General terms and conditions

1.1 These general terms and conditions (GTC) apply to the Services, Software and Equipment supplied by SysPros Sàrl, Chemin des Taborneires 4-6, 1350 Orbe, Switzerland, UID CHE-352.623.109 (SysPros). They govern exclusively relationships with Clients acting for professional or commercial purposes. They are not intended for contracts concluded with consumers.

1.2 Applicable version. The GTC are handed to the Client, or made accessible through a durable reference identifying their version, before the Commercial Commitment is concluded. The accepted version forms part of it. SysPros keeps a copy of that version and of the evidence of its acceptance. The www.syspros.ch website may present the current version; its publication, or a reference on an invoice or a delivery, does not by itself amend an existing contract.

1.3 Amendments for the future. For a non-renewable fixed-term Commercial Commitment, the accepted version remains applicable until the end of the term, unless the parties agree otherwise in a documented way or a mandatory rule requires an adjustment. For an open-ended Commercial Commitment, a substantial amendment is notified at least 60 days before it takes effect. For a renewable Commercial Commitment, it is notified at least 60 days before the renewal date and applies only to the following period. The notification states the new version, its effective date, the main changes and the Client's right to object. The Client may refuse an unfavorable substantial amendment and terminate the affected service alone as of the announced effective date, without exit penalty, even if the ordinary notice period has already expired. Separate, irrevocable and previously identified third-party commitments are handled in accordance with Sections 7.13, 14.4 and 24.14, subject to mandatory law. If no objection is raised before the effective date, the new version is deemed accepted only if the notification expressly pointed out this consequence. Purely administrative corrections, or corrections favorable to the Client, may take effect on the announced date, provided they neither reduce the Client's rights nor increase its burdens.

2.1 In addition to the terms defined elsewhere in these GTC and/or in the relevant Commercial Commitments, capitalized terms have the meaning given to them in chapter III. GLOSSARY of these GTC.

3.1 Conclusion and content. Every Commercial Commitment identifies the services ordered, their Scope, the price or its calculation method, the term and, where applicable, minimum commitments, third-party terms and applicable documents. Standard parameters may be set out in service sheets identified by their version, handed over or made accessible before acceptance and incorporated by reference; they need not be reproduced in full in every offer. A Commercial Commitment may result from an accepted offer, a confirmed order or a documented electronic exchange between authorized persons. A one-off request may be accepted at the rates communicated under Section 7.2. Statutory form requirements and the parties' powers of representation remain reserved.

3.2 Derogations. A Commercial Commitment may expressly derogate from these GTC. A derogation must be agreed between the parties and documented in accordance with Section 16.8. The order of precedence in Section 3.4 applies.

3.3 Client terms. The Client's general terms and conditions, purchase orders and other documents apply only to the extent that SysPros has expressly accepted them. Merely performing an order does not amount to accepting the Client's terms. Derogations that have been expressly accepted are governed by Section 3.2.

3.4 Order of precedence. Unless an express derogation identifies the document concerned, the order of precedence is as follows: (i) amendments accepted by the parties, from the most recent to the oldest; (ii) the framework agreement; (iii) the specific Commercial Commitment or the accepted offer; (iv) technical appendices, Scope descriptions and validly incorporated service sheets; (v) these GTC. Where they have been expressly concluded, a specific data processing agreement (DPA), an SLA and a security appendix each prevail within their own field. Their existence is not presumed; in the absence of a separate DPA, the processing framework built into Section 9 applies. A derogation must be explicit and comply with mandatory law. Third-party terms govern only their own products or services and are incorporated only if their version was handed to the Client, or made accessible through a durable and identifiable reference, before the order. They do not remove SysPros' own obligations.

4.1 SysPros supplies the Services, Software and Equipment in accordance with the Commercial Commitment and with the agreed diligence. The Client performs its payment and cooperation obligations. A failure by the Client authorizes a limitation or suspension of the services only under the conditions set out in these GTC and applicable law.

4.2 Obligation of means. By default, a Commercial Commitment whose purpose is the supply of Services constitutes an obligation of means (best efforts) only on the part of SysPros. SysPros supplies the Services in accordance with the rules of the trade, with the care and diligence required of a supplier of similar services.

4.3 Obligation of result. Where a Commercial Commitment provides for a specific result and describes its Deliverables and Specifications, Section 23 applies. The legal characterization arising from the actual nature of the services and mandatory provisions remain reserved, regardless of the designation chosen by the parties.

4.4 Contractual targets and parameters. Quantified commitments regarding Availability, intervention, restoration, resolution, RTO, RPO, detection or response are binding where they are expressly agreed as such in an accepted and documented Commercial Commitment or SLA. Backup frequencies, retention periods, capacities and other parameters set out in an accepted offer or a contractual appendix are parameters of the service to be implemented, without by themselves creating a guarantee of result or an SLA. Advertising material and preparatory exchanges not incorporated into the contract are indicative only. An offer accepted electronically does not lose its contractual value merely because it was not signed by hand. The handling terms of Section 19.5 and statutory reporting obligations remain reserved.

4.5 Deadlines. SysPros organizes performance diligently according to the agreed schedule and informs the Client of foreseeable significant delays. Deadlines designated as firm in an accepted Commercial Commitment are binding; other dates are estimates. The consequences of a delay are assessed under the contract and applicable law.

4.6 Subcontracting. SysPros may subcontract all or part of the Services and remains responsible for performing its own contractual obligations, including when it uses auxiliaries. Processing of Personal Data is subject to Section 9 and to any specific data protection provisions agreed. A change in a subcontractor's terms authorizes a price adjustment only in accordance with Sections 7.7 and 7.13.

4.7 Staff. SysPros freely determines which employees are assigned to perform the Services and how they are replaced. The Client has no right to the involvement of a specifically named employee, unless a Commercial Commitment expressly provides otherwise.

4.8 Out-of-scope services. Any service not included in the scope of a Commercial Commitment is supplied, if SysPros agrees and to the extent of its available resources, on a time-and-materials basis at the usual rates under Section 7. The Client may approve such a service by email.

5.1 The Client undertakes to pay SysPros the agreed fees in accordance with the payment terms set out in Section 7 and/or in the Commercial Commitments.

