Specific Conditions and General Conditions of the Publisher
Specific Conditions and General Conditions of the Publisher
Version 4 — July 2026
PART I — SPECIFIC CONDITIONS
Document to be completed and signed by the Parties
These Specific Conditions (“CP”) and the General Conditions of the Publisher set out in Part II form a single contractual document. Signature of the CP by the Client entails unreserved acceptance of the General Conditions of the Publisher.
CP 1 — PARTIES
CP 1.1 Contracting Entity
The Erium group entity designated below grants the Licence and is deemed to be the Publisher within the meaning of the General Conditions of the Publisher.
Corporate name
……………………………………………………………
Legal form, share capital, registration
……………………………………………………………
Registered office
……………………………………………………………
Represented by
……………………………………………………………
CP 1.2 Client
Corporate name
……………………………………………………………
Legal form, share capital, registration
……………………………………………………………
Registered office
……………………………………………………………
Represented by
……………………………………………………………
The Licence is granted to the sole Client designated above. Any extension to another entity of the Client's group shall be the subject of a separate order.
CP 2 — PURPOSE
The Publisher grants the Client a Licence of Use of the BlackNoise AEV Platform, together with the associated Support and Maintenance, according to the scope defined in the attached Quotation and on the terms hereof.
CP 3 — SCOPE OF THE LICENCE
The functional and technical scope of the Licence — subscribed offer, number of Vectors, modules, add-ons, additional services and options — is defined exhaustively in the attached Quotation, signed by the Client. The Quotation forms an integral part of this document.
Quotation reference
……………………………………………………………
Deployment Mode
☐ SaaS ☐ On-premise
Subscribed Support level
☐ Standard ☐ Premium
Applicable Reasonable Use thresholds
Documentation in force · or specific thresholds: ……………………………………………………………
Scheduled date of provision
……………………………………………………………
CP 4 — TERM AND RENEWAL
CP 4.1 Commitment Term
The Licence is granted for a firm Commitment Term, running from the provision of the Platform.
The Licence may not be terminated for convenience before the end of the firm Commitment Term. In the event of early termination attributable to the Client, the multi-year discount granted shall become payable up to the difference between the amounts invoiced and the price applicable to a twelve (12) month commitment.
CP 4.2 Automatic renewal
Upon expiry of the Commitment Term, the Licence shall be renewed automatically for successive periods of twelve (12) months, without limitation on the number of renewals, unless terminated by written notice given by either Party to the other no later than two (2) months before the end of the current period.
By express derogation from articles 1214 and 1215 of the French Civil Code, each renewal period is of fixed duration: renewal does not convert the Licence into an open-ended agreement.
Termination takes effect at the end of the current period, without indemnity on either side. Article 3.5 of the General Conditions of the Publisher shall then apply.
CP 4.3 Price adjustment upon renewal
Each renewed period shall be invoiced at the price of the preceding period increased by an uplift capped at five per cent (5%). The Publisher shall notify the amount of the renewed Fee no later than three (3) months before the end of the current period; failing notification within that time, the Fee of the preceding period shall be carried over unchanged.
The price notification period is deliberately longer than the termination notice period, so that the Client has at least one month to decide with knowledge of the applicable price.
CP 5 — PRICE
The price of the Licence, modules, options and additional services is defined in the attached Quotation, signed by the Client. No price appears in these CP or in the General Conditions of the Publisher.
Reference prices are expressed in euros. Where the Quotation shows amounts in another currency, conversion shall be carried out at the reference rate stated therein; that rate is guaranteed for the period of validity of the Quotation and the invoicing currency is fixed at the time of order.
CP 6 — PAYMENT
First period: the Fee is payable in full upon order, prior to the provision of the Platform.
Renewed periods: the Fee is invoiced on the anniversary of the effective date and payable upon receipt of invoice.
Additional services: invoiced in accordance with the terms of the corresponding Quotation or purchase order.
Payments shall be made in funds free of any set-off, withholding or deduction of any nature whatsoever.
