Service Specific Terms Addendum

Last Updated: January 17, 2023

 

This Service Specific Terms Addendum sets forth the additional terms and conditions that apply to Your use of the applicable Services listed below. Capitalized terms not defined in these terms have the meaning given to them in the Cloud Terms and Conditions.

1.1 Webroot Business Endpoint Protection (“WEP”), DNS Protection (“DNSP”), and Security Awareness Training (“SAT”). Your purchase and use of WEP, DNSP and SAT are subject to the additional terms available at https://www.webroot.com/us/en/legal/licensing-definition-guidelines.

1.2 Webroot Secure File Share (formerly known as Zix Secure File Share). You are responsible for establishing the data retention settings for Your Content via a support request. In no event will Your Content be retained for longer than four (4) years.

1.3 Webroot Email Threat Protection Service (formerly known as Zix Email Threat Protection). The Service filters no more than 3,600 messages per hour inbound, 30 messages per minute outbound, or 10,000 messages per day per OT may throttle the volume of Your email traffic to conform to this quota. OT will make commercially reasonable efforts to notify You if any action has or will be taken.

1.4 Webroot Advanced Email Encryption (formerly known as Zix Email Encryption). Unless otherwise agreed in writing, the Services shall not be used to encrypt application-generated (bulk) emails. Additionally, OT reserves the right to display a short message on all outbound encrypted messages.

2.1 Hybrid Solution. A Hybrid Solution combines cloud-based data protection with on-site hardware provided by OT.

a. Additional Defined Terms.
“Client Software” means the OT proprietary software agents, clients and plug-ins that are installed on specific devices used to extract Your Content from such devices.
“Hybrid Solution” is comprised of three components: (a) the Services, (b) the Software Components and (c) the HWaaS.
“Installed Software” means the OT software that is pre-loaded onto the HWaaS.
“Hardware as a Service” or “HWaaS” means the leased hardware components in the on-site hardware.
“License Period” means the term set forth in an Order Documentation.
“Licensed Location” means the location where You are authorized by OT to use the Hybrid Solution.
“Software Components” means the Client Software and the Installed Software.

2.2 License Grants. Except for the limited rights granted herein, OT and its licensors retain all right, title and interest in and to the Software Components and the HWaaS and all intellectual property rights therein.

a. The Services. The cloud back-up component of the Hybrid Solution is licensed pursuant to the Cloud Terms and Conditions.

b. Software Components. For the License Period, OT grants to You a non-exclusive, non-transferable, revocable, fee-bearing, limited license (without the right to sublicense) to install, execute and use the Software Components solely: (i) in object code format, and (ii) for Your internal business purposes in the Licensed Location, with no right to make such software available to third parties either by transferring copies thereof or by providing a hosted service. The Installed Software may be used solely on the HWaaS, as installed thereon.

c. HWaaS. HWaaS is provided to You only as part of the Hybrid Solution. HWaaS is not sold to You, and no transfer of title in the HWaaS is effectuated in connection with the Hybrid Solution. The HwaaS shall not be deemed to be a fixture of any part of Your premises. For the License Period, OT grants to You a non-exclusive, non-transferable, revocable, fee-bearing, limited lease (without the right to sublease) to use the HwaaS solely: (i) as part of the Hybrid Solution and (ii) for Your internal business purposes in the Licensed Location, with no right to otherwise transfer the HwaaS to any third party, or otherwise grant access to third parties to use the HwaaS for any purpose, including but not limited to use of the HwaaS to provide a hosted service to third parties. No other use of the HwaaS is permitted. The HWaaS may not be used separate and apart from the Installed Software. You may not sell, lease, abandon, or give away the HwaaS or permit any unauthorized third party to access or use the HwaaS.

2.3 Your Responsibility for Maintenance of Appliance. You agree that You will: (a) store and operate the HwaaS in a manner so that the HwaaS remains in good operating condition and (b) not allow anyone other than OT or its authorized agent(s) to service or access the Software Components or HwaaS. In the event the HwaaS requires repair or replacement, OT will, in its sole discretion, repair or replace the HwaaS at OT’s expense, provided, however, that if the HwaaS is in need of repair or replacement as a result of Your actions, omissions, or violation of the Agreement, You authorize OT to invoice You a non-refundable fee equal to the costs incurred by OT to repair or replace the HwaaS and all shipping and handling fees associated with the repair or replacement. You agree to pay any such invoice within thirty (30) days of Your receipt of such invoice.