5.2 For each Commercial Commitment, the Client warrants that it (i) has obtained all internal and external authorizations that may be required; and (ii) does not breach any contractual, legal or regulatory obligation by entering into such a contract.

5.3 The Client provides SysPros with all assistance necessary or useful for the proper performance of the Services. In particular, the Client:

• a) provides, spontaneously and without delay, any information it is aware of that is necessary or useful for the proper performance of the Services;
• b) responds as soon as possible to any request from SysPros concerning such information;
• c) allows SysPros to access its premises, infrastructure and systems, including remotely, where such access is necessary or useful for the proper performance of the Services, and makes adequate means and resources available (e.g. equipped offices, network, access, power supply, technical room);
• d) follows any reasonable instruction and/or guideline from SysPros relating to (i) the Services; (ii) the Software; (iii) the Equipment; and (iv) the infrastructure in connection with which SysPros supplies the Services, or on which the Software is installed and/or used; and
• e) appoints a competent contact person, reachable during Business Hours and holding the necessary decision-making authority, in particular during interventions and in the event of an Incident.

5.4 Infrastructure. Subject to the tasks expressly entrusted to SysPros, the Client is responsible for funding and maintaining infrastructure that is adequately sized, up to date and supported, as well as the necessary connectivity, power supply, cooling and physical security. SysPros informs the Client of significant shortcomings it identifies while performing the agreed services.

5.5 Unless training of the Client's staff is the subject of a Commercial Commitment, the Client is solely responsible for adequately training its staff in the use of the Software, or of the Equipment or infrastructure on which the Software is installed and/or used.

5.6 The Client is solely responsible for interventions by its own staff, and by any third party it has engaged or that acts on its behalf, on the Software, Equipment or infrastructure covered by the Services. The Client informs SysPros in advance of any intervention by a third party within the Scope.

5.7 Sector-specific constraints. Before ordering, the Client identifies and communicates its legal, regulatory, data location, professional secrecy and continuity requirements, in particular in the healthcare, finance, public sector or critical infrastructure sectors. The parties determine which measures are expressly taken on. SysPros does not attest to any sector-specific compliance that has not been agreed, without being released from its own legal and contractual obligations.

5.8 Unsupported systems and recommendations not followed. If the Client keeps an obsolete element in service or does not follow a documented security recommendation, SysPros sets out the known risks, the proposed measures, their financial impact and the time allowed for a decision. It may refuse or limit work on the affected element, propose special conditions or continue only the services that remain feasible. Unless an emergency justifies a shorter period, the Client has 10 working days to respond. Its silence may be treated as a lack of authorization to carry out the recommendation, but does not amount to an additional order or to a general waiver of its rights. Section 12.6 concerns only the consequences causally linked to that choice; SysPros' liability for its own failures remains reserved. Services that continue and firm commitments remain billable under the contract.

5.9 Access and privileged accounts. The Client remains the holder of its accounts, subscriptions, licenses, domain names and tenants. At all times it keeps an emergency administrator access and the corresponding authentication means in its own custody. It informs SysPros without delay of any change in access rights, of the departure of any privileged user and of any third-party intervention within the Scope.

5.10 Scope. The Client validates the Scope (inventory of the systems, sites, users, applications and data covered) and informs SysPros without delay of any change. Any element that has not been declared, or that was added without informing SysPros, is out of Scope and is not covered by any commitment (Section 18.2).

5.11 Reporting. The Client reports Incidents, anomalies and suspected compromises without delay through the channels set out in Section 19.1. An employee's personal channels are not contractual support channels and do not trigger an SLA, unless agreed otherwise. This rule does not release SysPros from dealing with a serious threat or a data breach of which it actually becomes aware, in accordance with the applicable obligations.

5.12 Client licenses. The Client warrants that it holds the licenses, rights and authorizations required for the Software and services it operates that are not supplied to it by SysPros, and bears alone the consequences of any lack of license.

5.13 Authorized persons. The Client communicates and keeps up to date the list of persons authorized to request services, their technical and financial approval powers and the emergency contacts. SysPros carries out reasonable checks proportionate to the sensitivity of the request. A missing or outdated list constitutes a failure to cooperate, but does not release SysPros from the checks required for sensitive requests.

5.14 Sensitive requests. Creating or deleting accounts, resetting authentication, granting privileges, changing DNS, email or firewall settings, restores, exports, erasures and system shutdowns are subject to appropriate checks. The agreed procedure may provide for dual approval or out-of-band verification with a known contact. In the absence of a specific procedure, SysPros verifies at least the identity and authorization of the requester by means appropriate to the risk, without relying solely on the appearance of an email. SysPros may defer or refuse a request in case of reasonable doubt and documents the checks performed. Its liability remains governed by Section 12.

5.15 Domain names, DNS and certificates. The Client provides accurate ownership, contact and payment information and keeps it up to date. Where their management or renewal is entrusted to SysPros, SysPros performs the agreed tasks diligently and reports any obstacles it identifies. The consequences of inaccurate information, insufficient funds or an external failure are allocated according to their cause and Section 12; they do not release SysPros from a failure to renew that is attributable to it.

6.1 Each party appoints a lead manager for the contractual relationship and/or the various Commercial Commitments. If deemed necessary, the parties may appoint other bodies as part of the governance of their contractual relationship.

6.2 Either party may propose to the other changes to the Services and/or Software covered by a Commercial Commitment, through the lead contacts responsible for managing the Commercial Commitment concerned.

6.3 Agreement on a change. The parties document the accepted change, its Scope, its price and its impact on deadlines, security and service levels. An amendment or an electronic exchange accepted by the authorized persons is sufficient, subject to statutory forms and any forms expressly agreed. Substitutions of tools and subcontractors that are already authorized follow Sections 9.4, 9.5 and 18.7 without requiring a new amendment, within the limits set out there. The emergency measures of Section 22.9 remain reserved.

6.4 Disagreement. If no agreement is reached within 30 days or within the agreed period, the proposal is referred to the management of each party or to the competent governance body. SysPros continues the undisputed services under the existing contract. A change that has not been accepted may remain on hold; SysPros is not required to perform new unfunded services or an operation creating a serious risk. Any suspension of the existing baseline services must comply with Section 14.8.

7.1 Unless a Commercial Commitment expressly provides otherwise, SysPros supplies its Services on a time-and-materials basis, at the rate stated in the Commercial Commitment.

