Terms of sale

The French version of this document is the authoritative version. This English translation is provided for information only.

Article 1Purpose · Scope · Status of the Customer

CONYVO, a French single-shareholder simplified joint-stock company (SASU) with variable capital, whose registered office is at 39 Bd Georges Clemenceau, 83000 Toulon, France, registered with the Toulon Trade and Companies Register under number 102 903 457, represented by its duly authorized President (hereinafter "CONYVO" or the "Provider").

These general terms of sale (hereinafter the "Terms of Sale") set out the conditions under which CONYVO markets to the business customer (hereinafter the "Customer") the business digital infrastructure solution "Conyvo Infrastructure" and the related services.

The Terms of Sale apply to both ways of acquiring the Solution: (I) the Subscription, hosted and managed by CONYVO, and (II) the purchase and On-Premise installation on the Customer's infrastructure, with optional maintenance.

The Terms of Sale apply exclusively to business-to-business relationships. The Customer acknowledges that it is contracting for the purposes of its business, that it has the necessary skills and resources, and that it is not acting as a consumer or non-professional.

The Terms of Sale are the sole basis for commercial negotiation within the meaning of Article L441-1 of the French Commercial Code. They prevail over any other document of the Customer, unless CONYVO expressly agrees otherwise in writing.

In accordance with applicable regulations, CONYVO provides its Terms of Sale on a Durable Medium to any business buyer who requests them.

Article 2Definitions

Capitalized terms have the meaning given to them below, in the singular as in the plural:

• Solution: the business digital environment "Conyvo Infrastructure", made up of the Conyvo Core foundation and, where applicable, the Packages subscribed, as described in the Purchase Order.
• Conyvo Core: the mandatory foundation, including in particular identity and single sign-on, the access portal, account management, collaboration, email, secure private access, perimeter protection, security monitoring, backups and automation.
• Package: a defined add-on module added to the Conyvo Core (e.g. Conyvo Gestion, Web Start, Web Custom, Social, Dev, Intelligence, API Connector, additional storage, enhanced or priority SLA), whose scope and availability status are specified in the Purchase Order.
• Subscription: the arrangement under which CONYVO hosts, operates, monitors, backs up and maintains the Solution for the Customer during a Contract Period, in return for an annual fee paid in advance.
• On-Premise: the arrangement under which CONYVO installs the Solution on an infrastructure chosen, supplied and controlled by the Customer, then hands over its operation to the Customer.
• Commissioning: the initial service of scoping, sizing, installation, integration, customization, agreed migration and Acceptance of the Solution.
• Segment: the sizing profile selected in the Purchase Order (Very small business, Startup / scale-up, SME, Mid-cap / large SME, Large enterprise, Group / holding). The associated number of users is a sizing benchmark and not a billing unit.
• Purchase Order: the document issued by CONYVO and accepted by the Customer, setting out the Segment, the acquisition arrangement, the Packages, the selected versions and integrations, the price, the term and the special conditions.
• Quote: a priced commercial proposal issued by CONYVO, valid for the period stated or, failing that, thirty (30) days.
• Customer Data: all data, files, emails, content, settings and information entered, generated or stored by the Customer or its Users in the Solution.
• User: any natural person (employee, executive, contractor, partner of the Customer) for whom the Customer opens an access account to the Solution, under its responsibility.
• Customer Administrator: a User appointed by the Customer and holding delegated administration rights over its accounts, groups and uses.
• Acceptance: the joint procedure for verifying that the Solution complies with the Purchase Order, prior to going into production.
• Incident: a reproducible malfunction of the Solution, within the scope operated by CONYVO, affecting its normal operation.
• Durable Medium: any medium that makes it possible to store information and refer to it later (PDF, email, customer area, signature platform, etc.).

Article 3Contractual documents · Order of precedence · Enforceability

The contract consists of the following documents, from the highest to the lowest ranking in the event of conflict: (I) framework agreement signed, where applicable; (II) Purchase Order and special conditions; (III) accepted Quote; (IV) Terms of Sale; (V) appendices (SLA, DPA, Reversibility); (VI) documentation and operations file.

By way of exception, Appendix 2 (DPA) prevails over any other document solely for matters relating to personal data.

Any general terms of purchase or other document of the Customer cannot be enforced against CONYVO, even if communicated later, unless expressly accepted in writing by CONYVO.

CONYVO's General Terms of Use apply to Users. The Customer guarantees that each of its Users complies with them.

Article 4Pre-contractual information · Quote · Order

Every order is preceded by a diagnosis or audit to qualify the need, the volumes, the security level, the data to be migrated and the Customer's contact person. The Customer guarantees the accuracy of the information provided, on which the sizing and the price are based.