2.4 Restrictions. The HwaaS is not licensed for use in life support systems, human implantation, nuclear facilities or any other application where HwaaS failure could lead to loss of life or property damage. If You use the HwaaS for use in such applications or fails to comply with the manufacturer’s specifications, You acknowledge that (a) any such use or non-compliance is at Your sole risk, (b) OT and its licensors and suppliers are not liable, in whole or in part, for any claim or damage arising from such use, and (c) You shall indemnify, defend and hold OT, its licensors and suppliers harmless from any claims, damages, losses, costs, expenses and liabilities arising out of or in connection with such use, including if applicable (i) OT’s compliance with Your designs, specifications, or instructions, (ii) modification of any HwaaS by anyone other than OT, or (iii) use of the HwaaS in combination with other products or in violation of this clause.

2.5 Return of HwaaS. You agree to promptly return the HwaaS in an undamaged condition within ten (10) calendar days of non-renewal, cancellation, or expiration of the Hybrid Solution or issuance of replacement HwaaS to You (the “Return Period”). You are solely responsible for deleting Your Content stored on any HwaaS prior to returning the HwaaS to OT. You acknowledge and agree that OT will not be responsible for any use or disclosure of any of Your Content that remains on any returned HwaaS. You will be responsible for the (a) cost of shipping and handling in connection with the return of the HwaaS to OT and (b) risk of loss associated with the HwaaS until it arrives at OT’s warehouse. OT reserves the right to invoice You for the replacement cost of the HwaaS if OT does not receive the HwaaS by the end of the Return Period. All such payments are due within thirty (30) days of the invoice date.

The CDR (Cloud Disaster Recovery) Services consist of cloud-based, managed services that enable: (a) ongoing availability of Your information technology operations and (b) recovery of mission-critical applications, servers, and data in the cloud after a Disaster (as defined below).

3.1 Performance

a. OT will provide to You a disaster recovery plan (a “DR Plan”) as set forth in the Order Documentation. The Order Documentation and DR Plan will identify the service level purchased (e.g., 1 hour recovery, 24 hour recovery or 48 hour recovery), the Fees to be paid, the equipment covered by the CDR Services (the “Covered Equipment”) and the premises where the Covered Equipment is located (the “Covered Site”). OT will provide the CDR Services solely in connection with the Covered Equipment as configured at the Covered Site and as described in the DR Plan. Equipment and devices not identified in the DR Plan or not accurately described and/or configured in accordance with the DR Plan fall outside the scope of the CDR Services. If the Covered Equipment and/or configurations identified in the DR Plan are different than the Covered Equipment and configuration in the Order Documentation, and OT is required to expand greater resources to provide the CDR Services, OT will require You to enter into amended Order Documentation that accurately reflects the CDR Services to be provided in accordance with the DR Plan.

b. In the event that You: (i) are unable to use the Covered Equipment in a production environment at the Covered Site for its intended computer processing and related business production purposes (a “Disaster”); and (ii) provide OT notice of such Disaster in accordance with the OT procedures then in effect; then OT will provide You with remote access to a OT-hosted environment that duplicates the functionality of the Covered Equipment at the Covered Site as described in the DR Plan (the “Duplicate Environment”) and Your Content as hosted in the Duplicate Environment, subject further to the terms herein. OT will continue to operate the Duplicate Environment until You have informed OT via email that You are again able to use the Covered Equipment in a production environment at the Covered Site, and that the Disaster has ended (“Covered Site Restoration”).

3.2 Individuals Designated to Declare a Disaster. A Disaster may be declared only by the individuals authorized by You in the respective Order Documentation, DR Plan or otherwise identified by You in writing. You may change the designated individuals by written notice to OT.

3.3 Disaster Fees. In addition to the monthly fees for the CDR Services are set forth in the applicable Order Documentation, in the event of a Disaster, You will pay the additional Disaster specific fees then in effect. These include a per-server fee for each Disaster declaration.

3.4 Your Materials. You hereby grant to OT a non-exclusive, worldwide, royalty-free, right and license to reproduce and use the software, applications, and Your Content necessary for OT to create and maintain the Duplicate Environment (the “Your Materials”) solely as necessary to perform the CDR Services. Customer represents and warrants that: (a) it has all the rights necessary to grant the foregoing license and (b) that OT’s reproduction and use of Your Materials will not infringe the rights of any third party, including any intellectual property or privacy rights. You shall indemnify, defend and hold harmless OT for any claims, damages, or losses (i) relating to the use of Your Materials or (ii) arising from a third party's claim that Your Materials infringe on such third party's intellectual property rights.

