Portal does not include strategic data. Likewise, it declares that it will not forward strategic data to the Publisher.

The Publisher shall bear no responsibility in the event of the storage, loading or sharing of strategic data by the Licensee.

ARTICLE 8. EGERIE’S OBLIGATIONS

Provision of the Software

The Publisher sends the Delivery Note with the address of the MyEGERIE Portal, as well as the user names and access codes of the designated users of the MyEGERIE Portal and of the Support services. The Licensee will receive a separate e-mail containing the Software license activation key in accordance with the planned number of Users

Access to the MyEGERIE Portal enables designated Users to download and consult the installation guides (technical prerequisites and installation procedure), the user and administration guides for the Software as well as all the functional documents relating to the Software.

Under no circumstances may the Publisher be held liable in the event of a failure to make the Software available attributable to the Licensee or in a case of force majeure.

The Publisher undertakes to ensure a connection to the download platforms based on an uninterrupted connection 7 days a week and 24 hours a day.

The following will not be taken into account:

Outages of the Licensee's software;
Outages of the Licensee's equipment;
Outages due to the Internet or the operators’ connections connecting the Licensee to the Internet;
Interruptions to the Publisher’s infrastructure lasting less than 60 minutes.

Under no circumstances may the Publisher be held liable in the event of a failure to make the Software available attributable to the Licensee or in a case of force majeure.

Services

Under these Terms of Use, the Licensee does not benefit from the provision of any services not specified on the Order Form or Accepted Quote, such as maintenance or support services, or updates or new major versions of the Software.

However, the Licensee may subscribe to a Maintenance Contract, under the terms of which the Publisher will undertake to provide maintenance and support for the Software for a specific period under specific conditions.

The Contract also excludes any work and interventions relating to the installation and proper functioning of the Licensee’s workstations and the Licensee's infrastructure (telecommunications, networks, security equipment) enabling the Licensee to access and use the Software, or services for modifying the Software (e.g. installation, customisation, recovery of existing elements).

These services are not included in this Contract and may be the subject of a specific agreement with specific pricing by the Publisher or the Approved Partner.

ARTICLE 9. COLLABORATION BETWEEN THE PARTIES

The proper performance of the Contract requires faithful, active and permanent collaboration between the Parties.

Therefore, each of the Parties undertakes to:

Be actively involved in the fulfilment of its obligations;
Refrain from any behaviour which may affect and/or hinder the performance of the other Party's obligations;
Provide each other, in a timely manner, with all the information and documents necessary for the performance of the Contract.

In addition, the Licensee undertakes to maintain sufficiently competent, qualified and trained Users throughout the duration of the execution of these terms and conditions.

ARTICLE 10. LIABILITY

The Publisher may under no circumstances be held liable for any indirect damage suffered by the Licensee that may arise from or during the performance of this Contract and its consequences.

Indirect damage includes, but is not limited to, loss of earnings or profits, loss of data, loss of opportunity, commercial damages, the consequences of complaints or claims by third parties against the Licensee, notwithstanding the fact that the Publisher would have been warned of the possibility of its occurrence.

With the exception of the provisions of the article relating to the hold harmless clause or in the event of gross negligence or wilful misconduct on the part of the Publisher, the liability of the latter, in the event of damage occurring to the Licensee, for any reason whatsoever and whatever the legal basis invoked or retained, all combined and cumulative damages shall be expressly limited and may under no circumstances exceed 75% of the sums actually collected by the Publisher under the Contract or, where applicable, the ceiling specified in article 11 below.

The Publisher shall bear no responsibility in case of:

Use of the Software in a manner not provided for in the User Documentation or use not expressly authorised by these Terms of Use;
Modification of all or part of the functions or information accessible via the Software not carried out by the Publisher or by one of the Approved Partners designated by the latter;
Use of all or part of the Software when the Publisher, following a problem or for any other reason whatsoever, had recommended that its use be suspended;
Use of the Software in an environment or configuration that does not comply with the Publisher’s technical prerequisites, or in connection with programs or data from third parties not expressly approved by the Publisher;
Loss of Licensee Data following an intervention by the Publisher or an Approved Partner appointed by the Licensee or by the Publisher, where the Licensee has not taken the precaution of backing up its data prior to this intervention when requested to do so;
The occurrence of any damage resulting from the Licensee's fault or negligence, or which the Licensee could have avoided by asking for the Publisher's advice;
Use in connection with programs not supplied or endorsed by the Publisher and likely to affect the Licensee's data;
Loss by the Licensee of the user names and passwords of the SuperAdministrator accounts,
Failure to back up data by Users;
Failure to install the updates recommended by the Publisher.

ARTICLE 11. GUARANTEES

In light of the highly technical nature of the Software and the limitations of the state of the art, EGERIE cannot guarantee the fault-free or uninterrupted operation of the Software. EGERIE will intervene within the framework of a best-efforts obligation and under the conditions provided for in these Terms of Use.

Software errors, updates, developments, new major versions and operating incidents will be covered by a Maintenance Contract that will be offered by the Publisher or the Approved Partner to the Licensee.

The Publisher guarantees the Licensee that it holds all the rights enabling it to enter into the Contract.

The Publisher shall have exclusive control over the manner of conducting the defence against the action and shall be free to settle or continue any proceedings of its choice. The Licensee shall provide the Publisher with all the information, elements and assistance needed to enable it to carry out its defence or to reach a settlement agreement.

If all or part of the Software is acknowledged by a final court decision as constituting an infringement, or if the Publisher considers that it is likely that the Software, in whole or in part, will be considered as infringing, the Publisher may either provide the Licensee with non-infringing software having the same functions, or obtain the right for the Licensee to continue to use and exploit the Software, or terminate the Contract. In this case, the Publisher will compensate the Licensee according to the following terms, to the exclusion of any other compensation:

If the prohibition on using the Software occurs within the three years following the signature of the Contract, the Publisher will refund the sums paid by the Licensee to acquire the rights to use the Software granted by these Terms of Use;
If the prohibition on using the Software occurs within the fourth year following the signature of the Contract, the Publisher will refund 50% of the sums paid by the Licensee to acquire the rights to use the Software granted by these Terms of Use;
If the prohibition on using the Software occurs within the fifth year following the signature of the Contract, the Publisher will refund 25% of the sums paid by the Licensee to acquire the rights to use the Software granted by these Terms of Use;
If the prohibition on using the Software occurs after five years following the signature of the Contract, the Publisher will retain the sums paid by the Licensee to acquire the rights to use the Software granted by these Terms of Use.