7.2 Applicable rates. Rates, travel costs and surcharges are communicated to the Client before the order, in the offer or in an identifiable rate card. Where no rate has been agreed, SysPros informs the Client of the proposed rate before performance; urgent services that have already been authorized are paid according to the agreed framework or, failing that, according to applicable law. The mere availability of a rate card on request does not amount to acceptance of a rate that has not been communicated.

7.3 Surcharges. Unless agreed otherwise, time-and-materials services performed outside Business Hours or on a Saturday carry a 50% surcharge, and those performed on a Sunday or an official public holiday of the canton of Vaud a 100% surcharge. These surcharges are not cumulative: the highest rate applies. A surcharge for the urgent performance of work that could have been scheduled is announced and accepted before the intervention. Maintenance included in a flat fee does not carry a surcharge merely because it is scheduled outside Business Hours, unless expressly stipulated.

7.4 Unless otherwise stipulated in the relevant Commercial Commitment, SysPros' prices and rates are in Swiss francs, including customs clearance charges but excluding VAT. Incidental costs (such as packaging, transport or delivery costs) are not included in these prices and are borne by the Client.

7.5 Expenses. The Client reimburses the reasonable expenses necessary to perform the services, according to the terms communicated before the order. Unusual or significant travel, accommodation or meal expenses require its prior approval, except in an emergency falling within an already authorized framework.

7.6 Payment. Invoices are payable by the due date agreed in the Commercial Commitment or, failing that, within 30 days of receipt. Set-off is excluded, unless agreed otherwise, in the case of a claim acknowledged by SysPros or established by a final decision, or where a mandatory provision applies. Payments by cheque are not accepted.

7.7 Indexation. SysPros' own recurring rates may be adjusted, upward or downward, no more than once a year on the contract anniversary date, with three months' notice. The reference index is the Swiss consumer price index (CPI) published by the Federal Statistical Office. The adjusted price equals the reference price multiplied by the ratio between the latest index published at the time of notification and the index for the month in which the contract was concluded or last indexed. SysPros communicates the calculation and keeps a comparable basis if the series changes. Prices of one-off services already accepted are not indexed. The same cost change cannot be passed on under both this provision and Section 7.13.

7.8 Time is billed in quarter-hour increments, rounded up to the next quarter hour. A minimum of 15 minutes is billed for a Client request or for a remote or on-site intervention. Travel is billed at actual time or at a flat rate.

7.9 Default and reminders. In the event of default, default interest of 10% per annum is due if that rate has been expressly accepted in the Commercial Commitment; failing that, the statutory rate of 5% per annum applies. The first reminder is free of charge. From the second reminder onward, administrative fees of up to CHF 40 per reminder may be charged, to the extent that they correspond to reasonably incurred costs. Necessary external collection costs that are admissible under applicable law remain reserved, without compensating the same cost twice.

7.10 Recurring services. Recurring Services, Licenses and rentals are invoiced and payable in advance according to the agreed cycle. If an amount due that is not disputed in good faith remains unpaid, SysPros may suspend the service concerned after a formal notice stating the amount, the measure envisaged and an additional period of at least 10 working days. Rented Equipment is returned in accordance with the contract and applicable law. Security emergencies and legal obligations remain governed by Section 14.8.

7.11 Future deliveries. If late payment persists after the formal notice under Section 7.10, SysPros may proportionately suspend the future deliveries concerned until payment is made or an agreed security is provided. If Equipment that is still unpaid is resold, SysPros may request a written assignment of the resale claim, to the extent legally permissible and up to the amount of its own claim. No right of repossession by self-help is granted.

7.12 Volumes. Billable units, their price, the measurement source, the frequency and the reference period are defined in the Commercial Commitment. SysPros provides an understandable statement allowing the invoice to be checked. Any increase is invoiced according to the agreed cycle or, failing that, from the next billing period. The Client may dispute a measurement, giving reasons, within 30 days of receiving the statement; a confirmed error gives rise to a correction or a credit note, including for the affected periods already invoiced. An element that has been detected but not integrated into the service may be invoiced only if a corresponding category and its price have been agreed, in particular for a license or consumption actually supplied. Mere detection does not amount to MSP coverage: coverage begins after Onboarding and validation of the prerequisites. Decreases take effect according to the agreed cycle or, failing that, at the end of the current contractual period, subject to other minimums and to third-party commitments identified before the order. During the ordinary termination notice period, decreases in the variable portion of the Managed Services are governed by Section 14.5. A measurement error is not treated as a volume reduction.

7.13 Supplier price increases. SysPros may pass on increases actually imposed on resold third-party services, provided the applicable mechanism was brought to the Client's attention before the order. It communicates the service concerned, the reason, the quantified impact and the effective date with at least 30 days' notice, without retroactive effect. If the increase exceeds 20% of the price of the service concerned, the Client may terminate that service alone as of the date of the increase. This right does not automatically end a separate fixed-term third-party subscription that was previously identified and validly accepted: the sale fees agreed with SysPros for that subscription remain due under Section 24.14 to the extent that it continues until its accepted term. SysPros indicates the options for continuing, reducing or transferring it and their financial effects. No additional penalty, and no fee for SysPros' own discontinued services, is due on that basis. The effects of a releasing cancellation, a saving or a refund are dealt with under Sections 14.4 and 24.14; mandatory law and a termination attributable to SysPros remain reserved.

7.14 Disputed invoices. The Client reports the disputed items and the reasons for the dispute within 30 days of receiving the invoice. The parties check the billing elements and correct any established errors. Failure to dispute within this period amounts to administrative approval of the verifiable items, but does not entail a waiver regarding undetectable errors or mandatory rights. Undisputed items remain payable when due.

8.1 Unless expressly stipulated to that effect, neither these GTC nor any Commercial Commitment are intended to transfer any Intellectual Property Right of SysPros to the Client.

8.2 Intellectual property claims. In the event of a serious claim by a third party, SysPros may obtain the necessary rights, modify or replace the service with a substantially equivalent solution, or end the affected service alone where no reasonable solution is available. It informs the Client and refunds the amounts paid in advance for services not supplied. Warranties and liability for a failure attributable to SysPros remain reserved.

8.3 The terms applicable to Software supplied to the Client by SysPros are set out in Section 24 and in one or more Commercial Commitments.

