SLA & GTC & General Conditions

Contents

  • SLA/GTC/General Conditions Agreement – 3
  • Liability & Online processing- 7
  • Services – 12
  • GSE®System Platform – 13
  • Support  – 16
  • GSES First Class – 18
  • Product – Services & Responsibilities – 20

SLA/GTC/General Conditions Agreement

About SLA/GTC

These terms and conditions apply to all agreements that GSE®System Software (GSES) concludes. GSES aims at having transparent and unambiguous terms and conditions so that everyone can understand them. If any terms or conditions should be unclear, please inform GSES.

Applicable law and disputes

The law in the country of the GSES site with which the agreement has been concluded applies. The Vienna Sales Convention that has its own rules for international sale and purchase agreements is excluded. If disputes should arise between a customer and GSES, they shall be presented exclusively to a competent court of the country of the GSES site with which the agreement has been concluded.

  • For the Netherlands: Midden-Nederland District Court, Utrecht location

Changes

GSES works on the development of new, fascinating and innovative software that make working with it easier every day. The SLA/GTC/General conditions may also be amended in line with this where the principle is that those changes shall improve the quality of the GSES services. Changes will always be made known to the customer and significant amendments shall also be listed in a special newsletter. If the GSES software and services continue to be used, the most recent ‘General Terms and Conditions and SLA’ shall continue to apply. A possible objection may be lodged against the changes by submitting an “improvement suggestion". We shall then assess whether the change can lead to the adjustment thereof. In an extreme case, the option is available to terminate the agreement after the change where the old terms and conditions shall continue to apply for another two months. 

Agreement

The agreement is being concluded for an indefinite period of time where a minimum of one year shall apply unless agreed otherwise. When an agreement is concluded, the customer will receive a licence for the use of the GSES Platform. This will be invoiced through a subscription method.

Licence

The purchased product components (including users, employees, environments and returns) with the related quantities and start and end dates are encrypted in the licence. The licence may only be used for the own company (or companies) of the customer. The scope of the licence is aligned to the number of employees at the organisation.

Pricing

GSES uses, scales for the pricing of the licence based on the purchase quantities and prices based on revenue. The price scale may change when the licence quantities increase or decrease. A specification of the offered products, prices and scales can be found in the “Licences & Prices" section in the contract or in the subscription on the GSES platform. GSES pursues a policy in line with the market and price index with regard to its prices. GSES may index prices on an annual basis where the consumer price index figures are taken into account for the period of the past year from July up to and including June. Upon indexing, GSES will send a message to customers before 1 October in which the percentage will be specified. The indexing shall come into effect as from the first invoice in the next calendar year.

Invoicing

GSES invoices:

  • Licences: on a yearly basis in advance;

All invoices are sent through email as a PDF file. The payment period is 14 days unless agreed otherwise.

Validity of the licence

The licence is automatically renewed. The validity of the licence can be shortened with regard to un- wanted payment practices such as:

  • An invoice regarding which there is no dispute that is still unpaid after 60 days.
  • Paying invoices repeatedly one month late.

If a licence is due and payable within 21 days, a message shall be displayed when users sign on.

Changes to the licence – Changes to the licence can be requested through the GSES helpdesk.

Product components – Additions to the licence can be implemented directly. A cancellation of the product component can be implemented after a minimum of one year of full invoicing of the licence.

Agreement termination

The termination of the agreement can be submitted in writing through the GSES Helpdesk.

Termination by the customer

The termination of the licence can be implemented directly (if reported three months before the new invoice period) or as of the specified date. Access to the software and related data shall no longer be possible after the termination of the agreement.

Termination by GSES

The cancellation period for GSES is 12 months. GSES is entitled to terminate the agreement with im- mediate effect if the customer does not comply with his or her liabilities (after having been given notice of default), has applied for a moratorium or has filed a winding-up petition.

Customer data procedure after termination

  • The customer has the option of exporting all data in various formats before termination.
  • After the end date of the licence, the customer is entitled to a copy of the data for a local Profit installation. The customer can request this. This ensures that data can also be exported in various formats.

The entire production environment will be archived for one year (this can be requested through the Support Centre) and will thereafter be definitely removed from the backup location. The backup can be removed (i.e. deleted) before this period has expired upon request.