ARTICLE 12. TERMINATION

The Contract may be terminated automatically and without formalities by either of the Parties in the event of a breach by the other Party of any of its obligations under the terms of the Contract, and in particular the obligations set out in Articles 5 to 8, 14, 15.1 and 15.5, if this breach is not remedied within thirty (30) days following receipt by the Party in breach of a registered letter with acknowledgement of receipt giving notification of this breach and without prejudice to any damages to which the Party having initiated the termination may be entitled.

In the event of termination of this contractual relationship for any reason whatsoever, the Licensee undertakes either to return to the Publisher, within thirty (30) days of the end of the contractual relationship, all of the constituent components of the Software, including the license activation key, the media and all copies that may have been made, guaranteeing in writing the entirety of this return, or provide in writing a certificate attesting to the destruction of the Software, the license activation key, its media and all copies that may have been made.

The Licensee undertakes to export its Licensee Data or, upon written request from the Licensee, the Publisher may return the Licensee Data to the Licensee in accordance with Article 7.5 of these Terms of Use.

ARTICLE 13. REFERENCES

The Licensee grants the Publisher a non-exclusive worldwide licence, free of charge and subject to sub- licensing, for the duration of this Contract, enabling it to use the Licensee’s distinctive signs as a reference on its commercial media (paper and electronic) for the purpose of promoting and marketing the Publisher's services.

The Parties may mention their collaboration and use their contact details as a commercial reference. As such, the Parties expressly authorise each other to link to their respective websites with hypertext links.

ARTICLE 14. CONFIDENTIALITY

For the purposes of this Contract, these Terms of Use and all information or data of any nature whatsoever, including technical, commercial, strategic, financial, economic or legal information in any form or medium whatsoever, which is received and/or exchanged between the Parties during the negotiation and/or performance of the Contract, shall be considered confidential information (hereinafter “Confidential Information”).

The User and Administrator documentation transferred by EGERIE,
The technical documentation of the Software,
Libraries of risk analyses or modelling examples,
The user interface and visual representations associated with risk modelling,
The original functionality of the Software,
If applicable, the Source Code of the Software.

Confidential Information is not considered to be information that:

Is, as of the signature date of the Contract, publicly known, or which will become publicly known subsequently to the Contract, but, in any event, in the absence of any fault of the parties in its obligation of confidentiality;
Was in the lawful possession of the other Party prior to its disclosure and was not obtained by it directly or indirectly from the disclosing Party, and if that Party can prove such prior personal possession;
Is received from a third party in a lawful and unrestricted manner. The Parties acknowledge that any Confidential Information remains in any case the exclusive property of the party communicating it, and that its transmission does not confer any ownership or right of use over all or part of the content of the Confidential Information to the party receiving it.

In this respect, the Parties undertake within the framework of the Contract:

To use the Confidential Information only for the purposes of the Contract;
To take all necessary measures to protect the confidentiality of this Confidential Information;
To keep confidential and not to disclose or publish such Confidential Information – by any means whatsoever and for any purpose whatsoever, either directly or indirectly – to third parties to the contract to which they are parties, without the prior written authorisation of the Party that communicated it and which the latter may refuse at its sole discretion.

Confidential Information may be communicated only to the Parties' employees, within the limit of what they need to know to perform their duties under this Contract. Each of the Parties concerned shall remain responsible for its employees’ compliance with their obligations. Any breach of this obligation of confidentiality by either of the Parties shall entitle the other Party to automatically terminate these Terms of Use, subject to thirty (30) days' notice, without the defaulting Party being entitled to claim compensation of any kind, and notwithstanding any damages to which the non-defaulting Party may be entitled.

ARTICLE 15. MISCELLANEOUS

Non solicitation of personnel

During the performance of this Contract and for two (2) years following its term, the Licensee will expressly refrain from hiring or causing to work, either directly or indirectly through an intermediary, for any reason whatsoever, any of the Publisher's employees who have participated in the performance of the Contract, regardless of their specialisation.

Any failure to comply with this obligation shall expose the Licensee to immediately paying the Publisher an indemnity equal to the gross earnings of the last eighteen (18) months of the person concerned, plus employer's charges, without prejudice to damages and interest.

Independence of the parties

Each Party is a legally and financially independent legal entity, acting in its own name and under its sole responsibility. The Contract constitutes neither an association nor a mandate given by either Party to the other. Each Party shall therefore refrain from entering into a commitment in the name and on behalf of the other Party, for which it can in no way substitute itself.

Force Majeure

Neither of the Parties may be held liable for a breach of any of its obligations under the Contract resulting from the occurrence of a case of force majeure, provided, however, that:

The Party invoking such a case notifies the other Party of its existence as soon as possible;
It does everything necessary to limit the consequences; and
It resumes the execution of the Contract immediately after this case of force majeure has disappeared.

The case of force majeure suspends the obligations arising from the Contract for the entire duration of its existence, with the exception of those obligations that may reasonably be interpreted as surviving the suspension, such as the obligations relating to confidentiality and respect for the Publisher's property rights over the Software.

If the case of force majeure persists for more than fifteen (15) consecutive days, it shall give rise to the right to automatically terminate the Contract.

For the application of this Contract, the following events in particular are included in the definition of force majeure: breakdown or failure of the hosting company; electrical power failure, fire, flood, natural disaster; strike; war; epidemic; attacks; uprising; demonstration.

Amendments to the Contract

The Contract may only be modified or amended by means of a written amendment signed by a person duly authorised to represent each of the Parties.

Assignment of the contract

The Publisher reserves the right to transfer the rights and obligations of this Contract to any other person. If the Licensee wishes to assign the Contract, in particular in the event of restructuring or a change of control, it undertakes to inform the Publisher in writing without delay and prior to the transaction of the terms and

conditions of the assignment, and the Publisher reserves the right to object in the event of assignment, either directly or indirectly, to a competitor of the Publisher.

Titles

Non-waiver

Nullity and independence of clauses

The possible annulment of one or more of the clauses herein, by a court decision, an arbitration award or by mutual agreement between the Parties, shall not affect the other stipulations, which shall continue to have their full and complete effect provided that the general scheme of the agreement can be safeguarded.

