Service Level Agreement

‍DEFINITIONS

TERM	MEANING
Agreement	means the agreement between the parties to which this schedule is appended
Business Day	means a day on which the Customer is open for business at an office location using the Service
Customer	includes its subsidiaries/ affiliates entities
term	meaning
Customer Help Desk	means the internal support desk established by the Customer qualified to support the Services within the Customer’s operations
Day	means a calendar day
Down Time	means total unavailability of the service to all users due to factors within the control of SCW
Maintenance and Support Services	means the maintenance and support services to be provided by SCW as described in this Schedule
Minimum Service Level	means the Minimum Service Levels to be achieved by SCW as set out in this Schedule
Response Times	The average amount of time it takes between a system alert or customer support ticket being raised and when a support team member acknowledges the incident and begins working to resolve it
Resolution Time	The average amount of time to detect an issue, diagnose the problem, repair the fault (possibly by means of a workaround), and return the system to being functional. It is measured from the moment that a failure occurs until the point where the product or service is repaired, tested, and available for use.
Service	means the online security learning service to be provided by SCW to the Customer
Service Credits	means the applicable service credits as described in 2(f) of the Service Levels
Service Hours	means, in respect of each week of the Term, the period from the start of the first business day in the first location from which Customer accesses the Services to the end of the last Business day in the relevant week in the last location from which Customer accesses the Services, and excludes Public Holidays in the relevant territory.
Service Levels	means the performance levels to which the Services shall be provided as set out in this Schedule
Service Period	means each calendar month that Customer receives the Services
Service Up Time Percentage	means the total number of minutes in a calendar month minus the number of minutes of downtime suffered in a calendar month, divided by the total number of minutes in a calendar month minus scheduled downtime
System Response Time	means the time required for the Service to respond to an input as set out in this Schedule
Term	means the term for which the Customer has subscribed to the Service
Up Time	has the meaning set out in 2(e)(iii) of the Service Levels

SERVICES SPECIFICATION

1. GENERAL

1.1. This schedule describes the scope and functionality of the Services to be provided by SCW to the Customer under this Subscription Agreement. It also specifies certain of the obligations of each party in the delivery of the Services.
1.2. Each Service has, where specified, an associated Service Level.

2. SERVICE OVERVIEW

2.1.        SCW shall supply Customers with an online security training service incorporating the following production environment services:
     (a)   Online Access: On-line access to the Service during the Service Hours excluding scheduled downtime as defined in this schedule or as otherwise agreed in writing between the parties.
     (b)   Maintenance and Support Services during the Service Hours.
     (c) Data back-ups in accordance with section 5.
     (d)   Application management: (1) application upgrades, (2) delivery of application maintenance updates
2.2.        SCW shall monitor and manage all components used to deliver the Service during the Service Hours throughout the Term.
2.3.        SCW shall ensure appropriate capacity planning of the Services to ensure there is always sufficient capacity to provide the Service at the Service Levels. This shall require Customer to advise SCW of any anticipated material changes to the use of the Service.

3. MAINTENANCE AND SUPPORT SERVICES

3.1.        Release Strategy
     (a) SCW will inform Customer regularly of the timing and contents of new releases to the Service. Customer may provide suggestions and input to SCW regarding any planned or requested new features. SCW shall, at its sole discretion, consider whether Customer’s suggestions shall be included in a subsequent release as part of the Maintenance and Support Services.
      (b)   Except where a product enhancement cost has been agreed with the Customer, such new releases to the Service shall be made at no cost to the Customer.
      (c)   SCW shall document any such changes in release notes which shall be made available to the Customer as soon as possible, but no later than the date any new release is issued.

