Platform Terms and Conditions
ORION CYBER SECURITY MASTER SUBSCRIPTION AGREEMENT
This Master Subscription Agreement (the “Agreement”) governs Customer’s access to and use of the Services, and is entered into by and between the applicable Orion Contracting Entity (as defined below), including any subsidiary or affiliated company (“Orion”), and the entity or individual accepting this Agreement (the “Customer”) (each, a “Party”, and together, the “Parties”).
This Agreement becomes effective on the earliest of: (i) Customer’s acceptance of this Agreement by clicking “I Accept” (or a similar button or checkbox); (ii) Customer’s execution of an Order Form that references this Agreement; or (iii) Customer’s first access to or use of the Services (the “Effective Date”). If you accept this Agreement on behalf of a company or other legal entity, you represent and warrant that you have the authority to bind such entity to this Agreement, in which case “Customer” shall refer to such entity. If you do not have such authority, or if you do not agree to this Agreement, you must not accept this Agreement and may not access or use the Services.
Orion Contracting Entity. The Orion entity that is a Party to this Agreement (the “Orion Contracting Entity”) is the Orion entity identified in the applicable Order Form. Where no Orion entity is identified in the Order Form, the Orion Contracting Entity shall be: (a) Orion Cyber Security Inc., having its principal place of business at 1521 Concord Pike Suite 201, Wilmington, New Castle, DE 19803, if Customer’s principal place of business is located in Israel; or (b) Orion C.S Cyber Security Ltd., having its principal place of business at 34-36 Yehuda Halevi Street, Tel Aviv, Israel 6513616, in all other cases. The governing of law this Agreement and the courts having jurisdiction over it are determined by the identity of the Orion Contracting Entity, as set forth in the Miscellaneous Section below.
1. Subscription.
1.1 Orion hereby grants Customer during the Term, a limited, revocable, non-exclusive, non-sublicensable, non-transferable right for Customer and its employees ("Authorized Users") to access and use Orion proprietary cloud-based platform (“Platform”) in accordance with Orion’s instructions and technical documentation ("Documentation"), solely for Customer’s internal business purposes, and under the terms set forth in an applicable order form mutually approved by the Parties ("Order Form") which is hereby incorporated into this Agreement. The access and use of the Platform shall be also referred to as the “Services”.
1.2 Orion shall use commercially reasonable efforts to make the Platform available in accordance with Orion SLA as may be updated by Orion from time to time.
1.3 Restrictions on Use. Customer shall not use the Services in any manner or for any purpose other than as expressly permitted in the Agreement. Customer may not, directly or indirectly, and may not authorize any third party to attempt to: (i) copy, modify, alter, tamper with, repair, or otherwise create derivative works of or distribute any part of the Platform or Services; (ii) sell, license (or sub-license), lease, assign, transfer, pledge, or share Customer's rights under this Agreement, with any third party; (iii) reverse engineer, disassemble, or decompile the Platform or the Services, or attempt to discover the Platform's source code or underlying algorithms; (iv) use, remove or alter any Orion's or any third party's logos, trademarks or any other or other proprietary rights affixed to or provided as part of the Platform or the Services; (v) disturb or disrupt the Platform or the Services, directly or indirectly, or transmit or activate viruses or any other unlawful material in connection with the Platform or the Services; or (vi) use the Platform or the Services in a manner that would violate applicable laws, or is outside the scope of the rights granted in this Agreement. Customer must promptly notify Orion in writing if it becomes aware of, or has reason to believe, that any of the prohibitions listed in this Section has been breached by Customer or any Authorized User.
1.4 Orion shall provide technical support, on a basis of reasonable effort, all in accordance with the terms set forth in the Maintenance and Support Program (the “SLA”) attached hereto as Exhibit A.
2. Rights and Title.
2.1 All title, ownership rights, and intellectual property rights (including all copyrights, patents, trade secret rights and trademarks) evidenced by or embodied in, attached, extracted from, connected, and/or related to the Services and the various practices, materials, methodologies, tools, and templates used with respect thereto (and all improvements enhancements, corrections, modifications, alterations, revisions, extensions and updates and derivative works thereof) are and shall remain solely in Orion, and/or its licensors, if any. Orion expressly reserves all rights to the foregoing, and except for the limited grant of rights expressly set forth herein, Orion does not grant the Customer any right, title, or interest in any intellectual property owned or licensed by Orion. If Customer provides any feedback (such as suggested improvements or a like regarding the Services) (collectively, “Feedback”) Customer hereby grants to Orion a non-exclusive, perpetual, irrevocable, transferable, royalty-free and worldwide right, with the right to grant and authorize sublicenses, to use and benefit from such Feedback to provide and improve the Platform and/ or the Services and Orion’s business without any compensation or credit due to Customer.
3. Customer Data, Privacy and Security
3.1 Customer warrants that as between the Parties, Customer solely owns and retains all rights, title and interest in and to Customer Data including all Intellectual Property Rights embodied in Customer Data. "Customer Data" means any data or information associated with the Customer that the Platform automatically accesses, collects, processes and/or hosts when monitoring, and communicating with Customer’s cloud resources and information technology systems. Customer hereby grants Orion, during the Term, a non-exclusive, worldwide royalty-free right use and otherwise process the Customer Data solely to the extent necessary to perform its obligations under this Agreement.
3.2 In providing the Services, Orion will (i) process and access Customer Data only to the extent reasonably necessary to provide Customer the Services; and (ii) implement and maintain commercially reasonable technical, physical and organizational measures to protect the security, confidentiality and integrity of Customer Data hosted by Orion or Orion’s authorized third party service providers, from unauthorized access, use, alteration or disclosure.
3.3 To the extent Customer Data contains any personal data as defined under the applicable data protection law ("Personal Data"), Orion will process such Personal Data in accordance with the data processing addendum (“DPA”), attached hereto as Exhibit B, and applicable data protection law. Customer acknowledges and agrees that Orion may use aggregated and/or anonymized Customer Data to the extent necessary to provide the Services.