The subscription can also be continued with a smaller set of products to ensure that the data is still entirely accessible.

Liability & Online Processing

GSES guarantees that GSES platform complies with all specifications that it specifies. GSES shall always try to repair any errors should they occur. GSES takes great care in ensuring that GSES platform works correctly and that its services are provided appropriately. Despite these efforts, things can go wrong that may lead to damage or losses to the customer. GSES aims at achieving a suitable solution every time in consultation with the customer.

Liability

Liability issues in Europe shall run through GSES Management (no platform or software owner/manager/developer) based in the Netherlands. GSES cannot rely on liability restrictions if intent and/or wilful recklessness in its actions or of its employees or the third parties that it engages are involved.

GSES excludes its liability with regard to any form of consequential losses such as lost sales or profits and missed opportunities. The liability of GSES is also excluded if the customer or third parties engaged by the customer have made changes to the GSES products that are not allowed.

GSES and the customer are not liable with regard to each other if force majeure is involved. Force majeure is deemed to mean the following: Force majeure in the sense of the law including at suppliers of parties, unsound fulfilment of supplier obligations that are prescribed by the customer to GSES, interruptions to the electrical grid and faults or interruptions that impede data traffic insofar as the cause thereof cannot be blamed on the parties themselves.

The combined professional and business liability insurance

GSES has combined professional and business liability insurance for exceptional emergencies that GSES cannot or does not wish to cover. This insurance is appropriate. For more information about the content and scope of this insurance, please request information.

Reporting

GSES requires that the customer reports a complaint or claim as soon as possible to GSES. Not only can GSES then immediately work with the customer on a solution, but GSES must also report a claim to its insurer. For that matter, it continues to apply that GSES shall aim to find a suitable solution in consultation with the customer regardless of this complaint and/or claim.

Delivery periods

If GSES should not meet a delivery period, the customer must first give GSES notice of default and give GSES a reasonable period any way to comply with its obligations,

Confidentiality

GSES is fully aware that the information that the customer shares with GSES and saves within GSES Platform is confidential and is of a business-sensitive nature. All GSES employees must keep any data of the customer strictly confidential contractually.

Employees with access to customer data

Only GSES Platform system administrators have full access to customer data for:

  • Installing a new version;
  • Implementing patches and hot fixes;
  • Creating a backup;
  • Moving data within the GSES Platform domain.

Consultants, Support Assistants and other GSES employees only have access to customer data if they have received permission for this from the customer and for as long as they have permission of the customer. Customers are themselves responsible for this through their own authorisation tool within the application.

Security

GSES takes suitable technical and organisational measures continuously to ensure that the customer’s personal data is secure against loss related to any form of unlawful processing. The customer is entitled to check compliance with this in consultation with GSES during the duration of the agreement by an independent expert, for example, by having an audit carried out. The customer shall bear all the costs in relation with this audit.

Sub processors

GSES shall process the customer data in data centres of TransIP and it is therefore a sub processor. The data centres that GSES uses are only located in the Netherlands (Schiphol Rijk and Haarlem) and fall under the legislation and regulations of the Netherlands and comply with strict Dutch and European legislation with regard to logical and physical access security and continuity. The data centres are at least ISO 27001 certified.

GSES shall not have new sub processors process data without informing the customer about this in a timely manner. The customer can inform GSES that the customer objects about the sub processor. GSES shall settle these objections on a management level. If GSES should want to have data processed by the new objected sub processor, the customer shall have the opportunity to terminate the agreement.

Data subjects

The customer is responsible for the entered data of data subjects and therefore for informing and assisting with regard to the rights of data subjects. GSES shall never respond to requests from data subjects and shall always refer them to the data controller. GSES shall cooperate insofar as this is possible within the application with the customer so that the customer can comply with the customer’s legal obligations in the case that a data subject exercises his or her rights based on the GDPR or other applicable regulations regarding the processing of personal data.

Obligation to report data leaks

The GDPR requires that any data leak be reported to the Dutch or Belgian Data Protection Authority (DPA) by the data controller of the data. GSES shall therefore not submit any reports to the relevant Data Protection Authority. GSES shall, naturally, inform the customer correctly, on time and in full about relevant incidents so that the customer can comply with the customer’s legal obligations as the data controller. The Policy rules with regard to the obligation to report data leaks of the Data Protection Authority provide more information about this.

