Terms of Service for Access and Use of SESAM Software as a Service (SaaS)

1. INTRODUCTION

Purpose

This documents contains terms of service for Customers’ access to and use of SESAM Software as a Service (“Services”) provided by Bouvet Norge AS, 996 756 246 (“SESAM”). The services consist of both free- and paid subscriptions and the term “Customer” is used regardless of whether a Subscription Fee applies to a particular Customer’s account. Some sections of this document will only apply to Customers with an account with a defined Subscription Fee. Upon ordering access to the Services, and confirming acceptance of the terms of service in this document, a legally binding agreement (“Agreement”) is entered into between SESAM and the Customer. All Services, as they are available at any time, through the portal https://portal.sesam.io, are subject to the terms of this Agreement.

Upon entering into this Agreement and the registration of the Customer in SESAM’s systems, the Customer is given a right to use the Services on the terms in this Agreement. Once access to the Services has been granted, the Customer will receive an e-mail to its registered e-mail address with the necessary access and login details.

The Services consist of various sub-services, and the right to use the Services only comprise the individual sub-services which the Customer has ordered and received access to. Some of the Services are payable. The Customer’s account overview sets out active sub-services which the Customer has ordered, including which Services are payable.

Some sub-services may be subject to additional terms and/or restrictions. Such additional terms and/or restrictions are set out in the terms of use for the sub-service together with the description of the sub-service in question.

1.2. Description of the Services

The Services are standardized services, and the Customer acknowledges that the functionality in the Services will change. The Customer is given the right to use the Services, with the functionality as provided from time to time. The right to use the Services is not connected to any specific version of the underlying software or any set functionality as provided at any time, but is rather connected to access to and use of the Services as they are at any given time. Details of the functionality of each of the Services can be found at https://docs.sesam.io.

2. THE RIGHT TO USE THE SERVICES

2.1. General

If the Customer is a legal person, the Customer may set up users and give these users access to the Services with different roles. Users consist of physical persons in the employment or service of the Customer.

If the Customer is a physical person, the Customer will be assigned a single user.

The Customer and the Customer’s users receive a limited, terminable, non-exclusive and non-transferable right to use the Services in accordance with the terms of this Agreement, exclusively for the Customer’s internal business purposes. This right may be conditional on the payment of the applicable subscription fee and other fees (“Subscription Fee”). Any applicable Subscription Fee is provided on the Customer’s account overview.

The Payment of the Subscription Fee and the compliance with the terms of this Agreement is a precondition for the right to use the Services. SESAM may adjust the agreed Subscription Fee yearly, upon 3 months’ written notice. In case of changes in public taxes, charges or other duties or other changes in public administrative practice affects the vendor’s costs connected to the Service, the Subscription Fee may be adjusted correspondingly without prior notice.

The Customer may not allow a third party to use the Services in a service bureau or similar, or offer services dependent on the Services to a third party. However, the Customer may allow in-hire consultants or temporary employees to use the Services for Customers internal business purposes. The Customer may also use the Services to collect/deliver data from the applications and databases of the Customer’s suppliers and/or customers.

The Services depend on standard software. When purchasing access to the Services, the Customer does not purchase a copy of, or license to, the software used to deliver the Services, but consecutively pay for a subscription to access the Services. To the extent that separate license- or other terms apply for use of third party software and/ or services included in the Services, these are set out together with the description of the Services in question. Any terms for third party software and/or services take precedence over the terms of this Agreement.

2.2. The relationship between the Customer’s users and SESAM

The Customer commits to adhere to the terms of this Agreement, and to ensure that any of its users do the same. The Customer accepts the full responsibility for all activities connected to its users, and its user’s compliance with the terms of the Agreement. When the individual user accepts any terms upon logging into a Service, or on a later change of such terms, no Agreement is made between such individual user and SESAM. It is at all times the Customer who is party to any agreement with SESAM, and who has all rights and obligations set out in such agreement.