Applicable law and jurisdiction

APPENDIX 1: OPEN-SOURCE SOFTWARE USED FOR THE EGERIE RISK MANAGER AND EGERIE PRIVACY MANAGER SOFTWARE

SERVER LIBRARIES

silex/silex (v1.2) —> MIT Licence
twig/twig (v1.16) —> BSD Licence
symfony/monolog-bridge (v2.4) —> MIT Licence
silex/web-profiler (v1.0) —> MIT Licence
symfony/translation (v2.3) —> MIT Licence
symfony/config (v2.3) —> MIT Licence
symfony/yaml (v2.3) —> MIT Licence
symfony/security (v2.8.33) —> MIT Licence
symfony/twig-bridge (v2.4) —> MIT Licence
symfony/validator (v2.8) —> MIT Licence
dflydev/doctrine-orm-service-provider (v1.0) —> MIT Licence
knplabs/console-service-provider (v1.0) —> MIT Licence
saxulum/saxulum-webprofiler-provider (v1.1) —> MIT Licence
dominikzogg/doctrine-orm-manager-registry-provider (v1.2) —> MIT Licence
doctrine/doctrine-bundle (v1.5) —> MIT Licence
gedmo/doctrine-extensions (v2.4) —> MIT Licence
jms/serializer (v1.1) —> MIT Licence
kriansa/h2p (v2.0) —> MIT Licence
jakoch/phantomjs-installer (v2.1) —> MIT Licence
gargron/fileupload (v1.5.1) —> MIT Licence
symfony/form (v2.8) —> MIT Licence
symfony/serializer (v3.1) —> MIT Licence
symfony/doctrine-bridge (v2.7) —> MIT Licence
ezyang/htmlpurifier (v4.9) —> LGPL Licence -2.1-or-later
behat/mink-goutte-driver (v1.2) —> MIT Licence
behat/mink-browserkit-driver (v1.3) —> MIT Licence
swiftmailer/swiftmailer (v5.4) —> MIT Licence
dmore/behat-chrome-extension (v1.2) —> MIT Licence
jumbojett/openid-connect-php (v0.3.0) —> Apache-2.0 Licence
cnam/security-jwt-service-provider (v1) —> GNU Licence General Public License v2.0
ramsey/uuid-doctrine (v1.4) —> MIT Licence
saxulum/saxulum-doctrine-orm-manager-registry-provider (v2.2) —> MIT Licence
onelogin/php-saml (v3.2) —> MIT Licence
symfony/browser-kit (v2.4) —> MIT Licence
symfony/css-selector (v2.4) —> MIT Licence
phpunit/phpunit (v5.6) —> 3-Clause BSD Licence
behat/behat (v3.5) —> MIT Licence
behat/mink (v1.7) —> MIT Licence
behat/mink-extension (v2.3) —> MIT Licence
behat/mink-selenium2-driver (v1.3) —> MIT Licence
behat/mink-sahi-driver (v1.2) —> MIT Licence

CLIENT LIBRAIRIES (BROWSER)

select2 (v2 4.0.3) —> MIT Licence
bootstrap-slider.min.js (v10.0.0) —> MIT Licence
jquery.fileDownload (v1.4.4) —> MIT Licence
jquery.slimscroll (v1.2.0) —> MIT Licence

⁃ bootstrap-toggle.min (v2.2.0) —> MIT Licence

tinymce (v4.7.4) —> LGPL-2.1-only Licence
bootstrap-multiselect.min (v2.0) —> Apache Licence 2.0
jquery (v1.9) —> MIT Licence
bootstrap (v3.3.5) —> MIT Licence
reactJS (v15.0.0) —> MIT Licence
react-dom (v15.0.0) —> MIT Licence

PURCHASED CLIENT LIBRAIRIES (BROWSER):

RappidJS https://www.jointjs.com/
Highcharts https://shop.highsoft.com/
Color Admin theme https://wrapbootstrap.com/theme/color-admin-5-admin-template-4-frontend- WB0N89JMK

SYSTEM COMPONENTS:

Debian —> GPL Licence
MySQL —> GPL Licence
PHP —> Non Copyleft Licence
Apache —> GPL Licence
Samba —> GPL Licence

APPENDIX 2: COMPLIANCE WITH THE GDPR (DATA PROCESSING ADDENDUM)

If, however, Personal Data is communicated, in order to comply with the Applicable Regulations, the following provisions shall apply.

Within the meaning of the Applicable Regulations, the Publisher acts as a data processor, solely on behalf and on the instructions of the Licensee, who is qualified as the data controller for the Personal Data. The said instructions must comply with the Applicable Regulations.

Taking into account the current state of knowledge, consistent with the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risks, of varying degrees of probability and severity, to the rights and freedoms of natural persons, the Customer undertakes to implement the appropriate technical and organisational measures to guarantee a level of security appropriate to the risks.

ARTICLE 1. DESCRIPTION OF THE PROCESSING OPERATIONS

In its capacity as data processor, the Publisher is authorised to process the Personal Data necessary to execute the Contract on behalf of the Licensee, within the context of the Licensee’s use of the MyEGERIE Portal in the event that the Licensee communicates Personal Data within this context.

The purpose(s) of the processing operation is/are the performance of the Contract, namely ensuring the availability of the MyEGERIE Portal.

The personal data processed is the Personal Data communicated by the Licensee on the MyEGERIE Portal.

The categories of persons concerned are: employees, collaborators and agents of the Licensee, external persons such as suppliers or contacts.

It is agreed that the duration of the processing of Personal Data is equivalent to the duration of the Contract, increased by one year with regard to the backups made by EGERIE.

ARTICLE 2. OBLIGATIONS OF THE PUBLISHER

The Publisher undertakes to process the Personal Data in accordance with the Licensee’s documented instructions, unless it is required to do so under the terms of Union law or the law of the Member State to which the data processor is subject. In this case, the data processor shall inform the data controller of this legal obligation prior to the processing operation, unless the law concerned prohibits such notification on important grounds of public interest.

The Licensee's instructions consist of the provisions set out in this Contract, the operations carried out by the Licensee itself within the context of using the MyEGERIE Portal and any written instructions from the Licensee communicated by the Licensee to the Publisher within the context of performing the Contract.

The Publisher ensures that persons authorised to process personal data undertake to respect confidentiality or are subject to an appropriate legal obligation of confidentiality.

In addition to the Licensee Data security clauses, and taking into account the state of knowledge consistent with the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing operations as well as the risks, of varying degrees of probability and severity, to the rights and freedoms of individuals, the Publisher undertakes to implement the appropriate technical and organisational measures in order to guarantee a level of security appropriate to the risks.