3.2.        Support Services & Responsibilities
     (a)    SCW shall provide the support services in English.
     (b)    SCW shall notify Customer of all material incidents that have an impact on
the Service provided to the Customer
     (c)     SCW shall be responsible for:
            (i) The availability of the Service.
             (ii)  Solving incidents and problems raised by the Customer Help Desk.
             (iii)  Implementing changes to the Service required as a result of solving incidents.
             (iv) Communicating the status of incidents to the Customer Help Desk.
             (v) Communicating information about planned system changes of outages to Customer and the subsidiaries in a timely manner.
             (vi)  Responding to each incident in line with the specified actions for each incident class.
     (d)  Customer is responsible for:
              (i) Raising incidents to the SCW help desk through a centralized Customer Help Desk.
             (ii) The Customer must nominate at least 2 authorized Support
             (iii) Contacts and notify SCW of their names and contact details immediately following the date of the Agreement. Incidents and service requests must be reported via any of the supported service channels.
             (iv) No phone support is provided directly to Users.
              (v) The Customer must not publish SCW’s contact details on their intranet, website, or anywhere else.

3.3. Service channels

Channel	Days/Hours
Knowledge Base (https://help.securecodewarrior.com/)	24/7
Email (support@securecodewarrior.com)	24/5 service hours
Support widget on the platform	24/5 service hours

3.4.        Incident management
The Customer Help Desk shall provide the following items when notifying SCW of an incident:
       (i) incident time, duration, and location.
       (ii) User ID and contact details.
       (iii) Incident description.
       (iv) Category of the incident, to be mutually agreed between the parties.‍

3.5. Incident categorization

CLASS	RESPONSE TIME	RESOLUTION TIME
Class A Severe Impact Provision of Service Failure An incident that results in the loss of all or a significant portion of the service and impacts a majority of the users.	1 hour	24 hours
Class B Major Impact Provision of Service Failure The service is accessible by means of a workaround, or only a small number of users are impacted Or an incident which materially affects the performance of the Services in a negative manner or materially restricts the Customer and the Subsidiaries’ use of the Service	4 hours	5 business days
Class C Moderate impact Incidents occur which do not individually represent a failure of the service but are agreed as defects Or an incident which only has a minor effect on the Customer’s use of the Service or an Incident which is not a Class A or B incident	8 hours	Within such period of time as SCW deems appropriate given the nature of the issue.
Class D Low impact A general question or concern raised by the Customer concerning the use or implementation of the Service	1 business day	2 business days

SCW can adjust the severity of reported issues if our investigations have shown the severity to be incorrect.
Severity readjustment is commonly used in circumstances where a ticket is submitted as Class A or Class B but contradicts the definition above.
SCW may also increase the level of severity if the issue is considered to be more serious than initially reported

3.6. Closing Incidents
Before closing an incident, the SCW help desk will seek confirmation from the Customer that the incident has been resolved.‍

4. SERVICE LEVELS

4.1.        General Description of Service Levels
     (a) Unless otherwise specified, the measurement period for the Service Levels is each Service Period.
     (b) Where Service Levels are described as “targeted”, such targeted Service Level measurements represent the expected performance levels of the Service under normal operating conditions, but such targeted measurements are for guidance only and do not constitute any obligations or liabilities on the part of SCW and any failure to meet such targeted Service Levels shall not be construed in any way as a breach by SCW of this Agreement.
     (c) In the event that Service Levels fail to meet the targeted Up Time and/or the targeted System Response Time metrics in any Service Period, SCW’s obligations are limited to providing analysis and explanation of the reason(s) and proposed reasonable measures to eliminate the undershoot. Such measures may require changes either in the usage of the Services by the Customer or of the Services by SCW.
     (d) Where Service Levels are described as ‘contracted’, such contracted Service Level measurements represent the actual performance
levels of the Service under normal operating conditions and a failure to meet such contracted Service Levels will result in Service Credits being calculated.

4.2. Uptime and Performance Service Levels

     (a) The Service Levels apply to the SCW learning platform and shall be measured over the Service Hours except for scheduled
maintenance periods.
     (b) The metrics used to measure performance of the Service are as follows:
               (i) System Response Time
               (ii) Up Time
               (iii) Maintenance Window
     (c) The point of measurement for all Services monitoring with respect to System Response time shall be the servers at the SCW sub-processor data center. Response times exclude the transaction cycle times on communication links from the data center to the Customer’s end-user

Commitment	System response time measure	System response Time % of Service period that response times will be met
Targeted	5 seconds	99.9%
Contracted	10 seconds	99.5%
Contracted	10 seconds	99.75%