Any late payment shall automatically give rise to late payment interest at the increased statutory rate, together with the fixed indemnity for recovery costs provided for by the applicable regulations, without prejudice to suspension of access after formal notice has remained unsuccessful.
CP 7 — CONTACTS
Publisher — sales contact
……………………………………………………………
Publisher — support contact
……………………………………………………………
Client — designated Administrator
……………………………………………………………
Client — billing contact
……………………………………………………………
The designation and up-to-date maintenance of at least one Administrator are conditions for the benefit of Maintenance.
CP 8 — CONTRACTUAL DOCUMENTS AND ORDER OF PRECEDENCE
The contractual documents are, in decreasing order of precedence:
the Quotation signed by the Client, for all matters relating to scope, quantities and prices;
these Specific Conditions, for all provisions of a legal nature;
the General Conditions of the Publisher set out in Part II.
In the event of any conflict, the higher-ranking document shall prevail in its respective field. Any provision of the General Conditions of the Publisher contrary to these CP shall be deemed unwritten to the sole extent of the conflict.
CP 9 — GOVERNING LAW AND JURISDICTION
In the absence of any statement below, article 16.6 of the General Conditions of the Publisher shall apply.
Agreed governing law
……………………………………………………………
Agreed competent jurisdiction
……………………………………………………………
CP 10 — SIGNATURE
The Client acknowledges having read Part II — General Conditions of the Publisher, which forms an integral part of this document, and accepts its provisions without reservation. It further acknowledges having signed the attached Quotation.
For the Publisher
For the Client
Name: .................................. Title: .................................. Date: .................................. Signature and company stamp:
Name: .................................. Title: .................................. Date: .................................. Signature and company stamp:
PART II — GENERAL CONDITIONS OF THE PUBLISHER
Contractual framework — applies unless otherwise provided in the Specific Conditions
RECITALS
The Publisher, ERIUM SAS (Paris Trade and Companies Register no. 833 264 922), publishes BlackNoise AEV (the “Platform”), an Adversarial Exposure Validation software. The Platform consists of an application environment (the “Application”) and execution vectors (the “Vectors”) deployed within the Client's information systems.
The Vectors are connected to the Application, which sends data to them and receives data from them. The Platform makes it possible to run attack simulations executed from the Vectors, then to collect, analyse and interpret the resulting data. It includes visualisation functions and can interface with other software by means of connectors (API).
This having been recalled, the Parties agree as follows.
ARTICLE 1 — DEFINITIONS
Capitalised terms have the meaning given to them below or in the body hereof.
Analyst · the person or persons employed by the Operating Entity and/or the Client using all or part of the Platform in the course of their activities.
Anomaly · any failure, blockage, malfunction or reproducible incident whose correction is necessary in that it prevents or restricts normal use of the Platform. An Anomaly is “Blocking” where the Platform is unavailable; it is “Non-Blocking” where it disrupts use of the Platform without preventing the execution of simulations or the use of their results.
Target · any environment, system, network, application, service or asset on which an attack simulation may be executed.
Client · the legal entity for whose benefit the Platform is used and within which the Vectors are deployed.
Documentation · the installation, user and administration manuals, in whatever medium, describing the operation and implementation of the Platform, communicated or made available by the Publisher and liable to be updated.
IPR · any intellectual property right and all its component rights, together with any subject matter of such rights, including in particular patents, inventions, trade marks, trade names, designs, models, databases, copyright, sui generis rights and know-how, whether registered or not, including any application for registration.
Publisher · ERIUM SAS (Paris Trade and Companies Register no. 833 264 922), publisher of the Platform. Where the Licence is granted by another Erium group entity designated in the Specific Conditions or in the order, that entity is deemed to be the Publisher within the meaning hereof.
Operating Entity · the legal entity in charge of operating the Platform, namely (i) the Partner where it delivers a service in addition to distribution, (ii) the Client where it operates the Platform directly, or (iii) the Client's security services provider.
