Vates VMS Terms and Conditions

Article 1 - Preamble

VATES Corporation specializes in the development, maintenance of software, and the provision of IT services. VATES offers its customers a subscription to a support and maintenance contract for Open Source software developed and maintained by VATES. In this context, customers may specifically subscribe to a usage license for the XCP-ng virtualization platform and Xen Orchestra Appliance , a software for management, administration, backup, and/or replication of a virtualization infrastructure, through the website www.vates.tech (hereinafter referred to as the "Website"), acceptance of a Quote, or issuance of a Purchase Order by the Customer, based on the quote provided by VATES (hereinafter referred to as the "Purchase Order").

In addition to the XCP-ng software, and where applicable, the Xen Orchestra software, customers may also subscribe to usage licenses for supplementary software (which only operate on the condition that the customer has already subscribed to a usage license for the XCP-ng software), also offered in Open Source mode, such as:

• XOSTOR : A software base hyperconvergence solution
• XO Proxy : A software solution to administrate backup with Xen Orchestra in distant infrastructure

All software offered on the Website are collectively referred to as the "Software." A list of Software made available by VATES and for which support is offered by VATES is available on the Website.

The use of Software offered by VATES is subject to their respective license conditions as specified in the Schedule of the Special Conditions attached hereto and relating to each Software, and does not, in this regard, require the payment of any royalty fees for free and open licenses (copyleft principle), the source code of which is available to users.

VATES Corporation also offers a tailored maintenance package to which the Customer has chosen to subscribe.

In the context of using the Software and any supplementary Software, the Customer wishes to avail themselves of support and maintenance services.

To offer maintenance commitments tailored to the Customer for each Software, VATES has distinct offerings that correspond to the needs of each Customer.

These General Terms and Conditions (hereinafter referred to as the "Terms") apply to all contracts, quotes, technical and commercial proposals, or maintenance service orders placed between VATES Corporation and a professional customer (hereinafter referred to as the "Customer").

These Terms take precedence over any conditions not expressly accepted by VATES, including the Customer's general purchasing conditions.

To subscribe to a Software maintenance contract as provided herein, the Customer may either complete their subscription online on the Website via the form corresponding to the concerned Software, proceed by accepting a quote requested from VATES via said Website, or by directly issuing a Purchase Order based on the quote provided by VATES. The placement of an Order by the Customer implies acceptance of these Terms.

Article 2 – Definitions

In these Terms, the following terms are defined as follows:

Customer : Refers to the company using XCP-ng and any other Software operating with XCP-ng and subscribing to this maintenance.

Customer Portal : Refers to a web service provided by Vates to allow customers to interact with various elements of the service, including the creation of a support ticket.

Host : Refers to a computing server that is under the control of XCP-ng.

Incident : Refers to any malfunction of XCP-ng (especially in the creation of virtual machines or VM management - migration, disk management), or any other Software offered on VATES' Website, subject to an error message returned by the Software to the Customer. The severity of the incident is determined by VATES according to the criteria defined in the attached Schedule 1.B.

Main Contact : Refers to the person designated by the Customer to act as their primary representative. The Main Contact is named in these Terms, in Shedule 1, and will receive from Vates official notifications and important information as well as formal notices concerning XCP-ng Pro support services or support for any other Software, for which the Customer has subscribed to a support/maintenance subscription.

Order : Refers to any order for support/maintenance and/or Services placed by the Customer directly on VATES' Website or via the issuance of a Purchase Order based on the quote provided to the Customer by VATES.

Pool : Refers to a group of servers that work together to create a virtual infrastructure.

Remote Support : Refers to the provision of support services by Vates within the Customer's infrastructure using the secure SSH tunnel provided in Xen Orchestra. This support will primarily be provided from Vates' offices.

Service Level Agreement (SLA) : Refers to the target response times (as mentioned in the relevant Special Terms for each Software and on Vates' website) for Vates to respond to Incidents and/or create a plan to resolve Incidents. The Service Level Agreement is provided to the Customer in the SC corresponding to the Software for which maintenance is subscribed.

Services : Refers to all training, expertise, and/or any other services subscribed to by the Customer at the time of their Order.

Software : Refers to the Open Source software developed by VATES and listed on the Website (including XCP-ng), for which the Customer subscribes to a support and maintenance contract. The list of software maintained by VATES is available on the Website.

Software Patch : Refers to the development or modifications of the XCP-ng Software or any other Software, which may be necessary to resolve Incidents.

