Channel Cloud Marketplaces ltd Privacy Policy

You can download a PDF copy of the privacy policy here.

Why This Policy Exists

Your privacy, and protecting it is important to us.

In order to provide our services, Channel Cloud Marketplaces Ltd needs to collect and process information about some individuals. These can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact. Channel Cloud Marketplaces Ltd operates under the familiar name of Channel Cloud Marketplaces Ltd and www.cloudinthechannel.com. References in this policy to Channel Cloud Marketplaces Ltd refer to our services, products, apps, websites and servers.

This policy describes what personal data is collected, handled and stored, how we protect your data was we work with it, and how we comply with the law through the company’s data protection standards.

This data protection policy ensures Channel Cloud Marketplaces Ltd;

– Complies with data protection law and follows good practice.
– Protects the rights of staff, customers and partners.
– Is open about how it stores and processes individuals’ data.

Statement

GDPR stands for General Data Protection Regulation and replaces the previous Data Protection Directives that were in place. It was approved by the EU Parliament in 2016 and comes into effect on 25th May 2018. GDPR states that personal data should be ‘processed fairly & lawfully’ and ‘collected for specified, explicit and legitimate purposes’ and that individuals data is not processed without their knowledge and are only processed with their ‘explicit’ consent. GDPR covers personal data relating to individuals.

Channel Cloud Marketplaces Ltd is committed to protecting the rights and freedoms of individuals with respect to the processing of personal data. GDPR gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly.

Channel Cloud Marketplaces Ltd – 27th June 2023 in Cyprus, number 448436, Registered office: 11 Florinis street, CITY FORUM, Floor 1, Flat 102, 1065, Nicosia, Nicosia, NICOSIA, Cyprus.


Personal Data Held By Channel Cloud Marketplaces Ltd
Personal Data We Collect

By necessity, Channel Cloud Marketplaces Ltd needs to store some personal information. There are two sets of data held; User Access Data and End Customer Data.

User Access Data

Every person who wishes to use Channel Cloud Marketplaces Ltd needs to register and login. During the registration process, we collect the following personal data;

– Title
– First Name
– Last Name
– Telephone Number
– Email Address
– Business Name and Address
– Job Title

This data is collected in order to validate that the registered user is a legitimate trade professional,and to be able to identify who the person using the site is. We store the data permanently. The reason for doing so is so that users are able to log on and access the service easily. The names and other details of the site’s users are not passed on to any third party.

End Customer Data

Channel Cloud Marketplaces Ltd provides services to Client businesses who may sell, via Channel Cloud Marketplaces Ltd, products to individuals. In order to be able to sell and deliver a product to that End Customer, it is necessary for Channel Cloud Marketplaces Ltd to collect the following personal data;

– Title
– First Name
– Last Name
– Personal Email Address
– Telephone
– Number
– Physical Address

This data is collected in order to be able to ensure that the individual be kept informed of the progress of his order, and to have their purchases physically delivered. We store the data permanently. The reason for doing so is to have a record of the orders and who made them. This data will potentially be passed to wholesale suppliers. This is because a lot of products are directly shipped from wholesale distribution centres to the end customer.

Without collecting the End Customers name and address, the Client business would not know where to deliver the purchases to. Without collecting the email address and telephone number, it would not be possible to deliver the products via direct shipment, as this is often a mandatory requirement by 3rd party couriers used by wholesale suppliers.


GDPR Rights For Individuals
Right To Be Forgotten

Channel Cloud Marketplaces Ltd respects the wishes of individuals to have their personal details that have been legitimately collected to be deleted, and thus ‘be forgotten’ by the organisation. Channel Cloud Marketplaces Ltd have created a mechanism that will delete all personal information regarding an individual from our records.

Procedure To Request To ‘Be Forgotten’

The procedure for removing personal information for an individual is as follows;

1. Channel Cloud Marketplaces Ltd receive a request from an individual or a person authorised by that individual to have their personal data removed.
2. Requests will only be considered if received by physical post to Channel Cloud Marketplaces’s registered address, or electronically via a Channel Cloud Marketplaces Ltd monitored email account. Should an individual make a right to be forgotten request by telephone or other electronic means, they will be asked to confirm their request by post or email.
3. The existence of an individual’s record is appropriately confirmed.
4. Upon validation that this is a genuine request by the Data Protection Officer, an approval email will be sent to the designated IT Manager at Channel Cloud Marketplaces Ltd
5. The IT Manager will execute the mechanism described below to remove the individual’s details.
6. The removal of the individual’s details is validated by the Data Protection Officer
7. The individual requesting the right to be forgotten will then be notified by Data Protection Officer using the same communications method as the request was received by.

Measurable Outcome Of Being Forgotten

Upon receiving an approved, valid request to remove an individual’s personal data, Channel Cloud Marketplaces Ltd IT Manager will execute specially written software code which performs the following tasks;

– Title, first and last name are overwritten with hashes (#)
– Email is overwritten with hashes (#)
– Telephone is overwritten with hashes (#)
– All address details are overwritten with hashes (#)
– Job title is overwritten with hashes (#)

Allowing Users To Edit Their Personal Information

Upon Login, all Channel Cloud Marketplaces Ltd Client business users have access to a personalised account page where they can maintain and update any of the personal details stored about them.