Before the Order, CONYVO informs the Customer of the fees, Commissioning costs, early termination conditions and provider-switching arrangements that apply, in accordance with Article 29 of Regulation (EU) 2023/2854 (the "Data Act").

The Order becomes firm and final when CONYVO receives: (I) the signed Purchase Order or Quote, including by electronic signature, and (II) payment of the agreed deposit. The Order implies unreserved acceptance of the Terms of Sale.

CONYVO reserves the right to refuse an Order, in particular in the event of previous unpaid invoices, technical, legal or reputational risk, needs beyond validated capacities, or an activity excluded by Article 14.

Article 5Description of the Solution · Conyvo Core · Packages

The scope of the Solution is strictly that described in the Purchase Order, which sets the list of components, modules, versions and integrations. Any feature not expressly mentioned is excluded.

The Conyvo Core is mandatory and common to all installations. Packages can only be subscribed in addition to the Conyvo Core; some depend on other Packages (e.g. Web Start requires Conyvo Gestion).

Packages marked "pilot", "to be industrialized", "subject to study" or "dedicated project" are provided in their current state of development, within a specific scope and without any service level commitment, unless otherwise stated in the Purchase Order.

The Conyvo Gestion package is not certified accounting software, point-of-sale software or an approved e-invoicing platform, unless such a configuration is expressly provided for in the Purchase Order.

Roadmaps presented (in particular the Conyvo Mobile application) are indicative. They do not constitute a commitment by CONYVO and cannot form the basis of any Order, claim or price reduction.

Article 6Acquisition arrangements · Subscription · On-Premise

Subscription: CONYVO hosts and operates the Solution on infrastructure located in the European Union. The Customer administers its Users and uses; CONYVO operates the technical scope defined in the Purchase Order.

On-Premise: CONYVO installs the Solution on the machine, network or hosting provider designated by the Customer. Hardware, power, network, third-party licenses, off-site backup and third-party services remain the sole responsibility and expense of the Customer.

The choice of arrangement, Segment and Packages is the Customer's sole decision, in the light of the diagnosis. CONYVO has no duty to advise beyond the information provided during the diagnosis and set out in the Purchase Order.

Article 7Commissioning · Deployment · Migration

Commissioning follows these steps: (I) scoping and audit; (II) preparation of environments; (III) installation and hardening; (IV) integration and customization; (V) agreed migration; (VI) testing and restoration; (VII) Acceptance.

Lead times and schedules are indicative, unless CONYVO makes an express written commitment. They depend on the Customer's cooperation, the provision of access (DNS, accounts, exports) and the availability of third parties (registrars, software publishers, operators).

Migration covers only the data, volumes, formats and sources identified in the Purchase Order and audited. Any additional migration, unstructured data or unaudited source is billed on a time-and-materials basis.

The Customer remains solely responsible for the quality, completeness and lawfulness of the migrated data. It keeps a complete copy of its source data until Acceptance is signed.

Article 8Acceptance · Approval · Go-live

CONYVO makes the Solution available to the Customer for Acceptance on the basis of a test plan drawn up from the Purchase Order. The Customer has ten (10) business days to submit written, precise and reproducible reservations.

If no reservations are notified within this period, or if the Customer uses the Solution in production, the Solution is deemed accepted and compliant without reservation.

Only blocking anomalies preventing the use of an essential function may prevent Acceptance. Minor anomalies are corrected later, under the support arrangements.

The Acceptance date or, failing that, the go-live date is the starting point of the first Contract Period of the Subscription and of On-Premise maintenance.

Article 9Subscription · Term · Renewal · Termination at expiry

Unless otherwise stipulated, the Subscription is entered into for an initial term of twelve (12) months (the "Contract Period"). It then renews automatically for successive periods of twelve (12) months, at the prices then in force.

Either Party may object to renewal by giving two (2) months' notice before the expiry date, by registered letter with acknowledgment of receipt or by any Durable Medium provided for in the Purchase Order.

The Customer may at any time request a switch of provider or a return to On-Premise under the conditions of Article 23 and Appendix 3. The fee for the current Contract Period remains due as an early termination penalty, as disclosed to the Customer before the Order.

CONYVO may change components, versions, tools and technical operating conditions, without substantially degrading the functions subscribed, in particular for security reasons, end of support of a component or changes in third-party software.

Article 10Hosting · Location · Subcontracting

Under the Subscription, Customer Data is hosted by a hosting provider established in Europe, in a region located in the European Union selected contractually. Any region located outside the European Union is excluded from the standard offers.

