This Service Level Agreement (“SLA”) governs the service, support and availability services provided by OXORY AS.DS GmbH (“OXORY”) to the Customer under the respective underlying individual contract, service specification or service contract.

This SLA supplements OXORY’s General Terms and Conditions (“GTC”) in the version valid at the time the contract is concluded, in particular Clauses B.4 (Software Maintenance), B.5 (Support and Helpdesk Services) and B.7 (Cloud and Managed Services).

This SLA applies only to the systems, applications, services and service levels expressly specified in the respective service specification. The customer-specific parameters, in particular the selected service tier (Clause 20), are defined in the service specification.

The following order of precedence applies: (1) individual contract, (2) service specification, (3) this SLA, (4) the GTC. Mandatory statutory provisions remain unaffected.

Activities not expressly agreed as SLA services are provided on a time-and-materials basis at OXORY’s rates applicable at the time.

Support comprises – to the extent agreed in the service specification – in particular:

• receipt and logging of support requests;
• classification and prioritisation of tickets;
• analysis and handling of incidents as well as fault diagnosis;
• assistance with troubleshooting and provision of workarounds;
• coordination with manufacturers and third-party providers;
• technical advice in connection with the supported systems;
• documentation of the handling;
• forwarding to downstream support or development levels.

The specific scope of services is set out in the respective service specification.

The following are in particular not part of this SLA:

• new software developments and custom programming;
• extensive customising services, migrations and project services;
• training;
• on-site assignments not agreed upon;
• support for non-approved system environments;
• services required due to unauthorised changes by the Customer or third parties;
• services for products for which no support has been agreed.

Unless otherwise agreed in the service specification, the following standard service hours apply: Monday to Friday, 08:00 to 17:00 (CET/CEST). Excluded are public holidays in North Rhine-Westphalia as well as 24 and 31 December (Clause B.5.3 of the GTC).

Tickets received outside service hours are deemed received at the start of the next service hours. Response times and any agreed restoration times run exclusively within service hours (“service hours”).

Extended service hours, on-call standby or a 24/7 service exist only if expressly agreed in the service specification.

Tickets must be submitted via the support channels specified in the service specification, in particular via the OXORY ticket system, the designated support e-mail address, the service hotline or agreed interfaces or portals.

The Customer designates in the service specification the contact persons authorised to request support (key users).

OXORY is entitled to reject tickets from unauthorised persons or to request confirmation by an authorised contact person.

Where an incident is reported by telephone, OXORY may require the Customer to additionally document the ticket via the ticket system or in text form.

When creating a ticket, the Customer specifies a provisional priority.

OXORY determines the final priority at its reasonable discretion based on the actual impact (Clause B.5.6 of the GTC).

OXORY may change the priority during handling if the actual impact changes or the original classification was incorrect. OXORY notifies the Customer of any change via the ticket.

Classification as P1 or P2 requires that the information necessary for this purpose (Clause 12.1) has been provided.

Response times are determined by the service tier agreed in the service specification (Clause 20). The following response times apply to the “Standard” service tier:

The response time begins upon receipt of a complete ticket (Clause 12.1) within service hours.

A response is the commencement of qualified handling of the ticket by a competent OXORY employee, as communicated to the Customer. An automatic acknowledgement of receipt does not constitute a response.

The response time is not a resolution or restoration time.

Binding resolution or restoration times exist only if expressly agreed in the service specification (Clause B.5.2 of the GTC). Restoration means restoring the usability of the affected function, including by means of a reasonable workaround.

OXORY continues handling P1 and P2 incidents with appropriate priority until the incident has been resolved, a reasonable workaround has been provided, the cause lies with a third-party manufacturer and has been escalated to it, or further cooperation by the Customer is required.

In the case of P1 incidents, OXORY informs the Customer of material changes in the handling status, insofar as this is possible and reasonable in the specific situation.

Agreed restoration times do not apply insofar as the incident is caused by third-party platforms, software or services (Clause 13).