Procedure To Submit A Subject Access Request

The procedure for requesting a copy of personal information collected about an individual is as follows;

1. Channel Cloud Marketplaces Ltd receive a request from an individual or a person authorised by that individual to view a copy of their personal data.
2. Requests will only be considered if received by physical post to Channel Cloud Marketplaces’s registered address, or electronically via a Channel Cloud Marketplaces Ltd monitored email account. Should an individual make a Data Portability request by telephone or other electronic means, they will be asked to confirm their request by post or email.
3. The existence of an individual’s record is appropriately confirmed.
4. Upon validation that this is a genuine request by the Data Protection Officer, an approval email will be sent to the designated IT Manager at Channel Cloud Marketplaces Ltd.
5. IT Manager will execute the mechanism described below to create a file containing a copy of the personal details collected about the individual.
6. The file is sent to the requesting individual using the same communications method as the request was received by.

Data Portability – Subject Access Request

Channel Cloud Marketplaces Ltd have created a mechanism that will provide visibility of all personal information collected about an individual, to that individual.

Measurable Outcome Of A Subject Access Request

Upon receiving an approved, valid request to provide a copy of an individual’s collected personal data, Channel Cloud Marketplaces Ltd IT Manager will execute specially written software code. This code creates a Comma Separated Value (CSV) file containing a copy of the individual’s collected personal data. This file is deleted after it has been sent to the individual.


Personal Data Use & Storage
Staff With Key Responsibilities

The Board of Directors, is ultimately responsible for ensuring that Channel Cloud Marketplaces Ltd meets its legal obligations.

The Data Protection Officer

– Keeps the board updated about data protection responsibilities, risks and issues.
– Reviews all data protection procedures and related policies, in line with an agreed schedule.
– Arranges data protection training and advice for the people covered by this policy.
– Answers data protection questions from staff and anyone else covered by this policy.
– Deals with requests from individuals to view the personal details Channel Cloud Marketplaces Ltd holds about them (also called ‘subject access requests’).
– Checks and approves contracts or agreements with third parties that may handle Channel Cloud Marketplaces Ltd confidential data.

The IT Manager

– Ensures all systems, services and equipment used for storing data meet acceptable security standards.
– Performs regular checks and scans to ensure security hardware and software is functioning properly.
– Evaluates third-party services the company is considering using to store or process data, for example: cloud computing services.

General Guidelines For All Staff

The only people able to access data covered by this policy should be those who need it for their work.

– Data should not be shared informally. When access to confidential information is required, staff should request it from their line managers.
– Channel Cloud Marketplaces Ltd will provide training to all staff to help them understand their responsibilities when handling data.
– Staff should keep all data secure, by taking sensible precautions and following these guidelines.
– Strong passwords must be used and should never be shared.
– Personal details should not be disclosed to unauthorised people, neither within the company or externally.
– Data should be regularly reviewed and updated if it is found to be out of date. If no longer required, it should be deleted and securely disposed of.
– Staff should request help from their line manager or the Data Protection Officer if they are unsure about any aspect of data protection.

Data Storage

These guidelines describe how and where data should be safely stored. Staff questions about storing data safely should be directed to the IT Manager. When data is stored electronically, it must be protected from causal unauthorised access, malicious hacking attempts and accidental deletion.

– Data should be protected by strong passwords that are changed regularly and never shared between staff.
– All Data stored on any removable media for the purposes of disaster recovery, (for example; USB Drives, Tapes and DVD) is automatically encrypted. This media should be securely taken offsite and locked away when not being used.
– As policy, general staff DO NOT use, (nor have the option to use) removable media for temporary file storage.
– Data should only be stored on designated drives and servers, and should only be uploaded to approved cloud computing services.
– Servers containing personal data should be sited in a secure location, away from general office space.
– Data should be backed up frequently. Those backups should be tested regularly, and stored securely, in line with the company’s standard backup procedures.
– Data should never be saved directly to laptops or other mobile devices like tablets or smart phones. General staff DO NOT use Laptops or Mobile devices to access, process or store Data.
– All servers and computers containing data should be protected by approved security software and a firewall.

These guidelines also apply to data that is usually stored electronically but has been printed out for some reason:

– When data is stored on paper and printouts, it should be kept in a secure place where unauthorised people cannot see it, for example; not left on a printer.
– When not required, the paper and printouts should be kept in a locked drawer or filing cabinet.
– Paper and printouts should be shredded and disposed of securely when no longer required.

Data Use

Channel Cloud Marketplaces Ltd cannot provide any substantive value to its clients and their end customers unless it can collect and process Personal Details. If personal details are secured to the extent that they cannot be accessed, Channel Cloud Marketplaces Ltd would ceases to be a viable business. However, it is when this collected personal data is accessed and processed that it is at the greatest risk of loss, corruption and theft. Staff should hereforetake great care to protect confidential data.

– When working with personal details, staff should ensure the screens of their computers are always locked when unattended.
– Personal data should not be shared informally. Data must be encrypted before being transferred electronically. In particular, it should never be sent externally by unencrypted email. The IT manager can explain how to send data to authorised external contacts.
– Staff should not save copies of personal data to their own computers. Staff should always access and update the central server copy of any data.
– Personal data should be never be transferred outside of the European Economic Area.

Data Accuracy

The law requires Channel Cloud Marketplaces Ltd to take reasonable steps to ensure data is kept accurate and up to date. Further, Channel Cloud Marketplaces Ltd prides itself on our overall data accuracy. It is most important that individual personal data is accurate, and staff should place great emphasis on ensuring its continued precision. It is the responsibility of all staff who work with data to take all reasonable steps to ensure it is kept as accurate and up to date as possible.