If the customer makes a (provisional) report to the Data Protection Authority and/or the data subject(s) about a data leak at GSES without the customer having informed GSES, the customer shall be liable for the losses and damage that GSES has suffered and the costs of this report. If it is shown that a data leak at GSES is not involved in any way, the customer must retract the report immediately.

Determining the data leak

For determining an infringement in relation to personal data, GSES uses the GDPR and the Policy rules with regard to the obligation to report data leaks as guidelines.

Reports made by customers

If it shown that a security incident or data leak has occurred at GSES, GSES shall inform the customer regarding this as soon as possible after GSES has become aware of the data leak. To realise this, GSES shall ensure that all its employees are capable and continue to be capable of observing a data leak and GSES expects its contractors to allow GSES to comply with this. For the purpose of clarity: if a data leak occurs at an GSES sub processor, GSES shall, naturally, also report this. GSES is the contact point for the customer. The customer does not need to contact the GSES sub processors.

Providing information

GSES shall try to provide the customer with all the information that the customer requires to make a report to the Data Protection Authority and/or the data subject(s).

Informing period

The GDPR indicates that reporting must be ‘immediate’. According to the Data Protection Authority, this must be without any unnecessary delay and, if possible, no later than 72 hours after its discovery by the data controller. If a security incident occurs, GSES shall inform the customer as soon as possible, but no later than within 48 hours. The customer shall have to make the assessment himself or herself whether the security incident falls under the term ‘data leak’ and whether it must be reported to the Data Protection Authority. The customer has 72 hours for this after the customer has been informed about this.

Progress and measures

GSES shall continue to inform the customer about the progress and measures that are being taken. In any case, GSES shall keep the customer informed with regard to any change in the situation, when further information becomes known and about the measures that are taken. 

Removing data

GSES shall remove all customer data after the agreement has ended as described in “Termination of the agreement". If the customer should wish the data to be removed before, a request for this can be submitted. GSES undertakes to comply with this.

Service Partners & Experts

GSES has a wide and large partner network in which there are service-providing partners, and parties that link products to the GSES application. These linking partners supply software links and services between the external application and Profit. GSES offers here different facilities (such as consulting, opt- in software and audit facilities) that ensure that high-quality links can be achieved.

The service-providing partners with whom GSES works with offer services that are complementary to GSES’ services. These organisations are independent and autonomous companies with their own DNA. Certified partners specialise in their own professional domains and have a high level of knowledge of the GSES organisation and GSES’ software. There is an intensive GSES Partner and Expert programme that must be followed including taking a knowledge test.

GSES can make recommendations regarding a partner or the customer can select a partner on

https://gses-system.com/strategic-partners/ .

In all cases, the customer concludes himself or herself a contract with the relevant partner.

No commissions are charged between the partner and GSES regarding customer deals unless there are delivered services regarding which mutual agreements have been made. When this is the case, GSES or the partner can discuss this agreement with the customer. 

Availability, Maintenance & Performance of the GSES Platform

GSES Platform is reliable, secure and fast. GSES works together with external parties to make GSES Platform available. In addition, GSES Platform works with professional parties to safeguard security. GSES has made clear agreements with its supplier and customers for the required maintenance. Optimum backup procedures guarantee an optimum continuity where we assume a fair use procedure of our customers.

Availability

GSES Platform is hosted on systems of professional Dutch data centres. These top-tier data centres have a network availability of 99.9999%. The availability and performance of GSES Platform are monitored continuously.

GSES Platform may not be available in the following situations:

  • Preventive maintenance;
  • When a new version of GSES Platform is installed;
  • When faults are resolved with regard to the software that fall under the responsibility of the
    customer;
  • Maintenance that has been discussed and agreed with the customer;
  • Emergencies or disasters as a result of natural disasters and other force majeure situations.

Maintenance
The customer shall be informed at least five days in advance if it is possible that GSES Platform may not be available. The activities will be performed between 9 p.m. and 7 a.m. or during weekends. Incidental patches and hot fixes are implemented automatically and without prenotification at night.