Production Incident · the situation in which the Platform is no longer accessible in nominal conditions as a result of (i) a configuration error in the Platform or its dependencies, (ii) failure to comply with the Prerequisites, (iii) a failure of monitoring or resource management, or (iv) a hardware, network or server failure.
Maintenance · the correction of Anomalies and the supply of updates to the Platform by the Publisher, on the terms hereof.
Deployment Mode · the installation environment of the Application and the Vectors, namely (i) a cloud-type environment administered by the Publisher (SaaS model), or (ii) an environment defined and administered by the Operating Entity (on-premise model).
Open Source · the software developments included in the Platform's libraries supplied under an “open source” licence.
Operator · the person or persons employed by the Operating Entity and/or the Client holding extended rights, in particular for configuration, parameter modification or simulation scheduling.
Partner · the legal entity having entered into a partnership agreement with the Publisher for the distribution of the Platform.
Authorised Scope · all Targets owned by the Client or for which it holds formal, express and prior authorisation to carry out testing; it is defined, verified and kept up to date under the sole responsibility of the Client.
Platform · the Application enabling attack simulations to be steered and their results to be used, together with all its patches, improvements, updates and versions supplied by the Publisher, and the execution Vectors in whatever form (software agent, virtual machine, container or physical appliance) managed via the Application.
Prerequisites · all the minimum software and network conditions and configurations of the Client's information system necessary for the proper operation of the Platform, together with the information to be provided to the Publisher for its installation and configuration.
Fee · the amount due in respect of the Licence of Use, Maintenance and Support, for each twelve (12) month period, whether initial or renewed.
Support · the Publisher's technical assistance service intended to handle difficulties encountered in using the Platform, on the terms hereof.
Reasonable Use · the volume of use of the Platform corresponding to its purpose and to the agreed sizing, assessed in the light of the subscribed scope and the reference thresholds published in the Documentation. References to “unlimited”, “illimité”, “fair use” or equivalent wording appearing in the Quotation, the Documentation or sales materials denote the absence of a firm contractual quota, and not a right of unlimited use: they are to be understood within the limits of Reasonable Use.
User · any natural person employed by or attached to the Operating Entity and/or the Client (in particular an Analyst or Operator), authorised to access all or part of the Platform. As the Users are not signatories hereto, the Client stands surety (porte-fort) within the meaning of article 1204 of the French Civil Code for their compliance with the applicable provisions.
ARTICLE 2 — PURPOSE
The purpose of these General Conditions of the Publisher (“CGE”) is to define the conditions applicable (i) to the types of Licence that may be granted by the Publisher over the Platform, and (ii) to the provision of Support, Maintenance and, where applicable, hosting on the Publisher Cloud.
ARTICLE 3 — RIGHTS GRANTED ACCORDING TO THE TYPE OF LICENCE
Depending on the type of Licence agreed with the Publisher, the latter grants the Operating Entity the following rights, subject to the limitations set out in this article.
3.1 Licence of Use
The Publisher grants the Operating Entity, on a non-exclusive, personal and non-transferable basis, a right to use the Platform for internal purposes, for the scope and term agreed in the contract. The Operating Entity is authorised to use the Platform on behalf of the Client where it provides the Client with a service.
3.2 Evaluation Licence (PoC)
Prior to the conclusion of a use agreement, the Publisher may grant the Operating Entity, on a non-exclusive, personal and non-transferable basis, a licence for evaluation purposes (PoC). Its duration and scope are defined in the contract or purchase order specific to each Client. These CGE, in particular articles 6 and 9, apply identically during the Evaluation phase and in operation.
