Reseller - Support, Maintenance, and Availability Agreement

Sept 1, 2022.

Definitions
Scope of Support, Maintenance and Availability
Support Services
Maintenance
Availability

This SMA Agreement shall govern the support and maintenance provided to the Reseller in relation to the COVR Products as well as the availability of the Services. This document forms an integral part of the Agreement between the Parties.

Definitions

Terms not defined herein shall be given the meaning as otherwise is set out in the Agreement.

"Agreed Time of Service" means the minutes when the agreed service level is measured. The Agreed Time of Service is 24/7 365 days a year.
"Availability" means that the Services are made available at the Connection Point. Availability is calculated using the following formula:

Availability (%)= (AS-TB-AB) / (AS-TB)) * 100

AS = Agreed Time of Service
TB = Permitted downtime
AB = Downtime (this does not include downtime for which the Service Provider is not responsible, in accordance with Section 4.2).

"Business Days" means Monday through Friday, save for (i) Swedish public holidays and (ii) Trettondagsafton, Skärtorsdag, Pingstafton, Midsommarafton, Allhelgonadagen, Julafton and Nyårsafton.
"Business Hours" means 9-17 CET on Business Days.
"Connection Point" the point or points where Covr connects the Services to a general electronic communications network;
"COVR Product Specification" means the product and function specification for the COVR Products as available at https://www.covrsecurity.com/covr-app-requirements/. The COVR Product Specification may be updated from time to time as changes are made to the COVR Products, including Updates and Upgrades.
"COVR Products" shall mean the COVR App, COVR SDK, COVR Software and the Services.
"COVR Support Services" means the support services set out in Section 2.2.
"Critical Update" shall have the meaning set out in Section 2.8.
"Delivery Date" means the date on which the Services are made available to the Reseller in accordance with what has been agreed between the Parties.
"Downtime" means the period of downtime within the Agreed Time of Service that Availability has not been met with a deduction for the time of Permitted Downtime. Down time is calculated from the moment in time the failure in Availability is reported in accordance with Section 4.3 until the Services become Available. When determining Availability in accordance with the formula in the definition of "Availability" above, Downtime shall not include downtime that is not the responsibility of Covr in accordance with Section 4.2.
"Helpdesk Service" shall be given the meaning set out in Section 2.4.
"Incident Resolution Assistance" shall be given the meaning set out in Section 2.6.
"Incident" means a material non-conformance between a COVR Product and the COVR Product Specification.
"Incident Report" shall have the meaning assigned to it in Section 2.5.2.
"Incident Report Number" shall have the meaning assigned to it in Section 2.5.4.
"Permitted Downtime" a) planned service and maintenance about which the Reseller has been informed in advance where commercially reasonable, or b) other downtime at the request of the Reseller or with the Reseller's approval. The number of occasions of Permitted Downtime as referred to in a) above shall not exceed two per month, except where otherwise agreed. Covr may notify the Reseller of planned service and maintenance through e-mail. Such notification shall be deemed received when sent by Covr.
"Reseller Support Services" means the COVR Products support services set out in Section 2.1.
"Service Request" shall mean requests that not are related to Incidents but to usage of the COVR Products, any audit-related requests to prove that the COVR Products are compliant with rules and regulatory requirements as specified in the submitted Service Request and ad hoc queries from Users.
"Service Request Number" shall be given the meaning set out in Section 2.7.
"Support Manager" means Covr's overall responsible person for support issues in relation to the Reseller, as provided in Section 2.9.1.
"Support Website" shall be given the meaning set out in Section 2.3.
"Technical Contacts" means the Reseller's contact persons to whom Covr's Support Services will be provided, as further defined in Section 2.9.1.
"Updates" shall mean the Service Provider's published corrections of the Covr Products, which will be provided to the Customer in accordance with the Service Specification.
"Upgrades" shall mean the Service Provider's published versions of the Covr Products including new or better functionality, which will be provided to the Customer in accordance with the Service Description.