– Data should be held in as few places as possible. Staff should not create unnecessary additional data sets.
– Staff should take every opportunity to ensure data is updated, for example: by confirming a Client business user’s details when they call.
– Channel Cloud Marketplaces Ltd should make it easy for data subjects to update the information Channel Cloud Marketplaces Ltd holds about them. For instance, via their account page on the Channel Cloud Marketplaces Ltd website.
– Data should be updated as inaccuracies are discovered. For instance, if a customer can no longer be reached on their stored telephone number, it should be removed from the database.

Terms and Conditions

Channel Cloud Marketplaces Ltd Terms and Conditions

This Is Agreement Between You And Us On The Terms Set Out Below

Background

The Supplier has agreed to provide services and software and data to the Customer on the terms and conditions of this agreement.

The Supplier is licensor of software and the data and is willing to license the Customer to use this Software and data on the terms set out below.

1. AGREED TERMS & INTERPRETATION

1.1 The definitions and rules of interpretation in this clause apply in this agreement.

1.2 Definitions:

Business Hours: 9am-6pm Monday to Friday but not including weekends or public holidays in Cyprus.

Effective Date: the date that the service is activated or the date of registration for the free services.

Event Outside Our Control: any act or event beyond a party’s reasonable control, including failure of public or private telecommunications networks save where caused by acts or omissions of the party and/or which could have been avoided by implementation of an appropriate business continuity plan.

Fees: the fees according to the requests for payment created.

Force Majeure Event: an event which includes, but is not limited to, acts of God war, riot, strikes, or terrorism.

Open-Source Software: open-source software as defined by the Open Source Initiative or the Free Software Foundation.

Services: the services more particularly described on our web site and selected by you.

Service Management Team: the team appointed to manage the services.

Schedule: a schedule to this agreement incorporated in the document or by way of html link to a supporting document and/or html page.

SLA: the service level agreement more particularly described here

Software: the software more particularly described on our web site.

We/Us/Supplier: Channel Cloud Marketplaces Ltd.

You/Customer: a Customer of Channel Cloud Marketplaces Ltd.

Clause, Schedule and paragraph headings shall not affect the interpretation of this agreement.

1.3 Unless the context otherwise requires:

  • (a) words in the singular shall include the plural and words in the plural shall include the singular;

  • (b) A reference to a statute or statutory provision is a reference to it as amended, extended or re-enacted from time to time;

  • (c) a reference to one gender shall include a reference to the other genders; and

  • (d) any words following the terms including, include, in particular, for example or any similar expression shall be construed as illustrative and shall not limit the sense of the words, description, definition, phrase or term preceding those terms.

1.4 In the case of conflict or ambiguity between any provision contained in the body of this agreement and any provision contained in the schedules or appendices, the provision in the body of this agreement shall take precedence.

1.5 A person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality) and that person’s personal representatives, successors and permitted assigns.

1.6 References to clauses are to the clauses of this agreement.

2. SCOPE OF SERVICES

2.1 We will provide you with the Services that you have selected in the service description below.

2.2 We will provide you with the Services in accordance with our SLA as set out here.

2.3 By clicking submit and commencing the use of our Services you agree that you are accepting these terms and conditions.

3. FEES

3.1 Requests for payment for services will be sent.

3.2 Customer shall pay each request for payment submitted to it by the Supplier within 30 days of receipt via any of the payment methods we accept in your jurisdiction.

3.3 If the Customer fails to make any payment of any undisputed request for payment to the Supplier under this agreement by the due date then, the service may be suspended without further notice.

3.4 All sums payable under this agreement are exclusive of VAT or any relevant local sales taxes, for which you shall be responsible.

4. TERM OF AGREEMENT

This is set out in the requests for payment, typically monthly or annual billing offered. For longer term agreements a separate contract will be provided.

5. GRANT OF LICENCE

5.1 In consideration of payment by you of the agreed Fees and you agreeing to abide by the terms of this agreement, we grant to you a non-exclusive, non-transferable worldwide licence to use the Software and the data generated by the Software on the terms of this agreement.

5.2 You may access and use the Software and the data for normal business purposes by any number of concurrent users, subject to the payment of our Fees.

5.3 Except as expressly set out in this agreement or as permitted by any local law, you undertake:

  • (a) not to copy the Software or the data except where such copying is incidental to normal use of the Software and the data, or where it is necessary for the purpose of the provision of your services to your customers and/or back-up or operational security;

  • (b) not to rent, lease, sub-license, loan the Software or data;

  • (c) not to make alterations to, or modifications of, the whole or any part of the Software;

  • (d) not to disassemble, decompile, reverse-engineer or create derivative works based on the whole or any part of the Software nor attempt to do any such thing except to the extent that (by virtue of section 296A of the Copyright, Designs and Patents Act 1988) such actions cannot be prohibited because they are essential for the purpose of achieving inter-operability of the Software with another software program, and provided that the information obtained by you during such activities:

    • (i) is used only for the purpose of achieving inter-operability of the Software with another software program; and

    • (ii) is not unnecessarily disclosed or communicated without our prior written consent to any third party; and

    • (iii) is not used to create any software which is substantially similar to the Software;

  • (e) to supervise and control use of the Software and ensure that the Software is used by your employees and representatives in accordance with the terms of this agreement;

  • (f) to include our copyright notice on all entire and partial copies you make of the Software on any medium;

  • (g) not to provide or otherwise make available the Software in whole or in part (including but not limited to program listings, object and source program listings, object code and source code), in any form to any person other than your employees without prior written consent from us;

  • (h) to comply with all applicable technology control or export laws and regulations.

