General Terms of Service

These General Terms of Service (hereinafter the "General Terms" or "Terms") apply to all services provided by KALIFY (the "Provider") to its business clients (the "Client"), in particular:

• Consulting and support for the development of applications on Microsoft Power Platform (Power Apps, Power Automate, Copilot Studio) using "low code" / "no code" approaches
• The development of bespoke software, web, mobile or business applications
• The integration of third-party solutions and the configuration of SaaS platforms
• Corrective and preventive maintenance services and minor enhancements to applications used by the Client (Article 7)
• The provision of online services published by KALIFY, including the Power Platform governance platform KALM (Article 8)
• Training and change-management support related to the projects carried out

Application of the General Terms. Any order for services, request for assistance, acceptance of a quote, subscription to an online service, or agreement given for the Provider's intervention constitutes unreserved acceptance by the Client of these General Terms. Any departure from these Terms must be accepted in writing by the Provider; failing this, it shall not be binding on the Provider. Any reference to the application of other terms, in particular the Client's own general purchasing conditions, shall not be binding on the Provider unless expressly accepted in writing by an authorized representative of the Provider.

Special Conditions – Contract. The General Terms may be supplemented or clarified by Special Conditions (contract, quote, purchase order, pricing schedule) specifying the Client's identity, the subject matter and scope of the services, the pricing terms and any agreed departures. In the event of conflict, the Special Conditions shall prevail. The Special Conditions together with the General Terms constitute the Contract between the Provider and the Client.

Every service is the subject of a prior quote issued by KALIFY, specifying the nature of the work, the projected schedule, the expected deliverables and the price. The quote is valid for 30 days from its date of issue; beyond that period, KALIFY reserves the right to revise it.

The contract is formed upon receipt by KALIFY of any of the following expressions of agreement:

• Signature of the quote or contract (handwritten or electronic — a document signed in electronic form has the same legal value as a handwritten signature, in accordance with Articles 1366 et seq. of the French Civil Code)
• Payment of the deposit indicated in the quote
• A written purchase order from the Client referencing the KALIFY quote
• Online subscription to a service published by KALIFY

During the term of the Contract, the Client may request additional services from the Provider, which shall be the subject of a quote also governed by the Contract. An accepted quote constitutes an amendment supplementing the Contract.

Performance of the services. The Provider undertakes to perform the services as a competent professional and in compliance with the standards and good practices of the profession. The Provider's obligations constitute obligations of means (best-efforts obligations), the outcome of which depends on various factors, and in particular on the Client's cooperation, the involvement of its teams and the availability of communication networks, which are not under the Provider's control.

The Provider undertakes to assign to each engagement the personnel best qualified to meet its needs and may, if necessary and under its own responsibility, engage another provider so that the services are performed under the best conditions of quality and timeliness, without this altering the agreed financial terms.

The services are performed remotely. Should travel be required, an additional quote, outside any fixed-price arrangement, will be proposed to the Client.

Ongoing advice. In addition to handling requests, the Provider provides an ongoing advisory service to the Client on the organization and possible developments of its information system, so as to ensure the best balance between efficiency, security and cost. The Client is informed of the need to make choices and trade-offs in this area, and such decisions are made by the Client under its sole responsibility. The Provider bears no responsibility for the consequences of the Client's choices and decisions.

The Client must designate, among its personnel, one to three individuals with the skills and authority necessary to act as the Provider's point of contact. These individuals shall centralize requests for assistance, document them and communicate them to the Provider. If the Client authorizes several individuals to submit requests, it shall provide the Provider in advance with a named list of those individuals.

The Client is required to ensure that all conditions necessary for the performance of the services are met, in particular:

• Providing the Provider with the necessary information and ensuring the availability of the IT access (environments, applications, data sources) required for the engagement
• Carrying out acceptance testing within the agreed time frame and providing precise, documented feedback
• Ensuring its personnel comply with the Provider's recommendations, in particular regarding backups, updates, IT protections and security precautions
• Carrying out, under its sole responsibility and prior to any intervention by the Provider, the backup procedures for data, files and programs needed to prevent any loss, destruction or alteration
• Ensuring that the data and content provided to KALIFY comply with third-party rights and applicable regulations

In case of doubt as to these conditions, the Client must seek information from the Provider. Any delay attributable to the Client (late validation, absence of a point of contact, access not provided) may result in a rescheduling or additional billing if such delay generates extra cost for KALIFY.