4. Confidential Information.
4.1 Each party (the “Receiving Party”) may have access to certain non-public and/or proprietary information of the other party (the “Disclosing Party”), in any form or media, including confidential trade secrets and other information related to the products, software, technology, data, know-how, or business of the Disclosing Party, whether written or oral, and any such other information that, regardless of the manner in which it is furnished and given the totality of the circumstances, a reasonable person or entity should have reason to believe is proprietary, confidential, or competitively sensitive (the “Confidential Information”). The Receiving Party shall take reasonable measures, at least as protective as those taken to protect its own confidential information, but in no event less than reasonable care, to protect the Disclosing Party's Confidential Information from disclosure to a third party. The Receiving Party shall not use or disclose the Confidential Information of the Disclosing Party except as expressly permitted under this Agreement. All right, title and interest in and to Confidential Information are and shall remain the sole and exclusive property of the Disclosing Party.
4.2 Notwithstanding the foregoing, the parties agree that Confidential Information will not include any information that the Receiving Party has documentation to demonstrate such information: (i) is or becomes publicly known or is or becomes part of the public domain through no fault of the Disclosing Party; (ii) the Disclosing Party authorizes in writing to be disclosed; (iii) is rightfully received by the Receiving Party from a third party without restriction on disclosure and without breach of this Agreement; (iv) is known to the Receiving Party on the Effective Date from a source other than the Disclosing Party, and not subject to a confidentiality obligation. Notwithstanding anything to the contrary in this Agreement, if vulnerabilities are detected in Customer systems by Orion in its performance of the Services, Orion may use such information solely for its own internal purposes, including the development the Platform or any other products and services, and to inform the performance of services for other customers, provided that such information is only utilized and disclosed once it is irreversibly aggregated and anonymized in a manner such that it cannot be used to identify or re-identify Customer.
5. Consideration.
5.1 Fees. The Services are conditioned on Customer's payment in full of the applicable fees set forth in each Order Form.
5.2 All fees are non-refundable and exclusive of tax. Fees shall be payable within thirty (30) days of the date of the invoice issued by Orion. Payment of Fees shall be made by wire transfer or ACH to the account designated by Orion from time to time. All amounts payable under each Order Form are exclusive of all sales, use, value-added, withholding, and other direct or indirect taxes, charges, levies and duties. Customer shall bear all value added, state, local, withholding, and other taxes or other charges applicable to the Services. In the event that Customer is required by law to deduct and/or withhold any amounts from any payments due hereunder, it shall gross-up and increase the amounts to be paid to Orion so that the actual net amount to be paid to Orion shall equal the fees that would have been due to Orion without such deduction or withholding.
6. Term and Termination.
6.1 Term. This Agreement shall be in effect as of the Effective Date and shall remain in effect as long as there is an Order Form which is in effect, unless terminated earlier in accordance with the terms hereof (the "Term").
6.2 Termination
6.2.1 Material Breach. Either party may terminate this Agreement with immediate effect upon written notice to the other party if the other party materially breaches this Agreement and such breach remains uncured (to the extent that the breach can be cured) thirty (30) days after having received written notice thereof. In the event Customer terminates this Agreement due to Orion’s uncured material breach, Orion will promptly refund the pro-rata portion of any fees paid by Customer attributable to the date of the breach through the end of the Term.
6.2.2 Distress Event. In the event that either party becomes liquidated, dissolved, bankrupt or insolvent, whether voluntarily or involuntarily, or shall take any action to be so declared, the other party shall have the right to immediately terminate this Agreement.
7. Effect of Termination.
7.1 General. Upon termination of this Agreement, (1) Customer shall immediately discontinue all access and use of the Platform and Additional Services and shall promptly delete all copies of the Documentation in Customer’s or any of its representatives’ possession or control; (2) Orion will delete Customer Data and Platform account access.
7.2 Survival. This Section 7 and Sections 1.3 (Restrictions on Use), 2 (Rights and Title),4 (Confidential Information) 5 (Consideration), 8 (Warranty Disclaimer), 9 (Limitation of Liability), 10 (Indemnification), and 12 (Miscellaneous) shall survive termination of this Agreement.
8. Representations of the Parties.
8.1 Each Party represents and warrants that it is duly organized, validly existing and in good standing under the laws of its jurisdiction of incorporation or organization; and that the execution and performance of this Agreement will not conflict with other agreements to which it is bound or violate applicable law.
8.2 Orion represents and warrants that (1) it and its personnel shall have, and shall maintain throughout the Term, the capability, skills, experience, licenses, and means required (in accordance with applicable law) to perform the Services; (2) Orion will perform the Services in accordance with the cloud resilience professional standards, know-how, processes, procedures and work methods of Orion, as maybe updated by Orion from time to time.
8.3 Customer represents and warrants that: (1) Customer grants Orion access to Customer's computer systems, cloud resources and other web related assets, including but not limited to Customer's digital assets whether on premise, or as part of any cloud environment (collectively, "Customer Systems"), to the extent required by Orion from time to time for the sole purpose of the performance of the Services. Customer further confirms that the provision of the Services are not in violation of any agreement to which the Customer is a party, with any third party, or any regulation or law applicable to the Customer; (2) Customer acknowledges that Orion will not detect, identify, address or correct any errors or defects in Customer's Systems, whether or not due to imprecise or ambiguous entry, storage, interpretation or processing or reporting of data. Orion will not be responsible for any defect or problem arising out of or related to data processing in any systems (including Customer Systems). Moreover, Orion will not conduct a review to detect fraud or illegal acts. The Services are advisory in nature. None of the Services or any reports will constitute any legal opinion or advice; (3) In the event Orion proposes recommendations for Customer's consideration and implementation in connection with the Services, Customer acknowledges that Customer has final approval over recommendations made by Orion and is responsible for all management decisions relating to the implementation of Services, and decisions resulting from the use or implementation of the output of the Services; (4) Orion shall base any comments or recommendations as to the functional or technical capabilities of any products in use or being considered by Customer solely on information provided by Customer's vendors, through Customer, or which is generally made available by such vendors. Orion does not assume any responsibility for any third-party products, programs or services, their performance or compliance with Customer's specifications or otherwise.