1. Scope of Support, Maintenance and Availability

1.1 Covr agrees to use commercially reasonable efforts to provide COVR Support Services to the Reseller in respect of the COVR Products. Covr may engage subcontractors to execute the COVR Support Services. Covr's maintenance undertaking is described in Section 3.

1.2 The Reseller shall provide the Reseller Support Services in relation to the COVR Products. For the avoidance of doubt, the Reseller is also responsible for the Reseller's and the Customers' systems, software, equipment and network access necessary for the COVR Products to function in accordance with the Agreement.

1.3 This SMA Agreement also regulates the availability service level for the Services.

2. Support Services

2.1 Reseller Support Services
The Reseller shall provide and maintain an internal organisation that to a reasonable extent can manage, basic requests for assistance from Customer's and their Users related to the COVR Products and other queries related to the Reseller's and Customer's use of the COVR Products, including but not limited to user access management, issues with customer data and bugs in the COVR Products. In case the Reseller is unable to solve or provide an adequate answer to the request, the Reseller may escalate the issue to Covr in accordance with this SMA Agreement.

2.2 COVR Support Services

As from the Delivery Date, Covr will make available to Reseller the following support services in respect of the COVR Products:

Support Website;
Helpdesk Service; and
Incident Resolution Assistance.

2.3 Support Website

2.3.1 Covr will give Reseller and the Customers access to a website that will contain a knowledge database, product information and release information.

2.3.2 The website will also offer a frequently asked questions service enabling the Reseller and its Customers to review answers to questions put forward by other resellers and customers.

2.4 Help desk Service

2.4.1 Covr will provide consultation and advice to Reseller's Technical Contact directly over the telephone and/or by e-mail for technical questions regarding issues related to the COVR Products and the use thereof.

2.4.2 Helpdesk Service will be provided 24/7 365 days per year.

2.5 Incident Reporting and Classification

2.5.1 Helpdesk Service and Incident Resolution Assistance will be provided subject to the reporting and classification of Incidents as follows, unless the COVR Support Service is requested through a Service Request and is regulated by Section 2.7.

2.5.2 Any Incident for which Reseller requests such services as mentioned in Section 2.5.1 shall be reported by Reseller's Technical Contacts by using the COVR support tool available at https://support.covrsecurity.com/hc/en-us/requests/new ("Incident Report"). The Incident Report shall contain a detailed description of the nature of the Incident, including but not limited to any error message, the conditions under which it occurs and other relevant data sufficient to enable Covr to reproduce the reported Incident, to verify its existence and diagnose its cause. The Incident Report shall also contain Reseller recommended priority (1-4) of the Incident and contact information to the Reseller, the relevant Customer or Incident identification.

2.5.3 All COVR Support Services will be provided in English or Swedish. Therefore, any Incident Reports shall be drafted in English or Swedish.

2.5.4 Reseller shall propose that the Incident shall be assigned to one of the below four Incident classes. Covr shall then decide, in its reasonable opinion, to which class the Incident shall be assigned. Furthermore, Covr shall assign an incident report number to the Incident Report ("Incident Report Number"). Covr may re-classify an Incident.

2.5.5 Any Incident shall be assigned to one of the following Incident classes.

a) Critical Incident (P1)
An Incident that renders a COVR Product inoperable or causes a COVR Product to substantially fail for all or majority of the Users of a Customer.
b) Serious Incident (P2)
An Incident that renders a COVR Product inoperable or causes the COVR Product to substantially fail for 5-50 % of the Users of a Customer.
c) Moderate Incident (P3)
An Incident reported by one or a few of the Users of a Customer but that causes major limitations in the use of a COVR Product for such Users.
d) Minor Incident (P4)
An Incident that does not qualify as a Critical, Serious or Moderate Incident.