3.5 Your Obligations.

a. General. You shall:

i. Notify OT of any changes to Your Covered Equipment or Covered Site and update Your portal accordingly. Changes to Your Covered Equipment or Covered Site include without limitation, adding servers or changes to servers.

ii. Determine whether the service level selected by You and specified in the applicable Order Documentation is sufficient to meet Your requirements for continuing its information processing activities in the event of a Disaster.

iii. Comply with OT’s policies and procedures, including such policies related to declaring a Disaster and confirming Covered Site Restoration.

iv. Perform Your obligations identified in the DR Plan or otherwise agreed upon by the parties and related to the CDR Services.

v. Maintain the Covered Equipment at the Covered Site in accordance with operational requirements, and to the extent that any Covered Equipment is third-party equipment, in accordance with the requirements of the third-party equipment manufacturer.

vi. Provide to OT a SAVSYS tape or SAVSYS optical media if the CDR Services are used in an IBM environment prior to commencement of the CDR Services each time the operating system on the Covered Equipment is upgraded and as otherwise may be requested by OT.

vii. Create and monitor the traffic on the tunnel if an IPsec tunnel is required (OT only provides the end target for the IPsec tunnel).

viii. Provide a site edge device to be supported by Cisco for IPsec tunneling to initiate the IPsec tunnel.

ix. Maintain and monitor the status and health of the domain controller.

x. Conduct disaster recovery testing as provided in Section 3.5(b) below.

xi. Support and maintain Your Materials in the Duplicate Environment in accordance with the Service Documentation and create and maintain a domain controller in the Duplicate Environment in connection with CDR Services with a 1-hour service level.

b. Testing. In accordance with the DR Plan and the CDR policies and procedures then in effect (“CDR Policies”), You will conduct disaster recovery testing (a “CDR Test”). During a CDR Test, You shall provide to OT Your encryption key(s) and the required accounts necessary for operating system access to recover machines, i.e. local administrator, domain administrator, root or (sudo) or QSECOFR. You shall remain responsible for all configurations of any third-party software according to third-party vendor specifications. You will perform the CDR Test, within a reasonable amount of time after purchase, in accordance with OT’s instruction. A CDR Test will be completed using Your actual servers, server application sets and server count, as defined in the DR Plan. OT will provide You with access to a Duplicate Environment in order to conduct a CDR Test, subject to the number of tests permitted under the level of CDR Services purchased by You, as set forth in the applicable Order Documentation. If You require additional CDR Tests, a Duplicate Environment may be available to You at OT’s then-current fees. You will schedule CDR Tests with at least sixty (60) days advanced written notice to OT and in accordance with the CDR Policies. Priority for use of the Duplicate Environment is given to customers that have a declared Disaster. Accordingly, OT reserves the right to reschedule CDR Tests. If during a CDR Test OT is unable to activate and operate the Duplicate Environment in material compliance with the DR Plan (the “CDR Test Target), OT reserves the right to troubleshoot and re-conduct the CDR Test. If after reasonable efforts OT is unable to meet the CDR Test Target, either party may terminate the CDR Services (and the applicable portion of any Order Documentation) and OT will refund to You any prepaid but unused fees as Your sole and exclusive remedy. Each party’s right of termination under this Section 3.5(b) must be exercised by written notice of its intention to terminate the CDR Services within forty-five (45) days of the failed CDR Test or such right of termination will be waived.

c. Disaster. At any time between the date that You declare a Disaster and the date of Covered Site Restoration (the “Disaster Recovery Period”), You will:

i. Provide assistance and otherwise perform the obligations as set forth herein.
ii. Comply with all CDR Policies, including that You will provide OT encryption keys as necessary to activate the Duplicate Environment.
iii. Re-route all external IP addresses and aliases to the IP addresses associated with the Duplicate Environment.
iv. Make available any equipment, software, workspace, supplies, and personnel and/or telecommunications services needed to activate and operate the Duplicate Environment, including those not specifically identified in the DR Plan.
v. Provide Your own equipment, such as laptops, in order to access and use the Duplicate Environment.
vi. Provide the appropriate skills and knowledge required to recover, support and maintain the business applications being recovered in the Duplicate Environment.
vii. Work diligently to install applications on the Covered Equipment at the Covered Site with the intent of obtaining Covered Site Restoration.
viii. Be responsible for all configurations of any third-party software according to third party vendor specifications.
ix. Provide the required accounts necessary for operating system access to recover the machines, i.e. local administrator, domain administrator, root or (sudo) or QSECOFR.

d. Remedy. You may, as the exclusive remedy for OT’s material breach of : (i) terminate the Agreement within five (5) days advance notice; and (ii) receive a refund equal to the fees paid to OT for the three (3) month period immediately preceding the Disaster. This remedy does not apply to (i) Your breach of Your obligations under the Agreement or any other cause beyond OT’s reasonable control, (ii) any self-service Disaster declarations, tests or failovers, or (iii) any period of time outside the DR Plan, including but not limited to the restoration of the Covered Equipment at the Covered Site.