5.4 Our Software creates material levels of data which is refreshed on a daily basis. You may access and copy this data as part of our Services to you subject to the limitation of liability as set out in clause 7 below.

5.5 You may use and/or publish the data created by our Software within your own web site, ERP and third-party sites relevant to the conduct of your business.

6. INTELLECTUAL PROPERTY RIGHTS

6.1 You acknowledge that all intellectual property rights in the Software anywhere in the world belong to us, that rights in the Software are licensed (not sold) to you, and that you have no rights in, or to, the Software other than the right to use them in accordance with the terms of this agreement.

6.2 You acknowledge that you have no right to have access to the Software in source code form.

6.3 The Software is updated from time to time and we make no warranty that this will be compatible with your systems without the requirement of an upgrade or customisation of your systems.

7. LIMITATION OF LIABILITY

7.1 You use and rely on the data generated by our Software solely at your own risk.

7.2 You acknowledge that the Software which generates the data has not been developed to meet your individual requirements, and that it is therefore your responsibility to ensure that the facilities and functions of the Software meet your requirements.

7.3 We only supply the Software for internal use by your business, and you agree not to sub licence the Software.

7.4 We shall not in any circumstances whatever be liable to you, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, arising under or in connection with the agreement for:

  • (a) loss of profits, sales, business, or revenue;

  • (b) business interruption;

  • (c) loss of anticipated savings;

  • (d) loss or corruption of data or information;

  • (e) loss of business opportunity, goodwill or reputation; or

  • (f) any indirect or consequential loss or damage.

7.5 Other than the losses set out in condition 7.4 (for which we are not liable), our maximum aggregate liability under or in connection with this agreement whether in contract, tort (including negligence) or otherwise, shall in all circumstances be limited to a sum equal to two times the Fees paid by you. This maximum cap does not apply to condition 7.10.

7.6 Where for example you access our Software through a site or webstore that is hosted by a third party and their services then we make no warranty and accept no liability in relation to the provision of the services of that third party or the availability of the site or webstore.

7.7 Parts of our Service and Software may rely on Open-Source Software and we make no warranty that this is bug or error free and we accept no liability or any losses arising from any such bugs or errors.

7.8 We do not give any warranty or undertaking as to the accuracy or completeness of the data collated by our Software and we are not liable for any losses arising from an error or omission in such data.

7.9 Price and stock data generated by the Software is only indicative and are subject to change. You are sole responsible for the way you use and apply this information.

7.10 Nothing in this agreement shall limit or exclude our liability for:

  • (a) death or personal injury resulting from our negligence;

  • (b) fraud or fraudulent misrepresentation;

  • (c) any other liability that cannot be excluded or limited by Cypriot law.

7.11 This agreement sets out the full extent of our obligations and liabilities in respect of the supply of the Software and data.

7.12 Except as expressly stated in this agreement, there are no conditions, warranties, representations or other terms, express or implied, that are binding on us. Any condition, warranty, representation or other term concerning the supply of the Software and data which might otherwise be implied into, or incorporated in, this agreement whether by statute, common law or otherwise, is excluded to the fullest extent permitted by law.

8. TERM AND TERMINATION

8.1 Without affecting any other right or remedy available to us, either party may terminate this agreement with immediate effect by giving written notice to you if:

  • (a) the other party suspends, or threatens to suspend, payment of its debts or is unable to pay its debts as they fall due or admits inability to pay its debts or is deemed unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986;(b) the other party commences negotiations with all or any class of its creditors with a view to rescheduling any of its debts, or make a proposal for or enter into any compromise or arrangement with its creditors other than for the sole purpose of a scheme for a solvent amalgamation or the solvent reconstruction;

  • (c) a petition is filed, a notice is given, a resolution is passed, or an order is made, for or in connection with the other party winding up other than for the sole purpose of a scheme for a solvent amalgamation or solvent reconstruction;

  • (d) an application is made to court, or an order is made, for the appointment of an administrator, or if a notice of intention to appoint an administrator is given or if an administrator is appointed;

  • (e) the holder of a qualifying floating charge over the other party’s assets has become entitled to appoint or has appointed an administrative receiver;

  • (f) a person becomes entitled to appoint a receiver over the other party’s assets or a receiver is appointed over the other party’s assets;

  • (g) a creditor or encumbrancer attaches or takes possession of, or a distress, execution, sequestration or other such process is levied or enforced on or sued against the other party, over the whole or any part of the other party’s assets and such attachment or process is not discharged within 14 days;

  • (h) any event occurs, or proceeding is taken against, in any jurisdiction to which the other party is subject that has an effect equivalent or similar to any of the events mentioned in clause 9.1(a) to clause 9.1(g) (inclusive);

  • (i) the other party suspends or ceases, or threatens to suspend or cease, carrying on all or a substantial part of its business; or

  • (j) the other party is subject to a change of control (within the meaning of section 1124 of the Corporation Tax Act 2010).