3.3 Limits
Whatever the type of Licence, the Client, the Partner and, where applicable, the Operating Entity acknowledge that the Publisher grants no ownership right over the Platform, the IPR or the Open Source, but solely a right of use in accordance with the Licence granted. The right to use the Open Source arises from the applicable open source licence. Accordingly, they shall refrain, unless expressly authorised by the Publisher, from:
decompiling, disassembling or reverse-engineering the Platform, save for interoperability purposes under the conditions of article L. 122-6-1 of the French Intellectual Property Code and after the Publisher has refused to communicate the necessary information requested in writing;
attempting to discover the structure of the source code or any other operating mechanism of the Platform;
reproducing the Platform other than by a single back-up copy in accordance with the French Intellectual Property Code;
modifying, correcting, translating or adapting all or part of the Platform, creating derivative works from it, or extracting and re-using a qualitatively or quantitatively substantial part of it;
marketing, sub-licensing, distributing, transferring, renting, pledging, disseminating or making the Platform available by any means whatsoever, outside the conditions hereof;
removing any notice relating to the Publisher's IPR appearing on the Platform, its media or the Documentation;
using the Platform for a purpose, or on a system or place of operation, that has not been agreed;
reproducing the Documentation beyond the authorised number of copies, set by default at one (1);
attempting to open or modify the Vectors in their physical version. From their design stage, the Vectors are subject to a non-offensive, strictly confidential tamper-detection strategy enabling any attempt to open or modify them to be detected; the Client, the Partner and the Operating Entity acknowledge having been informed thereof.
3.4 Term and renewal
Unless otherwise provided in the Specific Conditions or the order, the Licence of Use is granted for the agreed Commitment Term, running from the provision of the Platform.
Upon expiry of the Commitment Term, the Licence of Use shall be renewed automatically for successive periods of twelve (12) months, without limitation on the number of renewals, unless terminated by written notice given by either Party to the other no later than two (2) months before the end of the current period. By express derogation from articles 1214 and 1215 of the French Civil Code, each renewal period is of fixed duration: renewal does not convert the Licence into an open-ended agreement.
Each renewed period shall be invoiced at the price of the preceding period increased by an uplift capped at five per cent (5%). The Publisher shall notify the amount of the renewed Fee no later than three (3) months before the end of the current period; failing which, the Fee of the preceding period shall be carried over unchanged.
Termination takes effect at the end of the current period, without indemnity on either side; article 3.5 shall then apply. This article does not apply to the Evaluation Licence (PoC), which ends automatically at its term without renewal.
3.5 End of the rights granted
At the end of the agreed term (the “Commitment Term”), the Operating Entity may renew its Licence of Use. Failing renewal or a new order, it shall cease all access to and use of the Platform and uninstall the Vectors. Where the Platform is hosted in the Publisher Cloud, the Publisher shall deactivate access rights within ten (10) business days from the end of the Licence, then permanently delete the stored data upon expiry of a period of one (1) month. In the other Deployment Modes, uninstallation shall be carried out by the Operating Entity within fifteen (15) days. The Operating Entity shall then delete every copy of the Platform and all of the Publisher's Confidential Information.
ARTICLE 4 — TERMS OF PROVISION
The Platform is made available to the Operating Entity according to the Deployment Mode agreed between the Parties.
In the event of deployment in the Publisher Cloud, the Publisher shall carry out the deployment and upkeep of the Application in accordance with the provisions of the order. The Operating Entity shall notify the Publisher in writing, prior to the order, of any particular condition liable to affect the sizing of the Publisher Cloud. Provision is effected by the supply of access credentials to the Application.
In the other Deployment Modes, the Platform and the Documentation are made available in digital format; their deployment is incumbent on the Operating Entity with the Publisher's assistance.
The Platform and the Documentation are deemed delivered on the date they are made available.
ARTICLE 5 — INSTALLATION AND OPERATION
From delivery, the Operating Entity is solely responsible for operating the Platform on its information system, in particular for deploying the Vectors and for the selection, configuration and execution of attack simulations.
The infrastructure hosting the Platform shall at all times satisfy the Prerequisites. The Prerequisites are available on the Publisher's support portal and may be updated by the Publisher to reflect changes to the Platform.