Handling procedures. Each incident or change request must be logged through the KALIFY Help Center application made available to the Client. Named accounts are provided to the Client to log requests and track their progress. The Client can view the number of available tickets there and can order additional ticket packs under the terms of the Contract.

Covered applications. The Client shall declare the application(s) covered by the maintenance package and shall keep this list up to date via the KALIFY Help Center. It undertakes to provide the information and access rights necessary on these applications and their data sources so that the Provider can carry out incident resolution.

Response time. The Provider undertakes to mobilize all available means to acknowledge requests for assistance, during business hours (8am–6pm, Monday to Friday), within a maximum of forty-eight (48) hours from receipt and validation of a support ticket.

Individual tickets. The Client may request the use of individual tickets, ordered outside of any package. These tickets are invoiced monthly based on the number of tickets consumed, at the unit rate in effect specified in the Special Conditions or the quote.

Ticket packages. The package is payable in full upon conclusion of the Contract or upon the date a new package is ordered; each new package is the subject of a quote validated by the Client. The validity period of a ticket is one (1) year from the date the package is ordered. Each ticket corresponds to an intervention of up to one hour; any request for assistance results in the consumption of one ticket if the intervention does not exceed one hour, and of one additional ticket for each additional hour of intervention. Any ticket that has been started is deemed to be fully used regardless of the actual duration of the intervention.

Unused tickets at the end of the period are permanently forfeited and may not be carried forward or give rise to any form of compensation. In the event of early termination of the Contract, for whatever reason, tickets included in a package or purchased separately and not consumed as of the termination date shall not give rise to any refund, compensation or carry-over; the Client acknowledges that they shall not give rise to any claim for compensation.

These Terms serve as the general terms of use and sale for the KALM platform (kalm.kalify.fr), an online governance service for the Client's Microsoft Power Platform environments.

Subscription and offerings. KALM is offered as a per-organization subscription, available in various plans (Inventory; ALM and Governance; Audit and Security) specified in the quote. A free 14-day trial period provides access to all plans; at the end of the trial, only the ordered plans remain accessible. The subscription is entered into for the term stated in the quote and is automatically renewed, unless terminated with 90 days' notice before the renewal date.

Access and accounts. Access is via the Client's Microsoft Entra ID authentication. The Client is responsible for its users' accounts, the roles it assigns to them, and the consents it grants to the application within its Microsoft tenant. The Power Platform licenses and administrative rights necessary for the service to function remain the Client's responsibility.

Hosting and availability. The service is hosted in France with a professional hosting provider. KALIFY implements reasonable means to ensure continuous availability, without any guarantee of results; maintenance operations, hosting-provider incidents, and changes to the Microsoft services on which KALM depends may cause interruptions. The service evolves regularly; such evolutions shall not result in any reduction of ordered functionality without prior notice.

Data segregation. Data belonging to the Client's organization is stored in a dedicated space and is accessible only to accounts whose email domain is among the verified domains of that organization, regardless of their role within KALM. KALIFY, in its capacity as host, does not access this data through the application: its administration console only shows account and billing information and the list of the Client's administrators. Technical operations (backups, restoration) are performed on encrypted files, are logged, and do not allow the content to be read; the Client's administrators are informed of any restoration. Where KALIFY assists the Client, it does so using an account created by the Client on its own Microsoft tenant, which the Client may deactivate at any time. A daily automated check confirms that all access to organization data is denied to any external account.

Backups and reversibility. Each organization's data is backed up daily in encrypted form. The Client may download its backups from its organization's settings throughout the subscription term. Upon expiry or termination, the organization's data is retained for 30 days to allow for retrieval, and is then deleted.

Use. The Client shall not use the service in any manner contrary to law, attempt to access another organization's data, compromise the security or performance of the service, or resell access to it. KALIFY may suspend access in the event of a serious breach or non-payment (Article 9), after notice.

The price of the services is stated in the Special Conditions, in an appendix, or is the subject of a quote submitted for the Client's acceptance. Prices are stated in euros exclusive of tax (VAT excluded); applicable VAT is added at the rate in effect on the invoice date.