8.4 Know-how and reusable elements. SysPros remains free to use its know-how, methods, procedures, tools, scripts, templates, libraries and generic components developed or used in the course of supplying the Services, including where they were improved under a Commercial Commitment, provided they do not incorporate any Confidential Information of the Client.

8.5 Client data. The Client remains at all times the holder of the rights to its data and content. SysPros acquires no rights to them, other than the rights of use strictly necessary to perform the Services.

8.6 Aggregated technical data. SysPros may use aggregated and anonymized technical data (telemetry, Incident statistics, performance and security indicators) to operate, secure and improve its Services, provided that no Personal Data or Confidential Information of the Client can be inferred from it.

8.7 Artificial intelligence. SysPros may use AI features that are useful for performing the Service, in compliance with documented instructions, confidentiality and the data protection framework of Section 9. No Client content is used, or authorized to be used, to train a model accessible to third parties without prior, specific and documented consent. SysPros selects and configures tools according to their security, location, retention and subprocessing guarantees, and informs the Client of the categories of use that process its data. Outputs that may have a significant legal, financial, operational or security effect are subject to appropriate human review; answers may be inaccurate. An automated individual decision subject to legal requirements is implemented only within an expressly defined framework. The Client does not pass SysPros' Confidential Information to a third-party AI service without appropriate safeguards.

8.8 Custom developments. SysPros retains its rights to its pre-existing, generic and reusable elements. Unless agreed otherwise, once a custom development constituting a Deliverable has been paid in full, the Client holds a non-exclusive, worldwide license to the elements handed over, for its internal needs, for the statutory duration of the rights concerned. It may entrust their operation and maintenance to a provider bound by confidentiality, without transferring SysPros' internal tools that were not handed over or any third-party rights. This license survives the end of the Services; it does not include free future maintenance or the handover of source code that was not agreed. Elements supplied solely as a service or subscription remain limited to the duration of that service or subscription. Any transfer of exclusive rights requires a documented agreement and separate remuneration. Section 24.15 applies to open source components.

9.1 Roles. For Personal Data processed for the purposes and on the instructions of the Client, the Client acts as controller and SysPros as processor. Where the Client is itself a processor, it says so before the processing and communicates the identity of the controller and the applicable instructions and restrictions; it warrants that it holds the required authorizations. These elements may be documented by email, without a separate DPA. For managing its business relationship, invoicing, debt collection and the security of its own systems, SysPros acts as controller to the extent that it determines the purposes and means.

9.2 Instructions. SysPros processes Personal Data on behalf of the Client only on its documented instructions and to the extent necessary for the subscribed Services, subject to a legal obligation of its own. These GTC, the Commercial Commitment and the validly incorporated service sheets or appendices constitute the initial instructions. Further instructions may be given by an authorized contact by email or ticket, subject to the checks in Section 5.14. SysPros informs the Client if it considers that an instruction infringes applicable law and may defer carrying it out until it has been clarified. A change of purpose not covered by the Services is not authorized merely because data is made available.

9.3 Security. Each party undertakes to implement, and to ensure that its auxiliaries and subcontractors implement, appropriate technical, organizational and operational measures within the meaning of Art. 8 FADP and Art. 1 et seq. DPO to ensure the security of Personal Data, in particular to prevent any unauthorized access and fraudulent use, and to prevent its loss, undue alteration and destruction. Section 10 is reserved.

9.4 Sub-processors. The Client grants SysPros a general authorization to use sub-processors for the subscribed Services, in accordance with Art. 9 para. 3 FADP and Art. 7 DPO, subject to Section 9.10 and to any specific agreement. SysPros selects them with due care, checks the relevant guarantees and imposes on them confidentiality, security and data protection obligations equivalent to its own. It remains responsible for its own obligations toward the Client.

List on request. SysPros keeps a dated and versioned internal list of the relevant sub-processors, including along the subprocessing chain. It specifies their identity, their role, the services and categories of data concerned, the relevant countries of registered office, hosting, processing and access, and the necessary transfer mechanisms. The list applicable to the Client's Services is provided free of charge, without undue delay, on request to info@syspros.ch, including before the Services start. It is neither published nor systematically attached to offers. This detailed list is separate from the summary information provided for in Section 9.5 and from the change notifications below.

Changes and objection. Any addition or replacement giving access to the Client's systems or Personal Data is announced directly, in particular by email in accordance with Section 16.8, at least 30 days before it takes effect. The notification states the provider, the Services and data concerned, the relevant countries, the applicable safeguards, the planned date and the right to object. It also serves as information under Section 9.5 where it contains the required elements, without separate communication. Within this period the Client may object in writing on serious and documented data protection grounds. Absent an objection to a sufficiently complete notification, the general authorization covers the change, without a new signature. In the event of a reasoned objection, SysPros does not entrust the data concerned to the new provider until a solution has been agreed or the service ends. If no reasonable solution is found, either party may terminate the affected service alone as of the date of the change, without additional penalty, subject to validly accepted separate third-party commitments and mandatory law. A shorter notice period requires a specific documented agreement. Merely updating the list does not replace the notification. Providers that access neither the systems nor the data are not subject to this notice period; the other contractual commitments remain applicable.

9.5 Transfers and access from abroad. The Services may involve hosting, processing or remote access from abroad, in particular for management, monitoring, support and cybersecurity tools. SysPros identifies the relevant recipients and countries in its documentation and in the list under Section 9.4.

Summary information. Before the processing concerned, SysPros hands the Client, or makes clearly accessible to it through a reference communicated directly, summary information stating the Services concerned, the relevant countries of hosting, processing and access, and the applicable transfer safeguards. A standard service sheet or a dated and identifiable private document is sufficient, without repeating it in every offer or systematically handing over the detailed list. This information allows the Client to monitor transfers and to fulfill its obligations toward data subjects, in particular under Art. 19 FADP. Information already communicated need not be repeated as long as it remains accurate and applicable; relevant changes are announced before they are implemented, according to the terms below and those of Section 9.4.