8.2 Any provision of this agreement that expressly or by implication is intended to come into or continue in force on or after termination or expiry of this agreement shall remain in full force and effect.

8.3 Termination or expiry of this agreement shall not affect any party’s rights, remedies, obligations or liabilities that have accrued up to the date of termination or expiry, including the right to claim damages in respect of any breach of the agreement which existed at or before the date of termination or expiry.

8.4 On termination for any reason:

  • (a) all rights granted to you under this agreement shall cease;(b) you shall cease all activities authorised by any licence;

  • (c) you shall immediately pay to us any sums due to us under this agreement; and

  • (d) we shall provide you with all reasonably requested assistance to ensure a smooth transition of the Services to a new supplier.

8.5 Either party may terminate this agreement and, in the case of Supplier, stop supplying the Services or data immediately by written notice to the other party if the other party commit a material or persistent breach of this agreement which the other party fails to remedy (if remediable) within 14 days after the service of written notice from the terminating party requiring the other party to do so.

9. COMMUNICATIONS BETWEEN US

9.1 Please note that any notice given by you to us, or by us to you, will be deemed received and properly served immediately when posted on our website, 24 hours after an e-mail is sent, or three days after the date of posting of any letter. In proving the service of any notice, it will be sufficient to prove, in the case of a letter, that such letter was properly addressed, stamped and placed in the post and, in the case of an e-mail, that such e-mail was sent to the specified e-mail address of the addressee.

10. EVENTS OUTSIDE OUR CONTROL

10.1 Neither party will be liable or responsible for any failure to perform, or delay in performance of, any of its obligations under this agreement that is caused by an Event Outside Our Control.

10.2 If an Event Outside Our Control takes place that affects the performance of either party’s obligations under this agreement:

  • (a) the party’s obligations under this agreement will be suspended and the time for performance of our obligations will be extended for the duration of the Event Outside Our Control; and

  • (b) the affected party will use its reasonable endeavours to find a solution by which its obligations under this agreement may be performed despite the Event Outside Our Control.

10.3 Should an Event Outside Our Control continue for more than 14 days, either party shall be entitled to terminate this agreement on written notice to the other.

11. HOW WE MAY USE YOUR PERSONAL INFORMATION

11.1 We will only use your personal information as set out in the privacy policy below

12. OTHER IMPORTANT TERMS

12.1 We may transfer our rights and obligations under this Licence to another organisation, but this will not affect your rights or our obligations under this agreement.

12.2 You may only transfer your rights or your obligations under this agreement to another person if we agree in writing.

12.3 This agreement and any document expressly referred to in it constitutes the entire agreement between us and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between us, whether written or oral, relating to its subject matter. You agree that you shall have no remedies in respect of any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this agreement or any document expressly referred to in it.

12.4 You agree that you shall have no claim for innocent or negligent misrepresentation or negligent misstatement based on any statement in this in this agreement or any document expressly referred to in it.

12.5 If we fail to insist that you perform any of your obligations under this agreement, or if we do not enforce our rights against you, or if we delay in doing so, that will not mean that we have waived our rights against you and will not mean that you do not have to comply with those obligations. If we do waive a default by you, we will only do so in writing, and that will not mean that we will automatically waive any later default by you.

12.6 Nothing in this agreement is intended to, or shall be deemed to, establish any partnership or joint venture between us, constitute you as our agent, or authorise you to make or enter into any commitments for or on behalf of us and we both confirm that we are acting on our own behalf and not for the benefit of any other person.

12.7 Each of the conditions of this agreement operates separately. If any court or competent authority decides that any of them are unlawful or unenforceable, the remaining conditions will remain in full force and effect.

12.8 This agreement may be executed in any number of counterparts, and by the parties on separate counterparts, but shall not be effective until each party has executed at least one counterpart. Each counterpart shall constitute an original of this Addendum, but all the counterparts shall together constitute but one and the same instrument.

12.9 Each party undertakes that it shall not at any time during this agreement, and for a period of five years after termination of this agreement, disclose to any person any confidential information concerning the business, affairs, financials, market plans, customers or suppliers of the other party or of any member of the group of companies to which the other party belongs, except as permitted by clause 12.10 below.

12.10 Each party may disclose the other party’s confidential information:

  • (a) to its employees, officers, representatives or advisers who need to know such information for the purposes of exercising the party’s rights or carrying out its obligations under or in connection with this agreement. Each party shall ensure that its employees, officers, representatives or advisers to whom it discloses the other party’s confidential information comply with clause 12.9 above; and

  • (b) as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.

12.11 No party shall use any other party’s confidential information for any purpose other than to exercise its rights and perform its obligations under or in connection with this agreement.

12.12 This agreement does not override any additional restrictions, in terms of confidentiality of data, that apply through separate agreements made with third parties who supply data, including but not limited to, distributors and content providers.

12.13 This agreement, its subject matter and its formation (and any non-contractual disputes or claims) are governed by Cypriot law. We both irrevocably agree to the exclusive jurisdiction of the courts of England and Wales.

13 SERVICE DEFINITION

13.1 Currently, the Services are designed to handle processes around sourcing, purchasing and sale of IT and Office products. They include:

13.1.1 Functionality accessible via SITC website:

  • a) Product search

  • b) Price and availability

  • c) Product descriptions

  • d) Distributor management

  • e) Baskets

  • f) Product management

  • g) Quote automation

  • h) Order automation

  • i) Procurement automation

  • j) Data synchronization with external systems

  • k) All pieces of infrastructure that make up the site (i.e. Web Servers, Application Servers, Database, Internet Service Provider etc.) and component technologies (i.e. OS, Patches).

