Service Level Agreement

Key service levels at a glance

Parties

The undersigned:

1. Trivle, registered with the Netherlands Chamber of Commerce (KvK) under number 92733689, having its registered office at Zwolsekanaal 35, 7681 EC Vroomshoop, the Netherlands, duly represented by name of representative (“Trivle”); and

2. Customer name, registered under number registration number, having its registered office at registered office address, duly represented by name and title of representative (the “Customer”),

hereinafter jointly referred to as the “Parties” and each individually as a “Party”.

Recitals

A. Trivle provides a multi-tenant software-as-a-service platform for e-learning and training management, consisting of an application programming interface (API), web applications and mobile applications (the “Platform”).

B. The Customer has entered into subscription agreement / order form reference with Trivle, dated date, for the use of the Platform (the “Subscription Agreement”).

C. The Parties wish to record the service levels that apply to the Platform, including availability, support, incident handling, maintenance, backups and recovery, in this Service Level Agreement (the “SLA”).

The Parties therefore agree as follows:

1. Definitions

1.1 In this SLA, the following capitalised terms have the meanings set out below. Other capitalised terms have the meaning given to them in the Subscription Agreement or the General Terms and Conditions.

(a) Availability: the percentage of time in a calendar month during which the Production Platform is available, calculated in accordance with Article 3.3.

(b) Business Day: Monday to Friday, excluding public holidays recognised in the Netherlands.

(c) Business Hours: 09:00 to 17:00 CET/CEST on Business Days.

(d) DPA: the data processing agreement between the Parties concerning the processing of personal data through the Platform.

(e) Downtime: any period during which the Production Platform is Unavailable, excluding Excluded Downtime.

(f) Excluded Downtime: unavailability resulting from any of the circumstances listed in Article 3.4.

(g) General Terms and Conditions: Trivle’s general terms and conditions, available at https://www.trivle.com/legal/terms-and-conditions.

(h) Incident: an unplanned interruption of the Platform, a reduction in its quality, or a defect as a result of which the Platform does not function in accordance with its documentation.

(i) Maintenance Window: the weekly maintenance window referred to in Article 8.6.

(j) Monthly Fee: the subscription fee payable by the Customer for the use of the Platform in respect of a calendar month, excluding VAT and excluding fees for one-off services, consultancy and custom development. Where the subscription fee is invoiced for a longer period, the Monthly Fee is the pro rata amount for one month.

(k) Production Platform: the production environment of the API and the web application of the Platform made available to the Customer. Test, acceptance, staging and demonstration environments are not part of the Production Platform.

(l) Resolution: the restoration of the affected functionality by means of a permanent fix or a Workaround.

(m) Response Time: the time between receipt of a report of an Incident through a channel referred to in Article 5.3 and the first substantive response by Trivle (not an automated acknowledgement), confirming receipt, the Severity and the next steps.

(n) Service Credit: a credit on the Monthly Fee as set out in Articles 4 and 6.5.

(o) Severity: the classification of an Incident as P1, P2, P3 or P4 in accordance with Article 6.

(p) Target Resolution Time: the target period for Resolution set out in Article 6.2.

(q) Users: the employees, learners, trainers, administrators and other persons whom the Customer has authorised to use the Platform.

(r) Workaround: a temporary solution that substantially restores the affected functionality without placing an unreasonable burden on the Customer or its Users.

2. Scope and order of precedence

2.1 This SLA applies to the Platform as provided to the Customer under the Subscription Agreement. It sets out the service levels for availability, support, incident handling, maintenance and updates, backups and recovery.

2.2 This SLA supplements the General Terms and Conditions, which apply in full. In the event of any conflict, this SLA prevails over the Subscription Agreement and the General Terms and Conditions with respect to service levels. With respect to the processing of personal data, the DPA prevails.

2.3 This SLA does not cover custom development, configuration work, content creation, training of Users, data migrations or integrations built by the Customer or by third parties. Such services can be provided on request under a separate assignment or at the agreed hourly rate.

2.4 Customer-specific arrangements, such as access to a dedicated issue-tracker project or quarterly service reviews, are recorded in Annex A.

3. Availability

3.1 Trivle shall ensure that the Production Platform achieves an Availability of at least 99.9% per calendar month (the “Availability Target”).

3.2 Availability is measured by an external monitoring service, operated independently of the hosting infrastructure of the Platform, which checks the Production Platform at intervals of no more than one minute. The Production Platform is “Unavailable” when the monitoring records that the API or the web application does not respond, or responds with server errors, so that Users cannot log in or cannot use the core functionality of the Platform. Trivle’s monitoring records are decisive, save for evidence to the contrary.