In view of the nature of the processing of Personal Data, the Publisher undertakes to assist the Licensee to the extent possible, by means of appropriate technical and organisational measures, in fulfilling its obligation to comply with requests to exercise the rights of individuals pursuant to Articles 15 to 22 of the GDPR.

In addition, the Publisher shall assist the Licensee in ensuring compliance with the obligations set out in Articles 32 to 36 of the GDPR, taking into account the nature of the processing operations and the information available to the Publisher, and, in particular, shall provide the Licensee with any pertinent information in its possession, at the Licensee's expense, concerning the impact assessments relating to the protection of Personal Data carried out by and under the sole responsibility of the Licensee as well as any prior consultations with the competent supervisory authority that may result therefrom.

The Publisher shall notify the Licensee as soon as possible after becoming aware of any breach of security of the Personal Data leading, either accidentally or unlawfully, to the destruction, loss, alteration, unauthorised disclosure of Personal Data transmitted, stored or otherwise processed in any other way, or unauthorised access to such Personal Data.

As soon as possible after notification of the breach of security of the Personal Data and to the extent possible, the Publisher shall provide the Licensee with the following information:

The categories and approximate number of persons affected by the breach;
The categories and approximate number of personal data records concerned.

The Licensee authorises the Publisher to use subcontractors to carry out Personal Data processing activities on behalf of the Licensee that are strictly necessary for the performance of the Contract.

The Publisher remains liable to the Licensee for the performance by the said subcontractor of its obligations.

including companies established in the United States of America with “Privacy Shield” certification, without putting in place adequate tools to supervise these transfers in application of Article 46 of the GDPR and outside the needs which are strictly necessary in application of the Contract.

The Publisher undertakes to cooperate with the competent data protection authorities, in particular in the event of a request for information or audit.

TERMS OF SALE FOR ON PREMISE / SAAS SUBSCRIPTION OF EGERIE RISK MANAGER AND EGERIE PRIVACY MANAGER

ARTICLE 1. PURPOSE

Acceptance of the Quote or the sending of a Purchase Order constitutes acceptance of these Terms of Sale by the Buyer and of the Terms of Use by the Customer.

ARTICLE 2. DEFINITIONS

In these Terms of Use, the terms below used with a capital letter, in the singular or plural, will have the following meaning:

Purchase Order or Accepted Quote: means any document or exchange stipulating the details of the right to use the Software and Services accepted by EGERIE and the Buyer.
Delivery note: means the document issued by the Publisher recalling all the characteristics of the order made by the Buyer, such as the number of Users, with the exception of the price.
Conditions of Use: conditions of use of the Software provided by EGERIE or the Approved Partner, which the Customer undertakes to accept in order to benefit from access to the Software and Services.
Contract: means these Terms of Sale as well as any document annexed thereto, in particular the Purchase Order or Accepted Quote.
Documentation: means the technical and functional manuals and all information relating to the Software, accessible and updated on the MyEgerie Portal of the Customer or the Approved Partner and/or provided by EGERIE.
Upgrade: means the functional and/or technical upgrade of the Software, as provided by regular updates, identified by the passage from one minor version to the next (the minor version number being identified by the second digit of the version number (Y for a version named x.Yz)) or from one revision of a minor version to the next (the number of a revision being identified by the third digit of the version number (Z for a version named x.yZ)). The term Upgrade does not include Major Versions and new modules.

⁃ Customer: means the legal entity having accepted the Terms of Use and benefiting from the right to use the Software and Services.

Software: refers to the EGERIE Risk Manager and/or EGERIE Privacy Manager software and all the related object code programs, in the version provided for in the Purchase Order or accepted Quote, including the Upgrades as defined above, as well as the related Documentation.
Approved Partner: means the company approved by the Publisher that promotes and markets the right to use the Software and Services to a Customer.

MyEGERIE Portal: means the Publisher's portal giving the Customer or Authorised Partner access to a dedicated area.
Service(s): means all the services associated with the Software provided by EGERIE or an Approved Partner, such as support and maintenance services which may or may not be included in the subscription for the right to use the Software in accordance with what is specified in the Purchase Order or Accepted Quote and the Additional Services.
Additional Service(s): means the services provided by the Authorised Partner or the Publisher not included in the right to use the Software, specifically provided for in the Purchase Order or accepted Quote.
User: means any natural person (such as an employee, subcontractor or consultant of the Licensee) using the Software under the responsibility of the Licensee in accordance with the provisions of the Contract. The Licensee is responsible for the Users' compliance with the Terms of Use and remains solely liable to the Publisher for any breach of the Terms of Use by a User.
Major Version: means a version of the Software launched on the market by the Publisher, including a set of computer programs identified by the version number (the major version number being identified by the first digit of the version number (X for a version named X.yz)). The notion of Major Version does not include new modules.

The notions that are not defined in these Terms of Sale are defined in the Terms of Use, which the Buyer undertakes to read.

ARTICLE 3. CHARACTERISTICS OF THE SOFTWARE AND SERVICES

These Terms of Sale relate to the subscription of a right of access and, where applicable, installation of the Software, for a period specified in the Purchase Order or Accepted Quote.

The Software may be made available to the Customer:

Either by making a downloadable copy of the Software available for local installation at the Customer's premises (On Premise), including (i) access to Upgrades and new Major Versions of the Software and (ii) support and maintenance services as defined in the Terms of Use.
Or by making the Software available as an application which is accessible remotely by the Customer via the Internet (SaaS (Software as a Service)), including (i) access to the Software, (ii) hosting of the Software and data, (iii) access to the Upgrades and new Major Versions of the Software and (iv) support and maintenance services as defined in the Terms of Use.

ARTICLE 4. ACCESS TO THE SOFTWARE

After receipt of the Accepted Quote or Purchase Order by the Publisher, the Publisher makes the Software available in accordance with the provisions of the Terms of Use.

ARTICLE 5. PRICE

Any potential price reduction will be indicated on the Purchase Order or Accepted Quote.

ARTICLE 6. TERMS OF INVOICING

The rights to use the Software and Services will be invoiced in accordance with the Purchase Order or Accepted Quote and the Terms of Use.

In the event of an order concerning several Software programs and/or Services, each order may be subject to partial invoicing, relating to each Software program and/or Service.

ARTICLE 7. TERMS OF PAYMENT

The Publisher's invoices will be paid by the Buyer by bank transfer or credit card.

Unless otherwise agreed between the Parties and shown on the Purchase Order or Accepted Quote, payment shall be made within 45 days from the date of issue of the invoice.