CONYVO may subcontract all or part of the hosting, operation or services to qualified third parties, under its responsibility. No one accesses the Customer's environment without named authorization, logging and a confidentiality undertaking.

CONYVO may change hosting provider or data center within the European Union, after informing the Customer in advance, under the conditions of Appendix 2 where personal data is concerned.

The Solution is not certified health data hosting within the meaning of Article L1111-8 of the French Public Health Code. The Customer shall not host such data in it without a specific contract and appropriate certification.

Article 11On-Premise · Installation · Handover · Optional maintenance

CONYVO installs the Solution on the infrastructure designated by the Customer, which guarantees that it meets the hardware and network prerequisites communicated. Any extra cost due to non-compliant or unaudited infrastructure is billed on a time-and-materials basis.

At Acceptance, CONYVO hands over to the Customer the administration access, the configurations and the operations file. The Customer then alone takes over the operation, security, updates and backup of the Solution.

On-Premise maintenance is optional and is subject to a separate annual subscription. Without such a subscription, any work after Acceptance is carried out on the basis of a quote or on a time-and-materials basis, subject to CONYVO's availability.

The maintenance subscribed is limited to the volume and scope set out in the Purchase Order. It does not cover hardware, network, the host operating system, or changes made by the Customer or a third party.

Article 12Essential obligations of the Customer

The Customer undertakes in particular to:

• appoint a competent internal contact person with decision-making authority, available throughout the term of the contract;
• provide complete, accurate and up-to-date information, as well as the access (DNS, domains, accounts, exports, APIs) and licenses required, which it guarantees it lawfully holds;
• approve interim deliverables and Acceptance within the agreed time frames;
• keep its own backups of critical data and test the procedures for which it is responsible;
• comply with the technical prerequisites, security recommendations and documentation;
• pay the price on the agreed due dates.

These obligations are decisive for CONYVO's consent. Any breach automatically results in the postponement of deadlines, the billing of downtime and, where applicable, the revision of the scope and price.

Article 13Accounts · Users · Delegated administration

The Customer creates, modifies and deletes its Users' accounts under its own responsibility, either directly or by request to CONYVO. It regularly reviews authorizations and promptly removes access that is no longer needed.

The Customer is solely responsible for the confidentiality of credentials and for enabling the MFA offered. Any action performed using a User's credentials is deemed to have been performed by the Customer.

The Customer is liable for the acts of its Users as for its own. It guarantees that each of them complies with the Terms of Use and the Terms of Sale.

CONYVO retains named and logged technical operating access to the hosted environment. The Customer shall not delete, restrict or modify this access without CONYVO's prior written consent.

Article 14Lawful use · Prohibited uses · Suspension

The Customer undertakes to use the Solution in accordance with the law, the rights of third parties and IT security rules. In particular, it shall refrain from any fraudulent use, any breach of public order and any activity likely to compromise the security of systems.

The following are prohibited in particular: (I) sending unsolicited bulk email; (II) hosting unlawful content or malware; (III) mining crypto-assets; (IV) unauthorized penetration testing; (V) reselling or making the Solution available to third parties; (VI) circumventing quotas and limits.

CONYVO may suspend all or part of the Solution, without notice in an emergency, in the event of an actual or reasonably suspected security risk, unlawful use, an order from an authority or breach of these terms. It informs the Customer as soon as possible.

Suspension does not release the Customer from its payment obligations and gives no right to any compensation or service credit. Costs of restoration, clean-up or IP address delisting are billed to the Customer.

Article 15Support · Maintenance · Service levels

Standard support is included in the Subscription. It is limited to the monthly volume, scope, channels and hours defined in Appendix 1 and the Purchase Order; it is in no event unlimited support.

The enhanced SLA and priority SLA options are subscribed separately, after CONYVO has validated capacity. No on-call or 24/7 support is provided without a specific accepted quote.

Corrective maintenance, security maintenance and upgrades of the Conyvo Core are carried out by CONYVO as part of the Subscription. They may cause temporary interruptions, under the conditions of Appendix 1.

Any work resulting from non-compliant use, an action of the Customer, its information system or a third party (investigation, remediation, requested restoration) is billed on a time-and-materials basis.

Article 16Changes · Change Requests · Time and materials

Any request for changes, specific development, integration, training or migration not provided for in the Purchase Order constitutes a Change Request, giving rise to an additional quote or to time-and-materials billing.

On a time-and-materials basis, billing is based on time spent, by the hour or by the day, according to the price list in force, with a minimum of one (1) hour per intervention. CONYVO may stop the work if the budget is exceeded without approval.