A specific system availability is owed only if expressly agreed in the service specification. An availability commitment does not constitute a guarantee in the legal sense (Clause 2.4 of the GTC).

Availability is measured at the transfer point defined in the service specification. Where systems are operated on third-party platforms (e.g. Microsoft Azure, Microsoft 365), the transfer point is access to the respective platform; the availability of the platform itself is governed by the manufacturer’s service level agreements (Clause B.7.2 of the GTC).

Unless otherwise agreed in the service specification, availability is calculated per calendar year (annual average) using the following formula (Clause B.7.4 of the GTC):

The following are not counted as downtime when calculating availability:

• planned maintenance announced in accordance with Clause 10 as well as maintenance agreed with the Customer;
• outages due to force majeure (Clause 7.2 of the GTC);
• outages due to disruptions within the Customer’s area of responsibility, lack of cooperation or failure to install security updates (Clause 13.5 of the GTC);
• outages of third-party platforms, services or performances for which OXORY is not responsible, as well as of the internet outside OXORY’s area of responsibility;
• outages due to unsupported system environments, use in breach of contract or changes by the Customer or third parties;
• suspensions pursuant to Clause B.7.9 of the GTC as well as security-related measures pursuant to Clause 14.2, insofar as they were necessary to avert a specific threat.

Regular maintenance is performed within the maintenance windows agreed in the service specification; unless otherwise agreed, outside service hours.

OXORY announces planned maintenance that results in an interruption of availability to the Customer in text form at least five business days in advance (Clause B.7.4 of the GTC).

In the case of security-critical updates or to avert significant security risks, OXORY is entitled to carry out necessary maintenance at short notice; OXORY informs the Customer as early as possible.

If a P1 or P2 incident is not stabilised within a reasonable time despite qualified handling, or if there is disagreement about the classification, either party may request an escalation.

The technical escalation levels are: Level 1 – Service Desk (initial intake, classification, initial technical handling); Level 2 – Specialist (involvement of a functionally or technically specialised employee); Level 3 – Manufacturer / Development (involvement of OXORY development or a responsible third-party manufacturer). The contacts for management escalation are defined in the service specification.

Involving a third-party manufacturer may lead to additional handling times over which OXORY has no direct influence. OXORY informs the Customer of an escalation to a third-party manufacturer insofar as this is necessary for further handling.

Emergency contact (Business Critical Contact). For business-critical systems, an emergency contact may be agreed in the service specification; in the “Enterprise” service tier it is included in the service. For this purpose, the parties define in the service specification in particular: the emergency mobile number, the responsible escalation manager, the executive management contact as the final escalation level and the hours of availability. The Customer in turn designates a corresponding emergency contact. The emergency contact is available exclusively for P1 incidents and serious security incidents after the ticket has been logged via the regular support channels. Outside service hours, it is only reachable if on-call standby has been agreed in the service specification. The agreed response times remain unaffected by the designation of an emergency contact.

The Customer provides OXORY in good time with all information required for handling. A ticket is complete if it contains in particular: a description of the error, time of occurrence, affected systems, error messages, log files or screenshots, steps to reproduce and a reachable contact person.

Where necessary, the Customer enables secure remote access to the affected systems and ensures that the required access is available during handling.

As long as the Customer fails to fulfil an obligation to cooperate or OXORY is waiting for information, approvals or access from the Customer, the response and restoration times are suspended (clock stop). OXORY notifies the Customer of the reason via the ticket. Such delays are not taken into account when calculating service levels.

The Customer is responsible for appropriate data backup unless OXORY has been expressly commissioned with data backup in the service specification (Clauses 4.3 and 11.4 of the GTC). The parameters of a commissioned data backup (e.g. frequency, retention, RPO, RTO) are defined in the service specification.

If an incident is caused by software, hardware, cloud services, networks or other services of a third party, OXORY supports the Customer within the agreed scope of services in communicating with the respective provider.