ARTICLE 8. PRICE REVISION

days before the expiry date, but may not exceed the increase resulting from the application of the following formula: P = Po x S / So where:

P = price after revision.

Po = initial price for the first revision, then price from the previous revision for subsequent revisions.

S = most recent Syntec index published on the price revision date.

In the event of the disappearance of the aforementioned index, the Parties shall agree on the new index for the purpose of establishing a formula with a comparable effect.

ARTICLE 9. LATE PENALTIES AND SUSPENSION OF THE CONTRACT

Furthermore, the Buyer’s failure to pay an invoice that has come due will entitle the Publisher to demand payment of all other invoices, including those that are not yet overdue.

The Publisher reserves the right to decide how partial payments made by the Buyer will be off-set against the sums due to the Publisher.

ARTICLE 10. MISCELLANEOUS

30.1.Non solicitation of personnel

The Buyer expressly waives, during the performance of this Contract and for two (2) years following its term, for any reason whatsoever, to hire or cause to work,

30.2.Independence of the parties

30.3.Force Majeure

Neither of the Parties may be held liable for a breach of any of its obligations under the Contract resulting from the occurrence of a case of force majeure, provided, however, that:

The Party invoking such a case notifies the other Party of its existence as soon as possible,
It does everything necessary to limit the consequences, and
It resumes the execution of the Contract immediately after this case of force majeure has disappeared.

30.4.Titles

30.5.No waiver

30.6.Nullity and independence of clauses

30.7.Applicable law, jurisdiction

TERMS OF USE FOR SAAS MODE SUBSCRIPTION TO EGERIE RISK MANAGER AND EGERIE PRIVACY MANAGER

These Terms of Use apply in the event of subscription to the right to use the Software and/or the provision of Services directly with EGERIE or through an Approved Partner.

ARTICLE 1. PURPOSE

Likewise, the Customer remains the owner of all rights to its own data and products.

ARTICLE 2. DEFINITIONS

In these Terms of Use, the terms below used with a capital letter, in the singular or plural, will have the following meaning:

Anomaly: means any incident, defect, malfunction or non-conformity of the Software's functionalities in relation to the Documentation, reproducible by the Customer and verified by the Publisher, which prevents the normal operation of all or part of the Software or which causes an incorrect result or inappropriate processing operation when the Software is used in accordance with its Documentation and for its intended purpose.
Blocking Anomaly: means an Anomaly that renders the Software or one of its essential functions totally unavailable.
Non-Blocking Anomaly: means any Anomaly that affects the operation of the Software but does not constitute a Blocking Anomaly or a Semi-Blocking Anomaly.
Semi-Blocking Anomaly: means any Anomaly allowing only partial use of the Software's functions.
Purchase Order or Accepted Quote: means any document or exchange stipulating the details of the right to use the Software and Services accepted by EGERIE (or the Approved Partner) and the Customer;
Delivery note: means the document issued by the Publisher recalling all the characteristics of the order made by the Customer, such as the number of Users, with the exception of the price.
Customer: means the legal entity having accepted the Terms of Use and having acquired the right to use the Software in SaaS mode.
Special Conditions: means the information contained in the Order Form or any other document expressly accepted by the Parties concerning the right to use the Software or the Services.
Terms of Use: means these terms and conditions.
Terms of Sale: means the Publisher's terms applicable to any order for the right to use the Software and/or Services by the Customer, appended to the Order Form, applicable when the Customer enters into a direct agreement with the Publisher.
Contract: means these Terms of Use, including their appendices, the Delivery Note and the Special Conditions or Purchase Order or Accepted Quote.
Documentation: means the technical and functional manuals and all information relating to the Software accessible and updated on the Customer's MyEGERIE Portal and/or provided by EGERIE.
Customer Data: means the information (including Personal Data) owned by the Customer and/or for which they are responsible, which the Customer enters, fills in, transmits, collects, stores and/or processes and, where applicable, communicates to EGERIE within the context of the Support and the use of the Software and the MyEGERIE Portal.
Personal data: means the personal data that the Customer processes in their capacity as data controller and that EGERIE is likely to process in its capacity as data processor, within the meaning of Law No. 78-17 of 6 January 1978, as amended, known as the law on “Information Technology, Data Files, and Civil Liberties” (French Data Protection Act) 2016/679 of the European Parliament and of the Council of 27 April 2016 (known as the “GDPR”), this set of regulations being referred to hereinafter as the “Applicable Regulations”.
Upgrade: means the functional and/or technical upgrade of the Software, as provided by regular updates, identified by the passage from one minor version to the next (the minor version number being identified by the second digit of the version number (Y for a version named x.Yz)) or from one revision of a minor version to the next (the number of a revision being identified by the third digit of the version number (Z for a version named x.yZ)). The term Upgrade does not include Major Versions and new modules.
Working day: means a day between Monday and Friday which is not a public holiday in mainland France.
Software: refers to the EGERIE Risk Manager and/or EGERIE Privacy Manager software and all the related object code programs, in the version provided for in the Purchase Order or Accepted Quote, including the Upgrades as defined above, as well as the related Documentation.
Maintenance: means all the services and actions provided by the Publisher with a view to the continuous operation, the revision and improvement of the Software, described in Appendix 1.
Approved Partner: means the company approved by the Publisher that promotes and markets the right to use the Software and Services to a Customer.
MyEGERIE Portal: means the space made available to the Customer by the Publisher.
Service(s): means all the services associated with the Software provided by EGERIE or an Approved Partner, such as Support and Maintenance services which are included in the subscription for the right to use the Software and the Additional Services expressly provided for in the Purchase Order or accepted Quote.
Additional Service(s): means the services provided by the Authorised Partner or the Publisher not included in the right to use the Software, specifically provided for in the Purchase Order or accepted Quote.
Support: means all the technical or functional services provided by the Publisher or its Authorised Partner following a support request described in Appendix 1.
User: means any natural person (such as an employee, subcontractor or consultant of the Customer) using the Software under the responsibility of the Customer in accordance with the provisions of the Contract. The Customer is responsible for the Users' compliance with the Terms of Use and remains solely liable to the Publisher for any breach of the Terms of Use by a User.
Designated User: means any natural person using the MyEGERIE Portal and the Support service described in writing to EGERIE at the time of the order.
Major Version: means a version of the Software launched on the market by the Publisher, including a set of computer programs identified by the version number (the major version number being identified by the first digit of the version number (X for a version named X.yz)). The notion of Major Version does not include new modules.