Warranty Disclaimer. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH ABOVE IN THIS SECTION, EACH PARTY HEREBY EXPRESSLY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY, TITLE, NON-INFRINGEMENT, NON-INTERFERENCE, ACCURACY, CONDITION, AND FITNESS FOR A PARTICULAR PURPOSE (WHETHER OR NOT SUCH PARTY KNOWS, HAS REASON TO KNOW, HAS BEEN ADVISED, OR IS OTHERWISE AWARE OF ANY SUCH PURPOSE). WITHOUT LIMITING THE FOREGOING, ORION DOES NOT WARRANT THAT (A) THE USE OF THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, OR (B) THE SERVICES WILL DETECT, PREVENT, OR PROTECT AGAINST ALL POSSIBLE THREATS WHETHER KNOWN OR UNKNOWN. CUSTOMER ACKNOWLEDGES AND AGREES THAT THE SERVICES MAY INCORPORATE AND UTILIZE ARTIFICIAL INTELLIGENCE ("AI") AND MACHINE LEARNING ALGORITHMS ("MACHINE LEARNING") TO ENHANCE FUNCTIONALITY, EFFICIENCY, AND USER EXPERIENCE. CUSTOMER UNDERSTANDS AND AGREES THAT WHILE AI AND MACHINE LEARNING CAN PROVIDE SUBSTANTIAL BENEFITS, THEY ARE BASED ON CURRENT TECHNOLOGIES AND PRACTICES WHICH ARE EVOLVING AND THAT ORION MAKES NO WARRANTIES OR REPRESENTATIONS ABOUT THE ACCURACY, RELIABILITY, OR EFFECTIVENESS OF AI AND MACHINE LEARNING INCORPORATED INTO THE SERVICES. CUSTOMER FURTHER ACKNOWLEDGES THAT THE USE OF AI AND MACHINE LEARNING IN THE SERVICES DOES NOT GUARANTEE ANY SPECIFIC OUTCOMES, AND THAT THE PERFORMANCE OF THE SERVICES MAY VARY. ORION DISCLAIMS ANY LIABILITY FOR ANY ERRORS, OMISSIONS, OR INACCURACIES THAT MAY ARISE FROM THE USE OF AI AND MACHINE LEARNING IN THE SERVICES.
9. Limitation of Liability.
9.1 NEITHER PARTY SHALL BE LIABLE, IN CONTRACT OR TORT, UNDER STATUTE OR OTHERWISE, ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, PUNITIVE OR SPECIAL DAMAGES IN CONNECTION WITH CLAIMS ARISING OUT OF THIS AGREEMENT OR ANY ORDER FORM, OR OTHERWISE RELATING TO THE SERVICES, INCLUDING ANY AMOUNT FOR LOSS OF PROFIT, DATA OR GOODWILL, WHETHER OR NOT THE LIKELIHOOD OF SUCH LOSS OR DAMAGE WAS CONTEMPLATED. IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR TO ANY THIRD PARTY FOR AGGREGATED DAMAGES IN EXCESS OF THE FEES ACTUALLY PAID OR PAYABLE TO ORION BY CUSTOMER (DIRECTLY OR THROUGH A PARTNER) IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO LIABILITY.
9.2 NOTWITHSTANDING THE FOREGOING, NOTHING HEREIN SHALL LIMIT THE LIABILITY OF EITHER PARTY IN ANYWAY FOR LIABILITY OR DAMAGES ARISING FROM (A) INTENTIONAL MISCONDUCT, (B) FRAUD OR FRAUDULENT MISREPRESENTATION. NO CLAIM RELATING TO THE SERVICES OR OTHERWISE UNDER THIS AGREEMENT SHALL BE MADE AFTER THE LAPSE OF 12 MONTHS FOLLOWING THE COMPLETION OF A PARTICULAR SERVICE.
10. Indemnification.
10.1 Subject to the cap set out in Section 9.1 above, Orion shall defend, indemnify and hold harmless Customer, from and against any third-party claims, damages, costs, liabilities and expenses (including reasonable attorneys’ fees) arising out of or related to any claim that the Platform, Services and/or Documentation infringes any third-party intellectual property right. Indemnification hereunder shall be conditioned upon: (a) Customer notifying Orion of the claim immediately upon becoming aware thereof, (b) Customer allowing Orion to assume full control of the defense and settlement of such claim, and (c) Customer reasonably cooperating with Orion in the defense and settlement of the claim.
11. Partner. If Customer has purchased the Services granted hereunder from a partner, reseller or distributor authorized by Orion (“Partner”), the terms of Section 5 (Consideration) shall not apply. To the extent there is any conflict between this Agreement and the agreement entered between Customer and the respective Partner, including any purchase order (“Partner Order Form”), then, as between Customer and Orion, this Agreement shall prevail. Any rights granted to Customer in such Partner Order Form which are not contained in this Agreement, apply only in connection with such Partner. In that case, Customer must seek redress or realization or enforcement of such rights solely with such Partner and not Orion.