Carbonite Information Archiving Services (formerly known as Zix Information Archiving Services) (“Archiving Services”)

4.1 Third-party accounts. You are responsible for configuring applicable third-party platforms or systems to transmit Your Content to the Archiving Services. You are responsible for obtaining any necessary consents from each individual end user (in compliance with applicable laws and regulations) to allow OT to provide the Archiving Services. Third-party email, social media, and other communication services are not offered, controlled, or provided by OT, and OT is not responsible for how a third party transmits, accesses, processes, stores, uses or provides data to Your Content sent on removable media to OT for import into the Archiving Services may be subject to import fees. In addition, such third-party services are subject to the terms and conditions and privacy policies applicable to those services, including, without limitation, the following terms:

YouTube terms and conditions:  https://www.youtube.com/t/terms

Google services privacy: https://policies.google.com/privacy?hl=en-GB

 https://security.google.com/settings/security/permissions

 

4.2 Data Retention. You are responsible for using the Archiving Services in accordance with applicable law, third-party email service terms and conditions, and Your own internal retention requirements. In order for Your Content to be retained after the Subscription Term to Archiving Services has expired, You must purchase extended data retention at an additional charge. At the end of the Subscription Term (or upon termination, if earlier).  The Archiving Services allow You to download archived information, and professional data exportation may be available at an additional charge by signing a separate Order Documentation.

 

4.3 FINRA/SEC Archiving Obligations. This Agreement does not relieve You from any applicable responsibilities You may have under SEC Rules 17a-3 and 17a-4. If You elect to cease using the Archiving Services for some or all of Your records preservation, the obligation to maintain and preserve books and records reverts back to You and You must provide written instructions to OT in order to transfer Your records to an alternative recordkeeping service.

5.1 Access to Data. Other than for the purposes of performing the Cloud-to-Cloud Backup Services, or for other services performed with Your consent, and subject to applicable law, OT will not access Your Content without Your permission, and Your Content will be decrypted only per Your authorization when You view, index, virus scan, export or restore such data. OT reserves the right to impose limits on abusive or excessive use, as determined by OT, in OT’s sole discretion. OT may set reasonable storage limits in the future. Upon termination of the Cloud-to-Cloud Backup Services, OT will use reasonable commercial efforts to send notification of such termination to the email address provided by You, informing You that Your access to the Cloud-to-Cloud Backup Services will be discontinued, and Your Content will be deleted after 14 days without a recovery option. OT will have no liability if You fail to receive the email or act in accordance with the email, or if Your Content is deleted following such period.

5.2 Limitation. You agree not to use or launch any automated system, including without limitation, “robots,” “spiders,” and “offline readers,” that accesses the Cloud-to-Cloud Backup Services, or any site or portal used to provide them, in a manner that sends more request messages to our servers in a given period of time than a human can reasonably produce in the same period by using a conventional online web browser. OT reserves the right to revoke these exceptions either generally or in specific cases.

5.3 Acknowledgement. YOU ACKNOWLEDGE THAT AN INTEGRAL FUNCTION OF THE CLOUD-TO-CLOUD BACKUP SERVICES IS PERFORMED THROUGH A THIRD-PARTY STORAGE PROVIDER SELECTED BY YOU OR, IF NOT OTHERWISE SPECIFIED BY YOU, USED BY DEFAULT (I.E., AMAZON S3 STORAGE IS THE DEFAULT) (THE “STORAGE PROVIDER”). OT THEREFORE CANNOT WARRANT AND HEREBY DISCLAIMS ANY RESPONSIBILITY WITH RESPECT TO THE INTEGRITY, RELIABILITY, SECURITY, QUALITY, COMPATIBILITY WITH YOUR SYSTEMS AND AVAILABILITY OF THE SERVICES PROVIDED BY THE STORAGE PROVIDER AND THEIR EFFECT ON THE CLOUD-TO-CLOUD BACKUP SERVICES AND/OR THE DATA. YOU ACKNOWLEDGE THAT THE DATA SHALL BE STORED AND HANDLED BY THE STORAGE PROVIDER IN ACCORDANCE WITH THE INTERNAL TERMS OF USE  OF THE STORAGE PROVIDER (INCLUDING ANY AUP OR PRIVACY POLICY) TO WHICH YOU HEREBY AGREE TO ADHERE. ACCORDINGLY, YOU SHALL INDEMNIFY OT FROM ANY CLAIMS ARISING FROM A BREACH BY YOU OF THE SAME AND SUCH BREACH SHALL ENTITLE OT TO IMMEDIATELY SUSPEND OR TERMINATE THE CLOUD-TO-CLOUD BACKUP SERVICES.