Software Patching : Refers to a service provided by Vates that includes the creation of Software Patches.

Support : Refers to XCP-ng support services and support services for all Software designed to assist in the maintenance of the Customer's System.

Support Matrix : Document specifying the maintained versions of XCP-ng and other Software.

System : Refers to the network, the hypervisor, the interface, or any other element for which the Customer has subscribed to a right of use via the Website.

Ticket : Refers to a support request or the reporting of an Incident, submitted by the Customer via the issuance of a ticket on the Customer Portal.

Vates : Refers to the Vates SAS simplified joint-stock company registered in Grenoble (France) under the number 752 155 259.

Virtual Machine or VM : Is a fully virtualized environment that runs on a physical machine. Multiple VMs can coexist on the same host and run different operating systems.

VMS or Virtualization Management Stack : Refers to one or more Xen Orchestra Appliances, their connected Pools and Hosts that Vates is providing support for

XCP-ng : Refers to the Open Source virtualization platform software developed by Vates and provided for use in accordance with the license rules as specified in this conditions.

XCP-ng Environment : Refers to the Hosts controlled by the XCP-ng virtualization platform. Any host controlled by a different XCP-ng installation constitutes a distinct virtualization environment.

Xen Orchestra or Xen Orchestra Appliance : Refers to the Open Source virtualization software to manage, administrate, backup/replicate an XCP-ng infrastructure developed by Vates and provided for use in accordance with the license rules as specified in this conditions.

XO or Xen Orchestra Proxy : Refers to the Open Source virtualization software operating with Xen Orchestra and specifically designed to perform backup/replication operation in distant location or large infrastructure and provided for use in accordance with the license rules as specified in this conditions.

XOSTOR : Refers to the Open Source virtualization software based hyperconvergence solution developed conjointly by Vates and LINBIT and provided for use in accordance with the license rules as specified in this conditions.

Article 3 – Purpose

The purpose of these Terms is to determine the conditions under which VATES provides corrective and evolutionary maintenance for the XCP-ng Software and any other Software for which the Customer has accepted the present conditions.

The Terms also aim to determine the conditions for the provision of Services by VATES when such Services are specified in the Order.

These Terms are intended to apply to any order placed by a Customer with VATES for the support and maintenance of XCP-ng and/or any other Software.

Article 4 - Contractual documents

The following documents, listed in order of priority in the event of any contradiction, constitute the contract binding the parties and represent the entirety of their commitments:

• General Terms and Conditions (Terms) and any appendices thereto.

• Any Special Terms (ST) related to the relevant Software or Services.

• The Purchase Order or the quote accepted by the Customer.

These Terms and any schedules express the entirety of the agreement between the parties. They cancel and replace all previous provisions, whether written or oral.

The Contract and any schedules may only be modified by an amendment, written and signed by an authorized representative of each party.

Article 5 - Duration

The maintenance service for the Software begins on the date of subscription to said maintenance via the website https://vates.tech upon validation of the order form by the Customer or on the date of acceptance of a quote issued by VATES upon the Customer's request via the form provided on the website. Any order for support and maintenance is planned for an initial period of one year, three years, or five years, as indicated in the Order, starting from the Customer's validation of the payment conditions on the website or from the sending of the Purchase Order.

At the end of this initial period, the support and maintenance contract is automatically renewed year by year if the customer chooses this option. Otherwise, the customer must proceed with the renewal by submitting a signed quote or a purchase order. It can be terminated at the end of each contractual period by sending an email by one of the Parties or, in the case of the Customer, directly from their interface available on the website.

If the Customer terminates the maintenance before the end of an ongoing contractual period, the Customer remains liable for the payment of the entire fee for said ongoing contractual period.

In the event of a serious breach by one of the Parties of one of its obligations, the other Party may terminate these Terms as of right, fifteen days after formal notice, by registered letter with acknowledgment of receipt, remained without effect.

In the event of a recovery or liquidation proceeding of one of the Parties, these Terms are subject to the procedures specified by articles L.621-28 and following of the French Commercial Code.

In all cases, the Customer undertakes to pay Vates the amounts due.

Article 6 - Description of Maintenance Services

6.1 - Purpose of Corrective Maintenance

The purpose of corrective maintenance is:

• To provide corrections for all Incidents reported by the Customer and observed by VATES, either in the form of corrections or Corrective Patches made available to the users of the Customer for XCP-ng and other Software for which the Customer has subscribed to maintenance and support;
• To provide the necessary updates so that XCP-ng and other Software continue to perform all functions described in their documentation, as well as updates reflecting improvements made to XCP-ng and other Software by VATES.