12. Miscellaneous. This Agreement shall constitute the full Agreement between the Parties with respect to its subject matter and shall supersede any and all prior agreements and understandings relating thereto. No change, modification, alteration or addition of or to any provision of this Agreement shall be binding unless in writing and executed by or on behalf of both Parties by a duly authorized representative. This Agreement and any rights or obligations hereunder may not be transferred or assigned by either party without the prior written consent of the other party, except that either party may assign this Agreement as a whole to a successor to all or substantially all of its assets or business related to this Agreement, without such consent. Subject to the foregoing, this Agreement shall be binding upon and inure to the benefit of the parties and their successors and assigns. Customer acknowledges that Orion reserves the right to use Customer's trademarks, logo, and name for any marketing purposes, including press release, newsletter and social media, however, without compromising any confidential information of Customer. If any of the terms contained in this Agreement shall, for any reason, be held to be void or unenforceable, it shall not affect the validity or enforceability of any other term in this Agreement. This Agreement does not, and shall not be construed to create any relationship, partnership, joint venture, employer-employee, agency, or franchisor-franchisee relationship between the Parties. Orion will not be liable for any delay or failure to provide the Services resulting from circumstances or causes beyond the reasonable control of Orion including, but not limited to on account of strikes, shortages, riots, insurrection, fires, flood, storms, explosions, acts of God, war, government or quasi-governmental authorities actions, acts of terrorism, earthquakes, power outages, pandemic or epidemic (or similar regional health crisis), or any other cause that is beyond the reasonable control of Orion. This Agreement shall be governed by and construed under the laws set forth below, without reference to principles and laws relating to the conflict of laws, and the courts set forth below shall have the exclusive jurisdiction with respect to any dispute and action arising under or in relation to this Agreement: (a) where the Orion Contracting Entity is Orion Cyber Security Inc. – the laws of the State of New York and the competent courts of New York City; and (b) where the Orion Contracting Entity is Orion C.S Cyber Security Ltd. – the laws of the State of Israel and the competent courts of Tel Aviv. This Agreement may be executed in electronic counterparts, each of which counterpart, when so executed and delivered, shall be deemed to be an original and all of which counterparts, taken together, shall constitute but one and the same agreement. Customer’s acceptance of this Agreement by electronic means (including by clicking “I Accept” or a similar button or checkbox) shall constitute Customer’s valid execution of this Agreement. All notices relating to this Agreement shall be in writing, signed by the party giving or making such notice or communication, and shall be delivered by: (a) personal delivery; or (b) electronic transmission; or (c) certified or registered mail, return receipt requested by electronic mail; or (d) recognized overnight courier service. Notices shall be sent to the address of the other party set forth in the Order Form and shall be deemed given upon personal delivery, three (3) business days after deposit in the mail, one (1) business day if delivered by overnight courier, or upon acknowledgment of electronic transmission.
Exhibit A
ORION CYBER SECURITY – MAINTENANCE AND SUPPORT PROGRAM
1. Maintenance Services.
a. Orion will provide Customer with remedial and preventive maintenance and support services to the Platform, as provided in and subject to the terms set forth in Orion's SLA (the “SLA”) as detailed herein (“Maintenance Services”) to keep the most current release of the Platform in good operating condition, and subject to the terms of the Orion master subscription agreement or other agreement, entered between the Customer and Orion (the "Agreement").
b. Orion’s obligation to provide Maintenance Services is dependent upon: (i) the Agreement being in effect; and (ii) the performance by Customer of all of its obligations set forth in the Agreement and the obligations set forth herein.
c. Without derogating from the provisions of the SLA, Orion shall not be obligated to provide Maintenance Services pursuant to this Maintenance and Support Program, that are required as a result of any of the following: (i) abuse, misuse, accident or neglect; (ii) repairs, alterations, customization and/or modifications; or (iii) use of materials composed by the Customer which may not comply with Orion’s requirements; (iv) use of the Platform for other than the intended purpose for which it was licensed; (v) alternations, modifications or integration of the Platform with third party software (for the avoidance of doubt Orion shall provide Maintenance Services the Orion in its 'out of the box' configuration); or (vi) inadequate backups of the Platform by the Customer that prevent Orion from reinstalling the Platform before or after the reported problem was solved.
2. Updates and New Versions.
a. During the term of the Agreement, Orion shall make available to Customer updates to the Platform, consisting of one copy of modifications and improvements to the Platform that Orion determines are required to achieve the specifications established by Orion for the Platform (the “Updates”). For the avoidance of doubt, Updates shall only include such modules of the Platform licensed by Customer, under the Agreement. The Updates will be made available to Customer at no additional cost.
b. Orion shall maintain prior versions of the Platform until the earlier of (i) a period not earlier than 18 months from the release of each new version release; or (ii) termination of this Support and Maintenance Agreement. Upon receipt and installment of Updates, Customer may keep one copy of the previous version of the Platform for archival purposes only and shall destroy all other copies of the previous version of the Platform.
3. Service Level Agreement (“SLA”)
a. Orion will support the Customer with problems generated directly by and as part of the Platform, as defined in this Maintenance and Support Program, including support for technical or installation problems, implementation and documentation errors. For the purpose of this SLA, the terms technical problems or installation problems shall be defined herein as defects (“Defects”).
b. Initiating Support Requests. Support calls shall be initiated by a designated individual nominated by Customer (the “Representative”) by filing of a Support Request through a designated form in the Platform's help section, or by an email to support@orionsec.io or calling Orion support center at +97252605344 or submitting a web support request at support.orionsec.io
c. Handling of Support Requests.
(i) The Support Team (ST) shall recreate the Defect reported in Orion's labs using the relevant 'out of the box' version of the Platform.
(ii) Orion may request the Representatives:
-->(1) To provide additional information (e.g. screen shots, log information etc).
-->(2) To perform troubleshooting activities to enable identification of the source of the reported problem.
-->(3) To install patches or files that are sent by Orion to be executed accurately in accordance with Orion's instructions and the results of such installation will be reported back to the ST.
-->(4) In any case where the Defect was successfully recreated by ST, Orion shall send an appropriate fix in accordance with the timetables set forth herein below.
-->(5) Orion will not support or provide solutions to problems (i) that were not generated directly by or on the Platform, including but not limited to, problems generated by Customer’s database, network components, operating systems, applications or integration with other systems; or (ii) in a Platform that has be customized or otherwise modified; or (iii) If the Customer did not implement any preventive maintenance steps and procedures that will be directed by Orion.
d. Priority Levels of Defects. Initial response for Defects will be provided based on the severity of the Defect as follows: Customer Support for the Platform covers (i) development and production issues for the Platform and its components, (ii) Informational and implementation questions about the Platform and features; and (iii) troubleshooting operational problems with the Platform.
e. Response Times and Availability. ST will attempt to respond to cases within these internal time frames. These are targets only and are not guaranteed. ST does not guarantee resolution times or delivery dates. These times are subject to change depending on the nature of a case and complexity of the reported case.