Performance
The GSES Platform performance should be good, but is dependent on the Internet connection and set- up of the environment of the customer.

Backup & restore
A backup is created four times a day of the entire production environment:

  • The day backup is deleted after one day.
  • The night backup is kept for 30 days and can be restored upon request. The average length of time
    required to restore an environment is four hours.
    If required, a backup of the environment can be requested through an incident for local use or archiving. GSES has a fair use policy with regard to these requests to prevent large data streams.

Monitoring

Systems, processes and users are monitored continuously on GSES Platform in the own Cyber Operations Centre where the objective is the following:

  • Prevent interruptions and faults or resolve them at an early stage. Monitoring focuses on the timely discovery of faults and unwanted behaviour. An GSES employee is always available to re- solve faults and other emergencies immediately even at night. Checking on abuse is part of the (daily) standard monitoring activities.
  • Collecting general user statistics such as response times. This information is analysed and may be discussed with the customer for improvement purposes.
  • Collection of anonymous statistics from the customer environment to improve our products and services.

Continuity

GSES Platform has emergency procedures to prevent the loss of data through the system being down, physical destruction or some other way and to promote restoring this data. Every customer is assigned a data centre. The data centres have redundant technologies so that some servers or storage being down will not lead immediately to an emergency. If required, contingency measures to use another data centre are in place.

RPO/RTO with regard to emergencies

If a data centre should be down completely, computer resources are no longer available. This would

then affect half of customers roughly. At that moment, additional computer capacity will be made available in the other data centre. The RPO (recovery point objective) is the maximum time that data loss can occur when a system goes down fully. RTO = max. 12 hours. The RTO (recovery time objective) is the time that is required to make the available backup available. The time that is required for this is not known. The different failures and faults have their own solutions and therefore also their own RPO and RTO.

Data centre continuity upon bankruptcy

Additional (contractual) agreements have been made with the data centre that must contribute to GSES’ customers continuing to have access to their data in case of bankruptcy:

  • The data centre will not stop services to GSES in case of bankruptcy of the data centre before a continuity plan has been agreed with the receiver.
  • If GSES is declared bankrupt, the data centre will not stop services up to at least a period of two
    weeks after the bankruptcy date. Before the services are stopped, the data centre will consult the receiver about the retention of services and safeguarding financial obligations.

Support

General support

Every report made to the Support Centre is referred to as an ‘incident’. An incident can be an error, fault, preference, set-up issue or user question. Customers may be referred to Service Management with regard to set-up issues (for more information, see Service Management).

The administrator of the customer portal can determine who may contact the Support Centre on be- half of their organization through the “employee" or “administrator" authorisation role. The support employee will check whether the contact has been given authorisation with regard to this with regard to each incident. If a user is not a contact with the organization, support is not given by the support employee. GSES expects that the customer maintains this issue because the customer is best placed to determine who are authorised.

Registration and response time

If the Help Centre does not offer a solution, the customer can submit an incident to the Support Centre. The customer can contact the Support Centre immediately with regard to an immediate problem situation after registering the incident on the customer portal. After entering the incident number on the telephone, the customer will be connected directly with the support employee who is processing the incident.

The customer can follow the settlement of the incident through the customer portal. The customer will receive an update by email every time the status changes. The customer will be involved in the settlement of the incident and can add his or her response and other additional information. The re- store time with regard to a problem will depend on the seriousness and duration of the situation and the degree in which GSES depends on third parties for the performance of restore or repair activities.

Priorities and restore times

The priority of the issue determines the response time. Most incidents are about issues that are related to knowledge about the product. These issues are often resolved the same day. If the issue is related to functionality that does not yet exist, that is, a preference, this is submitted to Product Management. It cannot always be indicated when and whether the preference will be fulfilled.

Every incident will be assigned a priority. It will be assigned by the support employee who processes the incident. The guidelines that we use for this are as follows:

  • Priority 3: Informative issues/preferences: In 90% of cases, the same or the next day (if it is exceptionally busy, the customer will be informed about this).

  • Priority 2: Problems that do not disrupt production: Restore time/workaround within one month insofar as this is possible.

  • Priority 1: Production-disrupting problems: Restore time/workaround within five working days in- so far as this is possible. A restore time/workaround within one working days insofar as this is possible applies with regard to production-disrupting problems for First Class customers.