The Customer accepts that SESAM may contact the Customer, and any Customer administrators, through registered e-mail addresses and through telephone, and provide general marketing information or other information about the Services. Such information will not be sent to the Customer’s other users.

2.3. User administration

If the Customer is a physical person, the Customer will be assigned a single user.

If the Customer is a legal person, users are created and administrated by the Customer. Customer's administrators for this Agreement should be communicated to SESAM.

The log-on information of an individual user shall not be shared or used by more than one physical person, but may freely be re-assigned by the Customer’s administrator. The Customer’s administrator may also name further administrators and delete users. The Customer shall ensure that all information about users and administrators are up to date at all times.

Each user is responsible for keeping his/her username and password confidential. The Customer shall inform SESAM immediately in case of unauthorized use of a user’s log-on information. Users are authorized to provide SESAM’s support personnel with access to their accounts where such access is necessary to provide support or else performed tasks asked for by the user.

2.4. Requirements for use of the Services

The Customer and any of its users shall not transfer viruses, malware or any other harmful code to the Services or use the Services in a manner which gives a risk for such transfer. The Services shall not be used for any illegal or otherwise unauthorized purpose. The Customer is responsible for complying with the Norwegian, EU and United States of America export restrictions and -regulations when the Services are used outside of Norway, including assuring that the Services are not used in jurisdictions where such use would be contrary to such export restrictions and -regulations.

3. TECHNICAL INFORMATION799203

The Services will be delivered through the operating environment selected by SESAM at any time, unless it is agreed with the Customer that the Customer will use another operating environment. The Customer will be given minimum three moths’ notice in case of significant changes to the operating environment. SESAM reserves the right to change the operating environment, but will in such event notify the Customer, in order to allow the Customer to evaluate the technical and legal effects of such change.

At the present time the operating environment selected by SESAM is Microsoft Azure. For Azure, separate terms of service apply from Microsoft: https://azure.microsoft.com/en-us/support/legal/subscription-agreement/?country=no&language=en and "Online Services Terms". These terms apply as amended and updated by Microsoft at any time. SESAM has no responsibility for error and defects in such services.

SESAM and the Customer may agree on special requirements for the operating environment in a separate agreement.

To the extent technical requirements apply to the Customer’s IT systems for the use of the various Services, e.g. requirements for bandwidth and/or hardware, this shall be set out together with the description of the Services in question.

4. SESAM’S RESPONSIBILITY FOR QUALITY OF SERVICE, AVAILABILITY AND SUPPORT

4.1. Quality of Service

SESAM warrants that the Services will perform substantially as described in applicable documentation of Services. The Services will be subject to continual improvement.

If the Services does not function as described in applicable documentation of Services, SESAM will correct verified errors in the services at SESAMS’s own expense. SESAM may choose to replace the Services or functionality therein instead of performing a correction. If SESAM does not solve the verified errors according to the time-limits set out together with the description of the Services in question or does not replace the Service within a reasonable time, the Customer may cancel their subscription to that particular service in accordance with the terms in section 11. The Customer may not set forth any other claims due to defects or errors in the Services.

Links to websites not owned or controlled by SESAM which are available in the Services, related web pages or the documentation are provided without any responsibility or liability for SESAM. SESAM is not responsible for the content and/or information on such websites. In the same manner, SESAM is not responsible for defects and errors arising from the Customer’s own applications, databases or other systems.

4.2. Service Level Agreements (SLA) targets, penalties

The provisions in this section apply only to the Customers who pay a Subscription Fee.

SESAM’s Service availability targets, SLA penalties, and fixed maintenance periods are set out together with the description of the Services in question.

SESAM may, from time to time, require additional maintenance periods beyond what is set out above, for example for major upgrades. Such maintenance periods will be notified to the Customer at least 48 hours in advance, and any unavailability does not count towards the calculation of Service availability targets.