____________________________________________________________
Categorization: Criteria // Initial Response Time // Status Update
--------------------------------------------------------------------------
Level 1 - Priority 1 Critical - Urgent: Critical technical issue resulting in a total loss of core functionality in the Platform. No workaround is available. // Within 2 hours(All days) // 4 Business hours
--------------------------------------------------------------------------
Level 2 - Priority 2 High: Major technical issue resulting in severe performance problems in the Platform. No workaround is available. // Within 6 Business hours // 1 Business Day
--------------------------------------------------------------------------
Level 3 - Priority 3 Normal, Medium, Low: A minor technical issue where the Customer can use the Platform with only slight inconvenience. // 1 Business Day // 1 Business week
____________________________________________________________
(i) Customer acknowledges that not all Level 3 problems will require a workaround. Orion may, in its reasonable discretion, respond to a Level 3 problem by making correction of the error a feature request.
(ii) For Level 1 and Level 2 incidents, Customer shall initiate contact with ST via telephone and indicate the probable category of the incident. Telephone Support shall be standard business hours. For Level 3 incidents, Customer may email or telephone the ST.
(iii) ST’s standard business hours are 9:00-19:00, IDT.
(iv) Response time is defined as the time between the creation of the case and the first attempt of an Orion support engineer from ST to contact the Customer who initiated a case.
(v) Above severities apply to systems in production, errors in non-production systems (test, development, sandbox) will be automatically downgraded one level.
(vi) Problems with the installation of the Platform have Priority/Severity “High” at a maximum.
(vii) When a Customer initiates a case outside standard business hours, then the case will be handled as if it was initiated at 8 AM the next business day.
(viii) An Orion installation in an environment which is not in compliance with Orion's sizing and technical recommendations will be automatically downgraded by one level.
(ix) Above response times apply only if e-mail communication is provided via support@orionsec.io and/or if phone communication is provided by calling the official and posted hotline numbers.
(x) If ST determines that an issue is fixed in a released patch, ST may require the Customer to apply this patch before commencing troubleshooting.
f. Resolved Queries. An issue is considered resolved when (i) the issue is solved; (ii) the source of the issue is determined to lie with a third party; or (iii) Customer does not respond to a request from Orion within seven (7) consecutive days after Orion’s request.
g. Solutions to Defects may include workarounds, patches or new versions.
h. Availability.
(i) Availability. The Platform will be operational and available for use by Customer in accordance with the Agreement on a 24 x 7 x 365 basis with an uptime commitment of 99.0% for each calendar month (“Availability”). Availability will be measured at the point where the Services are made available to Customer and does not include (i) outages caused by Customer; (ii) network traffic problems; or (iii) Scheduled Downtime (as defined below).
(ii) Scheduled Downtime. The calculation of the Availability will not include Scheduled Downtime. “Scheduled Downtime” means pre-scheduled maintenance periods, about which Customer will receive commercially reasonable advanced prior written notification, which are of reasonable frequency and duration and will be scheduled during non-peak use periods to the extent feasible.
(iii)If the Availability is not met in any given month, Orion shall issue to Customer credits as part of the subsequent subscription term, up to 6 additional weeks per annum, as follows:
____________________________________________________________
Availability // Credits
99.00% - 98.00% // 1 week of additional subscription term
-----------------------------------------------------------------------------
97.99% - 97.00% // 2 weeks of additional subscription term
-----------------------------------------------------------------------------
96.99% and below // 4 weeks of additional subscription term
____________________________________________________________
Exhibit B
DATA PROCESSING ADDENDUM
1. Applicability. This Data Processing Addendum (“DPA”) is incorporated by reference into the service agreement ("Agreement") entered by and between the Orion Contracting Entity (as defined in the Agreement), and its affiliates ("Orion") and you - the Client (as defined in the Agreement), to the extent that Orion processes Personal Data (as defined below) on behalf of Client. By signing the DPA, and/or accepting the Agreement, and/or accessing and/or using the Services (as defined in the Agreement), Client accepts this DPA and if the person signing or accepting or clicking through to the Services is entering the DPA on behalf of another entity or person, such person hereby represents and warrants to Orion that he is an Authorized User (as defined in the Agreement) with authority to bind Client to this DPA through such consent or use of the Services. If such person does not have such authority or if Client does not agree to this DPA, please do not provide Personal Data to Orion.
2. Definitions.
2.1 Terms used in this DPA but not defined herein (whether or not capitalized) shall have the meanings assigned to such terms in the Applicable Data Protection Laws.
2.2 "Applicable Data Protection Laws" shall mean, to the extent applicable to Orion's processing of Personal Data hereunder (with respect to each data subject): (i) General Data Protection Regulations (European Parliament and Council of European Union (2016) Regulation (EU) 2016/679) (EU GDPR); (ii) EU GDPR as it forms part of the law of England and Wales by virtue of section 3 of European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018 (UK GDPR); (iii) California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA); (iv) Protection of Privacy Law (Israel); and (v) any rules or regulations that amend and/or replace any of the aforementioned Data Protection Laws.
2.3 "Personal Data" refers to the definition of that term or any other similar term defined under the Applicable Data Protection Laws.
2.4 Security Documentation/s” means the security documentation applicable to the services purchased by Client under the Agreement, as updated from time to time and as made reasonably available by Orion. This can be provided upon request.
2.5 “Standard Contractual Clauses or SCCs” shall mean: where the EU GDPR applies, the standard contractual clauses pursuant to the EU Commission's Implementing Decision 2021/914 of 4 June 2021 currently set out at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj (“EU SCCs”); (ii) where the UK GDPR applies, the EU SCCs together with the UK Information Commissioner’s Office addendum, under S119A(1) of the Data Protection Act 2018 (“UK Addendum”); or any other Standard Contractual Clauses which amended and/or replace such Standard Contractual Clauses in accordance with Applicable Data Protection Law.