ARTICLE 3. HIERARCHICAL ORDER OF CONTRACTUAL DOCUMENTS

In the event of a contradiction between one and/or more provisions contained in any of these documents, the higher-ranked document shall prevail.

ARTICLE 4. ENTRY INTO FORCE – DURATION – RENEWAL

At the end of the initial term, unless otherwise stated in the Purchase Order or Accepted Quote, the Contract may only be renewed by written agreement of both Parties.

The Customer undertakes to pay the Publisher or its Authorised Partner in accordance with the applicable terms of sale.

ARTICLE 5. RIGHTS AND LIMITATIONS OF SOFTWARE USE, INTELLECTUAL PROPERTY

The Contract grants the Customer the right to access and use the Software remotely via the Internet for a specified period of time, including:

Access to the Software,
Hosting of the Software and Customer Data,
Access to Software Upgrades and Major Versions
The Support and Maintenance services provided for in this Contract, and
Where applicable, the Additional Services appearing in the Order Form or Accepted Quote.

Apart from, and without prejudice to, the rights granted in this Contract, the Customer is not authorised hereunder to:

Copy, print, transfer, forward or display all or part of the Software;
Permanently or temporarily reproduce the Software in whole or in part, by any means and in any form;
Sell, rent, sub-license, distribute or make the Software available to third parties in any way whatsoever;
Modify the Software and/or merge all or part of the Software into other computer programs without prior authorisation from the Publisher;
Intervene or have a third party intervene on the Software, in particular for maintenance purposes;
Compile, decompile, disassemble, translate, analyse, reverse engineer or attempt to reverse engineer the Software, except to the extent permitted by law;
Carry out any processing or IT services whatsoever for third parties using the Software, in particular contract work.

It is specified that the Publisher reserves the right to correct any errors that the Software may contain.

The Customer agrees that nothing in this Contract shall confer upon it any right, title or interest in the Publisher's distinctive signs.

ARTICLE 6. OBLIGATIONS OF THE CUSTOMER

General Obligations of the Customer

The Customer undertakes to comply with the prerequisites communicated by EGERIE for the access and use of the Software.

The Customer:

Undertakes to use the Software only in accordance with its professional purpose and with its Documentation, and for the sole needs of its activity;
Is solely responsible for the content disseminated and/or downloaded and assumes full responsibility for the nature, content, accuracy, integrity and legality of the data processed, stored or transmitted within the context of using the Software, as well as for the exploitation thereof. In particular, given the intended use of the Software, the Customer shall refrain from sending or storing data of a non-professional nature and, more generally, data of an illicit, obscene, or defamatory nature or data that is illegal or in violation of the rights of a third party, of the protection of minors or of privacy;
Undertakes not to distribute the Software, make it available to third parties or rent it;
Undertakes not to alter or disrupt the integrity or execution of the Software or the data contained therein;
Undertakes not to attempt to obtain unauthorised access to the Software or the systems or networks associated with it.

Use of the Software by the Customer

The Software will be used by the Customer under its sole control, direction and responsibility. The Customer guarantees compliance with this Contract by the Users.

Consequently, the Customer is responsible, in particular, for the following:

The implementation of all appropriate procedures and measures designed to protect workstations, hardware, software packages, software, passwords, in particular against viruses and intrusions;
The choice of access provider or telecommunications medium, the Customer must handle administrative requests and take out the necessary subscriptions, the cost of which it will bear;
The appointment, among its staff, of a privileged contact person for the Publisher acting as administrator for the Customer, and in particular as regards Support;
The use of the usernames or access codes given to him/her in connection with the performance of the Contract.

It will ensure that no one it has not authorised has access to the Software;

Errors committed by its personnel in the use of the Software and the procedures that enable it to connect to the Software, particularly concerning the means of Internet access and navigation.

The Customer's duty of care

The Customer is solely responsible, in particular, for:

The content of the data, their compliance with applicable regulations, and more generally, any information that it deposits on the MyEGERIE Portal that it distributes or keeps on its behalf within the framework of the Contract;
Any possible fraudulent use of the username and/or password or any usurpation of the identity of one of the Users;
Depositing documents or libraries on the MyEGERIE Portal, such as risk analysis models to contribute to the enrichment of the shared resource base. It is the responsibility of the Customer to ensure their anonymisation and the absence of confidential, sensitive or strategic data in the documents made available;
Ensuring that Users have the necessary level of knowledge to use the Software;
Providing Users with the information necessary for the secure use of the Software, and in particular, the obligation to keep their access usernames and passwords strictly personal and confidential;
Notifying the Publisher of any modification or change likely to affect the operation of the Software.

User Administration

The Customer has the right to access and use the Software for the number of Users specified in the Delivery Note.

The creation of the initial “SuperAdministrator” account is the sole responsibility of the Publisher. The Publisher

creates this account and assigns it an initial password.

DATA

7.1.Data ownership

In particular, the Customer shall refrain from using documents made available on the MyEGERIE Portal for commercial purposes.

7.2.Location

Customer Data is hosted in France.

7.3.Protection of personal data

The obligations of the Publisher and the Customer, relating to the protection of personal data, are set out in Appendix 2.

7.4.Protection of strategic data

Strategic data corresponds to the non-personal data that is of particular importance to the Customer.

The Publisher shall bear no responsibility in the event of the storage, loading or sharing of strategic data by the Customer.

7.5.Recovery of Customer Data

The Customer has the option to export its Customer Data in XML format and to store it via the Software.

In addition, the Customer is informed that the Customer Data will be deleted by the Publisher after a period of sixty

days from the date of termination of the Contract.

It is therefore up to the Customer to export or request the return of its Customer Data within that period, without additional charge.

Any restitution will be made in a format and on a medium that complies with the standards in use at the time of restitution. For example, the format in use is XML transmitted in an encrypted medium.

Under no circumstances does recovery confer any access, use or other rights to the Customer on the Software after the date of termination of the Contract.

OBLIGATIONS OF THE PUBLISHER

8.1.Provision of the Software

Under no circumstances may the Publisher be held liable in the event of a failure to make the Software available attributable to the Customer or in case of force majeure.

8.2.Credits

8.3.Exclusions

COLLABORATION BETWEEN THE PARTIES

The proper performance of the Contract requires loyal, active and permanent collaboration between the Parties. Therefore, each of the Parties undertakes to:

Be actively involved in the fulfilment of its obligations;
Refrain from any behaviour which may affect and/or hinder the performance of the other Party;
Provide each other, in a timely manner, with all the information and documents necessary for the performance of the Contract.