ARTICLE 6 — ACCEPTABLE USE RULES
6.1 Authorised Scope
The Operating Entity shall execute attack simulations only on Targets falling within the Authorised Scope. This obligation applies to all scenarios, whatever the posture of the Vector, external or internal. The Operating Entity warrants that no action is executed outside the Authorised Scope. The definition, verification and updating of the Authorised Scope fall under the sole responsibility of the Client; the Publisher has no knowledge of it and exercises no control over the selected Targets.
6.2 Responsibility for operation
The Operating Entity alone designs, configures and triggers the simulations. It alone bears responsibility for the choice of scenarios, their intensity and their consequences on the Client's systems. As the Platform constitutes a training and assessment tool, the Publisher incurs no liability for the effects produced by the scenarios selected and executed by the Operating Entity.
6.3 Purpose of use
Use of the Platform is strictly limited to security training and assessment. Any offensive use, directed against a third party or exceeding the Authorised Scope, is prohibited.
6.4 Credentials
Credentials are personal, confidential and non-transferable. Their sharing, assignment, resale or pooling is prohibited. The Operating Entity is answerable for their safekeeping and for the consequences of their use.
6.5 Reasonable Use
Access to the Platform is granted for Reasonable Use within the meaning of article 1, whatever references to unlimited use may appear in the Quotation, the Documentation or sales materials. Where use exceeds that framework or is liable to affect the stability, security or performance of the Platform, the Publisher Cloud or the shared environment, the Publisher may apply, at its sole discretion and in a proportionate manner, any technical limitation measure it deems appropriate, without any obligation to detail its nature. Such measures, which are temporary and lifted as soon as normal use resumes, constitute neither a breach by the Publisher nor an impairment of the availability rate provided for in article 7.2, and do not engage its liability. The Publisher shall inform the Operating Entity thereof within a reasonable time, except where urgency or security requires immediate application.
ARTICLE 7 — HOSTING IN THE PUBLISHER'S CLOUD
7.1 Conditions
In the event of deployment in the Publisher Cloud, the Publisher provides a hosting service for the Platform accessible over the internet (the “Publisher Cloud”). The Client acknowledges that the hosting and the data generated are entrusted to a sub-processor of the Publisher (the “Cloud Provider”).
7.2 Availability
The Platform is accessible twenty-four hours a day, seven days a week, subject to the periods of unavailability referred to below. The guaranteed annual availability rate is 99.5%, calculated as the ratio between the total number of minutes in the year, less the minutes of unavailability, and the total number of minutes in the year. Availability commitments are subject to the Operating Entity's compliance with the terms of the contract. The Client is informed of the technical uncertainties inherent in the internet and of the access interruptions that may result therefrom, which shall not engage the Publisher's liability.
Excluded from the calculation of the availability rate is unavailability resulting from:
interruptions planned by the Publisher and notified to the Operating Entity;
interruptions requested by the Operating Entity or necessary to safeguard the Operating Entity's information system or the hosting environment;
application failures attributable to the Operating Entity or to a third party;
malfunction of the Client's hardware or local network, or total or partial interruption of the internet network or of the private network used to access the Platform;
the time required for the physical transfer of stored data;
interruptions relating to the services of a third party other than the Cloud Provider;
maintenance operations on the infrastructure or the Platform;
failure to comply with a recommendation issued by the Publisher or the Cloud Provider;
any period during which the Operating Entity does not provide the necessary information or access, or does not cooperate in resolving a Production Incident;
any breach by the Operating Entity of its obligations;
cases of force majeure as defined by French case law.
The Operating Entity is responsible for the means of access to the Platform and for the administration of rights and Users.
7.3 Security and backup
The Cloud Provider's security measures are communicated on request. Back-ups are carried out in accordance with the Publisher's business continuity and disaster recovery plan.
7.4 Reversibility
Under a Licence of Use and upon the Client's express request, the Publisher shall return the data of which it does not itself hold a copy at the end of the contract. The request shall be sent to the Publisher no later than fifteen (15) days from notification of non-renewal or termination and, in any event, before the end of the Licence. The return is effected by making available a download link, in binary format and raw data, comprising the attack simulation timeline (CSV) and the list of IOCs (CSV). Any request for return or portability exceeding that scope shall be invoiced separately in accordance with the price list in force.