4.3. Notification of errors

If the Customer experiences that the Services in whole or in part are unavailable, or have reduced performance, the Customer shall report the error via https://support.sesam.io. In order to ensure that SESAM gets necessary information to identify and correct the error, the Customer shall, together with the notification of error, provide accurate information about the error, including a description of how the error occurred, how many users are affected, and which dataflows and/or systems are affected, or assist SESAM with gathering such information. 

4.4. Support

The provisions in this section apply only to the Customers who pay a Subscription Fee.

SESAM will provide basic technical support to the Customer. This entails technical assistance, but SESAM does not warrant that any solution will be found for any problems or requests. The administration and configuration of the Services for the Customer is not included in the support, and may be provided according to separate agreements. This may include assistance connected to integrated applications/databases.

The Customer may contact SESAM support on business days (Monday to Friday except Christmas Eve, New Year’s Eve and other Norwegian public holidays) between 08:00 and 16:00 hours Central European Time, or on specified times determined by SESAM. Any contact with SESAM support shall take place via https://support.sesam.io.

Support is provided in accordance with the following guidelines:

  • A Customer with more than three users shall designate a contact person for support, which will act as the Customer’s point of contact with SESAM. Accordingly, the contact person shall provide first line support, and forward detailed information to SESAM’s personnel.
  • Support requests shall regard the Services, when used in a manner recommended by SESAM. Support shall not cover repair of information, data-correction in a database or problems caused by the Customer. Neither shall the support cover any matter outside of the Services as covered by the Customer’s subscription.
  • SESAM will recommend trainings or consulting services if the support request takes the form of being general training or education.
  • Support does not include any form of consulting services

5. SECURITY

5.1. Rights to data

The Customer retains all rights to all data which the Customer stores or transfers in connection with the use of the Services.

Upon termination of all Services or individual Services, SESAM may agree to assist in transferring the data to a designated and usable format. Such a service should be ordered at least 30 days before the end of the subscription in question in order to ensure that the Customer can receive the data before deletion. Such assistance is invoiced by SESAM according to the at any time applicable fee schedule and terms for consultancy services. On termination of the subscription of the Service subscription, or subscription for an individual service, all Customer data will be deleted by SESAM.

5.2. Security

Customer’s privacy is important to SESAM and SESAM will abide by SESAM’s privacy policy. SESAM reserves the right to modify their privacy policy from time to time.

SESAM provides secure and reliable services, and will at any time have in place administrative, physical and technical security measures including backup solutions according to corresponding standards

  • SESAM has established an information security governance system where systems, routines and processes are set up in accordance with ISO 27001 and 27018
  • A yearly third party audit shall be carried out in accordance with ISO 27001
  • A confidential summary report of the audit shall be produced, and made available to the Customer upon request
  • The summary report shall enable the Customer to assess whether the security level in SESAM’s services are according to the Agreement and the Customer’s requirements 

5.3. Processing of personal data

The Services may entail processing of the Customer’s personal data, e.g. storage in SESAM’s operating environments, cf. section 3 above.

If the Services entail processing of the Customer's personal data, the Data Processing Addendum comes into force, and the Customer is obliged to fill in Annex 1 to the Data Processing Addendum. Note that if Annex 1 is not filled in by the Customer, there is a breach of the GDPR and SESAM must stop all processing of the Customer's personal data. The Customer must notify SESAM of the processing of personal data in advance of the processing of it by submitting the filled in Annex 1 to the Data Processing Addendum.

In the circumstance that the Services entail processing of the Customer's personal data the following will enter into force in addition to the Data Processing Addendum:

The Customer is the Controller in accordance with EU's General Data Protection Regulation ("GDPR") article 4 paragraph 7. SESAM is the Processor in accordance with GDPR article 4 paragraph 8.