The Parties shall meet as often as necessary to ensure the proper performance of the Contract and, in particular, to verify the proper performance of the Contract.

In addition, the Customer undertakes to maintain sufficiently competent, qualified and trained Users throughout the duration of the execution of these terms and conditions.

LIABILITY

The Publisher may under no circumstances be held liable for any indirect damage suffered by the Customer that may arise from or during the performance of this Contract and its consequences.

The Publisher shall bear no responsibility in case of:

Use of the Software in a manner not provided for in the User Documentation or use not expressly authorised by these Terms of Use;

Modification of all or part of the functions or information accessible via the Software not carried out by the Publisher or by one of the Authorised Partners designated by the latter;
Use of all or part of the Software when the Publisher, following a problem or for any other reason whatsoever, had recommended that its use be suspended;
Use of the Software in an environment or configuration that does not comply with the Publisher's technical prerequisites, or in connection with programs or data from third parties not expressly approved by the Publisher;
Loss of Customer data following an intervention by the Publisher or a third-party Publisher appointed by the Customer or by the Publisher, where the Customer has not taken the precaution of backing up its data prior to this intervention when requested to do so in writing;
The occurrence of any damage resulting from the Customer's fault or negligence, or which the Customer could have avoided by asking for the Publisher's advice;
Use in connection with programs not supplied or endorsed by the Publisher and likely to affect the Customer's data;
Loss by the Customer of the usernames and passwords of the SuperAdministrator accounts,
Failure by the Users to save Customer Data;
Failure to download Upgrades made available by the Publisher;
Updates not recommended by the Publisher.

HOLD HARMLESS CLAUSE

The Publisher guarantees the Customer that it holds all the rights enabling it to enter into the Contract.

TERMINATION

REFERENCES

CONFIDENTIALITY

The User and Administrator documentation transferred by EGERIE,
The technical documentation of the Software,
Libraries of risk analysis or modelling examples,
The user interface and visual representations associated with risk modelling,
The original functions of the Software.

The Publisher expressly agrees to treat the Customer Data as confidential.

Confidential Information is not considered to be information that:

Is, as of the signature date of the Contract, publicly known, or which will become publicly known subsequently to the Contract, but, in any event, in the absence of any fault of the parties in its obligation of confidentiality;
Was in the lawful possession of the other Party prior to its disclosure and was not obtained by it directly or indirectly from the disclosing Party, and if that Party can prove such prior personal possession;
Is received from a third party in a lawful and unrestricted manner, the Parties acknowledge that any Confidential Information remains in any case the exclusive property of the party communicating it, and that its transmission does not confer any ownership or right of use over all or part of the content of the Confidential Information to the party receiving it.

In this respect, the Parties undertake within the framework of the Contract:

To use the Confidential Information only for the purposes of the Contract;
To take all necessary measures to protect the confidentiality of the Confidential Information;
To keep confidential and not to disclose or publish the Confidential Information – by any means whatsoever and for any purpose whatsoever directly or indirectly – to third parties to the contract to which they are parties, without the prior written authorisation of the party who communicated it, which the latter may refuse at its sole discretion.

MISCELLANEOUS

Non solicitation of personnel

Independence of the parties

Force Majeure

Neither of the Parties may be held liable for a breach of any of its obligations under the Contract resulting from the occurrence of a case of force majeure, provided, however, that:

The Party invoking such a case notifies the other Party of its existence as soon as possible;
It does everything necessary to limit the consequences; and
It resumes the execution of the Contract immediately after this case of force majeure has disappeared.

If the case of force majeure persists for more than fifteen (15) consecutive days, it shall give rise to the right to automatically terminate the Contract.

Amendments to the Contract

The Contract may only be modified or amended by means of a written amendment signed by a person duly authorised to represent each of the Parties.

Assignment of the contract

The Publisher reserves the right to transfer the rights and obligations of this Contract to any other person.

Titles

No waiver

Nullity and independence of clauses

Applicable law, jurisdiction

APPENDIX 1 SERVICE LEVEL AGREEMENT (SLA)

ARTICLE 1. DESCRIPTION OF THE SERVICES INCLUDED IN THE SUBSCRIPTION OF THE RIGHT OF USE IN SAAS MODE.

Maintenance

The Publisher reserves the right to make changes to the Software, but only with a view to its constant improvement.

The Customer automatically benefits from the Upgrades and new Major Versions, made available remotely. The Customer is responsible for downloading these Upgrades and new Major Versions.

Unless otherwise stated in the Purchase Order or Accepted Quote, the Contract does not include the new modules. These may be subject to specific pricing by the Publisher or the Authorised Partner.

Upon the release of any Upgrade or new Major Version of the Software, the Publisher undertakes to make the new User and Administrator documentation available to the Customer on the MyEGERIE Portal.

Support

Levels of support:

As regards Support services, the Publisher undertakes to implement three-levels of Support:

Level 1 support: this is the functional support that is exclusively handled by the Authorised Partner or the Publisher. The purpose of functional support is to assist the Customer, through the intermediary of the Designated Users, on issues relating to the use of the Software and its functions in accordance with its purpose. The support does not constitute training services, which are not included in the subscription, but only for the resolution of questions that cannot be resolved by reading the Documentation.
Level 2 Support: this is the technical support provided by the Publisher to take into account complex technical issues or Anomalies that do not require the modification of the Software's source codes.
Level 3 Support: this is the technical support provided by the Publisher to take into account complex technical issues or Anomalies requiring an Upgrade of the Software.

Purpose of and contact details for Support:

By the Help Desk service available through the MyEGERIE Portal (an account is created at the request of the Customer's designated User);
By an e-mail sent to the address support@egerie-software.com;

– By telephone at +33(0) 494 638 105.

The User contacting the Publisher must be trained in the use of the Software.

ARTICLE 2. TERMS AND CONDITIONS FOR PROVIDING SUPPORT

Anomaly

Guaranteed Intervention Time

Guaranteed Recovery Time

Blocking anomaly

0.5 business day

1 business day

Semi-blocking anomaly

1 business day

3 business days

Non-blocking anomaly

2 business days

5 business days

The Guaranteed Intervention Time (GIT) corresponds to the time between the declaration of the Anomaly and the first response given by the Publisher.

ARTICLE 3. COMMITMENT OF AVAILABILITY

The Software is made available to the Customer by remote access through the MyEGERIE Portal.