If the reported Incident is related to an issue arising from third-party elements (such as firmware/drivers related to physical hardware present in the server), VATES will make its best efforts to assist the Customer but cannot commit to correcting the Incident.

The Customer commits to recording the observed Incidents with mention of the date and time and all technical elements allowing for a diagnosis of the cause of the fault. This document will be made available to VATES.

The Customer commits to communicating to VATES as soon as possible, spontaneously or upon request from VATES, any information that may be useful for the proper execution by VATES of the maintenance services.

In practice, the Customer reports without delay, via the opening of a Ticket on the Customer Portal, to VATES any Incident by indicating all elements, documents, information necessary for understanding the problem as precisely as possible. The Customer commits to describing the Incident as well as possible. Only persons on the Principal Contact list whose details have been provided by the Customer on the Customer Portal are authorized to enter Incidents via a Ticket on the Customer Portal.

If the information provided by the Customer does not allow VATES to perform a complete diagnosis of the Incident, then VATES will contact the Customer to obtain the information necessary for an analysis of the Incident. VATES cannot be held responsible for non-compliance with Service Level Agreements due to a lack of information communicated by the Customer. Furthermore, the Customer will perform all operations requested by VATES to better identify the cause of the Incident and will give VATES all access to data, systems, or information that it may require.

If it is indeed an Incident on Software, once the Incident is reproduced, VATES will qualify the Incident as blocking, major, or minor, according to the severity criteria provided in the table present in Schedule 1.B of these Terms, and will then begin to work on its correction. From the notification of the existence of the Incident by the Customer, VATES verifies the existence of such an Incident to correct it, or provide a workaround, subject to the installation by the Customer of all updates made by VATES to XCP-ng and/or any other Software.

Corrective maintenance is provided only on the latest version of XCP-ng and the latest version of the Software, accessible online via the Site, and on the previous version (N-1).

The Customer acknowledges having ensured that remote use of Software can be done from the computer hardware they have, particularly through their browser query software and their connection means. To use any of the Software and access updates, maintenance, and support on the Software, the Customer acknowledges having at a minimum:

• An Internet connection,
• A recent Microsoft ™ Internet Explorer web browser (versions IE8 and higher), FireFox, Safari, Edge, Chrome, or others, up-to-date and accepting cookies.

All costs necessary for the Customer's equipment and connection to the Internet to use the Software are solely the responsibility of the Customer.

6.2 - Evolutionary Maintenance

Under the title of evolutionary maintenance, the following technical and functional improvements may be periodically provided by VATES to the Customer, in order to improve the conditions of use of XCP-ng and/or the Software:

• (i) Corrections of Incidents previously resolved by workarounds: delivery by VATES of releases including Corrective Patches,
• (ii) New versions of XCP-ng and complementary Software, including those related to the evolution of databases, operating systems, and hardware.

The Customer alone carries out the installation of new versions or corrective patches that are sent to them by VATES.

6.3 - Time of correction / SLA

Commitments in terms of intervention and/or correction and associated levels of criticality, as well as the availability hours of support for each Software, are detailed in the Schedules of the Terms.

6.4 - Exceptions

VATES cannot be held responsible and guarantee the correction under this maintenance commitment for any errors, data corruption, or failures caused by misuse of XCP-ng and/or Software or by the possible incomplete description of an Incident, malice from the Customer, or misunderstanding on their part. In the case of such Incidents, VATES will nevertheless make all reasonable efforts to assist the Customer in resolving the Incidents, at the Customer's expense.

VATES can only intervene satisfactorily to resolve Software Incidents if the server infrastructures are in an optimal state of production, without malfunction or impact on production, before the start of these General Conditions of maintenance.

Furthermore, the Software must have been updated, and VATES must have the possibility to access the Customer's equipment/infrastructures, via secure access or a VPN tunnel, in order to qualify and resolve the Incident reported by the Customer.

To allow VATES to intervene under the best conditions and thus carry out the maintenance of the Software, each Host on the same Pool must be governed by the same level of support.

The Customer is informed that in the event of misuse of the Software(s) or non-compliance with the rules to which the use of the Software(s) is subject, VATES reserves the right to cease maintenance and support of said Software(s).