Article 17Prices · Revision · Capacities · Overruns

Prices are stated in euros, excluding taxes. VAT and any applicable tax are charged in addition at the rate in force. Ancillary costs (travel, third-party licenses, specific purchases) are charged in addition, on the basis of receipts or a flat fee.

The Subscription price is set per Segment and per Package, not per User. The Segment sets indicative capacities (users, storage, resources); if they are exceeded on a lasting basis, CONYVO may bill the higher Segment or capacity options, after informing the Customer.

CONYVO may revise its prices at each annual renewal date, in particular according to the SYNTEC index or changes in hosting, license and energy costs. The revision is notified at least two (2) months before it takes effect; the Customer may then object to renewal.

Any discount granted is attached to the Order concerned, is not automatically renewable and lapses in the event of late payment.

Article 18Invoicing · Deposits · Payment terms

Unless otherwise stipulated in the Purchase Order:

• Commissioning and the On-Premise purchase are invoiced fifty percent (50%) on Order and the balance on Acceptance, work starting only once the deposit has been received;
• the Subscription and On-Premise maintenance are invoiced annually in advance, on the Acceptance date and then on each renewal date;
• time-and-materials services, migrations and training are invoiced monthly or on completion.

Deposit, Subscription and maintenance invoices are payable on receipt; other invoices are payable thirty (30) days from their date of issue. No discount is granted for early payment.

Invoices are issued electronically, including through an approved platform as part of the roll-out of mandatory e-invoicing. The Customer provides and keeps up to date the information needed to receive them.

Article 19Late payment · Penalties · Indemnity · Suspension

Any late payment automatically triggers, without prior formal notice, penalties calculated at the European Central Bank refinancing rate plus ten (10) percentage points, in accordance with Article L441-10 of the French Commercial Code.

In addition, a fixed indemnity of forty (40) euros for recovery costs is due for each unpaid invoice. Where the costs incurred are higher, CONYVO may claim additional compensation on presentation of supporting documents.

In the event of non-payment, CONYVO may, without prejudice to any other right: (I) suspend services, support and access eight (8) days after a formal notice that remains unheeded; (II) refuse any new Order; (III) require cash payment; (IV) accelerate all sums due; (V) terminate the contract under Article 32.

During suspension, CONYVO keeps the Customer Data without deleting it. Unless mandatory provisions provide otherwise, the Customer shall not make any unilateral set-off, withholding or deduction from the sums due.

Article 20Free software · Third-party licenses

The Solution includes third-party free and open source software, which remains subject to its own licenses, notices and trademark rules, provided to the Customer on request or in the relevant interfaces.

CONYVO does not sell this software and grants no proprietary license over it. The price pays for engineering, integration, configuration, customization, hosting, operation and related services.

The Customer complies with the licenses of third-party components. Licenses, subscriptions or services of third-party publishers not expressly included in the Purchase Order remain at its expense.

CONYVO is not responsible for changes, discontinuation, license changes or defects of third-party software. Within the scope of maintenance, it endeavors to offer a reasonable alternative or workaround.

Article 21Intellectual property · License · Reservation of rights

Each Party retains ownership of its pre-existing elements. CONYVO retains all rights to its methods, automation scripts, deployment roles, standard configurations, dashboards, generic developments, documentation and know-how, including when they are integrated into the Solution.

Subject to full payment, CONYVO grants the Customer, for the term of the contract and for its internal needs, a personal, non-exclusive, non-assignable and non-transferable right to use its elements integrated into the Solution.

For On-Premise, this right of use is granted for the legal term of protection of the rights, on the installation handed over and solely for the Customer's internal needs, without any right of redistribution, resale or reuse for the benefit of third parties.

Any assignment of rights to a specific development must be expressly provided for, paid for and formalized in writing. The Customer remains the owner of the Customer Data.

Article 22Customer Data · Backups · Restoration

The Customer guarantees that it holds all rights to the Customer Data and that this data does not infringe any third-party right or any regulation. It remains solely responsible for its content, lawfulness and quality.

Under the Subscription, CONYVO performs encrypted backups according to the frequency, retention and recovery objectives (RPO/RTO) set out in the Purchase Order or Appendix 1. Recovery objectives are a best-efforts obligation.

In the event of loss or corruption of data, CONYVO's obligation is limited to restoring the last available and usable backup. Data created or modified since that backup cannot be guaranteed.

For On-Premise, backup, its off-site copy and restoration tests are the exclusive responsibility of the Customer, unless a service has been expressly subscribed.