Transfer safeguards. Transfers comply with Art. 16 and 17 FADP: an adequate level of protection recognized under Annex 1 DPO, or appropriate safeguards, in particular standard clauses recognized by the FDPIC. Where necessary, SysPros assesses the conditions of the transfer and adopts additional measures. A statutory exception is relied on only where its conditions are met. Any new country of processing or access is announced in advance together with its safeguards and may be objected to under the procedure in Section 9.4. An expressly agreed data location or access restriction remains mandatory; the requirements of Section 9.10 remain reserved.

9.6 Assistance. SysPros provides reasonable assistance with data subject requests, impact assessments and requests from authorities, under this contractual framework and at the rates communicated in advance. Work required to remedy a non-compliance attributable to SysPros is not invoiced to the Client as an additional service. Each party retains the obligations that the law imposes on it directly.

9.7 Data breach. SysPros informs the Client as soon as possible and without undue delay once it becomes aware of a breach of the security of Personal Data processed on the Client's behalf. It does not wait for a full investigation to be completed before sending a first alert, and gradually supplements the available information on the nature of the incident, the data concerned, the possible effects, the measures taken and the follow-up contact. A more precise contractual deadline may be set in a specific agreement or a validly incorporated service sheet; its absence does not remove the statutory reporting obligation. SysPros preserves the relevant available evidence and cooperates within the agreed scope. The Client assesses and makes the reports to the FDPIC and to data subjects for which it is responsible. SysPros communicates on the Client's behalf only on instruction, unless it has a legal obligation of its own.

9.8 Obligations of the Client. The Client ensures the lawfulness, quality, accuracy and relevance of the Personal Data entrusted to SysPros and assumes the obligations attached to its role, without removing those of SysPros. In particular, the Client undertakes to:

• a) provide data subjects with the required information on the collection and processing of their Personal Data (Art. 19 FADP);
• b) ensure that the processing is lawful and that it has the justification, legal basis or consent where applicable law requires it;
• c) ensure that the rights of data subjects are respected (in particular the rights of access, rectification, objection and to the delivery or transmission of data); and
• d) keep the record of processing activities where it is required to do so and fulfill its obligations toward the authorities.

9.9 End of processing. The return and deletion of Personal Data at the end of the Commercial Commitment are governed by Section 15.

9.10 Protected secrets. Before the Services begin, the Client indicates which data is subject to professional or official secrecy or to another special duty of confidentiality. The parties agree on the applicable authorizations and measures. Where the conditions of Art. 321 SCC are met, SysPros acts as an auxiliary and complies with the resulting obligations; this characterization is not presumed for every sector. Unless the Client has given express, documented and lawful consent, data covered by such secrecy is not accessible to subcontractors or other parties located outside Switzerland. The Client remains responsible for its own sector-specific obligations, and SysPros for the commitments it has accepted.

9.11 Processing framework built into the GTC. These provisions, supplemented by Sections 10, 11 and 15, constitute the contractual agreement on the processing of Personal Data for the subscribed Services. A separate document titled DPA is not systematically required. Details specific to the processing may result from the Scope, from validly incorporated standard service sheets or from documented instructions, without being reproduced in full in each Commercial Commitment. Additional provisions, possibly gathered in a DPA, are agreed where the nature of the data, the Client's requirements or the applicable legislation call for them.

Subject matter, data and duration. Depending solely on the Services ordered, the processing covers business contact details, user accounts, technical identifiers, inventories, configurations, logs, security events, support tickets and exchanges, as well as content entrusted to hosting, email or Backups. Data subjects may be the Client's employees, users, customers, suppliers and contacts. The necessary operations include collection, access, storage, authorized transmission, technical analysis, modification on instruction, restoration and erasure, for the purposes of supplying, administering, maintaining, supporting and securing the subscribed Services. This list does not authorize any category or operation that is not necessary for the Service. Sensitive data and protected secrets require appropriate measures and, where applicable, the details provided for in Section 9.10. Processing lasts as long as necessary for the Services; agreed retention periods, return and residual copies follow Section 15. Measures, incident contacts, assistance terms and audits are governed by Sections 9.3, 9.6, 9.7, 10 and 16.8.

10.1 Measures taken by SysPros. SysPros implements appropriate technical and organizational measures having regard to the state of the art, the nature of the agreed Scope, the risks involved and the cost of implementation. Depending on the risks and the agreed responsibilities, these measures cover the management of permissions and authentication, the protection of communications, the separation of access to client environments, patch tracking, logging and incident management. SysPros documents the arrangements specific to the Services and, on request, provides a description sufficient for the Client's review, while protecting other clients and its trade secrets. The measures may evolve without reducing the agreed level of protection and must remain appropriate to the risks. The access arrangements of Section 10.4 and the audits of Section 10.5 apply.

10.2 No guarantee of inviolability. Information security is an obligation of means. SysPros does not and cannot guarantee that the Services, the Software, the Equipment or the Client's infrastructure will be free of vulnerabilities, or that they will withstand every attempted intrusion, phishing, social engineering, ransomware, denial of service, exploitation of an unknown or not yet patched vulnerability, or any other attack, including where cybersecurity Services are the subject of a Commercial Commitment (Section 22).

10.3 Shared responsibility. The Client remains responsible for its security decisions and for accepting residual risk, for the behavior of its users, for its internal processes (in particular payment approval, identity and access management and information classification) and for all elements outside the Scope.

10.4 Access by SysPros. SysPros accesses the Client's systems only to the extent necessary to perform the Services and according to the principle of least privilege. It uses named or individually attributable accounts to the extent that the systems concerned technically allow it. Where a system only supports a single or shared administrator account, or where an emergency account is needed, SysPros implements proportionate compensating measures, such as storing credentials in a vault with tracked check-outs, periodically rotating secrets or logging sessions. SysPros records access and interventions according to its usual procedures.

10.5 Audits. Once a year, with 30 days' notice, the Client may have compliance with the security and data protection obligations verified. SysPros may first provide equivalent and relevant documentation. An additional audit is permitted after a significant breach, at the reasoned request of an authority, or if the documentation does not reasonably establish compliance. The audit is proportionate, carried out by a competent person bound by confidentiality, and protects other clients and trade secrets. The statutory rights of an authority remain reserved. Ordinary costs and SysPros' reasonable time are borne by the Client at the agreed rates; SysPros bears the reasonable costs directly linked to a substantial non-compliance that is attributable to it and established by the audit.