In addition, the correction of Incidents reported by the Customer resulting from one of the following causes is not covered under these General Conditions of maintenance and will therefore result, in the event of a request from the Customer for VATES intervention in these cases, in additional invoicing at the VATES rate in effect at the time of the Customer's request:

• Use of XCP-ng or another Software not in accordance with its documentation;
• Non-compliance by the Customer with the prerequisites indicated by VATES on the Site, including non-use of the latest or second latest version of the Software;
• Malfunctions affecting the operating system, hardware, database, or more generally the environment in which XCP-ng is used;
• Malfunction arising from third-party elements, notably third-party Software;
• Modification of the source codes and/or object codes of any Software.

Finally, it is specified that the backup environment set up by the Customer is not a production environment, which the Customer acknowledges and accepts, it being understood that any incident related to backup will be taken care of during working hours, as specified in these General Conditions.

Article 7 - Additional services

In the event of a request for additional assistance, not provided for in corrective and/or evolutionary maintenance as defined above, VATES will provide the Customer with a quote according to the prices in effect at the time of the request, within the limits of its skills and availability for the provision of any technical assistance and training related to XCP-ng or any other Software.

Training and certification services are also offered by VATES to the Customer, who can subscribe to them directly on the Site, in addition to the provision of support and maintenance.

These services will be billed on a flat-rate basis based on an hourly rate and an estimated number of hours of intervention.

If the Customer has subscribed to any of the additional services offered by VATES, the following conditions will apply.

7.1 - Locations and management of services

When the services are performed at the Customer's premises, they are carried out at the Customer's address indicated on the Site, in the quote, or the Purchase Order. Any change to this address must be the subject of a written agreement between the Parties and may have an impact, particularly financial, on the initially agreed terms.

As an employer, VATES ensures the supervision, exclusive control, and administrative and social management of its employees. In this capacity, VATES sets the absences of its employees for leave, training, or any other reason imposed by social legislation. Except in cases of force majeure, these absences are set in advance, according to the constraints related to the execution of this Contract. The employees assigned to the execution of the services perform them under the hierarchical and disciplinary authority of VATES by virtue of the link of subordination that binds them.

7.2 - Scheduling and planning

The schedule for the performance of the services is mutually agreed upon by the Parties. Any cancellation or postponement of the scheduled services requested by the Customer, compared to the schedule agreed upon between the Parties, regardless of the place of intervention, must be communicated to VATES. To allow VATES to mobilize the necessary skills and resources, the Customer undertakes to request this extension in writing. The Customer is informed that they will bear all costs related to the postponement of the schedule and the resulting consequences.

Article 8 - Financial conditions

8.1 - Maintenance fee

The amount of the maintenance fee is cumulatively defined for each of the offers proposed by VATES:

• Based on the number of Hosts for the same Pool;
• Based on the levels of service desired by the Customer, as provided in the corresponding CP (response time, number of Incidents covered, etc.), it being understood that the level of service subscribed to by the Customer must be the same for all Hosts in the same Pool.

The amount of the overall contractual fee due by the Customer is indicated on the Site in case of online subscription of the Order by the Customer or on VATES' quote duly accepted by the Customer and constituting an Order.

This amount is based on the number of Hosts in the Customer's virtual environment, according to the levels of service required by the Customer.

In the event that the Customer adds additional Hosts, according to the procedure indicated on the Site, to their environment, they must purchase support for these additional Hosts. In the case of purchasing additional Hosts during the term of these Terms for maintenance, the price resulting from the addition of these Hosts for the remaining contractual period will be adjusted on a pro-rata basis and added to the invoices.

All Hosts in a licensed Pool must have an identical level of support.

All parts of a Virtualization Management Stack must be properly licensed, including the XOAs and all connected Hosts.

⚠️ Vates reserves the right to withhold support from any customer operating a Virtualization Management Stack in which the number of Hosts under maintenance does not correspond to the total number of Hosts within a Pool, or in which any Hosts or components of the Stack, including XOAs and connected Hosts, do not share an identical level of support.

It is the Customer's responsibility to ensure that they acquire support services for these additional Hosts before proceeding with their installation in their XenOrchestra/XCP-ng virtual environment.

Prices are exclusive of taxes. The applied taxes are those provided for by current regulations. In the event that these are modified, the new regulations will be applied from the official date of their entry into force.

8.2 - Billing and renewal

Maintenance is billed in advance for the first contractual period, in full from the date of placing the Order until the end of the first contractual period, and then, in the event of renewal, at the beginning of each new contractual period.