Article 23Reversibility · Switching provider

The Customer may request, subject to a maximum notice period of two (2) months, the transfer of its exportable data and digital assets to another provider or to an On-Premise infrastructure, or their erasure, under the conditions of Appendix 3 and the Data Act.

CONYVO provides exports in structured, commonly used and machine-readable formats, together with the relevant documentation. Configurations and elements specific to CONYVO protected by trade secrets are excluded from exportable data.

From January 12, 2027, no switching charges are billed for the operations covered by the Data Act. Services going beyond them (takeover by the new provider, migration, training, reinstallation, development) are billed on a time-and-materials basis.

These provisions apply subject to the specific regime provided for in Article 31 of the Data Act, in particular for services mostly custom-built for the Customer.

Article 24Personal data (GDPR)

Each Party complies with Regulation (EU) 2016/679 (the "GDPR") and French Law No. 78-17 of January 6, 1978. CONYVO acts as data controller for managing the business relationship and as the Customer's processor for the data processed in the Solution.

Where CONYVO acts as processor, Appendix 2 (DPA) applies automatically and constitutes the contract provided for in Article 28 of the GDPR. The Customer, as data controller, guarantees the lawfulness of the processing it carries out using the Solution.

For On-Premise, CONYVO acts as processor only during Commissioning and maintenance work, within the limits of the access granted to it.

Article 25Security · Incidents · Logging

CONYVO implements appropriate security measures in light of the state of the art and the risks, in particular: named accounts, MFA, least privilege, encryption in transit, administration VPN, filtering, logging, security monitoring, updates and encrypted backups.

The Solution is designed to make it easier for the Customer to meet its security and compliance obligations. It is not a certification (ISO 27001, SecNumCloud, HDS or other) and does not, on its own, guarantee the Customer's regulatory compliance.

CONYVO logs access and technical operations for security, evidence and operational purposes. The Customer authorizes this processing within the limits described in Appendix 2.

It is up to the Customer to assess whether it is subject to specific sector or cybersecurity regulations (in particular the NIS 2 Directive) and to inform CONYVO before the Order. The resulting additional requirements are subject to a quote.

Article 26Artificial intelligence modules

Artificial intelligence Packages (document search, assistance) produce probabilistic results that may be inaccurate or incomplete. The Customer checks any result before use and remains solely responsible for decisions made on that basis.

No sensitive action (account creation, invoice, access change, publication, deletion) is executed without explicit, attributable and logged human approval.

CONYVO does not use Customer Data to train models without the Customer's prior written consent. The Customer qualifies its use cases under Regulation (EU) 2024/1689 on artificial intelligence.

Article 27Confidentiality · Trade secrets

Each Party keeps strictly confidential the information, documents, processes, architectures, configurations, prices and know-how of the other Party, for the term of the contract and five (5) years after it ends.

Information is not confidential if it (I) has entered the public domain through no fault, (II) has been lawfully obtained from a third party, (III) was already known, or (IV) is disclosed under a legal obligation or court decision.

CONYVO may keep archive copies of contractual documents and logs for evidence, compliance and dispute management purposes, for the legal limitation periods.

Article 28Warranties · Exclusions

CONYVO provides the Solution in accordance with industry best practice, under a best-efforts obligation, unless there is a written commitment to a specific result. No warranty of uninterrupted availability, absence of errors or fitness for a need not stated in the Purchase Order is given.

The warranties exclude malfunctions due to: (I) the Customer's environment, hardware or network; (II) non-compliant use; (III) a modification by the Customer or a third party; (IV) third-party software, services and operators; (V) force majeure.

Article 29Liability · Cap · Exclusions

CONYVO's liability is limited to direct, certain and proven damage attributable exclusively to a fault of CONYVO. Indirect damage is excluded, in particular loss of opportunity, operating loss, loss of revenue or customers, damage to reputation and replacement costs.

Except in the event of gross negligence or willful misconduct, CONYVO's total liability, for all causes combined, is capped at the amount excluding taxes actually paid by the Customer for the Order concerned during the twelve (12) months preceding the event giving rise to liability.

The Customer acknowledges that the price reflects the allocation of risks thus agreed and that this cap does not deprive CONYVO's essential obligation of its substance. Failure by the Customer to take the backup or security measures for which it is responsible reduces any compensation accordingly.

Any liability action against CONYVO is time-barred one (1) year from the day the Customer knew or should have known of the event giving rise to liability, in accordance with Article 2254 of the French Civil Code.

No provision excludes or limits a liability that cannot be excluded or limited by law, in particular in the event of personal injury, gross negligence or fraud.