2.6 Application Incident Resolution Assistance

Covr will acknowledge receipt of Reseller's Incident Report and will use commercially reasonable efforts (i) to classify and assign an Incident Report Number to the Incident Report, (ii) provide the Reseller with progress updates, and (iii) provide appropriate assistance to correct or alleviate the Incident reported, e.g. by implementing or furnishing an avoidance procedure, bypass, work-around or patch in accordance with below objectives:

Incident Class	Initial e-mail or telephone response, incl. Classification and numbering	Progress Update	Action	Work around, Patch or similar	COVR Product updates
Critical (P1)	30 minutes	Every Business Day or as mutually agreed	Work continuously during Business Hours	As required	Next
Serious (P2)	30 minutes	Every Business Day or as mutually agreed	Work continuously during Business Hours	As required	Next
Moderate (P3)	8 hours	Every Business Day or as mutually agreed	Work continuously during Business Hours	As required	Next
Minor (P4)	8 hours	Monthly or as mutually agreed	As reasonably required	No	As reasonably required

2.6.2 For the avoidance of doubt, the timelines set out in the table of this Section 2.6 are estimates only, and the Reseller shall not be entitled to any compensation in case such timelines cannot be met. Furthermore, Covr shall have no obligation to provide Incident Resolution Assistance where the Reseller or the Customer has not implemented any Critical Update released by Covr.

2.7 Service Requests

2.7.1 Helpdesk Service will also be provided upon the Reseller's Technical Contact submitting a Service Request, by using COVR support tool available at https://support.covrsecurity.com/hc/en-us/requests/new. Such requests shall be in English or Swedish. Service Requests will be assigned a number by Covr ("Service Request Number").

2.7.2 Covr will acknowledge receipt of the Reseller's Service Request and will use commercially reasonable efforts to provide an appropriate initial answer to the Service Request within 8 Business Hours. For the avoidance of doubt, the timeline set out in this Section 2.7.2 is an estimate only, and the Reseller shall not be entitled to any compensation in case such timeline cannot be met.

2.8 Updates and Upgrades

Covr may continuously make Updates and Upgrades to the COVR Products. Changes that would have a material impact on the Availability of the Services during Business Hours shall be subject to reasonable prior notification. Updates and Upgrades of the COVR Software and the COVR App shall be made available to the Reseller in a manner and form reasonably prescribed by Covr. Updates and Upgrades that are issued to address critical issues ("Critical Updates") may be provided and shall be installed at such times as determined by Covr in its discretion.

2.8.1 Any Upgrades shall be migrated within six months and another six months end of life support.

2.8.2 Any updates which are not an Upgrade, and which are made for the purposes of fixing bugs and other improvements of the Service and Software will be made continuously and are not subject to any notification to the Customer.

2.9 Customer's Single Point of Contact for Support

2.9.1 The Reseller shall designate one primary and one delegate individual ("Technical Contacts") to serve as liaisons with Covr. The Reseller's designated Technical Contacts shall be the sole liaison between the Reseller and Covr for COVR Support Services. To avoid interruption of the COVR Support Services, the Reseller shall notify Covr whenever a Technical Contact is replaced by another individual.

2.9.2 Covr will assign one individual to be overall responsible for all operational support issues in relation to the Reseller ("Support Manager")

2.10 Reseller's Obligations

2.10.1 Reseller agrees and undertakes to:

provide the Reseller Support Services to Customer;
ensure that only the Reseller's Technical Contacts contact Covr with respect to COVR Support Services;
ensure that Reseller's Technical Contacts are aware of Covr's support number, e-mail and web site address, the information required when reporting an event, and the contracted hours of operation of COVR Support Services;
maintain up-to-date lists of software, installation history, hardware equipment, and other relevant information which may reasonably be required to enable Covr to fulfil its obligations;
on Covr's request, promptly provide reasonable information and assistance necessary for Covr's performance of the COVR Support Services;
always refer to the applicable Incident Report Number or Service Request Number in its contact with Covr;
ensure that relevant and reasonable processes and procedures related to the COVR Products recommended by Covr are implemented and adhered to by Reseller and the Customer;
provide Covr's Support Manager with copies of the Reseller's and Customer's processes and procedures relevant for the COVR Products and provide reasonable information necessary for the understanding of such processes and procedures;
ensure that the Customers and, where relevant, the Reseller integrate and install the Updates and Upgrades for the COVR App and COVR Software as made available to Reseller by Covr in accordance with Covr's instructions and, where any Critical Update is concerned, within such time as notified by Covr; and
attend all service review meetings provided for in Section 2.15.