     (d) The System Response metric shall be calculated over a Service Period.
     (e) Measurement methods and targets for Service Up Times shall be as follows:
                (i) Service Up Time shall be calculated at the end of each Service Period. The Contracted Service level for Service Up Times in any service period shall be 99.75%. The targeted Service Level for Services Up Times in any Services Period shall be 99.9%.
                (ii) Up Time shall be expressed in percent and is defined as the time period during which the Service is available to the customer.
                (iii) Up Time is calculated as follows:-
Service Up Time in % = means total number of minutes in the calendar month minus scheduled downtime minus the number of minutes of downtime suffered in a calendar month, divided by the total number of minutes in a calendar month minus scheduled maintenance windows
                (iv) Service Up Time is continuously monitored via the following status page: https://status.securecodewarrior.com
     (f) Service Credits shall apply for failure to meet the contracted Service Levels and shall be as follows:
                 (i) For Uptime Percentage less than 99.75% but equal to or greater than 99.0%, you will be eligible for a 10% Service Credit of the Service fee for the applicable month.
                 (ii) For Uptime Percentage less than 99.0%, you will be eligible for a 20% Service Credit.
                 (iii) The Service Fee shall be the total service fee paid divided by the number of months of subscription to the service during a Term.
                 (iv) SCW shall provide the Service Credit to the Customer in the month following the Service Period in which the Service
Level Failure occurred.

4.3. Maintenance Windows
(a) The provisions for scheduled maintenance are as follows :

Frequency	Weekly
Duration	Maximum of two (2) hours

(b) Unplanned maintenance including corrective actions to be taken by SCW to resolve an incident

4.4.        Service Level Exclusions
The parties agree that the Service Levels shall not apply if one or more of the following exists:
     (a) Suspension of the Service to carry out planned or routine maintenance.
     (b) Adverse impact on Up Times or Response Times due to the malfunction of Customer-owned or controlled firewalls, networks, or connectivity.
     (c) Adverse impact on Up Times or Response Times due to a Force Majeure event(s)

4.5.        Back-Ups
     (a) SCW shall take a backup of all Customer data:-
                (i) Incremental Backup: Every Minute, retained for 24 hours
                (ii) Full backup: Every 6 hours, retained for 2 calendar days.
                (iii) Full backup: Every day retained for 7 calendar days.
                (iv) Full backup: Every week retained for 4 calendar weeks.
                (v) Full backup: Every month retained for 13 months.
     (b) Such backup shall be stored at a separate, secure, location to the production environment.
     (c) Backup data shall only be used for resolving incidents in the SCW Platform. Backup data is not intended to be used (and in most cases won't be able to be used) to recover data accidentally deleted by Customer. Accidentally deleted data does not classify as an incident.

Appendix A - Secure Code Warrior Legal Entities

a. ENGLAND AND WALES
Secure Code Warrior Limited
Company Number 08559432
Ironstone House
4 Ironstone Way
Brixworth, Northampton. NNG 9UD
United Kingdom

b. NEW SOUTH WALES
Secure Code Warrior Pty Limited
ABN 97 608 498 639
c/o Vital Addition
5, 120 Sussex Street
Sydney. NSW 2000
Australia

c. BELGIUM
Secure Code Warrior BVBA
Baron Ruzettelaan 5
bus 3 8310 Brugge
Belgium

d. DELAWARE
Security Code Warrior Inc
265 Franklin Street, Suite 1702
Boston MA 02110
USA

e. ICELAND
Motherji ehf
Borgatun 24, 105,
Reykjavik,
Iceland

Appendix B - Collection of Personal Information

a. PLATFORM USER

User email address (username)
First Name, Last Name
Employer/Company Name/ Team name
Test results /Metrics information/Assessment data
IP Address (Anonymised)
Machine ID (Anonymised)
Geo-location (derived from IP)
Password
Roles/Job Title
Inviter details (email address of inviter/First Name/Last Name)
Country/Region
Browser Type
Phone Number*

* Only required for Trial Users

Whilst you have access to our platform, and thereafter for a period of 12 months, unless otherwise agreed.

CUSTOMERS

Name
Business Email Address
Phone Number
Employer/Company Name
Job Title
Billing address
Company/Tax Registration Number

We will retain this information in accordance with applicable laws and our privacy policy for a period of 7 years from the date of our last contact with you unless, where you are entitled, request that we delete this information.