ARTICLE 8 — WARRANTIES
8.1 Warranty of conformity
The Publisher warrants that, for thirty (30) days from the provision of the Platform (the “Warranty Period”) and subject to use in accordance with the contract, the Platform operates in accordance with the Documentation. Upon a written claim describing the non-conformity sent during the Warranty Period, the Publisher shall use its best efforts, at its discretion, to remedy it by means of a patch or a workaround. Failing correction within thirty (30) days of receipt of the claim, the Parties may terminate the contract; the Client shall then obtain, from whoever granted it the Licence, a pro rata temporis refund of the Fee paid. The warranty does not apply where the non-conformity is not reproducible or results from (i) use not in accordance with the contract, (ii) a malfunction of the Operating Entity's or the Client's information system, or (iii) a cause beyond the Publisher's control.
8.2 Warranty of quiet enjoyment
The Publisher warrants that the Platform does not infringe the intellectual property rights of any third party. It shall bear the damages to which the Client or the Partner may be ordered by a final court decision on account of a breach of this warranty, provided that the beneficiary (i) notifies it in writing and without delay of any claim, (ii) leaves it in charge of the defence and negotiations, (iii) does not settle without its written consent and (iv) provides it with the necessary assistance. The Publisher may then, at its option, obtain the right to continue use, modify the Platform so as to end the infringement, provide an alternative solution of equivalent scope, or terminate the contract and refund the Fee less the period of enjoyment. The warranty does not apply where the claim results from (i) a combination of the Platform with items not supplied or approved by the Publisher, (ii) use not in accordance with the Documentation, or (iii) an unauthorised modification. This article survives the end of the contract and sets out the Publisher's sole obligations in the event of infringement of a third party's IPR.
8.3 Warranties of the Operating Entity
Throughout the period of use, the Operating Entity represents and warrants: (i) compliance with all applicable law, in particular its obligations towards its personnel in respect of personal data processing; (ii) compliance with the Prerequisites and the Documentation, to the exclusion of any software or system not identified as compatible; (iii) that the Platform is not intended to monitor the activity of personnel, the Publisher not being answerable for decisions taken by the Client on the basis of the information returned, any resulting disputes being settled directly between the Client and the persons concerned. The obligations relating to the Authorised Scope and to the purpose of use are set out in article 6.
ARTICLE 9 — LIABILITY
9.1 Principle
Each Party is answerable for the direct damage caused to the other as a result of the non-performance of its obligations, on the terms of this article.
9.2 Excluded damages
The Publisher shall in no event be liable for indirect damage, in particular loss of operations, loss of turnover, of profit, of clientele, of image or of data, nor for the consequences of an action brought by a third party against the Operating Entity or the Client.
9.3 Cap
The Publisher's total liability, all operative events and all losses combined, is limited to the amount excluding tax of the Fee actually paid in respect of the twelve (12) months preceding the operative event. A plurality of claims does not raise this cap.
9.4 Exclusions from the cap
Articles 9.2 and 9.3 apply neither in the event of wilful misconduct or gross negligence, nor in the event of bodily injury, nor to a breach of article 11 (Confidentiality), nor to the warranty provided for in article 8.2.
9.5 Liability of the Operating Entity and the Client
In accordance with article 6, the Operating Entity and the Client are solely answerable for the definition of the Authorised Scope, for the choice and consequences of the simulations executed and for any non-compliant use. They shall indemnify the Publisher against any third-party claim resulting therefrom.
9.6 Claim period
Any claim shall be brought within twelve (12) months of the occurrence of the operative event, failing which it shall be time-barred.
ARTICLE 10 — TERMINATION
The implementation of this article does not affect the automatic renewal mechanism for so long as the termination has not become effective.