In the event of renewal of this Contract at the end of the contractual period, the amount of the fee due for maintenance will be revised each calendar year on January 1st. This revision will be carried out based on the Syntec index by applying the following revision formula:

P = P0 (S/So), where:

• P: Price after revision
• P0: Original price
• So: Last SYNTEC index, or any new index that would officially replace it, published on the contract's effective date
• S: The most recent SYNTEC index, or any new index that would officially replace it, known on the revision date

In the event of the disappearance of the index, express competence is attributed to the President of the Grenoble Commercial Court to define an index that will integrate into the revision formula. This index must be chosen so that it is as close as possible to the disappeared index and that it respects the spirit that the Parties intended to define when establishing this revision clause.

Invoices corresponding to maintenance are payable within 30 days from their issuance by bank transfer or direct debit.

8.3 - Billing of additional services

In the case of orders for additional services, these are billed no later than the end of the month in which they are performed. Invoices are payable within 30 days from their issuance.

8.4 - Legal requirements for invoices

The invoices include the mandatory legal mentions. The rules, mentions, or internal procedures for processing orders and invoices of the Customer are not enforceable against VATES.

8.5 - Consequences of Non-Payment

In case of non-payment within the contractual deadlines, any unpaid amount will automatically bear interest day by day until the date of its full payment in principal, interest, fees, and accessories, at a rate equal to three times (3) the legal interest rate in force. This will occur without any prior formalities and notwithstanding the damages that VATES reserves the right to seek judicially. The Customer expressly acknowledges that any potential costs of recovering the amounts due and unpaid by him (costs of proceedings, expenses, disbursements, and attorney and bailiff fees) are deemed to constitute an accessory to VATES' claim. In addition, in accordance with legal provisions, any payment delay gives rise to the payment by the Customer of an indemnity for recovery costs, an amount fixed by decree, as of the date of these presents, at 40 (forty) euros.

VATES reserves the right to suspend any Service in case of non-payment, fifteen (15) days after sending a formal notice to pay, in the recommended form, which has remained partially or totally without effect, of the full amount of the sums due by the Customer within the allotted time, and, in general, in case of non-payment of any invoice issued by VATES that remains unpaid. VATES also reserves the right to terminate the current maintenance subscription with immediate effect.

All unpaid fees, following a bank rejection of a payment by the Customer, will remain the financial responsibility of the latter. In addition, the absence of payment by the Customer of an invoice that has reached its due date will result in the forfeiture of the term of the other current invoices and will therefore allow VATES to demand payment of all other invoices, including those whose due date has not been exceeded.

If, during a previous order, the Customer has evaded one of his obligations (default or delay in payment in particular), a refusal of sale may be opposed to him unless this Customer provides satisfactory guarantees or cash payment.

8.6 - Exclusion

Any payment by compensation is excluded.

Article 9 - Liability

Each Party shall only be liable for the financial consequences of direct and foreseeable damages caused by its actions in the context of the execution of these General Conditions of Maintenance. No Party shall under any circumstances incur liability for indirect or unforeseeable damages, which include, but are not limited to, any lost profits, commercial damage, loss of revenue or profit, loss of customers, loss of opportunity, inaccuracy or corruption of files or data.

The Software subject to the support and maintenance order will be used by the Customer under its sole control, direction, and responsibility. The Customer remains the custodian of the hardware, software, data, files, programs, or databases, and, consequently, VATES cannot be held responsible for their deterioration or destruction, whether total or partial.

Therefore, the Customer acknowledges and accepts that it is solely responsible for managing the redundancy of its storage solution with RAID systems or any equivalent technology, for the storage of its Virtual Machines. To ensure the security of its data integrated into the Software, the Customer undertakes to carry out regular backups of its Virtual Machines outside its production hosts and to ensure the proper functioning of said backups.

The operating systems, applications, and data integrated into the Virtual Machines are the sole and unique responsibility of the Customer.

VATES is only liable in the case of proven fault. The amount of VATES' financial liability is limited to the amount of the fee paid by the Customer when subscribing to the maintenance.

The limitations and exclusions of liability specified are determined by the balance that constitutes together the extent of VATES' obligations and the prices of the Services, the amounts of compensation that VATES may be required to pay to the Customer in the event of its liability being called into question, and the provisions of the insurance policy covering VATES' professional civil liability. The Customer is aware that the rates charged by VATES are determined based on the existence of this limitation of liability.

Article 10 - Reference

The Customer authorizes VATES to mention its name on a list of references that it may distribute, particularly to its customers and prospects.

The Customer may withdraw this authorization from VATES by email notification.