3. Processing of Personal Data on behalf of Client.
3.1 Orion’s Processing of Personal Data. Orion acts as a processor/service provider for Client and performs processing operations on behalf of Client and upon the instructions of Client as a controller/business, as set forth herein, in the Agreement, and any additional agreement entered into between Client and Orion (collectively, the "Terms"), pursuant to which Client may provide Personal Data to Orion ("Contracted Business Purpose").
3.2 Sensitive Data. The Parties agree that the provision of the services under the Agreement is not intended for the processing of Sensitive Data. For the avoidance of doubt, this DPA will not apply to Sensitive Data and Orion shall have no liability whatsoever for Sensitive Data, whether in connection with a Personal Data Breach or otherwise.
4. Client Representations.
Client sets forth the details, including the purpose, the means and the ways in which Orion shall process Personal Data, as required by Applicable Data Protection Laws in Appendix A (Details of Processing of Processed Personal Data), attached hereto, and Client represents and warrants that:
4.1 It complies with personal data security and other obligations prescribed by Applicable Data Protection Laws for controller/business, and that the provision of Personal Data to Orion is in strict compliance with Applicable Data Protection Laws;
4.2 It only processes Personal Data that has been collected in accordance with the Applicable Data Protection Laws;
4.3 It has in place procedures in case an individual whose Personal Data is collected, wish to exercise their rights in accordance with the Applicable Data Protection Laws;
4.4 It provides Orion with access to only such Personal Data for which Client has obtained any legally required consents from the respective data subjects or has in place any other legal basis;
4.5 Client does not sell Personal Data to Orion;
4.6 It shall have the sole responsibility for the accuracy, quality, and legality of such Client’s Personal Data;
4.7 It shall provide Orion with access to only such Personal Data which is explicitly permitted under Applicable Data Protection Laws ("Permitted Personal Data"). Solely Client shall be liable for any data which is made available to Orion in excess of the Permitted Personal Data (“Non-Permitted Data”). Orion's obligations under the Terms shall not apply to any such Non-Permitted Data;
4.8 It is and will remain duly and effectively authorized to give the instruction set out herein and any additional instructions as provided pursuant to the Terms, at all relevant times and at least for as long as the Terms are in effect and for any additional period during which Orion is lawfully processing Personal Data.
5. Orion Obligations.
5.1 Orion carries out the processing of Personal Data on Client's behalf;
5.2 Pursuant to the provisions of Article 28 of the GDPR, to the extent applicable with respect to each data subject, Orion agrees that it will:
5.2.1 process Personal Data solely on Client's behalf and in compliance with Client's instructions, including instructions in this DPA and all Terms, unless required to do so by EU or applicable Member State law;
5.2.2 implement appropriate technical and organizational measures to provide an appropriate level of security, including, as appropriate and applicable, the measures referred to in Article 32(1) of the GDPR;
5.2.3 take reasonable steps to ensure that access to the processed Personal Data is limited on a need to know/access basis, and that all Orion personnel receiving such access are subject to confidentiality undertakings or professional or statutory obligations of confidentiality in connection with their access/use of Personal Data;
5.2.4 it shall provide reasonable assistance to Client with any data protection impact assessments or prior consultations with supervising authorities in relation to processing of Personal Data by the processor/service provider, as required under any Applicable Data Protection Laws, at the written request of the Client, and at Client's sole expense; and
5.3 Pursuant to the CCPA, to the extent applicable with respect to each data subject, Orion agrees that:
5.3.1 Orion is acting solely as a service provider with respect to Personal Data;
5.3.2 Orion shall not retain, use or disclose Personal Data for any purpose other than for the Contracted Business Purpose;
5.3.3 Orion may de-identify or aggregate Personal Data as part of performing the services specified in the Terms; and
5.3.4 Orion will limit personal information collection, use, retention, and disclosure to activities reasonably necessary and proportionate to achieve the Contracted Business Purposes or another compatible operational purpose.
6. Sub-Processing.
6.1 Authorized Sub-processors.
6.1.1 Client authorizes Orion to use its current Sub-processors engaged by Orion as of the effective date of this DPA, and provides Orion, subject to Section 6.2, with a general authorization to engage Sub-processors, in connection with the provision of the services under the Agreement. A list of Orion’s currently engaged Sub-processors is provided in Appendix B (“Sub-Processor List”). The Sub-Processor List, as of the date of the effective date of this DPA is hereby deemed authorized by Client.
6.2 Changes to Sub-Processors List.
6.2.1 Orion may appoint new Sub-processors and shall give reasonable notice of the appointment of any new Sub-processor, before authorizing such new Sub-processor to process Personal Data in connection with the provision of the services under the Agreement.
6.2.2 Client may reasonably object to Orion’s use of a new Sub-processor on grounds relating to a Sub-Processor’s non-compliance with Applicable Data Protection Laws, by notifying Orion in writing within no more than fourteen (14) days after receipt of Orion’s notice of any planned appointment. Client’s written objection shall reasonably explain the objection to Orion’s use of such new Sub-processor. Client’s continued use of the applicable services after the lapse of fourteen (14) days from such notification constitutes Client’s acceptance of the new sub-processor.
6.2.3 In the event Client reasonably objects to a new Sub-processor hereunder, as described above, Orion will use reasonable efforts to make available to Client a change in the services or recommend a commercially reasonable change to Client’s use of the services, to avoid processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening the Client. If Orion is unable to make available such change within sixty (60) days, Client may, as a sole remedy, terminate the applicable Agreement and this DPA only with respect to those services which cannot be provided by Orion without the use of the objected-to new Sub-processor, by providing written notice to Orion. For the avoidance of doubt all amounts due under the Agreement shall be duly paid to Orion. Until a decision is made regarding the new Sub Processor, Orion may temporarily suspend the processing of the affected Personal Data and/or suspend access to the services. Client will have no further claims against Orion due to the termination of the Agreement (including, without limitation, requesting refunds) and/or the DPA under the circumstances described herein.