‍
PRospects / leads

Name
Business Email Address
Phone Number
Employer/Company Name
Job Title
Physical Location

We will retain this information for a period of 24 months from the date of our last contact with you unless, where you are entitled, request that we delete this information.

PARTICIPANTS IN TOURNAMENTS AND / OR COMPETITIONS: Registrant / participant

Name
Email address
Physical address in circumstances where there may be a physical prize to be delivered
Country/Region

We will retain this information for the duration of the Competition, and for a period of 12 months from the date of our last contact with you unless, where you are entitled, request that we delete this information

SUPPLIER

Name
Business/Company Name
Email Address
Phone Number
Bank Details
Billing address
Company/Tax Registration Number

We will retain this data for up to 7 years from our last contact with you, unless you request that we delete the data beforehand.

recruitment candidates

CV/ Resume
Phone Number
Date of Birth
Qualifications
Email address
Physical address (if provided)

For unsuccessful we will retain this data for a period of twelve (12) months so that we may contact you regarding any future opportunities, unless you request that we delete the data beforehand.

Website visitor

Name³
Contact information³ (company, role/title, business email address and phone number)
IP Address¹
Cookie Data¹ ²

¹ When you communicate with us through our websites:
We use Drift as one of our chatbots to allow customers to interact with us through our websites. Drift will only use the IP address for data enrichment, i.e. to determine if it is associated with a business to provide Secure Code Warrior with information such the industry and # of employees of the business.

Drift will only use cookies to track the activities of site visitors within Secure Code Warrior’s sites, e.g. whether they visited a particular product page or the pricing page before engaging with the messaging widget. Drift will NOT track users across domains or build profiles.

² Cookiebot

We use Cookiebot to manage all cookies across our websites. Cookiebot allows Secure Code Warrior to:

Enable prior consent.
Provide clear and specific information about data types and purpose of the cookies.
Fully document all given consents.
Allow our visitors to reject superfluous cookies and still use our websites.
Allow our visitors to withdraw their consent whenever they want.

³ Information is collected after consent is given

Refer to our cookie policy

We will retain this data for a period of 12 months from the date of our last contact with you unless, where you are entitled, request that we delete this information.

Appendix C - Purposes for which we process your personal information, and the lawful basis on which we carry out such processing

1. PLATFORM USER

1.Necessary to enable us to perform our contract with you:

to set up, administer and manage a user’s account, verify a user’s identity, provider users with our platform and services, and to receive and respond to a user’s communications and requests.
to notify our users of updates to our platform and services necessary for the performance of the contract we have with you.
to support any other purpose necessary for performance of our contractual obligations or specifically stated at the time at which you provided your personal information.

2. Necessary for the performance of our contract with you where such communication relates specifically to our services, and legitimate interest to be able to handle such queries:

to receive and respond to a user’s communications and requests.

3. For legitimate interest to enable Secure Code Warrior to:

carry out market research campaigns so that we can better understand the functionality of our platform and how we can improve our platform and our services.
prepare statistics relating to the use of our platform and services by our users so that we can understand the use of, and improve our platform and services.

4. For legitimate interests to allow Secure Code Warrior to improve customer services offering:

to record and review customer service communications for training and performance improvements to enable us to improve customer services.
To enable Secure Code Warrior to comply with legal obligations.

5. With consent:

to send users marketing materials where marketing materials have been specifically requested.

2. Customers

1. Necessary for the performance of a contract

conducting business and make our services available to customers,

2. For legitimate interests to enable Secure Code Warrior to conduct business

to send and receive business communications
to administer our relationship with customers, prospective customers and business contacts

3. For legitimate interests to contact those who may benefit from our services

informing prospective customers and business contacts about our services.

4. With consent

to send out marketing materials where these have been specifically requested.

3. email contact / prospective customer

1.For legitimate interests to enable Secure Code Warrior to conduct business

to send and receive business communications
to administer our relationship with customers, prospective customers and business contacts

2. For legitimate interests to contact those who may benefit from our services

informing prospective customers and business contacts about our services.

3. With consent

to send out marketing materials where these have been specifically requested.