3.3 Availability is calculated as follows:

Availability (%) = (total minutes in the month − Excluded Downtime − Downtime) ÷ (total minutes in the month − Excluded Downtime) × 100

For reference: an Availability of 99.9% corresponds to approximately 43 minutes of Downtime in a 30-day month.

3.4 Unavailability resulting from any of the following circumstances is Excluded Downtime and does not count towards the Availability Target:

(a) maintenance within the weekly Maintenance Window (Friday 06:00–08:30 CET/CEST);

(b) planned maintenance announced at least two (2) Business Days in advance in accordance with Article 8.7;

(c) emergency maintenance necessary to address security vulnerabilities or threats in accordance with Article 8.8;

(d) force majeure as defined in the General Terms and Conditions;

(e) causes attributable to the Customer, its Users or its systems, including equipment, networks, configurations and third parties engaged by the Customer;

(f) beta, preview or experimental features that the Customer has requested or has chosen to use;

(g) failures of the public internet or of networks outside Trivle’s control.

3.5 The Availability Target applies to the API and the web application. The mobile applications rely on the API and therefore benefit from its availability. The distribution of the mobile applications through third-party app stores and the functioning of Users’ devices fall outside the scope of the Availability Target.

4. Service credits

4.1 If the Availability in a calendar month falls below the Availability Target, the Customer is entitled to a Service Credit equal to the following percentage of the Monthly Fee for that month:

4.2 The total Service Credits for missing the Availability Target shall not exceed 50% of the Monthly Fee for the affected month.

4.3 The Customer must claim a Service Credit in writing, by e-mail to support@trivle.com, within thirty (30) days after the end of the affected month, stating the dates and times of the Downtime concerned. Trivle shall assess the claim against its monitoring records. If no timely claim is made, the right to a Service Credit for that month lapses.

4.4 Approved Service Credits are deducted from the next invoice. Service Credits are not paid out in cash.

4.5 Service Credits are the sole and exclusive financial remedy for any failure to meet the Availability Target, without prejudice to Article 4.6 and to Trivle’s obligation to resolve Incidents in accordance with this SLA.

4.6 If the Availability is lower than 99.0% in three (3) consecutive calendar months, the Customer may terminate the Subscription Agreement by written notice to Trivle, provided the notice is given within thirty (30) days after the end of the third month. In that case, Trivle shall refund any fees paid in advance for the period after the termination date on a pro rata basis.

5. Support

5.1 Trivle provides support during Business Hours: Monday to Friday, 09:00–17:00 CET/CEST, excluding Dutch public holidays.

5.2 The Customer provides first-line support to its own Users, including questions about the use of the Platform, account management and content. Trivle provides second-line support to the Customer’s designated contacts listed in Annex A. Reports received by Trivle directly from Users may be referred back to the Customer.

5.3 The following channels are available for reporting Incidents and submitting questions:

(a) E-mail – support@trivle.com. This is the primary channel for all Incidents, questions and requests.

(b) Telephone – +31 (0)85 3018 039, for P1 Incidents and for P2 Incidents with a demonstrably urgent impact. Incidents reported by telephone are confirmed by e-mail.

(c) Issue tracker – for customers with custom work, Trivle may provide access to a dedicated project in its issue tracker (currently Linear) for reporting and following up Incidents, change requests and questions.

5.4 Outside Business Hours, Trivle uses reasonable efforts to respond to P1 Incidents, but does not guarantee a response. In that case, Response Times and Target Resolution Times start at the beginning of the next Business Hour.

5.5 A report of an Incident contains at least a description of the problem, the steps to reproduce it, the affected Users or functionality, the time at which it occurred and the proposed Severity. The Customer shall not include special categories of personal data or other sensitive personal data in reports, tickets or attachments; where an example is needed for reproduction, anonymised or pseudonymised data shall be used.

5.6 The telephone channel is intended for genuinely urgent matters only. In the event of repeated improper use, Trivle may restrict the use of this channel.

6. Incident classification and response

6.1 The Customer proposes a Severity when reporting an Incident. Trivle determines the final Severity reasonably and in consultation with the Customer, and explains any reclassification.

6.2 The following Severities, Response Times and Target Resolution Times apply:

6.3 Response Times are firm obligations. Availability incidents are detected automatically by Trivle’s monitoring; where the monitoring detects a P1 Incident, Trivle opens the Incident itself and informs the Customer in accordance with Article 7.

6.4 Target Resolution Times are best-efforts obligations. Per calendar quarter, Trivle resolves at least 80% of the Incidents in each Severity class within the applicable Target Resolution Time, provided that at least five (5) Incidents in that class were reported in that quarter; below that number, Trivle uses its best efforts to meet the Target Resolution Time in each individual case. The following are not taken into account in the measurement: time during which Trivle is waiting for information, access, approval or a decision from the Customer or its Users, and Incidents that fall outside the scope of this SLA under Article 8.5(b) or Article 14. Resolution also depends on the complexity of the Incident and on dependencies on third parties.