13.1.2 Functionality accessible via a dedicated hosted website for the client:

  • a) An ecommerce webstore based on the Magento ecommerce platform

  • b) Maintenance of up-to-date product content, stock and price information from SITC

  • c) Import of orders from the website into SITC

  • d) Synchronization of customer data between the website and SITC

  • e) All pieces of infrastructure that make up the site (i.e. Web Servers, Application Servers, Database, etc.)

14 SERVICE LEVEL AGREEMENT (SLA)

14.1 This SLA describes the levels of service that the Customer will receive from the Supplier and sets out what levels of availability and support the Customer is guaranteed to receive for specific parts of the IT system. It also explains what penalties will be applied to the Supplier should it fail to meet these levels.

14.2 The following issues are outside the scope of this SLA

  • a) Business process related issues

  • b) Support for Customer’s internal systems

  • c) Support on using basic internet technologies

  • d) Any external website

14.3 The Supplier aims to be helpful, accommodating and assist the Customer wherever possible, using all reasonable endeavours to rectify issues in a timely manner. However, there are a few exclusions. This SLA does not apply if:

  • a) The problem has been caused by using equipment, software or service(s) in a way that the Customer has been made aware is not recommended by the Supplier.

  • b) The Customer has made unauthorised changes to the configuration or setup of the service.

  • c) The Customer has prevented Supplier from performing required maintenance and update tasks.

  • d) The issue has been caused by unsupported equipment, software or other services.

  • e) The service has been unavailable due to an outage across the Internet which is beyond our control to rectify.

  • f) An issue has been caused by a fault in third party software not under our control, for example: operating system, database.

  • g) An issue has been caused by incorrect product data provided by a third party.

  • h) In circumstances that could be reasonably said to be beyond the Supplier’s control, for example where there is a Force Majeure Event.

  • i) The Customer is in breach of its contract with the Supplier for any reason, for example, late payment of fees unless such fees are the subject of a dispute between the parties.

14.4 Support Structure

14.4.1 Our resources are available during Business Hours. In certain circumstances on-call resources may be available for critical or major incidents outside of Business Hours.
The company is closed on public holidays in Cyprus

Support GroupHours (Local)
1st Level Support9:00 AM – 6:00 PM GMT
2st Level Support9:00 AM – 6:00 PM GMT
3st Level Support9:00 AM – 6:00 PM GMT



14.5 Roles and Responsibilities

14.5.1 1st Level Support is the first touch-point for you in terms of support, from both technical and process perspective. This team will resolve basic “how to” questions. Unresolved calls are escalated to 2nd level Application Support. Day to day details of role:

  • a) Application Support Incident resolution

  • b) Answer calls from the Customer

  • c) Open incident tickets corresponding to the issue if there’s none created. Identifies and agrees with the Customer the severity level of incident based on the Impact Assessment Guidelines set out below.

  • d) Resolve issue when possible using basic application knowledge, previous tickets, known workarounds and application documentation

  • e) Document all steps taken in ticket. Gather as much information about the issue like parameters used.

  • f) If cannot resolve, escalate to 2nd Level Support while tracking ticket until resolved with user confirmation.

  • g) If an escalated incident is returned as ‘Rejected’ due to the existence of a related problem or change ticket, the agent informs the Customer of the status, and then closes the incident. This relates to duplicate tickets, rather than the same user raising different tickets. Multiple issues raised by the same user will result in multiple tickets being created.

  • h) If our agent receives a service request for an issue with an existing incident ticket, she or he does not create a new incident ticket and gives the user the reference of the existing incident ticket. The 1st Level Support agent updates the existing ticket and informs 2nd Level Support of this.

  • i) Agent owns closing ticket with Customer confirmation

  • j) Agent redirects Customers to their Account Manager for business process questions

14.5.2 2nd Level Support is responsible for resolving open issues escalated from 1st Level Support. These issues are unresolved by the 1st Level Support resources for various reasons, for example: out of scope of 1st Level, very technical issues, system bug that needs development fix, hardware issues, performance issues. Day to Day details of role:

  • a) Application Support Incident resolution

  • b) Our agent acknowledges ticket, works to resolve the issue, directs the ticket back to 1st level support once resolved

  • c) If we cannot resolve issue, we escalate this to 3rd Level Support while tracking the ticket until it is resolved

  • d) Understanding low level technical solution of customer business processes

  • e) Connecting with you for any additional information required

  • f) Ensuring tickets will be updated and resolved on time, as per SLA

  • g) Working closely with 1st and 3rd Level Support teams

  • h) Updating any Troubleshooting Guide to establish a method for quick resolution on various types of issues at 2nd level and creating documentation for 1st level for workarounds on known issues

  • i) Monthly incident/problem reporting

  • j) Escalating infrastructure issues especially when not performing within SLA or Performance Targets

14.5.3 3rd Level Support is responsible for the code which includes bug fixing, new code development, code enhancements needed, code migration into live environment. They are also responsible to ensure that the hardware environment, (for example web servers, db servers) is stable, performing as agreed SLAs and escalation tickets, for example: critical incident, changes in the form of new code, are closed in time per the SLA. Day to day details of role:

  • a) Resolve open tickets/incidents being escalated from 2nd Level Support or Service Manager

  • 1b) System monitoring, raise tickets to self for performance or hardware issues

  • c) Bug fixing (code changes and testing) as a result of production incident escalation from 1st /2nd level support or Service Manager

  • 11d) Work closely with 2nd Level Support, Service Manager

  • e) Maintain dedicated test box, testing changes before migration to Production

  • f) Ensure proper testing and approvals of change happens before they are migrated to Production

  • g) Ensure documentation for code change to facilitate traceability.