The Customer as the Controller agrees and warrants that:

  • The Customer owns or otherwise has the right to transfer the personal data to the Service for processing, and that the Customer is responsible for the accuracy, integrity, contents, and legality of the personal data, including transfer and instructions;
  • Where applicable, that the processing of personal data is covered by an applicable permit, and/or has been notified to the applicable regulatory authorities and/or Data Subjects, and that the processing of personal data is not in violation of applicable law, hereunder GDPR. 
  • It is the Customer’s obligation as the Controller to notify the applicable regulatory authorities and/or Data Subjects in case of breach or the unauthorized transfer of special categories of data such as personal data;
  • The Customer, by way of its risk assessment, has verified that SESAM’s security measures are effective and appropriate for the processing in question; 
  • SESAM has provided sufficient guarantees in terms of logical, technical, physical and organizational security measures.
  • SESAM generally recommends that the Customer uses standard-level SLA or higher when processing personal data.
  • If it is set forth in the agreement that the processing of personal data includes processing of special categories of personal data or data processing that entails high risk, SESAM requires that the Customer uses standard-level SLA or higher.

The Data Processing Addendum further states the Parties’ obligations and rights as Controller and Processor, regarding the Processor’s processing of Personal Data on behalf of the Controller.

SESAM as the Processor, shall only process data in accordance with the Data Processing Addendum.

6. FEES AND PAYMENT TERMS

For Services included in this Agreement, the Customer may have payed a Subscription Fee to SESAM as set out together with the description of the Services in question.

7. RIGHT TO AUDIT AND CONTROL

The provisions in this section apply only to the Customers who pay a Subscription Fee.

SESAM shall, to the extent required by applicable audit standards or applicable governmental requirements/legislation, allow the Customer’s internal or external auditors to observe SESAM’s delivery of the Services with related Customer data and any documentation for the Services for the Customer. The Customer shall give reasonable notice before such audits, at least 20 calendar days, and the audit shall be carried out during normal business hours. The Customer acknowledges that scope of audit shall be limited to SESAM’s own delivery of Service, as well as applicable documentation.

The Customers may not utilize auditors who are in direct competition with SESAM. The auditor(s) shall sign a confidentiality statement. The Customer shall adhere to SESAM’s applicable regulations when access is given to SESAM’s facilities.

Any costs which SESAM may have in relation to the audit, control and any possible further quality assurance that the Customer may require, will be invoiced to the Customer in accordance with SESAM’s applicable rates.

8. CHANGES TO THE AGREEMENT

SESAM reserves the right to change the terms of this Agreement upon at least 30 days’ notice.

Reference is made to SESAM’s limited opportunity to change the terms in sections 5.2 and 5.3 regarding the processing of data. SESAM may not change section 5.1. to the detriment of the Customer. 

9. INFRINGEMENT OF THIRD PARTY RIGHTS

The provisions in this section apply only to the Customers who pay a Subscription Fee.

SESAM shall defend the Customer against claims or law suits set forth by third parties claiming that the Customer's use of the Services infringes that third party’s registered Norwegian or EU intellectual property rights, including, without limitations, patents, copyright, trade secrets, trademark or any other intellectual property rights. In the event of such claims the Customer shall immediately inform SESAM in writing.

SESAM shall, to the extent SESAM is responsible for the infringement, hold the Customer harmless against all costs, damages, expenses or losses which the Customer is ordered to pay by a court or agrees to pay in a settlement, including attorney fees. This is subject to the full co-operation of the Customer with SESAM and that SESAM is in full control of the legal process and negotiations for a settlement. SESAM may at its own discretion (i) modify the Services so that there is no longer any infringement of third party rights, (ii) replace the Services with functionally equivalent services, (iii) provide a right for the Customer's continued use of the Services, or (iv) terminate the Customer's access to the Products and Services against a refund of any fees paid for the subscription after the date of termination. The Customer may not set forth any other claims as a result of infringement of third party rights.