11.1 Each party protects the other's Confidential Information with at least the same care it applies to its own comparable information, and in any case with reasonable diligence. It uses that information only for the contractual relationship and discloses it only to employees, advisers and subcontractors who need to know it and are bound by an adequate duty of confidentiality. Section 9 remains reserved.

11.2 The parties' obligations regarding Confidential Information remain in force throughout the contractual relationship and for as long as the information concerned remains Confidential Information.

11.3 Each party further undertakes to ensure that these provisions are complied with by its staff and by any third party who may be involved, in any capacity whatsoever, in the exercise of its rights and the performance of its contractual obligations.

11.4 Return. At the end of the contractual relationship, or on a request compatible with the services in progress, Confidential Information is returned or deleted within a reasonable period, as a rule 30 days. Agreed reversibility periods, statutory retention obligations, elements strictly necessary as evidence and Backup retention cycles under Section 15.4 are reserved. Copies kept remain protected and are not used for any other purpose.

11.5 Mandatory disclosure. Where a party is required to disclose information to an authority or a court, it limits the disclosure to what is required and notifies the other party where the law permits. Such disclosure does not make other information public and does not remove its protection.

12.1 Principle. Subject to the limitations below and to mandatory law, SysPros is liable for damage caused by a breach of its contractual obligations that is attributable to it. Proof of the breach, the damage, the causal link and fault follows the statutory rules of evidence, including the applicable presumptions. Each party takes reasonable steps to mitigate the damage.

12.2 Indirect damage. Subject to Section 12.8, SysPros is not liable for indirect or consequential damage such as loss of business, revenue, profit, customers or anticipated savings, or harm to reputation. Ransoms, manual reconstruction and re-entry of data are excluded to the extent legally permissible. A third-party claim is not excluded merely because of its origin: it is assessed according to the nature of the damage and these limitations. Fines and penalties remain borne by the party on which they are imposed, to the extent that the law prohibits their transfer. Damage to data falls under Section 12.4. These rules also benefit SysPros' officers, employees and auxiliaries, within the limits of applicable law.

12.3 Cap. Subject to Section 12.8, the total liability of SysPros, its officers and its auxiliaries per contract year is limited, for the affected recurring services, to the amount, excluding taxes, of the fees actually paid for the three months preceding the event giving rise to liability. Payments covering a quarterly, annual or other period are allocated pro rata to the period paid for, regardless of the payment date. If the service began less than three months earlier, only the fees for the period elapsed since it began are taken into account. For a one-off service, a Deliverable or Equipment sold, liability is limited to the price, excluding taxes, actually paid for the affected service or Equipment. The Commercial Commitment may set a specific cap, in particular for data, confidentiality or cybersecurity. Damage arising from the same event or from a series of related events is not compensated more than once. Refunds of the price of services not supplied and corrections owed under a warranty are not damages within the meaning of this cap.

12.4 Data. Subject to Section 12.8 and within the applicable cap, compensation for the loss, alteration or unavailability of data covers the reasonable costs of restoring from existing and usable Backups. If their absence or unusability results from a failure by SysPros in an expressly agreed Backup service, the reasonable costs of technical data recovery are also taken into account. Manual reconstruction and re-entry remain excluded under Section 12.2. This clause does not release SysPros from the configuration, monitoring and correction obligations it has actually taken on.

12.5 Force Majeure. The affected party is not liable for non-performance only to the extent that it is directly caused by an event meeting the definition of Force Majeure. It informs the other party without undue delay, limits the effects and seeks reasonable continuity measures. A cyberattack or a supplier outage is not automatically a case of Force Majeure. Services already supplied remain due; amounts paid for services that will definitively not be supplied are refunded, subject to applicable law and validly accepted separate third-party commitments. If the impediment lasts more than 60 consecutive days, either party may end the affected service alone for the future, without additional penalty.

12.6 External causes and cooperation. Subject to Sections 4.6, 9 and 12.8, SysPros is not liable for damage to the extent that it results from the causes below and not from a failure attributable to it. These reservations apply in particular to:

• a) elements, systems, data and sites outside the Scope, except for damage caused by a faulty intervention by SysPros;
• b) failures of external suppliers, without excluding SysPros' own tasks or its contractual liability for its subcontractors;
• c) keeping unsupported elements in service or not following a documented recommendation, for consequences directly linked to the reported risk;
• d) interventions by the Client, its staff or third parties it engages;
• e) inaccurate, incomplete or late information or instructions from the Client;
• f) unlawful or inaccurate content of the data supplied by the Client;
• g) use that does not comply with the Documentation, the contract or applicable law; and
• h) the unavoidable consequences of a necessary, proportionate and diligently performed emergency measure under Section 22.9, without any general exclusion based on good faith alone.

12.7 Notification of claims. The Client notifies a claim within a reasonable period after discovering it, with the relevant information available, so that it can be examined and the damage mitigated. This requirement does not create an automatic waiver after twelve months and does not replace statutory limitation or forfeiture periods. The applicable periods for notifying defects and for warranty claims remain reserved.

12.8 Mandatory law. The exclusions and limitations in these GTC do not apply to wilful intent or gross negligence on the part of SysPros, to personal injury, or in other cases where mandatory law precludes them, in particular within the meaning of Art. 100 and 101 CO. No other provision of the GTC, including those relating to third parties, emergency measures, warranties and suspensions, derogates from this reservation.

13.1 Third-party claims. The Client indemnifies SysPros against third-party claims directly caused by a contractual or legal breach attributable to the Client, in particular unlawful content, a lack of rights or a non-compliant instruction. The indemnity covers the amounts finally owed or accepted in an authorized settlement, as well as reasonable and documented defense costs. It covers neither a failure attributable to SysPros nor a penalty whose transfer would be unlawful.

13.2 Procedure. SysPros informs the Client without undue delay, keeps the relevant documents and allows the Client to take part in or take over the defense with competent counsel. The parties cooperate and avoid unnecessary costs. No settlement admitting fault, imposing an obligation or financially binding the other party is concluded without that party's prior consent, which may not be unreasonably withheld. In an emergency, necessary protective steps remain permitted.

14.1 Unless the parties expressly agree on another effective date, Commercial Commitments take effect on the day they are concluded.