Article 30Insurance

CONYVO declares that it is insured for the professional risks of its business with a reputable and solvent insurer. On written request, it provides an insurance certificate, subject to the confidentiality of the terms.

The Customer insures its own risks, in particular its equipment, data, operating losses and cyber risks.

Article 31Force majeure

Neither Party is liable for a failure resulting from force majeure within the meaning of Article 1218 of the French Civil Code. The following in particular are treated as such, where they meet the conditions: widespread failure of a hosting provider or operator, large-scale cyberattack, power failure, decision of an authority.

The Party invoking it informs the other in writing as soon as possible. The obligations affected are suspended for the duration of the event, except for payment obligations already due.

If the event lasts more than thirty (30) consecutive calendar days, either Party may automatically terminate the Order concerned, without compensation, CONYVO refunding only the sums received for services not performed.

Article 32Termination · Effects · Non-solicitation

In the event of a serious breach by a Party not remedied within thirty (30) days of a formal notice, the other Party may automatically terminate the Order concerned, without prejudice to the sums due and to any damages.

CONYVO may terminate automatically, after a formal notice that remains unheeded for fifteen (15) days, in the event of non-payment, unlawful use or endangering the security of the Solution or of other customers.

In the event of termination attributable to the Customer, all fees remaining until the end of the current Contract Period become immediately payable.

If CONYVO discontinues an offer or its business, it may, at its option, (I) complete the current Contract Period, or (II) end it with three (3) months' notice, while ensuring reversibility and refunding the sums paid in advance for the period not performed.

On termination, for whatever reason, the sums due for services performed or committed remain payable. The return and deletion of data are governed by Article 23 and Appendix 3.

During the term of the contract and for twelve (12) months after it ends, the Customer shall not solicit or recruit CONYVO's employees and subcontractors who worked on the Solution. In the event of breach, it owes a fixed indemnity equal to six (6) months of the gross salary or average billing of the person concerned, capped at twenty-five thousand (25,000) euros.

Article 33Compliance · Ethics · Sanctions

The Customer guarantees that it holds all authorizations, clearances and insurance required for its business and for the use of the Solution.

The Customer complies with regulations on anti-corruption, anti-money laundering, economic sanctions and embargoes. It guarantees that no User or beneficiary of the Solution is subject to restrictive measures of the European Union.

Article 34Assignment · Independence · References · Claims

The contract is entered into intuitu personae. The Customer may not assign or transfer all or part of its rights and obligations without CONYVO's prior written consent. CONYVO may assign the contract to any entity succeeding it (merger, sale of business, partial transfer of assets), after informing the Customer.

The Parties act as independent contracting parties. No provision creates a company, agency, partnership, employment relationship or exclusivity between them.

Unless the Customer refuses in writing, CONYVO may cite the Customer's name and logo and a factual description of the Solution deployed as a commercial reference, without disclosing any confidential information.

Any claim relating to the Solution must be notified in writing, precisely and with supporting documents, within thirty (30) calendar days of the event giving rise to it, failing which any right to a service credit or goodwill gesture in that respect is lost.

Unless mandatory provisions provide otherwise, a claim does not suspend payment obligations. Any goodwill gestures are at CONYVO's sole discretion and do not constitute an admission of liability.

Article 35Small businesses · Off-premises contracts

Where the contract is concluded off-premises with a Customer employing five (5) or fewer employees, and its subject does not fall within the scope of the Customer's main business, the provisions of Article L221-3 of the French Consumer Code apply, in particular the fourteen (14) day right of withdrawal.

A Customer in this situation that requests the performance of services before the withdrawal period expires acknowledges that it owes the price of the services performed until any withdrawal. The Customer declares its situation when placing the Order.

Article 36Amendment of the Terms of Sale · Evidence · Governing law · Jurisdiction

CONYVO may amend the Terms of Sale. The new Terms of Sale apply to Orders placed after they are communicated or published online and, for current Subscriptions, from the next Contract Period, except for mandatory legal or security changes.

Electronic exchanges, event logs, support tickets and electronic signatures constitute evidence between the Parties. The invalidity of one clause does not affect the other provisions. Failure to rely on a clause does not constitute a waiver.

The Terms of Sale are governed by French law. In the event of a dispute, the Parties seek an amicable solution for thirty (30) days from its written notification.

Failing agreement, any dispute falls within the exclusive jurisdiction of the Toulon Commercial Court, or any court that may replace it, including for summary proceedings, multiple defendants or third-party claims, subject to mandatory jurisdiction rules.