Opening times and additional support

The Help Centre can always be consulted through the customer portal that will provide an answer to the asked questions in 90% of cases. If the Help Centre does not offer a solution, an incident can be submitted through the customer portal. The Support Centre will answer these questions from Monday to Thursday between 8 a.m. and 6 p.m. and on Fridays between 8 a.m. and 4 p.m. unless specified otherwise on the customer portal. The Support Centre can also be reached by telephone during these hours.

In addition, we offer an emergency service every working day from 6 a.m. to 8 a.m. and from 6 p.m. to 11 p.m. On Fridays, the emergency service is available from 4 p.m. to 11 p.m. as well as in the early morning. Emergencies can be submitted through the Support Centre where the person who submitted the emergency incident will be contacted within the hour.

First Class

A customer with a GSES First Class contract has direct contact with the GSES First Class team. This team consists of extremely highly trained and experienced support employees. The support employee, GSES First Class support manager or the consultancy manager will visit the customer’s site on an annual basis.

Extra services

The extra services consists of the following as standard:

  • Personal telephone number to report incidents;
  • There is no waiting time on the telephone in 90% of cases;
  • Advice in relation to set-up issues;
  • Entitlement to 15 hours of service management per year (the duration of the First Class con-
    tract is taken into account within this context);
  • Knowledge of your organisation;
  • Incident support

Monitoring – Monitoring Priority 1 incident at First Class Support:

  • Streamlined monitoring of the incident applies carried out by the First Class team and man-
    ager.
  • The product manager and other responsible persons within GSES are called in immediately.
  • The customer is kept informed at all times about the progress of the incident.
  • Work is also performed on the solution of the incident outside the standard opening hours.

Teamwork

The extra teamwork between the GSES First Class customer and GSES consists of the following:

  • Annual work placement visit of the personal GSES First Class employee; or
  • Annual assessment visit of the support manager of the GSES First Class team of the Support Centre; or
  • Annual visit of the consultancy manager; and
  • An invitation to attend a GSES First Class inspiration day or event.

Product – Services & responsibilities

GSES will provide the customer with a product that is continuously developed further with new functions, improvements and legal amendments. This product is called GSES System Platform and is made available as standard through the GSES online system. This section contains information about development, version management, system requirements, product support.

Services and responsibilities

GSES develops and delivers the software (GSES System Platform) and can, in most cases, take care of the implementation of this software at its customers. Customers are themselves responsible for the correct configuration of the application. If the application requires adjustment because of performance or security issues, GSES will contact the customer to implement the required adjustment. This service is included.

GSES ensures a correct delivery of applicable legislation in the software, for example, in relation to taxation matters and collective bargaining agreements (also known as collective labour agreements). The customer is responsible for correct application.

GSES is not responsible for the correct operation of links of additional software packages or additional services of third parties.

Property rights

The intellectual property right of the products is vested and will continue to be vested on GSES. If a third party should claim that the intellectual property right of the software is vested on him or her, the customer shall indemnify the customer. A condition in relation to this is, however, that the customer informs GSES as soon as possible, cooperates with the investigation and leaves the settlement of the issue completely to GSES from this point on.

The property right with regard to the entered data and the data generated by the application is vested on the customer. GSES may not and shall not appropriate customer data.

A licence does not entitle the customer to what is commonly referred to as the source code. A separate agreement can be concluded for an escrow agreement.

Development and version management

The software is continuously developed further and supplied with new functions, improvements and legal amendments. The delivery policy can be found on the customer portal.

Broadly speaking, GSES uses the following delivery schedule:

  • Version: 2-3 times a year;
  • Patch: On a daily basis if applicable.
    Every version comes with release notes. They describe which components have been changed.

The migration date will be made definitive at least five days in advance. The total migration duration of the version is six to eight weeks. The data will not be available temporarily with regard to the migration from one version to the next.

The time

during which the data will not be available is very dependent on a number of factors such as data conversion, size of the database and the quantity of records to be changed. Experience has shown that the maximum time is between 5 minutes and 2.5 hours. These activities are performed as much as possible outside office hours (Monday to Friday: 7 a.m. to 6 p.m.) and customers are notified well in advance.