2.11 System Access

2.11.1 To enable Covr to efficiently provide COVR Support Services, the Reseller shall grant, and shall ensure that the Customers grant Covr and if applicable, a subcontractor of Covr, if Covr so deems appropriate, access to the Reseller's and Customer's systems relevant for the COVR Products on a case-by-case basis. Covr shall use such system access only for the purposes of carrying out its obligations under the Agreement. In such use, Covr shall comply with the Reseller's or Customer's reasonable internal security instructions and procedures.

2.11.2 Provided that Covr complies with such reasonable instructions and procedures, Covr shall not be liable to the Reseller for any damage that may arise out of Covr's use of and access to the Reseller's or Customer's systems, unless such damages are caused by Covr's gross negligence or willful misconduct.

2.12 Remuneration

The remuneration payable for the COVR Support Services is set out in the Price Schedule to the Agreement and payable according to Price Schedule. Payments shall be made within thirty (30) days from the date of invoice.

2.13 Support Services Not Related to the COVR Products

2.13.1 Prior to sending Covr an Incident Report, the Reseller shall ensure that the reported Incident is attributable to one or more of COVR Products.

2.13.2 Notwithstanding what is set out in the main agreement document and Section 2.12 of this SMA Agreement, Covr shall be entitled to reasonable compensation for any work carried out or time spent by Covr as a consequence of reported Incidents that are not attributable to the COVR Products or which fall under Section 2.14.2.

2.14 Scope of Support

2.14.1 COVR Support Services will be provided to the Reseller only. Notwithstanding the foregoing, the Reseller authorises Covr to provide COVR Support Services directly to the Customers in relation to Critical Issues. Covr shall however be under no obligation to provide COVR Support Services to the Customers or the Reseller's sub-contractors, if any.

2.14.2 Covr's obligation to provide COVR Support Services shall not apply to the COVR Products if they have been used in a manner that fails to conform to Covr's written instructions or to the provisions of the Agreement.

2.14.3 Covr's obligation to provide COVR Support Services shall only apply to the most updated version of the COVR Products. Except for in case of Critical Updates, the Reseller and the Customer shall be given a period of three (3) months from when an Update or Upgrade was made available to the Reseller during which the Update or Upgrade, as applicable, shall be integrated and/or installed prior to the relevant COVR Product ceasing to be seen as the most updated version. Where a Critical Update has been released, the Reseller and the Customer shall integrate and/or install such Critical Update within the time frame notified by Covr.

2.15 Support Service Review Meetings

On either Party's request, and no more frequent than twice per calendar year, the Parties shall review the COVR Support Services rendered, and the performance under this SMA Agreement of either Party in relation to the support services, since the previous review. Such service review will be carried out by the Reseller's Technical Contacts and Covr's Support Manager in a telephone conference, unless Reseller's Technical Contact and Covr's Support Manager agree to meet in person, on each Party's own expense.

2.16 Limited Warranty for Service Provider Support

2.16.1 Covr warrants that the COVR Support Services will be provided in a professional and workmanlike manner, in accordance with well-established software support business standards. Covr makes no other warranties to the Reseller with respect to the COVR Support Services furnished hereunder, and no other warranties of any kind, whether written, oral, implied or statutory, including warranties of merchantability or fitness for a particular purpose, non-infringement or arising from course of dealing or usage in trade, shall apply.

2.16.2 In the event of breach of the warranty set out in Section 2.16.1 the Reseller is entitled to re-performance of the COVR Support Services, or if Covr reasonably cannot perform the COVR Support Services as warranted, the Reseller is entitled to terminate the Agreement and recover the part of the fee for the COVR Products paid during a period of three calendar months prior to the termination of the Agreement. Such remedies shall be the Reseller's exclusive remedy and shall constitute fulfilment of all obligations and liabilities of Covr with respect to the warranty under Section 2.16.1.