Calculation basis - Availability rate

The Publisher uses its best efforts to achieve a 99.99% availability rate of the Software (hereinafter the “Availability Rate”) according to the following calculation method:

(Total hours for the period - Hours of non-availability) / (Total hours for the period) x 100.

In case of failure to comply with the Availability Rate not due to one of the cases detailed in Article 4.3, clause 8.3 of the Terms of Use shall apply.

Unavailability Rate

The Software's downtime is calculated excluding:

(120) minutes per calendar month;

Interruptions due to any circumstance beyond the Publisher's control, including but not limited to Internet malfunctions, network saturation, ISP malfunctions attributable to the Customer's systems, etc.;
Interruptions due to the occurrence of Non-Blocking and Semi-Blocking Anomalies.
Interruptions to the Publisher's infrastructure lasting less than 60 minutes;
Interruptions due to breakdowns in the Customer's software or hardware.

ARTICLE 4. SECURITY

Consequently, the Publisher undertakes to respect and ensure that its staff respect the following obligations:

To take all appropriate measures in accordance with the state of the art to avoid any misappropriated or fraudulent use of Customer Data;
Not to make copies of the documents and media of the Customer Data entrusted to it, except those strictly necessary for the execution of the Contract;
To implement code audits of each New Major Version of the Software;
To implement regular testing of EGERIE applications and infrastructures;
To respect confidentiality and not to disclose Customer Data to other persons, whether private or public, natural persons or legal entities, unless such disclosure is required by law or by a competent judicial or administrative authority or is necessary within the context of legal proceedings.

APPENDIX 2 COMPLIANCE WITH THE GDPR (DATA PROCESSING ADDENDUM)

ARTICLE 1. DESCRIPTION OF THE PROCESSING OPERATION

The purpose(s) of the processing is/are the execution of the Contract, i.e. the hosting and provision of the Software and Customer Data, of the MyEGERIE Portal and the creation of Support.

The categories of persons concerned are: employees, collaborators and agents of the Customer, external persons such as suppliers or contacts.

It is understood that the duration of the processing of Personal Data is equivalent to the duration of the Contract, increased by one year with regard to the backups of Customer Data made by EGERIE.

ARTICLE 2. OBLIGATIONS OF THE PUBLISHER

The Publisher ensures that persons authorised to process personal data are committed to confidentiality or are subject to an appropriate legal obligation of confidentiality.

As soon as possible after notification of the breach of security of the Personal Data and, to the extent possible, the Publisher shall provide the Customer with the following information:

The categories and approximate number of persons affected by the breach;
The categories and approximate number of personal data records concerned.

The Publisher remains liable to the Customer for the performance by the said subcontractor of its obligations.

The Publisher undertakes to cooperate with the competent data protection authorities, in particular in the event of a request for information or audit.

Appendix 3: Open source software used for EGERIE RISK MANAGER AND EGERIE PRIVACY MANAGER software

SERVER LIBRARIES

silex/silex (v1.2) —> MIT License
twig/twig (v1.16) —> BSD License
symfony/monolog-bridge (v2.4) —> MIT License
silex/web-profiler (v1.0) —> MIT License
symfony/translation (v2.3) —> MIT License
symfony/config (v2.3) —> MIT License
symfony/yaml (v2.3) —> MIT License
symfony/security (v2.8.33) —> MIT License
symfony/twig-bridge (v2.4) —> MIT License
symfony/validator (v2.8) —> MIT License
dflydev/doctrine-orm-service-provider (v1.0) —> MIT License
knplabs/console-service-provider (v1.0) —> MIT License
saxulum/saxulum-webprofiler-provider (v1.1) —> MIT License
dominikzogg/doctrine-orm-manager-registry-provider (v1.2) —> MIT License
doctrine/doctrine-bundle (v1.5) —> MIT License
gedmo/doctrine-extensions (v2.4) —> MIT License
jms/serializer (v1.1) —> MIT License
kriansa/h2p (v2.0) —> MIT License
jakoch/phantomjs-installer (v2.1) —> MIT License
gargron/fileupload (v1.5.1) —> MIT License
symfony/form (v2.8) —> MIT License
symfony/serializer (v3.1) —> MIT License
symfony/doctrine-bridge (v2.7) —> MIT License
ezyang/htmlpurifier (v4.9) —> LGPL License -2.1-or-later
behat/mink-goutte-driver (v1.2) —> MIT License
behat/mink-browserkit-driver (v1.3) —> MIT License
swiftmailer/swiftmailer (v5.4) —> MIT License
dmore/behat-chrome-extension (v1.2) —> MIT License
jumbojett/openid-connect-php (v0.3.0) —> Apache-2.0 License
cnam/security-jwt-service-provider (v1) —> GNU License General Public License v2.0
ramsey/uuid-doctrine (v1.4) —> MIT License
saxulum/saxulum-doctrine-orm-manager-registry-provider (v2.2) —> MIT License
onelogin/php-saml (v3.2) —> MIT License
symfony/browser-kit (v2.4) —> MIT License
symfony/css-selector (v2.4) —> MIT License
phpunit/phpunit (v5.6) —> 3-Clause BSD License
behat/behat (v3.5) —> MIT License
behat/mink (v1.7) —> MIT License
behat/mink-extension (v2.3) —> MIT License
behat/mink-selenium2-driver (v1.3) —> MIT License
behat/mink-sahi-driver (v1.2) —> MIT License

CLIENT LIBRAIRIES (BROWSER)

select2 (v2 4.0.3) —> MIT License
bootstrap-slider.min.js (v10.0.0) —> MIT License
jquery.fileDownload (v1.4.4) —> MIT License
jquery.slimscroll (v1.2.0) —> MIT License
bootstrap-toggle.min (v2.2.0) —> MIT License
tinymce (v4.7.4) —> LGPL-2.1-only License
bootstrap-multiselect.min (v2.0) —> Apache License-2.0
jquery (v1.9) —> MIT License
bootstrap (v3.3.5) —> MIT License
reactJS (v15.0.0) —> MIT License
react-dom (v15.0.0) —> MIT License

PURCHASED CLIENT LIBRAIRIES (BROWSER)

RappidJS https://www.jointjs.com/
HichChart https://shop.highsoft.com/
Theme Color Admin https://wrapbootstrap.com/theme/color-admin-5-admin-template-4-frontend- WB0N89JMK

SYSTEM COMPONENTS

Debian —> GPL License
MySQL —> GPL License
PHP —> Non Copyleft License
Apache —> GPL License
Samba —> GPL License