14.2 Unless the parties expressly agree on another term and the term does not follow from the nature of the Services (e.g. completion of a project), Commercial Commitments are concluded for an initial period of 12 months, automatically renewable for consecutive periods of 12 months each. For Licenses, Section 24.4 is reserved; for licenses and subscriptions taken out with third-party publishers, Section 24.14 is reserved; and for rented Equipment, Section 26.2 is reserved.

14.3 Notice. Unless agreed otherwise, either party may terminate a renewable Commercial Commitment in writing, in accordance with Section 16.8, with three months' notice to the end of the current period. A contract expressly concluded for an indefinite term may be terminated with three months' notice to the end of a month. The special termination rights provided for in these GTC and mandatory rights remain reserved.

14.4 Early termination. For a validly agreed firm commitment and subject to mandatory law, early termination for convenience by the Client leaves the remaining fees due, after deduction of the variable costs directly saved and of the costs SysPros could reasonably have avoided. Separate fixed-term third-party orders that were previously identified and accepted, and their sale fees, are dealt with under Section 24.14, without double invoicing. This rule is not a penalty applicable to the special termination rights under Sections 1.3, 7.13, 9.4 or 14.6. Where Art. 404 CO applies to all or part of the services, the right to revoke or terminate at any time remains reserved; a termination indemnity may then be claimed only within the limits allowed by that provision, in particular in the case of termination at an inopportune time. Services already performed and other validly acquired claims remain due.

14.5 Minimum billing during the notice period. Unless the Commercial Commitment expressly derogates or SysPros agrees in writing, in the event of ordinary termination notified by the Client, the monthly portion of the Managed Services actually supplied by SysPros and billed by volume may not, during the contractual notice period, be lower than 80% of its average monthly amount, excluding taxes, over the three full calendar months preceding receipt of the termination. During this notice period, announced volume decreases take effect from the next billing period, subject to this floor and to expressly accepted firm minimums. The reference is corrected for measurement errors and the corresponding credit notes; it excludes fixed flat fees, third-party licenses and subscriptions, rentals, taxes, time-and-materials work, projects and other one-off services. If fewer than three full months are available, the average covers the months available; failing that, the variable portion of the initially agreed monthly fee serves as the reference. Quarterly or annual cycles are converted to a monthly basis according to the periods covered; fractions of a notice month are calculated pro rata. For this variable portion, the billable amount is the highest of the amount resulting from actual volume at the agreed rates, this floor and any expressly accepted firm minimum, without cumulation for the same service. Fixed flat fees remain due separately under the contract; third-party licenses and subscriptions remain subject to the sale price and fixed terms of Section 24.14, without reduction to 80%. The statement shows any minimum top-up separately. During the notice period, SysPros maintains the service capacity corresponding to the minimum billed, subject to lawful suspensions. A mere option to adjust volumes does not derogate from this floor, unless the Commercial Commitment expressly excludes this minimum during the notice period. This rule does not extend the agreed term and does not apply to the special terminations referred to in Section 14.4, nor to the extent that mandatory law, in particular Art. 404 CO where it applies, precludes it.

14.6 Serious breach. Either party may terminate the affected service if the other commits a serious breach and fails to remedy it within 30 days of receiving a formal notice that describes the breach sufficiently. If the failure cannot be remedied or makes continuation objectively unreasonable, immediate termination with reasons is possible within the limits of applicable law. The shorter specific periods provided for licenses and proportionate protective measures remain reserved.

14.7 Special cases. SysPros may terminate the service concerned in the event of non-payment persisting more than 30 days after a formal notice, serious unlawful use or a serious security breach making continuation unreasonable. Where the failure can be remedied without danger, a reasonable opportunity to correct it is granted. Insolvency, a composition moratorium or bankruptcy have only the effects permitted by applicable law; statutory rights to require security are reserved. No clause allows a statutory prohibition on termination to be circumvented.

14.8 Suspension. SysPros may suspend only the elements necessary in the event of a serious and imminent security risk, an order from an authority, a failure making a third-party service unavailable, or default under Section 7.10. It informs the Client in advance where possible, documents the reasons, favors a proportionate measure and restores the service as soon as the cause has disappeared. Fees remain due for the services available and for validly accepted firm commitments. A service of SysPros' own that is not supplied for a reason attributable to SysPros is not invoiced as performed. The Client's rights, the agreed credits and the reservation of Section 12.8 remain applicable.

14.9 Termination of one Commercial Commitment does not automatically terminate any other Commercial Commitments in force, and a breach of one Commercial Commitment does not in itself justify terminating another.

14.10 Effects of termination. Claims that have fallen due remain payable; future fees become due only in the cases provided for in the contract and permitted by law. During the 15 days following termination, the parties organize limited and secure access to uninstall or deactivate SysPros' tools, then revoke its access. A delay attributable to the Client may result in re-invoicing only the license costs that were genuinely unavoidable, after information and reasonable deactivation efforts; a mere technical impossibility does not create an indefinite subscription. The clauses on payment, intellectual property, confidentiality, data, liability, indemnification, reversibility, surviving licenses, return and disputes survive to the extent necessary for their effects.

15.1 Reversibility assistance. At the Client's request, the parties define the schedule, roles, dependencies, formats and costs of transfer to the Client or to its new provider. Migration, transformation, tenant separation or specific assistance work is invoiced at the communicated rates and may be subject to a reasonable advance payment. This condition does not allow data or basic access to be withheld in breach of Sections 15.2 and 15.5 or applicable law.

15.2 Standard export. At the end of the service, SysPros makes available on request a standard export of the Client Data it holds on the Client's behalf, in a common format that is technically available. A first export carried out using standard functions, without specific transformation, is included, except for a direct support or transfer cost announced and accepted in advance. A dispute over other invoices does not by itself justify withholding this export or control of the Client's accounts. Data of other clients, SysPros' internal secrets and tools not handed over are not included in the export. Additional services follow Section 15.1, and technical or contractual limits imposed by third parties are disclosed.

15.3 Exit schedule. Unless a different schedule is expressly agreed, in particular in a reversibility plan, the Client requests the export no later than 30 days after the end of the Commercial Commitment. SysPros points out this period and the planned deletion date when the exit is organized, then sends a final warning at least 10 working days before permanent deletion. A request received in time is processed before the data concerned is deleted. At the end of this period, active data may be deleted, subject to legal obligations and to the elements needed as evidence. Additional retention is owed only if agreed; keeping the data in production is not presumed.