3. Maintenance

Covr strives to keep the COVR Products up to date and functioning in accordance with relevant technology. Therefore, Covr may continuously perform maintenance on the COVR Products. Covr shall give the Reseller reasonable notice of any maintenance to be performed during Business Hours that may affect the Availability of the Services. Updates and Upgrades of the COVR Software and the COVR App shall be made available in a manner and form reasonably prescribed by Covr.

4. Availability

4.1 Agreed Availability

4.1.1 The agreed Availability of the Services is measured per calendar month and is 99 %. For the avoidance of doubt, the service level set out in this Section 4 does not apply to the Reseller if the Reseller or the Customer's use of the Services is a part of a preview, pre-release, beta or trial version of the Services or if the payment for access to the Services has been made using Microsoft Subscription credits or if the license has been ordered but yet not paid for by the Reseller.

4.1.2 The Services are hosted by a third party. More information about the third party's hosting service and the availability of such service can be found on Microsoft Azure webpage. For the avoidance of doubt, Covr does not provide any warranties, implied or expressed, in relation to the availability of the third party hosting service.

4.2 Downtime for Which the Service Provider Is Not Responsible

Covr is not responsible for downtime or any other failure to satisfy the agreed service level if Covr can show that it was caused by any of the following circumstances and provided that the said circumstance was not directly attributable to Covr:

circumstances outside Covr's area of responsibility for the Services, such as failure of communications or it is due to other products or services from the Reseller, Customer or third parties for which Covr has not specifically taken responsibility;
any other circumstances for which the Reseller has responsibility for under the terms of the Agreement, including but not limited to, the obligation to implement, and ensure that Customers implement, Critical Updates, complying with reasonable instructions of Covr or attempts to perform operations that exceed quotas prescribed by Covr; or
virus or other attack on security, despite Covr having taken professional security measures, any Force Majeure Event or Covr restricting the Reseller's access to the Services in accordance with the main document of the Agreement.

4.3 Reporting of Downtime

Downtime is only reported after it has been registered by Covr. Downtime may be registered by means of an automatic alarm, a report by the Reseller in a manner agreed between the Parties or upon discovery by Covr. The Reseller is responsible for ensuring that if it reports an Incident, that it is reported in a manner compliant with the Agreement.

4.4 Measurement

Except where otherwise agreed, Covr has responsibility for defraying the cost of and implementing tools capable of measuring the agreed service level. The measuring point for the Availability is the Connection Point.

4.5 Follow-Up

4.5.1 Within fifteen (15) days of the end of each calendar month or other agreed period, Covr shall provide the Reseller with a report on the measurements made of the agreed service level

4.5.2 The Technical Contacts are to receive the report referred to in Section 4.5.1 except where otherwise is agreed between the Parties.

4.5.3 The Parties may agree on a specific plan describing how non-conformities and disturbances are to be reported between the two Parties.

4.6 Price Reductions in Event of Failure to Reach Agreed Level of Service

4.6.1 If the Availability is below the agreed level of Availability for the Services, the Reseller is entitled to a price reduction by a percentage of the monthly fee for the COVR Products as shown in the table below:

Percentage or part thereof below the agreed level	% rate price reduction
<99 %	10 %
<95 %	30 %
<90 %	100 %

4.6.2 The maximum price reduction per month in the event of failure to meet Availability that can be credited to the Customer is 100 % of the monthly fee for the COVR Products.

4.6.3 To avoid losing the right to a price reduction, the Reseller shall submit a claim for price reduction by no later than the end of the calendar month following the month in which the report is sent to the Reseller as a referred to in Section 4.5.1.

4.6.4 Covr is responsible for failure to satisfy the agreed level of service only in accordance with the conditions of this Section 4. Over and above this the Reseller has no right to damages or any other compensation on account of deviations from the service level, except in the event of willful misconduct or gross negligence.

Reseller - Support, Maintenance, and Availability Agreement