Article 11 - Personal data

11.1 Processing in connection with maintenance

In connection with the maintenance services covered by these General Terms and Conditions, VATES only has access to the data of the Client’s users who created the Ticket via the Client Portal. The conditions under which VATES processes such data on behalf of the Client are defined in the Data Processing Agreement set out in Schedule 2 to these Terms, which forms an integral part of the contract.

For the avoidance of any doubt, it is specified that VATES has no access to any other personal data processed by the Client during maintenance operations: VATES only accesses virtual machines and technical information.

11.2 Contract Management

Furthermore, in connection with the management of its client and supplier data, VATES acts as a data controller.

The only data collected for the management of the Client account (surnames, first names, title, e-mail addresses, business telephone numbers of the Client’s contacts) are retained for the purposes of performing these General Terms and Conditions and/or any associated Specific Terms and Conditions, which the Client acknowledges and accepts upon signature.

The data collected are used for the following purposes:

• the performance of any administrative operation relating to contracts, orders, invoices, payments and accounting;
• the processing of payments;
• the provision of communication tools enabling the digitalisation of exchanges.

The Client is informed that each contact/user has the right to request that VATES update, delete or rectify his or her data, or to object to the processing of his or her data, on legitimate grounds.

For more information on VATES’ processing activities as data controller, please refer to the Privacy Policy, which forms an integral part of these General Terms and Conditions.

Article 12 - Insurance

VATES certifies that it holds an insurance policy covering its civil liability, that the payment of premiums is and will remain up to date, and undertakes to provide proof to the Customer upon the Customer's request.

The Customer certifies that it holds an insurance policy covering its civil liability and any damages suffered by the assets it owns.

Article 13 - Confidentiality

Each Party undertakes to implement appropriate means to maintain the strictest secrecy concerning information and documents designated in writing as confidential by the other Party, to which it has access during the performance of the Services subject to these Terms and any associated Special Terms (ST).

This confidentiality obligation will continue for a period of three years after the expiration or termination of these Terms and any associated ST, except in cases where disclosure is made mandatory by law or a judicial decision, or if such disclosure is necessary to implement or prove the existence of rights under these Terms and any associated ST.

Not considered confidential under this article are the informations that:

• Were already public at the time of their disclosure or have been made public after their disclosure without contravening these Terms and any associated ST;
• Were known to one of the Parties, without a confidentiality obligation, on the date of signing these Terms and any associated ST, with the burden of proof resting on that Party;
• Are communicated to one of the Parties or its staff by third parties who have obtained them through legitimate means.

If necessary, the Parties are authorized to communicate, under the strictest confidentiality, the Terms and any associated ST and related documents to their auditors, insurers, and tax and social organizations in case of control.

Article 14 - Non-solicitation of Personnel

Both parties agree, unless prior written consent is given, not to solicit or employ, directly or indirectly, any employee of the other party involved in the execution of these Terms and/or any associated ST, even if the initial solicitation is made by the employee.

This prohibition extends for the duration of these Terms and/or associated ST and for twelve months following the end of said Terms and/or ST.

Any breach of this obligation requires the defaulting party to immediately pay the other party, as a conventional indemnity, an amount equal to twelve times the last gross monthly salary of the concerned employee.

Article 15 - Force Majeure / External Causes

Neither party shall be held responsible towards the other if the execution of the Terms and/or ST is delayed or prevented due to a case of force majeure or external causes. Force majeure is understood as defined by Article 1218 of the French Civil Code.

In this regard, both parties agree that social conflicts, malfunction or interruption of the electrical network, or regional or national failure of telecommunications operators will be considered as external causes within the meaning of this article.

The party affected by a case of force majeure or an external cause shall immediately inform the other party by the means it deems appropriate, confirmed by registered letter with acknowledgment of receipt, justifying the exceptional circumstances that make it impossible to fulfill its contractual obligations, and providing all useful justifications.

In any case, the party affected by the case of force majeure or the external cause must make its best efforts to limit the duration and consequences.

If the event giving rise to the case of force majeure lasts for more than three months, either party may terminate these Terms and/or the concerned ST by registered letter with acknowledgment of receipt, unless expressly agreed otherwise between the parties.

Article 16 - renunciation

The fact that one of the parties does not take advantage of a breach by the other party of any of the obligations set forth herein shall not be interpreted for the future as a waiver of the obligation in question.