Unless otherwise stated in the quote, fixed-price project services are payable 40% upon order (deposit due upon signature of the quote) with the balance due upon final delivery or according to the milestones defined in the quote; maintenance packages and subscriptions are payable in full upon order.

Invoices are payable at the Provider's registered office, within 45 days from the invoice date, with no early-payment discount. Payment is deemed made when the funds are actually credited to the Provider's account. Where a specific payment schedule is set out in the quote, its terms shall prevail.

In the event of late payment:

• The Provider is entitled to suspend all services, automatically and without formal notice or prior warning
• Late-payment interest at a rate equal to 3 times the statutory interest rate shall apply from the first day of delay, together with a fixed collection indemnity of €40
• Any collection costs incurred shall be borne entirely by the Client
• Failure to pay a single invoice by its due date shall automatically render the outstanding balance on all other invoices immediately due

Under no circumstances may payments be suspended or set off against any claim without the Provider's prior written consent. Any partial payment shall first be applied to the unsecured portion of the debt, and then to the oldest outstanding amounts.

The Client warrants that it holds all intellectual property rights necessary for the use, within the scope of the Contract, of Microsoft Power Platform and of the other tools used in its information system, and that the elements it provides (content, trademarks, data, third-party software) are free of rights or duly authorized; it indemnifies KALIFY against any third-party claims in this respect.

Performance of the Contract shall not effect any transfer of intellectual property rights, the Provider and the Client each retaining the entirety of their respective rights. In particular, KALIFY retains all rights to its methods, tools, libraries, generic components, the KALM platform, and its know-how, whether developed prior to or independently of the engagement.

Within the limits of the rights it holds and subject to full payment of the sums due, the Provider grants the Client a non-exclusive, personal right to use, for its own business, the bespoke developments the Provider creates for it (applications, flows, source code, mockups, custom deliverables). The Client may modify them or have them modified for its own needs, without marketing or transferring them to third parties.

Since the Provider's obligations constitute obligations of means, its liability may only be engaged in the event of a clearly established fault and shall only cover material damage directly resulting from such fault. The burden of proving the Provider's fault, the damage, and the causal link rests with the Client. The Provider shall bear no liability for damage arising from the Client's failure to comply with its own obligations.

Any damage must imperatively be reported by the Client to the Provider within 48 hours of its occurrence and must be precisely documented. The Client must allow the Provider immediate access to its information system to assess the damage and implement remedial measures; failing this, the Provider's liability may not be sought for any aggravation of the damage.

The following are excluded from the Provider's liability:

• Data loss and any intangible, indirect or consequential damage (loss of revenue, loss of business, reputational harm)
• Malfunctions or incompatibilities resulting from updates, changes or technical developments to Microsoft Power Platform, or to connectors or third-party APIs used in the applications, except where covered by a specific service defined by amendment — the Client remains solely responsible for ensuring that technical changes imposed by Microsoft or other third parties are compatible with its needs and environment
• The consequences of the Client's choices and decisions, even where based on advice or recommendations from the Provider

The Provider's liability may only be engaged up to the annual amount, exclusive of tax, paid by the Client under the Contract whose performance gave rise to the liability, and may only be invoked within a period of 3 months from the performance of the services concerned.

The Provider and the Client undertake to comply with applicable regulations relating to the protection of personal data, including the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). The Client is the Data Controller for personal data and the Provider acts as Data Processor.

Client's obligations. The Client warrants that the personal data processed within the scope of the services has been collected and processed in accordance with the GDPR; it undertakes to inform the individuals concerned of the use of their data by the Provider for the purposes of performing the services. It remains solely responsible for decisions relating to such processing, including the instructions given to the Provider.

Provider's obligations. The Provider undertakes to:

• Process personal data only on the Client's documented instructions
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk (for KALM: minimization of stored data, segregation by organization, encryption of backups, logging of access)
• Notify the Client of any personal data breach as soon as possible after becoming aware of it
• Not engage a sub-processor for the processing without the Client's prior consent — the list of KALM's sub-processors (hosting in France, Microsoft services) is set out in its privacy policy
• Assist the Client in complying with its own obligations, in particular by providing the information necessary to demonstrate GDPR compliance
• Upon expiry or termination of the Contract, delete or return all personal data processed on behalf of the Client, in accordance with its instructions