Appendix 1SLA (Service Level Agreement) · Support and service levels

1. Purpose: This appendix sets out the support and maintenance arrangements and the service levels applicable to the Subscription and to the On-Premise maintenance subscribed. Time frames are objectives, not guarantees, and require the Customer's cooperation.

2. Scope: Support covers (I) Incidents affecting the scope operated by CONYVO; (II) assistance requests within the subscribed volume; (III) corrective and security maintenance. Incidents attributable to the Customer, a third party, an operator or software not supplied by CONYVO are excluded.

3. Channels: Requests are submitted by the Customer Administrator through the support portal or to contact@conyvo.com, with a description, steps to reproduce, screenshots and relevant logs. Personal instant messaging and untracked verbal commitments are not support channels.

4. Hours: Standard Support from Monday to Friday, excluding public holidays, from 9:00 a.m. to 6:00 p.m. (Paris time). Work outside these hours and on-call service are provided only on a specific accepted quote.

5. Volume: The monthly volume of support included is set in the Purchase Order according to the Segment. Unused volume cannot be carried over or refunded; overruns are billed on a time-and-materials basis after informing the Customer.

6. Prioritization: CONYVO qualifies each request according to its severity:

• P1 (Critical): total unavailability of an essential Conyvo Core service, with no workaround.
• P2 (Major): significant malfunction of a service, with a possible workaround.
• P3 (Minor): non-blocking anomaly or isolated incident.
• P4 (Request): question, assistance, configuration or change request.

7. Response objectives (Standard): acknowledgment and start of investigation, in business hours and business days:

• P1: within 8 business hours;
• P2: within 16 business hours;
• P3: within 3 business days;
• P4: within 5 business days.

8. Enhanced and priority SLA: The reduced objectives, service windows and reserved capacities of these options are set in the Purchase Order. They exclude any 24/7 on-call service unless a specific quote is accepted.

9. Resolution objectives: Resolution times depend on the cause, third parties and the access available. For a P1, CONYVO provides a workaround or restoration as soon as reasonably possible; other requests are handled in a corrective release or maintenance window.

10. Planned maintenance: CONYVO informs the Customer at least forty-eight (48) hours in advance of maintenance likely to interrupt the service and favors low-impact time slots. Urgent security patches may be applied without notice.

11. Backups: Under the Subscription, backups are encrypted, monitored and subject to a restoration test before go-live and periodically thereafter. Frequency, retention and RPO/RTO are set in the Purchase Order.

12. Availability: Unless expressly committed in the Purchase Order, CONYVO has only a best-efforts obligation. Any availability commitment excludes planned maintenance, third-party failures, incidents attributable to the Customer and force majeure.

13. Service credits: No service credit or penalty is due, unless expressly stipulated in the Purchase Order for the SLA options. Any credits are the fixed and exclusive compensation for the breach concerned and are capped at one twelfth (1/12) of the annual fee excluding taxes concerned.

Appendix 2DPA (Data Processing Agreement) · GDPR data processing agreement

1. Purpose: This appendix constitutes the contract provided for in Article 28 of the GDPR. It governs the processing of personal data carried out by CONYVO, as processor, on behalf of the Customer, as controller, and prevails over the Terms of Sale with regard to such processing.

2. Description of the processing: (I) subject matter: hosting, operation, backup, support and maintenance of the Solution; (II) duration: term of the contract plus the reversibility period; (III) nature: hosting, storage, occasional consultation, backup, restoration, logging, deletion; (IV) purposes: provision of the Solution, support, security.

3. Data subjects and data: (I) data subjects: Users, employees, customers, prospects, suppliers and correspondents of the Customer; (II) categories: identity, contact details, credentials, connection logs, content of files and emails, business data. The Customer shall not process health data in it without a specific contract.

4. Instructions: CONYVO processes data only on documented instructions from the Customer, including for transfers outside the European Union, except where required by law, in which case it informs the Customer. The Terms of Sale, the Purchase Order and the settings made by the Customer constitute its instructions.

5. Unlawful instruction: CONYVO immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions. It may suspend the execution of the instruction concerned until it is confirmed or amended.

6. Confidentiality: CONYVO ensures that persons authorized to process the data have committed to confidentiality or are under a statutory obligation of confidentiality, and only access the data to the extent necessary.

7. Security: CONYVO implements the measures required by Article 32 of the GDPR described in Article 25 of the Terms of Sale, in particular: named access control, MFA, encryption in transit and of backups, per-customer isolation, logging, security monitoring, updates and an incident management procedure.

8. Sub-processors: The Customer gives a general authorization to use sub-processors. The current list is set out in the Schedule below. CONYVO informs the Customer of any addition or replacement at least thirty (30) days in advance.