Article 17 - Partial invalidity

If any of the provisions of these Terms, or part of them, is null and void under a rule of law or a law in force, it shall be deemed unwritten, but will not result in the nullity of the Terms or the associated ST nor that of the partially concerned clause.

In case of contradiction, the provisions of the Terms take precedence over the ST.

Article 18 - Titles

In case of difficulties in interpretation between any of the titles and any of the clauses, the titles will be declared non-existent.

Article 19 - Applicable law and jurisdiction

These General Conditions (CG) are governed by French law.

ANY DISPUTE OR CONTESTATION TO WHICH THE EXECUTION OF THESE TERMS COULD GIVE RISE, AND WHICH COULD NOT HAVE BEEN THE SUBJECT OF AN AMICABLE AGREEMENT WITHIN THE FRAMEWORK OF THE CONCILIATION PROCEDURE, WILL FALL UNDER THE EXCLUSIVE JURISDICTION OF THE COMMERCIAL COURT OF GRENOBLE, NOTWITHSTANDING MULTIPLE DEFENDANTS OR A WARRANTY CALL, EVEN FOR EMERGENCY OR CONSERVATORY PROCEDURES, BY SUMMARY JUDGMENT OR BY PETITION.

SCHEDULE 1

1.A - Support access conditions

To ensure timely and efficient support, VATES relies on a specific set of tools that allow its support team to properly investigate and resolve issues. These include:

• A structured support ticket system
• The ability to open a secure support tunnel from the Xen Orchestra Appliance (XOA)
• SSH access to the XCP-ng host, when required, initiated through XOA

These tools are essential to reproduce, diagnose, and solve problems efficiently.

VATES would like to inform its customers that in order to access support, they must follow a defined protocol. Any requests made outside this process will not be processed within the timeframe guaranteed by the SLA.

In the event of an anomaly in the customer's infrastructure, the following steps must be followed:

1. The customer must log in to their support area using the main contact account (as defined in the terms and conditions), or any other account that has been added to the customer's organization. The support area is accessible at: https://account.vates.fr/#/support
2. The customer must open a support ticket describing the problem in as much detail as possible. Useful elements include:
   • A clear description of the issue
   • Screenshots from the Xen Orchestra Appliance
   • Logs or error messages if available

VATES support may request further diagnostic elements or access, such as opening a secure support tunnel from XOA or enabling SSH access to the relevant host(s).

⚠️ Failure to provide the requested elements (ticket, support tunnel, or SSH access) will result in degraded support. In such cases, support will be handled on a best-effort basis and may fall outside the guaranteed processing delays defined in the SLA.

VATES cannot be held responsible for extended resolution times caused by missing or incomplete access.

SCHEDULE 2 - Data Processing Agreement (DPA)

The purpose of this schedule is to define the conditions under which VATES undertakes, in its capacity as Processor, to carry out Personal Data processing operations on behalf of the Client in connection with the maintenance services.

1. DEFINITIONS

For the purposes of this schedule and notwithstanding any other definition provided for in the Contract, the following capitalised terms, whether used in the singular or plural, shall have the following meaning:

“Personal Data Protection Regulations”: the laws and regulations in force within the European Union, the European Economic Area and their Member States relating to the processing of Personal Data, including French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended from time to time (the “French Data Protection Act”), and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation” or the “GDPR”).

“Personal Data”: any information relating to an identified or identifiable natural person, i.e. a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

Terms relating to the protection of Personal Data that are not defined in this Appendix, including “Data Subject”, “Controller”, “Processor”, “Processing” and “Personal Data Breach”, shall have the meaning given to them by the GDPR, in particular Article 4 thereof.

2. DESCRIPTION OF THE PROCESSING

In connection with the performance of these General Terms and Conditions, VATES processes, as processor, only the Personal Data transmitted by the Client’s authorised users when opening a Ticket via the Client Portal: surname, first name, professional e-mail address and Ticket content. VATES has no access to any other personal data in connection with maintenance.

Such data are processed solely for the purposes of managing and resolving support requests, for the duration provided for in the Contract. The performance of these General Terms and Conditions constitutes the documented instruction of the Client.