15.4 Residual copies. Data held in Backups is deleted according to the documented retention cycles and is not kept indefinitely. Residual copies remain protected, with restricted access and no new use, unless a restore is necessary or a legal obligation applies. In the event of a restore, the applicable deletions are reapplied. The absence of targeted deletion in an immutable Backup is accepted only to the extent compatible with applicable law and the validly agreed processing instructions. Confirmation of deletion is provided on request for the operations actually carried out.

15.5 Accounts and subscriptions. SysPros returns, or confirms to the Client, control of its accounts, tenants, subscriptions and domain names, together with the access information it holds on the Client's behalf. The rights and constraints specific to third-party licenses remain applicable, but do not allow the Client's accounts to be appropriated. Additional technical migration or separation work is invoiced under Section 15.1.

15.6 Equipment. The return of rented Equipment is governed by Section 26.6.

16.1 Assignment. Transferring a contract to a third party requires the prior consent of the other party, which may not be withheld without reasonable grounds. SysPros may transfer a contract to an Affiliate after informing the Client in advance, provided this does not reduce the guarantees of solvency, security or confidentiality, or the Client's rights. Authorization requirements relating to data and mandatory rights remain reserved. The assignment of claims follows applicable law.

16.2 Independence. The parties remain independent contracting parties. The relationship constitutes neither a simple partnership, nor a joint venture, nor a general mandate of representation. A party binds the other toward third parties only on the basis of a specific, valid and documented power.

16.3 Agreed amendments. A bilateral amendment is documented and accepted by the authorized persons in accordance with Section 16.8. The mechanisms expressly agreed in Sections 1.3, 6.3, 7.7, 7.13, 9.4, 9.5 and 18.7 remain reserved. No administrative adjustment may be used to retroactively change the price, the Scope or the responsibilities.

16.4 Severability. Should any provision of these GTC or of a Commercial Commitment be void or non-binding, this shall in no way affect the validity or binding nature of the other provisions. In such a case, the parties shall replace the void or non-binding provision with a valid and binding provision that comes as close as possible to the intent of the provision replaced.

16.5 No waiver. A party's tolerance of any breach or waiver of any right, regardless of the subject matter, frequency and duration of the tolerance or waiver, shall not amount to a definitive waiver by that party of its right to invoke that breach or right at a later time.

16.6 No third-party beneficiaries. These GTC and the Commercial Commitments bind only the parties toward each other, and no third party may rely on them, subject to the parties' authorized successors and assignees, where applicable.

16.7 Non-solicitation. During the relationship and for twelve months after the end of the last Commercial Commitment, the Client refrains, without SysPros' prior written consent, from actively soliciting, directly or through an intermediary, with a view to hiring them, any employee or consultant of SysPros who was substantially assigned to the Services during the last twelve months of the relationship. Unsolicited applications and responses to general, untargeted job advertisements are not covered. Where wrongful active solicitation leads to the person being hired by the Client or by a third party acting on its behalf, the Client owes SysPros a single contractual penalty per person equal to 100% of that person's contractual gross annual salary at SysPros, at the activity rate in force at the time of the solicitation, including the thirteenth-month salary and excluding employer contributions and expense reimbursements. For an independent consultant, the penalty corresponds to 100% of the fees, excluding taxes, paid by SysPros to that person during the twelve months preceding the solicitation. SysPros must establish the facts constituting the breach; the penalty is not charged to the person recruited. The court's power to reduce the penalty under Art. 163 para. 3 CO and proof of greater damage, to the extent legally permissible, remain reserved, without double compensation. The validity of the restriction remains subject to mandatory law; the specific rules applicable to any hiring-out of staff, in particular Art. 22 of the Recruitment and Hire of Services Act (AVG), take precedence over this section.

16.8 Communications and evidence. Operational exchanges are sent to the designated contacts. Addresses for contractual notices are set out in the Commercial Commitment; failing that, those of SysPros are its registered office stated in Section 1.1 and info@syspros.ch, and those of the Client are the contact details it provided for the relationship. The contractual written form includes a signed document or an electronic exchange that identifies the authorized parties and preserves the content, unless a stricter statutory or agreed form applies. Terminations, formal notices and notifications of amendments are sent by a means that allows their receipt to be proven, in particular registered mail or email with acknowledgment of receipt or reliable technical proof of delivery to the designated address. Mere sending, without proof of delivery, does not create an automatic presumption of receipt. Each party reports changes to its contact details and keeps its previous contact details usable until this information has been received.

16.9 Commercial references. Any public use of the Client's name, logo, testimonial or case study requires the Client's prior written consent, which specifies the authorized uses. This consent may be withdrawn for the future, with a reasonable period for removal from digital media; arrangements for media already printed may be agreed. No Confidential Information is published without specific authorization. A reference in a confidential file may be the subject of a separate agreement.

16.10 Governing law. Any contractual relationship between the parties is governed by Swiss substantive law, excluding private international law and, where applicable, the United Nations Convention on Contracts for the International Sale of Goods (Vienna Convention).

16.11 Disputes. The parties first seek a solution through their management and may agree on confidential mediation not exceeding three months. This process does not prevent interim measures, steps needed to preserve a time limit, urgent actions or the collection of an undisputed debt. It does not automatically suspend statutory time limits; any suspension of, or waiver of, the limitation period must be agreed in the forms and within the limits of applicable law.

16.12 Place of jurisdiction. Subject to mandatory places of jurisdiction, the agreed place of jurisdiction is Orbe, canton of Vaud, the registered office of SysPros. SysPros may also bring proceedings at the Client's registered office or domicile for debt collection or urgent measures, to the extent permissible. The subject-matter jurisdiction of authorities and courts remains governed by law.

16.13 Insurance. Any relevant insurance cover and sums insured held by SysPros may be confirmed by a current certificate; these GTC do not guarantee any amount of insurance or any compensation from an insurer. The Client assesses and maintains its own cover, in particular third-party liability and cyber risk insurance. Insurance does not modify the contractual obligations or the agreed liability cap.

16.14 Lawful use. Each party complies with the legal restrictions applicable to it, in particular regarding export control, economic sanctions and anti-corruption. The Client does not use the Services for any unlawful activity. A suspension or termination based on these rules complies with the necessity and proportionality requirements of these GTC.