6.5 If Trivle does not meet the norm of Article 6.4 for a Severity class in a quarter, Trivle reports this to the Customer with an explanation and an improvement plan. If the norm for the same Severity class is not met in two (2) consecutive quarters, the Customer is entitled, as from the second quarter, to a Service Credit of 20% of the Monthly Fees for that quarter. Regardless of the number of Severity classes that do not meet the norm, this Service Credit amounts to no more than 20% of the Monthly Fees per quarter and is granted for no more than two (2) quarters per calendar year. This Service Credit is the sole and exclusive financial remedy for not meeting the Target Resolution Times. Article 4.3 and 4.4 apply accordingly.

6.6 In classifying Incidents, the combined impact of related or simultaneous Incidents is also considered. If, within a period of ten (10) Business Days, three (3) or more open Incidents affect the same part of the Platform and together cause a demonstrable commercial or operational impact, the Customer may request that these Incidents be treated jointly at one Severity level higher. The Parties determine the reclassification in mutual consultation; the increase is limited to one level.

7. Incident communication

7.1 Trivle acknowledges each P1 Incident and informs the Customer’s designated contact within one (1) Business Hour after the Incident has been reported or detected.

7.2 During a P1 Incident, Trivle provides status updates at least every two (2) hours during Business Hours until Resolution. For other Severities, Trivle informs the Customer of material progress and of the Resolution.

7.3 Within five (5) Business Days after Resolution of a P1 Incident, Trivle provides a written post-incident report describing the timeline, the root cause, the impact (duration, affected functionality and Users) and the corrective and preventive measures taken or planned.

7.4 Communication takes place by e-mail to the contacts listed in Annex A and, where appropriate, by telephone. Security incidents involving personal data are handled in accordance with Article 10.3.

8. Maintenance, updates and patch policy

8.1 Trivle continuously maintains and develops the Platform. Updates, bug fixes and security patches are included in the subscription at no additional cost. As the Platform is a multi-tenant service, updates are made available to all customers and the Customer always uses the current version of the Platform.

8.2 Every change to the Platform passes an automated continuous integration (CI) pipeline, including code style checks and an automated suite of more than 4,000 tests, before it can be deployed to production.

8.3 Third-party dependencies are monitored continuously. Proposed dependency updates are reviewed weekly (using Dependabot) and package vulnerability audits are carried out.

8.4 Security vulnerabilities in the Platform or its dependencies are addressed according to the following patch policy. The severity of a vulnerability is assessed by Trivle, taking into account its published severity rating and its exploitability in the context of the Platform.

Where no fix is available yet, Trivle takes reasonable mitigating measures where possible.

8.5 Regressions are handled as follows:

(a) If a change made by Trivle to the Platform causes a demonstrable regression in documented functionality, the remedy is treated as a bug fix and is carried out at no cost to the Customer, classified in accordance with Article 6.

(b) If a failure or deviation results from (i) incorrect or incomplete instructions or requirements of the Customer, (ii) acts of the Customer or its Users, or (iii) a change previously made at the Customer’s request as custom work, the remedy is carried out at the agreed hourly rate.

8.6 Trivle carries out regular, planned maintenance as far as possible within the weekly Maintenance Window: every Friday from 06:00 to 08:30 CET/CEST, before the start of Business Hours. Maintenance within this window does not require individual notice.

8.7 For planned maintenance outside the Maintenance Window that is expected to cause significant downtime or impact, Trivle notifies the Customer at least two (2) Business Days in advance, stating the expected time and duration. Trivle schedules such maintenance as far as possible at times of low usage.

8.8 Where urgent maintenance is necessary for the security, stability or availability of the Platform, including security patches, Trivle may carry out such maintenance immediately and without prior notice. Trivle informs the Customer as soon as possible of its nature and impact, in advance where possible and otherwise immediately afterwards.

8.9 Breaking changes to documented public APIs, including the OAuth2-based integration interfaces, are announced at least six (6) months in advance, except where a shorter period is required for security reasons, in which case Trivle gives as much notice as reasonably possible.

9. Backups, business continuity and recovery

9.1 The application servers of the Platform are hosted in the Netherlands by TransIP, in ISO 27001-certified data centres, and are managed via Ploi. The current list of sub-processors is available at https://www.trivle.com/legal/sub-processors.

9.2 Automated database backups are made at least daily and stored at an offsite location within the European Union. Backups are retained for thirty (30) days.