6.3 Orion shall ensure that any sub-processor used must qualify as a service provider under the Applicable Data Protection Laws and Orion cannot make any disclosures to the subcontractor that the CCPA would treat as a sale.
7. Data Subjects' Rights.
7.1 Client shall be solely responsible for compliance with any statutory obligations concerning requests to exercise data subject rights under Applicable Data Protection Laws (e.g., for access, rectification, deletion of processed Personal Data, etc.). Orion shall reasonably endeavor to assist Client insofar as feasible, to fulfil Client's said obligations with respect to such data subject requests, as applicable, at Client's sole expense.
7.2 Orion shall (i) without undue delay notify Client if it receives a request from a data subject under any Applicable Data Protection Laws in respect of processed personal data; and (ii) not respond to that request, except on the written instructions of Client or as required by Applicable Data Protection Laws, in which case Orion shall, to the extent permitted by Applicable Data Protection Laws, inform Client of that legal requirement before it responds to the request.
8. Personal Data Breach.
8.1 Orion shall notify Client without undue delay upon Orion becoming aware of any personal data breach within the meaning of Applicable Data Protection Laws relating to Personal Data processed on behalf of the Client, including Personal Data transmitted, stored or otherwise processed by Orion or its Sub-processors of which Orion becomes aware, which may require a notification to be made to a supervisory authority or data subject under Applicable Data Protection Laws "Personal Data Breach").
8.2 At the written request of the Client and at Client's sole expense, Orion shall provide reasonable co-operation and assistance to Client in respect of Client's obligations regarding the investigation of any Personal Data Breach and the notification to the supervisory authority and data subjects in respect of such a Personal Data Breach.
8.3 The obligations herein shall not apply to breaches that are caused by Client or Client’s users. Client will not make, disclose, release or publish any finding, admission of liability, communication, notice, press release or report concerning any Personal Data Breach which directly or indirectly identifies Orion, without Orion’s prior written approval, unless Client is compelled to do so pursuant to Applicable Data Protection Laws, in which case, Client shall provide Orion with reasonable prior written notice of such disclosure and will limit the disclosure to the minimum scope required.
9. Deletion or Return of Processed Personal Data.
9.1 Subject to the terms hereof, Orion shall promptly and in any event within up to thirty (30) days upon any termination or expiration of this Agreement (unless a sooner time period is required by Applicable Data Protection Laws) return and then destroy the Personal Data, except such copies as authorized including under this DPA or required to be retained in accordance with Applicable Data Protection Laws.
9.2 Orion may retain Personal Data to the extent authorized or required by Applicable Data Protection Laws, provided that Orion shall ensure the confidentiality of such Personal Data and shall ensure that it is only processed for such legal purpose(s).
9.3 Upon Client's prior written request, Orion shall provide written certification to Client that it has complied with this Section 9.
10. Security; Audit Rights
10.1 Controls & Certifications.
10.1.1 Orion shall implement and maintain industry-standard technical and organizational measures to protect the Personal Data processed hereunder, against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, as set forth in the Security Documentations, including, as appropriate, the measures required pursuant to Article 32 of the GDPR. Such security measures include measures to encrypt personal data; to help ensure ongoing confidentiality, integrity, availability and resilience of Orion’s systems and services; to help restore timely access to Personal Data following an incident; and for regular testing of effectiveness. Further, Orion is SOC2 (System and Organization Controls) certified, and as part of such certification, reports are created by independent third-party auditors to demonstrate and verify that Orion’s security measures are adequate. Upon Client’s request, Orion shall make available to Client, the most recent version of such third-party security audit and certification reports commonly made available to Orion’s Clients.
10.2 Audit Rights.
10.2.1 Subject to the terms hereof, and not more than once in each calendar year, Orion shall make available to a reputable auditor mandated by Client in coordination with Orion, at the cost of the Client, upon prior written request, within normal business hours at Orion premises, such information necessary and relevant to reasonably demonstrate compliance with this DPA, and shall allow for audits by such reputable auditor mandated by the Client in relation to the processing of the Personal Data by the processor/service provider, provided that such third-party auditor shall be subject to confidentiality obligations.
10.2.2 Client shall use (and ensure that each of its mandated auditors use) its best efforts to avoid causing (or, if it cannot avoid, to minimize) any damage, injury or disruption to the Orion's premises, equipment, personnel and business while its personnel are on those premises in the course of such an audit or inspection.
11. International Data Transfers
11.1 To the extent that Orion transfers Personal Data to countries outside of the European Economic Area and/or outside of the United Kingdom (UK), which do not provide an adequate level of data protection, as determined by the European Commission pursuant to Article 45 of GDPR, and by the Secretary of State, pursuant to Section 17A of the United Kingdom Data Protection Act 2018, respectively, or other adequate authority as determined by the EU and the UK (“Adequacy Decisions”), such transfer of Client’s Personal Data to other countries, where the application of the SCCs, as between the parties, is required under Applicable Data Protection Laws, shall be subject to: (i) Adequacy Decisions; (ii) exemptions under Article 49 of GDPR; or (iii) Standard Contractual Clauses are incorporated into this DPA by reference, which shall be implemented as follows:
11.1.1 In the case of transfer of Personal Data from Client to Orion, the parties shall implement Module II - “Controller to Processor”, of the Standard Contractual Clauses, with modifications detailed under this Section 11.1.1, in which case Orion shall be deemed as a "Data Importer" and Client shall be deemed as a "Data Exporter". The parties are deemed to have accepted and executed the SCCs, including the associated annexes. However, when Client is acting as a processor, Module III (“Processor-to-Processor”) shall apply, provided that, taking into account the nature of the processing, Client agrees that it is unlikely that Orion will know the identity of Client’s controllers, as Orion has no direct relationship with Client’s controllers and therefore, Client will fulfil Orion’s obligations to Client’s controllers under the Processor-to-Processor SCCs. The contents of Annex I of the SCCs are included within Appendix A to this DPA. The contents of Annex II of the SCCs are included within the Security Documentation. The parties further agree to the following implementation choices under the SCCs:
11.1.1.1 The Parties agree that for the purpose of transfer of Personal Data between Orion (Data Importer) and the Client (Data Exporter), the following shall apply:
11.1.1.2 Clause 7: shall not be applicable.
11.1.1.3 Clause 9(a): The parties choose Option 2, “General Written Authorization” and the method for appointing and time period for prior notice of Sub-processor changes shall be as set forth in Section 6 of the DPA
11.1.1.4 Clause 11: The parties choose not to include the optional language relating to the use of an independent dispute resolution body.