3. OBLIGATIONS OF VATES TOWARDS THE CLIENT

VATES undertakes to:

• process Personal Data only for the purpose covered by the processing subcontracted to it;
• process Personal Data in accordance with the documented instructions of the Client as defined in this appendix. If VATES considers that an instruction constitutes a breach of the GDPR or of any other provision of Union or Member State law relating to the protection of Personal Data, it shall immediately inform the Client. If VATES is required, on the Client’s instruction, to transfer Personal Data to a country outside the European Economic Area pursuant to Union law or the law of the Member State to which it is subject, VATES undertakes to inform the Client thereof before the Processing, unless such law prohibits such information on important grounds of public interest;
• guarantee the confidentiality of Personal Data processed under the Contract;
• ensure that persons authorised to process Personal Data under the Contract (i) undertake to respect the confidentiality of Personal Data or are subject to an appropriate statutory obligation of confidentiality, and (ii) receive the necessary training in Personal Data management;
• take into account, as regards its tools, products, applications or services, the principles of data protection by design and by default;
• keep the register required under Article 30 of the GDPR where applicable.

4. SUBSEQUENT SUBPROCESSING

The Client authorises VATES to engage another processor (hereinafter, the “subprocessor”) to carry out specific Processing activities. The list of VATES’ subprocessors shall be provided to the Client upon request. VATES undertakes to inform the Client of any intended change concerning the addition or replacement of subprocessors as soon as possible. The Client shall have a period of ten (10) Business Days from receipt of such information to submit its reasonable and legitimate objections in writing. The Client acknowledges and accepts that the absence of objection within this period shall be deemed acceptance by the Client of the subprocessor. In the event of an objection, VATES may respond to the Client by providing information likely to address such objections. If the Client maintains its objections, the Parties undertake to meet and discuss in good faith the continuation of their relationship.

In any event, VATES shall remain liable to the Client for the proper performance of the Contract by its subprocessors.

5. NOTIFICATION OF PERSONAL DATA BREACHES

VATES undertakes to notify the Client of any Personal Data Breach under the Contract as soon as possible after becoming aware of it, by e-mail to the Client’s DPO or, failing that, to the main contact designated in the General Maintenance Terms and Conditions.

Such notification shall be accompanied by any useful documentation to enable the Client, where necessary, to notify such Personal Data Breach to the competent supervisory authority and to the Data Subjects. Where all information cannot be provided at the same time, it shall be provided to the Client in phases, as and when it becomes reasonably available.

6. EXERCISE OF DATA SUBJECTS’ RIGHTS

As far as possible and taking into account the nature of the Processing, VATES undertakes to assist the Client in fulfilling its obligations to provide Data Subjects with the information required by the GDPR when they exercise their rights.

In the event that Data Subjects submit requests to exercise their rights to VATES, VATES shall forward such requests upon receipt by e-mail to the Client’s DPO or, failing that, to the main contact designated in these General Terms and Conditions.

7. SECURITY MEASURES

VATES undertakes to implement and maintain technical and organisational measures taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing, as well as the risks, the likelihood and severity of which vary, for the rights and freedoms of natural persons.

8. IMPACT ASSESSMENTS

As far as possible and taking into account the nature of the Processing, VATES undertakes to assist the Client in carrying out data protection impact assessments relating to the Processing carried out under the Contract. For the avoidance of any doubt, it is recalled that VATES is not responsible for carrying out and/or updating the Client’s impact assessment.

9. TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA SUBJECT TO APPROPRIATE SAFEGUARDS

In the event of a transfer of Personal Data outside the EEA that is not covered by an adequacy decision of the European Commission pursuant to Article 45 of the GDPR, VATES undertakes to govern such transfer by means of appropriate safeguards within the meaning of Article 46 of the GDPR, including by entering into standard contractual clauses adopted by the European Commission, and to ensure a level of protection equivalent to European requirements.

10. COMPLIANCE; AUDIT

The Client may request an audit only after having first requested in writing from VATES the information enabling VATES to demonstrate compliance with its obligations, and only if the responses obtained do not appear sufficient to the Client. Except in the event of an imminent risk to the security of Personal Data, only one audit per annual period is authorised.

The request shall be notified to VATES by registered letter with acknowledgement of receipt with ten (10) Business Days’ prior notice, specifying the identity of the auditor, the date and scope of the intervention, which shall be strictly limited to VATES’ processes relating to the Processing entrusted under the Contract. The auditor must be independent, recognised in its field, not be a competitor of VATES, and must first be subject to a written confidentiality undertaking.

The audit shall take place during VATES’ business hours, without disrupting its activity. VATES shall provide assistance up to a limit of four (4) man-days. Any time beyond this limit shall be invoiced at the average man-day rate of the personnel concerned. All costs, including the auditor’s fees, shall be borne by the Client.

The results shall be communicated to VATES. Any report or information arising from the audit shall be confidential.