14.5.4 Your nominated Account Manager will serve as the primary point of contact for all communications, requirement definitions, issue resolutions and reviews. The Account Manager will also deal with any change requests that may arise in due course vis-à-vis the current scope of work.

14.6 (within SLA) Incident Management

14.6.1 Incident Management will be in place to handle incidents or unexpected occurrences during the normal operations. In this case normal operations being the use and maintenance of the system during Business Hours.

14.6.2 Incident management processes ensure that incidents are quickly identified and resolved with the intent of restoring normal operations quickly and minimizing business impact. This can be done by resolving the issue with a fix or a workaround.

14.6.3 Incidents (or any “unexpected occurrence” within the site) are tracked by creating tickets. Each person involved in this process has access to, and is familiar with this tool. Tickets can be created by sending an email to support@cloudinthechannel.com

14.6.4 Once a ticket is entered, it is sent through the resolution chain and arrives in each level’s queue, waiting to be resolved. The same rule applies out-of-hours as email is monitored regularly.

14.6.5 The support team is committed to resolving tickets well within the defined resolution time and routinely reviews this commitment although such times will never exceed the resolution times set out in the Impact Assessment Guidelines below. We will provide assistance in understanding and replicating the issue, to help test/confirm the solution, and to CLOSE the ticket upon resolution. The defined timings are considered end-to-end, meaning an escalation to another group will not reset timing commitments regardless of a new ticket being created to investigate the same incident.

14.6.6 If tickets are 80% past the problem resolution turnaround time, a management escalation occurs, in case additional resources need to be allocated. However, if issues are elusive and difficult to resolve, some resolutions might fall out of the defines time.

14.6.7 Critical Incidents are cases where a site outage or incident greatly affects the site’s usage and/or performance. Our support team will send communications via email every hour until the issue is completely resolved. Once the issue is resolved, a follow-up email will be sent with a full incident analysis and steps that can be taken to prevent the issue from occurring again or ways to identify and resolve the issue in a timelier fashion.

14.6.8 In all other cases, it is highly recommended that all communications regarding resolution of the incident should be tracked via the History Lines of the ticket. However, there are instances when instant messaging, phone, or e-mail are better mediums to use, since they help facilitate a quicker resolution time. In this case, support team should record the items discussed, information shared, or troubleshooting ideas found during these conversations into the ticket History Lines. In this way, a full snapshot of all actions that occurred during resolution can be captured and potentially re-used at a future date.

14.6.9 There are several exceptions to this Incident Management process

  • a) Impact Levels – All tickets should be assigned an Impact Level based on each impact level definition. Each support team members reserves the right to downgrade/upgrade the impact of a ticket if the ticket was a) assigned an incorrect impact level or b) the impact of the issue has changed.

  • b) Closing Tickets – Tickets will be closed by the Customer upon confirmation that the resolution (or workaround) is working properly. In the case of CRITICAL/MAJOR tickets where the Customer is not available and there is insufficient information to proceed, the support team reserves the option to COMPLETE the ticket and send back to the Customer. If the issue persists, the original ticket should be classified as DUPLICATE and then CLOSED. After, a new ticket may be opened, referencing the original ticket.

  • c) Escalation – For ‘site-down’ CRITICAL type tickets, First Level support may send the ticket to 3rd level support immediately, with the intention to minimize time spent before the incident reaches the right support level for resolution.

  • d) Design vs. Incidents– In the case where an incident ticket is opened but the issue has been identified as a gap in design, the impact of the ticket will be changed to RFC-F. Timing will be determined and communicated to the ticket originator.

14.6.10 Impact Classification Guidelines

ImpactImpact DescriptionInitial Feedback TimeResolution TimeServices Hours
CriticalA CRITICAL INCIDENT shall mean that a large or significant part of the service is inoperable and/or there are substantial financial and/or legal consequences or other significant business impact.
It shall also mean large number of users of that service are affected – more than 50% of the service’s user population) unless the service is immediately restored.
It shall also mean an incident or problem of lower category (major) recurring at multiple times within the day to severely disrupt normal operations of a large part of the user group.
15 Minutes1 Hour24X5
On-call Support for UK Holidays and out of Hours
MajorMAJOR INCIDENT shall mean that a large number of users are impacted (25% or more), or a major portion of the service is unavailable to users, or reported values are substantially incorrect which could lead to errors if not corrected quickly.
It also relates to interfaces from critical source systems, operations degraded to below the relevant SLA or a recurring problem causing users to lose confidence in the accuracy or dependability of the service. A major incident presents small to medium business impact, with loss of efficiency to business operations.
1 Hour4 Hours24×5
On-call Support for UK Holidays
MinorMINOR INCIDENT shall mean that the incident has little or limited business impact, affecting the efficiency of normal business operations of an individual user or a small number of users ( < 10 users).
An incident could also be categorized as minor if a small portion of a non-critical service is not functioning. An incident that has a known workaround
8 Hours5 Weeks9×6
RFIRFI shall mean normal request for information on how to use some functionalities of the application, or how to run a business process with the application1 Week5 Weeks9×6
RFC-RRFC-R shall mean routine request for changes that follow an established path, are relatively common and have an accepted well documented procedures, and do not need Change Approval.
Examples are:
1. Updating quote/PO template designs
2. Assisting in solving design related issues on the Customer’s website
3. Assistance in setting up private feeds
1 Week5 Weeks9×6
RFC-FRequest for Change – Formal (RFC–F) shall mean requests for application improvements A RFC–F will initiate the formal change request process that feeds to blueprint process.Best EffortBest EffortBest Effort