‍
4. participants in tournaments and / or competitions: registrant / participant

1. Necessary for the performance of our contract with you, namely for the running of the competition and/ or tournament

2. With consent: to send out marketing materials

‍

5. SUPPLIER

1. For legitimate interests to enable Secure Code Warrior for the performance of a contract where the supplier is an individual

to assess and appoint suppliers
Legitimate interests to conduct business

2. To send and receive business communications.

3. To administer our relationship with our suppliers.

6. recruitment candidates

To enable Secure Code Warrior to recruit employees and assess potential candidates, that is to:

consider applications for roles for which you may have applied, directly or via a recruitment, and the negotiation of employment opportunities,
consider applicants for other roles within Secure Code Warrior for which they may be suited,
obtain references from former employers.

7. website visitor

For legitimate interest to enable Secure Code Warrior to,

provide, operate, maintain, improve, and promote our Websites and Services;
enable you to access and use our Websites and Services;
send promotional communications, such as providing you with information about products and services, features, surveys, newsletters, offers, promotions, contests, and events; and provide other news or information about us and our partners (you can opt-out of receiving marketing communications from us by unsubscribing from any communication we send you);
monitor and analyze trends, usage, and activities in connection with our Websites and Services and for marketing or advertising purposes;
investigate and prevent fraudulent transactions, unauthorized access to our Websites and Services, and other illegal activities;
personalize our Websites and Services, including by providing features or advertisements that match your interests and preferences; and for other purposes for which we obtain your consent.

Appendix D - Secure Code Warrior Related Websites

securecodewarrior.com
help.securecodewarrior.com
discover.securecodewarrior.com
leadersinappsec.com
leadersindevsec.com
softwaresecuritygurus.com
scw.io
learn.securecodewarrior.com

Learning activities

Learning paths

What we cover

SCW built integrations

For industries

For teams

We'll help you

Document Summary

‍DEFINITIONS

SERVICES SPECIFICATION

1. GENERAL

2. SERVICE OVERVIEW

3. MAINTENANCE AND SUPPORT SERVICES

4. SERVICE LEVELS

Appendix A - Secure Code Warrior Legal Entities

Appendix B - Collection of Personal Information

a. PLATFORM USER

CUSTOMERS

‍
PRospects / leads

PARTICIPANTS IN TOURNAMENTS AND / OR COMPETITIONS: Registrant / participant

SUPPLIER

recruitment candidates

Website visitor

Appendix C - Purposes for which we process your personal information, and the lawful basis on which we carry out such processing

1. PLATFORM USER

2. Customers

3. email contact / prospective customer

‍
4. participants in tournaments and / or competitions: registrant / participant

‍

5. SUPPLIER

6. recruitment candidates

7. website visitor

Appendix D - Secure Code Warrior Related Websites

Our approach to security and privacy

Visit our Trust Center to learn more about the security and privacy practices that safeguard our information assets, and those of our customers, against misuse, abuse or compromise.

Connect

Community

Company

Help & Support

Service Level Agreement

Document Summary

‍DEFINITIONS

SERVICES SPECIFICATION

1. GENERAL

2. SERVICE OVERVIEW

3. MAINTENANCE AND SUPPORT SERVICES

4. SERVICE LEVELS

Appendix A - Secure Code Warrior Legal Entities

Appendix B - Collection of Personal Information

a. PLATFORM USER

CUSTOMERS

‍PRospects / leads

PARTICIPANTS IN TOURNAMENTS AND / OR COMPETITIONS: Registrant / participant

SUPPLIER

recruitment candidates

Website visitor

Appendix C - Purposes for which we process your personal information, and the lawful basis on which we carry out such processing

1. PLATFORM USER

2. Customers

3. email contact / prospective customer

‍4. participants in tournaments and / or competitions: registrant / participant

‍

5. SUPPLIER

6. recruitment candidates

7. website visitor

Appendix D - Secure Code Warrior Related Websites

Our approach to security and privacy

Visit our Trust Center to learn more about the security and privacy practices that safeguard our information assets, and those of our customers, against misuse, abuse or compromise.

Connect

Community

Company

Help & Support

‍
PRospects / leads

‍
4. participants in tournaments and / or competitions: registrant / participant