Handling and resolution times of a third-party manufacturer are not service levels owed by OXORY, insofar as OXORY has no direct influence over them.

Services of third-party manufacturers are additionally subject to their support, maintenance and licence terms (Clauses B.3.6 and B.7.2 of the GTC). Insofar as OXORY merely brokers or resells services of a third party, OXORY is not liable for compliance with the third party’s service levels unless OXORY itself is responsible for the deviation.

Licence and subscription changes imposed by Microsoft (e.g. under the Cloud Solution Provider programme) or another manufacturer – in particular changes to licensing models, product and feature scopes, prices, terms, cancellation and reduction options, provisioning times as well as the discontinuation of products – do not constitute a deviation from service levels under this SLA. OXORY informs the Customer of material changes that have come to its attention and supports the transition within the agreed scope of services; otherwise Clauses B.4.7, B.7.3, B.7.8 and 17.5 of the GTC apply. This does not apply insofar as OXORY itself is responsible for a delay or impairment in the implementation.

Security-related incidents are prioritised according to their actual impact.

In the event of a suspected significant security incident, OXORY is entitled to initiate necessary immediate measures on the systems operated by OXORY or managed as part of Managed Services, in particular to temporarily block access, disconnect systems from the network, temporarily restrict services or install security-relevant updates. The measures shall be limited to the extent necessary to avert the threat. For systems operated by the Customer itself, OXORY recommends corresponding measures; their implementation is the Customer’s responsibility unless otherwise agreed.

OXORY informs the Customer of material security-related measures insofar as this is technically possible and compatible with the required urgency.

Incidents relevant under data protection law are handled in accordance with the statutory requirements and any existing data processing agreement (Clause 13.2 of the GTC).

Where agreed in the service specification, OXORY regularly provides the Customer with a service report. This may in particular include: total number of tickets and number by priority, average response times, open and closed tickets, escalations, deviations from service levels and the availability achieved.

Reporting is only provided insofar as the technical data required for this is available.

A deviation from an agreed service level is first analysed jointly by the parties.

The Customer receives service credits only if expressly agreed in the service specification, and only where OXORY is responsible for falling short of an agreed service level. Unless otherwise agreed, service credits relate exclusively to the agreed availability (Clause 9); service credits for exceeding response times are granted only if separate values have been agreed for this in the service specification.

Unless otherwise agreed in the service specification, the following service credits apply for an agreed target availability of 99.5%, based on the fees for the affected SLA service in the respective measurement period (Clause 9.3). Values marked with [ ] are specified in the service specification or in the price list:

The total of all service credits is capped at [15]% of the fees for the affected SLA service in the respective measurement period. Service credits are offset against the next invoice for the affected SLA service and are not paid out.

The Customer must claim service credits in text form within 30 days after the end of the affected measurement period; thereafter the claim lapses.

Service credits are offset against any claims for damages by the Customer arising from the same event. Unless otherwise agreed in the service specification, they are the exclusive contractual remedy for a deviation from service levels (Clause B.5.9 of the GTC). The right to extraordinary termination, mandatory statutory claims and liability under Clause 11.1 of the GTC remain unaffected.

Amendments or supplements to this SLA require at least text form. Amendments for existing contracts are governed by Clause 17.3 of the GTC.

The parties notify each other in text form of changes to the supported systems, contact persons and escalation contacts; such changes take effect upon receipt of the notification.

The term of this SLA corresponds to the term of the underlying service, maintenance or support contract, unless otherwise agreed in the service specification; alternatively, Clause 16.1 of the GTC applies.

This SLA ends upon termination of the underlying contract. The right to extraordinary termination for good cause remains unaffected.

OXORY offers the following service tiers. The service tier applicable to the Customer and any deviations are defined in the service specification. Values marked with [ ] are specified in the service specification or in the price list.

In all other respects, the General Terms and Conditions of OXORY AS.DS GmbH apply.

Should individual provisions of this SLA be invalid, the validity of the remaining provisions shall remain unaffected (Clause 17.10 of the GTC).