 

14.7 Problem Management

14.7.1 During the course of incident management, the suggested resolution for an incident might be a workaround, where the root cause still requires some additional time and effort to come to a complete and thorough resolution. PROBLEM tickets are prioritized based on impact level and will be worked on in such order. There is no commitment to resolutions, though we put our best efforts against each PROBLEM.

14.7.2 Problem Management will be in place to track and resolve recurring incidents, establish root causes for incidents resolved using workarounds and application defects. This process will not handle functionality issues caused by design gaps.

14.8 Change and Release Management

14.8.1 Change and Release Management will be in place to control changes that are moved into the application.

14.8.2 Change management provide processes to ensure that changes are implemented and deployed with minimal disruption to business processes. Release management would manage significant change requests and major application functionality into pre-scheduled release timings.

14.8.3 For routine change requests that are pre-aligned and pre-approved, these will be executed via RFC-R Tickets.

14.8.4 Emergency changes need to be triggered by a CRITICAL incident. Emergency changes can be released to production during the daily change window. Post assessment of emergency changes will be done as soon as the change is implemented in production. Fixes for Major incidents should be deployed during the change window.

14.8.5 Formal Change Requests are all non-routine changes (e.g. new developments – additional feature/functionality, continuous improvements) which require in depth risk and impact analysis and takes considerable and resources to complete. A solution discussion is led by the Supplier Developer Team before a change is planned, to ensure that changes implemented are in accordance with the expectations of the Customer. The proposed change is then documented by the Supplier for approval and payment by the Customer. Formal changes can only be moved to production after payment and sufficient testing.

14.9 Availability and Reliability Monitoring

14.9.1 Application Availability and Reliability Monitoring will be in place to automatically monitor whether the application is available and running for users. Probes will be used to monitor this, and any disruptions will be prompted to the Service Management Team.

14.9.2 All parts of the data centre infrastructure are monitored including the routers, switches, firewalls, bandwidth and power consumption.

14.9.3 Server Availability Monitoring probes are setup to probe the servers using Microsoft Monitoring Agent which is part of Microsoft System Centre. The alerts and thresholds are set by the software itself and follow Microsoft recommendations. Alerts are set up which notify the system administrators by SMS and email if there are any issues which require attention. Downtime is scheduled as follows;

  • a. Weekly Change Window Fridays 6:00 PM – 11:00 PM

  • b. Daily Maintenance Window 6:00 PM –7:00 PM

14.9.4 There may be the occasional need for Hardware Infrastructure Maintenance Downtime, as dictated by the hosting team. These maintenance periods will be communicated to the Customer with at least 5 days’ notice.

14.9.5 In order to enable the Customer to do business effectively, we guarantee that certain services will be available for a certain percentage of time. This Guaranteed uptime as follows:

ServicesGuaranteed uptime per month
Our Website99.9%
Customer’s hosted webstore99.9%

14.9.6 Uptime is measured the using our automated systems, over each calendar month. It is calculated to the nearest minute, based on the number of minutes in the given month. The uptime guarantee on our web site applies during working hours only, and exclude periods of routine maintenance.

14.9.7 If uptime for any item drops below the relevant threshold, Compensation will be applied in the form of a credit for the Customer. This is applied as a reduction of the following period’s fee payable by the Customer. The level of credit will be calculated depending on the number of hours for which the service was unavailable, minus the downtime permitted by this SLA. Compensation in any month is capped at 50% of the total monthly fee.

ServicesCredit per hour
(Pro-rated to nearest minute)
Our Website5% of total monthly fee
Customer’s hosted webstore2% of total monthly fee

 

14.10 Operational & Disaster Recovery

14.10.1 A Disaster Recovery Plan is provided as part of our services.

14.10.2 Our data is hosted at the Equinix Telecity data centre in London’s Docklands; one of Europe’s largest and most well-established data centres.

14.10.3 The Customer’s webstores are hosted on VMWare clusters run by OVH; one of Europe’s premier hosting partners. Hardware is backed by an SLA from OVH and guarantees 99.9% uptime per calendar month.

14.10.4 All hardware in our infrastructure is duplicated meaning there is full redundancy and no single point of failure across the network.

14.10.5 A regular weekly offsite backup from the data centre is taken in the eventuality of the data centre being unavailable. This mitigates against the unlikely event of the data centre being completely destroyed.

14.10.6 All data is backed up from the main servers to a separate Network Accessible Storage (NAS) device. A full backup occurs overnight, and hourly incremental backups are taken during the day. A week of full backups are taken and held.

14.10.7 In the event of a catastrophic failure, we commit to a two-hour window for restoration, however, using reasonable endeavours, a backup can be restored to production within 30 minutes of commencement.