The Licence of Use may be terminated automatically by a Party in the event of a breach by the other which has not been remedied, where this is possible, within thirty (30) days of a formal notice expressly referring to this provision. Where the breach is not capable of remedy, that period shall serve as notice of termination.
Incumbent on the Client: (i) compliance with the conditions of access and use, (ii) compliance with the Publisher's IPR and the terms of the Licence, (iii) compliance with the warranties and the Prerequisites, (iv) compliance with the confidentiality undertakings and (v) payment of the sums due.
Incumbent on the Publisher: (i) compliance with the annual availability rate, (ii) compliance with the confidentiality undertakings, (iii) compliance with the warranty of conformity and (iv) compliance with its obligations in respect of personal data.
ARTICLE 11 — CONFIDENTIALITY
Each Party shall keep confidential the information of the other Party to which it has access in the course of negotiating and performing the contract (the “Confidential Information”), throughout the term of the contract and for five (5) years after its end, save for any distinct period applicable to personal data.
The following are confidential in particular: (i) the information, analyses and documents relating to the discussions between the Parties or to the contract; (ii) the methodologies, products, tools, developments, models and financial, technical, commercial or other data; (iii) the information identified in writing as confidential; (iv) the Platform and the Documentation.
Each Party shall handle the Confidential Information with the same care as its own and shall refrain from disclosing it to third parties. Disclosure strictly necessary to agents, advisers or subcontractors (the “Authorised Third Parties”) is subject to an equivalent confidentiality undertaking; each Party stands surety (porte-fort) within the meaning of article 1204 of the French Civil Code for compliance therewith.
The obligation does not apply to information (i) already known before signature, (ii) in the public domain without any breach, (iii) communicated by a third party without breach of a confidentiality obligation, (iv) whose disclosure is required by law or by an administrative or judicial decision, or (v) which must be brought to the Client's attention for the purposes of the Platform.
The Publisher may pass on information lawfully requested by a judicial or administrative authority without incurring liability. Where a separate confidentiality agreement has been entered into for an Evaluation Licence, its provisions shall prevail in the event of any conflict.
ARTICLE 12 — PERSONAL DATA
Each Party shall comply with the regulations applicable to personal data, in particular Regulation (EU) 2016/679 (“GDPR”) and French Law no. 78-17 of 6 January 1978 as amended (the “Data Privacy Regulations”). The terms “Personal Data”, “Processing”, “Data Subject”, “Controller” and “Processor” have the meaning given to them by those regulations.
12.1 Capacity of the Parties
In respect of the Processing carried out:
in connection with the use of the Platform, the Client acts as Controller and the Operating Entity, where it is a separate entity, as Processor acting on the Client's documented instructions;
where the Platform is deployed in the Publisher Cloud, the Publisher acts as Processor for the Client in respect of hosting;
in respect of the Support and Maintenance Processing and the detection-improvement Processing, the Publisher acts as Controller.
12.2 Undertakings of the Publisher acting as Processor
When acting as Processor, the Publisher undertakes to:
process the Personal Data only on the Client's written instructions and inform the Client of any instruction that does not comply with the Data Privacy Regulations;
guarantee the confidentiality of the persons authorised to process the data and implement the security measures described in its security assurance plan;
reasonably assist the Client in handling requests from Data Subjects seeking to exercise their rights, which it shall forward to the Client without responding to them, unless instructed otherwise;
help the Client ensure compliance with its security obligations and, at the end of the contract, delete the Personal Data unless subject to a legal retention obligation;
make available to the Client the information necessary to demonstrate compliance and allow one audit per year, any audit or penetration test being subject to prior written agreement on its terms;
notify the Operating Entity as soon as possible, and if possible within forty-eight (48) hours, of any established Personal Data breach at the Publisher or its host;
cooperate reasonably with the CNIL and with the Client;
cease all processing at the end of the contract, subject to the reversibility undertakings.