11.1.1.5 Clause 17: The parties select Option 1 and specify the law of Ireland.
11.1.1.6 Clause 18(b): The parties specify the courts of Ireland.
11.1.2 In the case of transfer of Personal Data between Orion and its Sub-Processors for the purposes of carrying out specific Processing activities (on behalf of Client), Orion and its Sub-Processors will enter into Module III (“Processor-to-Processor”) of the Standard Contractual Clauses.
11.1.3 If the applicable Data Exporter, under Section 11.1.1 or 11.1.2, is transferring Personal Data governed by the UK GDPR, the parties agree to implement the applicable SCCs, as modified by the UK Addendum. The information required by Table 1 of the UK Transfer Addendum appears within Appendix A to this DPA. In addition, the parties adopt the SCCs, as modified by the UK Transfer Addendum, as to applicable international transfers of UK Personal Data in exactly the same manner set forth in Section 11.1 above, subject to the following:
11.1.3.1 Clause 13: The UK Information Commissioner’s Office (“ICO") shall be the competent supervisory authority.
11.1.3.2 Clause 17: The SCCs, as modified by the UK Transfer Addendum, shall be governed by the laws of England and Wales.
11.1.3.3 Clause 18: The parties agree that any dispute arising from the SCCs, as modified by the UK Transfer Addendum, shall be resolved by the courts of England and Wales. A UK Data Subject may also bring legal proceedings against the Data Exporter and/or Data Importer before the courts of any country in the UK. The parties agree to submit themselves to the jurisdiction of such courts.
11.2 Appendix A attached to this DPA shall also apply in connection with the processing of Personal Data, subject to Applicable Data Protection Law.
11.3 Orion reserves the right to adopt an alternative compliance standard to the SCCs for the lawful transfer of Personal Data, provided it is recognized under Data Protection Law. Orion will provide 30 days’ advance notice of its adoption of an alternative compliance standard.
12. General Terms.
12.1 Governing Law and Jurisdiction. All disputes with respect to this DPA shall be determined in accordance with the governing law provisions set forth in the Agreement.
12.2 Conflict. In the event of any conflict or inconsistency between this DPA and any other agreements between the parties, including agreements entered into after the date of this DPA, the provisions of this DPA shall prevail.
12.3 Changes in Applicable Data Protection Laws. Client may by at least forty-five (45) calendar days' prior written notice to processor/service provider, request in writing any changes to this DPA, if they are required, as a result of any change in any Applicable Data Protection Law, regarding the lawfulness of the processing of Personal Data. If Client provides its modification request, Orion shall make commercially reasonable efforts to accommodate such modification request, and Client shall not unreasonably withhold or delay agreement to any consequential changes to this DPA to protect the Orion against any additional risks, and/or to indemnify and compensate Orion for any further costs associated with the changes made hereunder.
12.4 Severance. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall either be (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
Appendix A
ANNEX 1.A. LIST OF PARTIES
Data exporter(s): Client.
As detailed in the Agreement.
Signature and date: By entering into the Agreement and DPA, Data Exporter is deemed to have executed the SCCs incorporated herein by reference (including their Annexes), as of the Effective Date of the Agreement.
Role: where Module Two applies: The Data Exporter is a data controller; where Module Three applies: The Data Exporter is a data processor.
Data importer(s): Orion.
Contact details: As detailed in the Agreement.
Signature and date: By entering into the Agreement and DPA, Data Importer is deemed to have executed the SCCs incorporated herein by reference (including their Annexes), as of the Effective Date of the Agreement.
Role: where Module Two applies: The Data Importer is a data processor; and where Module Three applies: The Data Importer is a sub-processor.
ANNEX 1.B. DETAILS OF PROCESSING OF PROCESSED PERSONAL DATA
1. The subject matter and duration of the processing of processed personal data:Orion will process personal data pursuant to the DPA and the Terms for the duration of the Agreement, unless otherwise agreed upon in writing.
2. The nature and purpose of the processing of personal data:
a. Providing the services to Client under the Agreement;
b. Performing the Agreement, and this DPA;
c. Acting upon Client’s written instructions in accordance with the Agreement and the DPA;
d. Complying with applicable laws and regulations.
3. The types of processed personal data: In providing the services to Client under the Agreement, Orion may have access to Personal Data as required for the provision of Orion’s services, including:
a. Name
b. E-mail address
c. IP Address
d. Role
e. Certain data which Orion does not require for the provision of the Services, but which Client makes available to Orion during the provision of Services.
4. The categories of data subjects to whom the processed personal data relates to are as follows:
a. Client’s Employees
b. Other categories which may be included in the data Client makes available to Orion during the provision of Services.
5. Sensitive Data (if applicable).The Parties do not intend for Sensitive Data to be transferred.
ANNEX 1.C. COMPETENT SUPERVISORY AUTHORITY
The competent supervisory authority in accordance with Clause 13 is the supervisory authority in the Member State stipulated in Section 11.1 above.
Appendix B
_________________________________________________________________
Name of Sub-processor: Services Performed // Sub-processor Location
-----------------------------------------------
AWS: Cloud // USA/Ireland
-----------------------------------------------
Mongo DB: Database // USA/Ireland
-----------------------------------------------
RedisCache: StorageUSA // Ireland
-----------------------------------------------
Neo4j: Database // USA/Ireland
-----------------------------------------------
Descope: Authentication // USA
_________________________________________________________________