The previous right to be held harmless does not apply if the Services have been used in violation of these terms and conditions or if the claim arises out of any modification, integration or customization of the Services not performed by SESAM.

The Customer shall defend SESAM against any claims or lawsuits in which a third-party claim that the Customer's data or use of the Services in combination with the Customer’s own applications, databases or other systems, is inconsistent with or infringes a third party's intellectual property rights, including without limitations,  patents, copyright, trade secrets, trademark or any other intellectual property rights. SESAM shall immediately notify the Customer in writing in the event of such claims. The Customer shall hold SESAM harmless against all costs, damages, expenses or losses that SESAM is sentenced to pay by a court or agrees to in a settlement, including attorney fees, provided that SESAM cooperates with the Customer at the Customer’s own expense and that SESAM provides the Customer with full control over the legal process and settlement, and that the settlement releases SESAM from all liability. 

10. LIABILITY, LIMITATION OF LIABILITY ETC. 

10.1. Limitation of liability 

If SESAM is held responsible for paying damages to the Customer as a consequence of breaches of any of the obligations under this Agreement, such damages may in no event include compensation for indirect loss or damages of any kind which may arise as a result of, or in connection with, such breach. Indirect loss includes, but is not limited to, loss of profit of any kind, losses as a consequence of disrupted operations, loss of data, lost savings, losses due to deprivation and claims from third parties (except as set out in section 9 above). SESAM’S liability under this Agreement is therefore limited to direct loss, unless otherwise set out in mandatory applicable law, for example damages due to gross negligence or intent. Any refunds or compensation for direct loss and costs during any 12-month period shall not exceed an amount equivalent to 6 month’s Subscription Fee’s ex. VAT for the Services during the same period.

If standardized sanctions are agreed, these standardized sanctions shall be the sole and exclusive remedy for the matter and no other claims may be made based on the same situation.

10.2. Force majeure

If the use and execution of the Services is wholly or partly prevented or materially impeded by circumstances beyond the parties’ control, both parties’ obligations are suspended for as long as the circumstances are relevant and as long as these circumstances lasts. Such circumstances include, but are not limited to, strikes, lockouts, and any relationship which under Norwegian law will be regarded as force majeure. Each party may, however, in accordance with section 11 of this Agreement, terminate the Agreement if the force majeure makes it particularly burdensome for that party to continue the Agreement.

In the event that law, rules or regulations applicable to the use or delivery of the Services is changed or new rules or regulations are adopted after the Services have been made available on the market and this prevents SESAM from fulfilling the Customer’s instructions regarding processing of personal data or other obligations in this Agreement, and/or this requires full or partial termination of access to the Services for a limited or indefinite period of time, this shall be considered as a force majeure circumstance. SESAM is not in any way responsible for any such or other force majeure circumstance. 

10.3. Circumstances for which SESAM not in any event is responsible

Even though SESAM will use appropriate care to ensure secure transmission of information between the Customer and the Services, the Customer recognizes that the Internet is an open system, and that SESAM cannot warrant that a third party cannot or will not intercept or alter data during the transmission. SESAM takes no responsibility for such unauthorized access to, use or alternation or publication or loss of data.

Neither is SESAM responsible for lack of availability of the Services when this is directly or indirectly caused by the Customer or by circumstances for which the Customer is responsible or the reconstruction of data regardless of cause. 

11. CANCELLATION AND SUSPENSION

The Customer may cancel the Services or individual sub-services and thereby cancel the entire subscription for SESAM’s Service using the Customer’s account tool with applicable notice period. The cancellation takes effect from the start of the first month after end of the notice period.

For non-paying Customers SESAM has the right to suspend or terminate access to all or any part of the Service at any time, with or without cause, with 14 days’ prior notice. In case of abuse, access to Services may be suspended or terminated without notice, effective immediately.

The provisions for the reminding of this section apply only to the Customers who pay a Subscription Fee.