9.3 Files uploaded to the Platform are stored in redundant cloud object storage.

9.4 Trivle tests its restore procedures at least once a month.

9.5 In the event of a disaster that requires the Platform to be restored from backups, Trivle uses the following recovery objectives:

9.6 Backups are intended for the recovery of the Platform as a whole. Restoring individual records or data of a single customer at the Customer’s request, for example after deletion by a User, is not part of the standard service and is carried out, where technically feasible, at the agreed hourly rate.

9.7 Upon termination of the Subscription Agreement, Trivle provides, at the Customer’s written request, one standard export of the Customer’s data (in CSV/JSON format, together with the uploaded files) free of charge. Additional migration assistance is provided at the agreed hourly rate. The deletion of personal data after termination is governed by the DPA.

10. Security and data protection

10.1 Trivle takes appropriate technical and organisational measures to secure the Platform and the data processed through it. These measures are described on Trivle’s trust page at https://www.trivle.com/trust.

10.2 Personal data is processed in accordance with the DPA. In the event of any conflict between this SLA and the DPA with respect to personal data, the DPA prevails.

10.3 Security incidents involving personal data are handled in accordance with the DPA. Trivle notifies the Customer of a personal data breach without undue delay and at the latest within twenty-four (24) hours after becoming aware of it.

10.4 Questions about data protection can be addressed to privacy@trivle.com.

11. Customer responsibilities

11.1 To enable Trivle to meet the service levels in this SLA, the Customer shall:

(a) provide first-line support to its Users in accordance with Article 5.2;

(b) designate contacts for support and escalation and keep the contact details in Annex A up to date;

(c) report Incidents promptly through the channels set out in Article 5.3, with the information referred to in Article 5.5;

(d) provide the information, access, cooperation and decisions that Trivle reasonably requires to resolve Incidents;

(e) manage User accounts and administrator rights, ensure that Users keep their login credentials confidential, and report any suspected unauthorised access to Trivle without delay;

(f) ensure that its own equipment, networks and browsers meet the requirements set out in the Platform’s documentation;

(g) use the Platform in accordance with the Subscription Agreement and the Platform’s documentation; and

(h) for integrations with the Platform, keep its OAuth2 client credentials secure, follow the API documentation and act on announced changes in good time.

12. Reporting and service reviews

12.1 On request, Trivle provides a monthly availability report stating the Availability achieved, any Downtime and any Excluded Downtime in the relevant month.

12.2 Where the norm of Article 6.4 is not met, Trivle reports this in accordance with Article 6.5.

12.3 For customers with custom work, the Parties hold a quarterly service review covering Incidents, open items, planning and agreed improvement measures.

13. Escalation

13.1 If the Customer considers that an Incident is not being handled in accordance with this SLA, or if the Parties disagree on its Severity, the Customer may escalate the matter as follows:

13.2 The contact details for each escalation level are listed in Annex A. Escalation does not suspend the obligations of either Party under this SLA.

14. Exclusions

14.1 The service levels, Response Times, Target Resolution Times and Service Credits under this SLA do not apply to Incidents caused by:

(a) acts or omissions of the Customer or its Users, including use of the Platform contrary to the Subscription Agreement or the Platform’s documentation;

(b) the Customer’s equipment, networks, software or browsers, or those of its Users;

(c) products or services of third parties that are not provided by Trivle under the Subscription Agreement, including integrations built by or for the Customer;

(d) modifications to the Platform or its configuration made by anyone other than Trivle;

(e) force majeure as defined in the General Terms and Conditions;

(f) beta, preview or experimental features that the Customer has requested or has chosen to use; or

(g) the Customer’s failure to fulfil its responsibilities under Article 11.

14.2 At the Customer’s request, Trivle may nevertheless assist in resolving such Incidents at the agreed hourly rate.

14.3 The limitations of liability in the General Terms and Conditions apply. Nothing in this SLA extends Trivle’s liability beyond those limitations.

15. Term, changes and governing law

15.1 This SLA enters into force on Effective date and runs for as long as the Subscription Agreement remains in force. It terminates automatically when the Subscription Agreement terminates, without prejudice to provisions that by their nature are intended to survive termination, including Article 9.7.

15.2 Changes to this SLA are valid only if agreed in writing by both Parties. Revisions of Trivle’s standard SLA template do not affect this SLA unless the Parties agree otherwise in writing.

15.3 This SLA is governed by the laws of the Netherlands. Any disputes arising from or in connection with this SLA shall be submitted exclusively to the competent court of the District Court of Overijssel (Rechtbank Overijssel), the Netherlands.

Annex A – Severity matrix and contact sheet

A.1 Severity matrix

The examples below are illustrative only. The definitions in Article 6.2 are decisive.

A.2 Trivle contacts

A.3 Customer contacts

A.4 Customer-specific arrangements