12.3 Processing carried out as Controller
The Support, Maintenance and detection-improvement Processing operations are described in the Platform's privacy policy, available on request. The Client declares having read it; the Publisher declares that they are compatible with the initial purposes and complies with its obligations as Controller.
12.4 Sub-processing
The Publisher uses sub-processors, including the Cloud Provider. Signature of the contract entails acceptance of the sub-processors in place. Any change is communicated to the Client and the Partner, who have ten (10) days to object on legitimate and reasoned grounds; failing which, the change is deemed accepted. In the event of refusal, the Publisher may adjust its prices. Hosting is provided by a sub-processor located in France, whose identity is kept available to the Client and communicated upon any change; the categories of data concerned are telemetry data, surname and first name, email address and browsing data, to the exclusion of any sensitive data. Where applicable, the Client mandates the Publisher to enter into, on its behalf, the standard contractual clauses required for any transfer outside the European Union.
ARTICLE 13 — SUPPORT
Support is organised in three levels.
13.1 Level 1
Requests for information or simple malfunctions: logging and qualification of the request, diagnosis and recommendations on the basis of quick-reference sheets, any update of the Documentation.
13.2 Level 2
Malfunctions requiring access to the Platform: diagnosis, support for the User, where appropriate by video conference, any update of the Documentation.
13.3 Level 3 “Premium”
Anomalies requiring a high level of expertise and, where appropriate, access by the Publisher to the Platform: handling by the Maintenance department, deployment of appropriate diagnostic mechanisms, sharing of best practices, any update of the Documentation.
The allocation of Support levels between the Publisher and the Operating Entity depends on the Support level subscribed. In any event, level 3 Support is provided by the Publisher, which may also provide all levels.
ARTICLE 14 — MAINTENANCE
14.1 General provisions
Patches and updates are made available on terms similar to delivery, their description appearing in the Documentation. New versions are made available on a monthly basis and Anomaly patches by weekly hot-fix where necessary, these cadences being indicative. The benefit of Maintenance presupposes: the designation and up-to-date maintenance of at least one Administrator; payment up to date of the sums due; use of a version still under maintenance.
14.2 Enhancement maintenance
Enhancement maintenance covers improvements to the functions and modules of the subscribed Licence, to the exclusion of new modules. The Publisher may include any technical protection measure useful for controlling use, in compliance with the Licence. Additional developments requested by the Client or the Operating Entity do not constitute an obligation of the Publisher.
14.3 SLA
The Publisher's service commitments are defined in the SLA chapter on the page doc.blacknoise.co.
ARTICLE 15 — ADDITIONAL SERVICES
The Operating Entity may order additional services not included in the contract, in particular: assistance in analysing simulation results; certification of the results of a simulation; the carrying out of developments (features, connectors or API). These services shall be the subject of a quotation accepted by the Operating Entity and a separate purchase order signed by the Parties, save where they appear in the quotation accepted by the Client.
ARTICLE 16 — MISCELLANEOUS PROVISIONS
16.1 Force majeure
No Party is liable for a breach resulting from a case of force majeure as defined by article 1218 of the French Civil Code and French case law.
16.2 Assignment
The contract may not be assigned by the Operating Entity without the Publisher's prior written consent. The Publisher may assign it to any company in its group or in the context of a restructuring transaction.
16.3 No waiver
The fact that a Party does not rely on a breach shall not constitute a waiver of its right to rely on it subsequently.
16.4 Partial invalidity
If a provision is held to be void or unenforceable, the other provisions shall remain in force and the Parties shall replace it with a valid provision of equivalent effect.
16.5 Entire agreement
These conditions, together with the order or the contract and their appendices, express the entirety of the Parties' agreement on their subject matter.
16.6 Governing law and jurisdiction
Save for any governing law and jurisdiction agreed between the Parties in the Specific Conditions or in the order, these conditions are governed by French law. Failing an amicable settlement, any dispute relating to their validity, interpretation or performance shall fall within the exclusive jurisdiction of the Paris Commercial Court, notwithstanding a plurality of defendants or third-party proceedings.