If a minimum term applies for some of the Services, the termination by the Customer takes effect after the expiration of such minimum term.

If payment is not made within 30 days after the due date, SESAM may, provided that the amount outstanding is not insignificant, suspend the Customer’s access to the Services until payment is made. Suspension shall be notified in writing by SESAM, with a final and reasonable deadline for the Customer to settle the amount outstanding before suspension is made effective. SESAM may terminate the Customer’s accounts for the Services if payment is not made to SESAM within 14 days after such suspension is made effective. The Customer shall pay delayed interest in accordance with applicable law for all Subscription Fees that are not settled before their due date. SESAM may make renewal of the Customer’s subscription conditional on a shorter payment due date or increased invoice frequency after one case of delayed payment.

SESAM may terminate the Customer’s subscription with 7 days’ notice if the Customer is in breach of any of his obligations under this Agreement, or if it becomes apparent that the Customer will materially breach this Agreement in the future. SESAM may with 6 days’ notice to the Customer also suspend the Customer’s subscription to the Services if the Agreement is breached by the Customer. Such suspension may be in effect until the matter has been resolved.

SESAM reserves the right to terminate any service in its entirety, or its availability in any market, with 6 months’ notice before such termination takes effect or in case of force majeure with such notice which is reasonable under the circumstances.

When the Services, hereunder users, are terminated, all data and copies of such data will be deleted from SESAMs servers upon the termination taking effect. The Customer will get access to his data as set out in section 5.1.

The limitation period for any claims arising in connection with this Agreement or breach of this Agreement is one year after the termination of the agreement. Claims forwarded after the limitation period is out of date and hence have no validity.

12. TRANSFER

Without obtaining SESAM’s prior written permission, the Customer is not entitled to transfer all or part of the right to use the Services to another entity (either through mergers, de-mergers, bankruptcy, change of ownership or control or to affiliates or otherwise). SESAM may fully or partially transfer its rights and obligations under the Agreement to subsidiaries or other companies within the same group, hereunder use these as sub-contractors, provided that this is done in a manner assuring compliance with the obligations under the GDPR from the Customer’s perspective.

13. CHOICE OF LAW

This Agreement will be construed, regulated and interpreted in accordance with and governed by Norwegian laws, without giving effect to its conflicts of law principles.  Further, Customer and SESAM agree to submit to the jurisdiction of Oslo, Norway for any legal disputes regarding this Agreement or its subject matter herein.

14. DISPUTES

Any dispute or disagreement arising between the parties will be resolved by negotiations.

If such negotiations fail, either party may request that the case is brought before a Norwegian court. If the parties so agree, the case shall be decided by arbitration after Norwegian Act of 14. May 2004 no. 25 on arbitration. If the parties require confidential treatment of the arbitration proceedings, hereunder the arbitration court’s verdict, this shall be agreed between the parties in writing together with the arbitration agreement.

The agreed legal venue shall be the location where SESAM has its registered address when the case is made before the court or arbitration court.

The following dispute resolution shall apply to the Customers who pay a Subscription Fee:

The parties will strive to resolve all disputes at the project management level. If any such dispute cannot be mutually resolved by the project managers within 7 days, then such dispute will immediately be referred to the parties’ respective division vice presidents (or equivalents) for discussion and resolution.  If such parties fail to resolve the dispute within 14 days, then such dispute will be referred to the party’s respective Chief Operating Officer (or equivalent) for discussion and attempted resolution.  If such dispute cannot be mutually resolved by such parties within 14 days, then either party may request that the case is brought before a Norwegian court. If the parties so agree, the case shall be decided by arbitration after Norwegian Act of 14. May 2004 no. 25 on arbitration. If the parties require confidential treatment of the arbitration proceedings, hereunder the arbitration court’s verdict, this shall be agreed between the parties in writing together with the arbitration agreement.

The agreed legal venue shall be the location where SESAM has its registered address when the case is made before the court or arbitration court.