9. Objection: The Customer may object to a new sub-processor on legitimate grounds relating to data protection, within fifteen (15) days. If no reasonable alternative is found, either Party may terminate the services concerned, without compensation.

10. Obligations of sub-processors: CONYVO contractually imposes on each sub-processor data protection obligations equivalent to this appendix. It remains fully liable to the Customer for the performance of their obligations.

11. Location and transfers: Under the Subscription, data is hosted in the European Union. Any transfer outside the European Economic Area takes place only on the Customer's instructions and on the basis of an adequacy decision or standard contractual clauses of the European Commission.

12. Data subject rights: CONYVO assists the Customer, through appropriate technical and organizational measures, in responding to requests to exercise rights. Any request received directly by CONYVO is forwarded without delay to the Customer, which alone responds to it.

13. Assistance: CONYVO helps the Customer ensure compliance with the obligations of Articles 32 to 36 of the GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of the processing and the information available to it.

14. Data breach: CONYVO notifies the Customer of any personal data breach within a maximum of forty-eight (48) hours of becoming aware of it, with the available information required by Article 33 of the GDPR. The Customer remains responsible for notifications to the CNIL and to data subjects.

15. End of processing: At the end of the services and of the reversibility period, CONYVO, at the Customer's choice, returns and then deletes the personal data and its copies, unless required by law to retain it. Backups are erased at the end of their retention cycle.

16. Documentation and audit: CONYVO makes available to the Customer the information needed to demonstrate compliance with Article 28 of the GDPR and allows audits, including inspections, by the Customer or an independent auditor bound by confidentiality.

17. Audit arrangements: Except in the event of a proven breach or a request from an authority, audits are limited to one (1) per year, with thirty (30) days' notice, carried out primarily on documents, without access to other customers' data or to the shared infrastructure. Time spent by CONYVO beyond one (1) day is billed on a time-and-materials basis.

18. CONYVO's own processing: CONYVO processes, as data controller, the Customer's contact data and the technical logs needed for security, billing and evidence, in accordance with its Privacy Policy.

19. Liability: The limitations of liability in the Terms of Sale apply between the Parties to this appendix, within the limits of mandatory law and without prejudice to the rights of data subjects and the powers of the supervisory authority.

20. Schedule - Sub-processors (Subscription):

• IONOS SE (Germany): server hosting and object storage, European Union region.

Appendix 3Reversibility · Exit plan · Switching provider

1. Purpose: This appendix organizes the reversibility of the Solution and implements Articles 23 to 31 of Regulation (EU) 2023/2854 (the "Data Act") for the Subscription. It also applies, as needed, at the end of On-Premise maintenance.

2. Request: The Customer notifies in writing its request to switch provider, return to On-Premise or erase data, with a notice period of no more than two (2) months. At the end of the notice period, it specifies the option chosen and, where applicable, the relevant information about the new provider.

3. Transition period: CONYVO carries out the exit operations within thirty (30) calendar days after the end of the notice period. If this is technically impossible, CONYVO informs the Customer within fourteen (14) business days, justifies it and proposes a period that may not exceed seven (7) months.

4. Continuity: During the transition period, CONYVO maintains the Solution and a high level of security, and provides reasonable assistance. Fees remain due pro rata temporis until the actual end of the transition period.

5. Exportable data: Exportable data includes in particular: (I) files and folders; (II) mailboxes; (III) calendars and contacts; (IV) application databases; (V) directory of accounts and groups; (VI) operations documentation handed over to the Customer.

6. Exclusions: Automation scripts, deployment roles, standard configurations and CONYVO's internal elements protected by trade secrets are excluded, provided that this exclusion does not prevent or delay the switch of provider.

7. Retrieval: The Customer has a data retrieval period of at least thirty (30) calendar days from the end of the transition period. It is responsible for checking the integrity of the exports during this period.

8. Erasure: At the end of the retrieval period and after a successful switch, CONYVO completely erases the Customer's exportable data and digital assets, subject to legal retention obligations, and notifies the Customer. The contract ends on that date.

9. Charges: From January 12, 2027, no switching charges are billed. The fees for the transition period, the early termination penalty disclosed to the Customer before the Order, and any additional services requested remain due.

10. Additional services: Migration to the new environment, reinstallation, data transformation, training of the new provider's teams and any assistance beyond legal obligations are billed on a time-and-materials basis, on an accepted quote.

11. On-Premise: At the end of maintenance, CONYVO hands over any administration access it still holds, revokes its own access and confirms this in writing. The Customer keeps the installation and alone operates it.

Last updated: November 5, 2026.