INTRODUCTION
Last Updated: October 20th, 2023
This Service Specific Terms Addendum sets forth the additional terms and conditions that apply to Your use of the applicable Services listed below. Capitalized terms not defined in these terms have the meaning given to them in the Cloud Terms and Conditions.
1. Webroot Services
1.1 Webroot Business Endpoint Protection (“WEP”), DNS Protection (“DNSP”), and Security Awareness Training (“SAT”). Your purchase and use of WEP, DNSP and SAT are subject to the additional terms:
- The Webroot Business services may be ordered as (a) an annual subscription for a fixed quantity plus excess usage measured and billed monthly or (b) a month-to-month usage-based subscription. Month-to-month subscriptions may be cancelled by providing written notice no less than 30 days prior to the end of the next billing period. By way of example, if a month-to-month subscription begins on January 10th, and notice of cancellation is provided on February 16th, the service will be provided through April 9th, and the final invoice will cover usage from March 10th to April 9th.
- Specific to WEP, the following shall apply:
- “Quantity” means the number of Endpoints where an end user is authorized to use or deploy the services.
- “Endpoint” means a single supported desktop, server, or mobile device, whether physical or virtual.
- Excess usage or usage for purposes of a month-to-month usage-based subscription shall be calculated based on the number of Endpoints where an end user has used or deployed the services at any time within the billing period.
- Specific to DNSP, the following shall apply:
- “Quantity” means the number of Endpoints where an end user is authorized to use or deploy the services.
- “Endpoint” means a single supported desktop, server, or mobile device, whether physical or virtual.
- Excess usage or usage for purposes of a month-to-month usage-based subscription shall be calculated based on the number of Endpoints where the DNSP agent software is installed and that agent was (a) activated in DDFU’s system and not deactivated as of the last day of the prior billing period or (b) activated in Webroot’s system during the then-current billing period. In the event the DNSP agent software is not installed, DDFU will identify all DNS requests or queries via external IP address from an end user (each, a “Request”) and divide the number of Requests by 30 to get the 30-day average. The 30-day average is further divided by the average number of Requests per day per end user (as measured and defined by DDFU). The resulting number (rounded up to the nearest whole number) will be counted toward usage for the billing period.
- Specific to SAT, the following shall apply:
- “Quantity” means the number of Seats that an end user is authorized to use.
- “Seat” means unique email address uploaded to the service.
- Excess usage or usage for purposes of a month-to-month usage-based subscription shall be calculated based on the number of Seats used at any time within the billing period.
1.2 Webroot Secure File Share (formerly known as Zix Secure File Share). You are responsible for establishing the data retention settings for Your Content via a support request. In no event will Your Content be retained for longer than four (4) years.
1.3 Webroot Email Threat Protection Service (formerly known as Zix Email Threat Protection). The Service filters no more than 3,600 messages per hour inbound, 30 messages per minute outbound, or 10,000 messages per day per DDFU may throttle the volume of Your email traffic to conform to this quota. DDFU will make commercially reasonable efforts to notify You if any action has or will be taken.
1.4 Webroot Advanced Email Encryption (formerly known as Zix Email Encryption). Unless otherwise agreed in writing, the Services shall not be used to encrypt application-generated (bulk) emails. Additionally, DDFU reserves the right to display a short message on all outbound encrypted.
2. Carbonite Services
2.1 Hybrid Solution. A Hybrid Solution combines cloud-based data protection with on-site hardware provided by DDFU.
a. Additional Defined Terms.
“Client Software” means the DDFU proprietary software agents, clients and plug-ins that are installed on specific devices used to extract Your Content from such devices.
“Hybrid Solution” is comprised of three components: (a) the Services, (b) the Software Components and (c) the HWaaS.
“Installed Software” means the DDFU software that is pre-loaded onto the HWaaS.
“Hardware as a Service” or “HWaaS” means the leased hardware components in the on-site hardware.
“License Period” means the term set forth in an Order Documentation.
“Licensed Location” means the location where You are authorized by DDFU to use the Hybrid Solution.
“Software Components” means the Client Software and the Installed Software.
2.2 License Grants. Except for the limited rights granted herein, DDFU and its licensors retain all right, title and interest in and to the Software Components and the HWaaS and all intellectual property rights therein.
a. The Services. The cloud back-up component of the Hybrid Solution is licensed pursuant to the Cloud Terms and Conditions.
b. Software Components. For the License Period, DDFU grants to You a non-exclusive, non-transferable, revocable, fee-bearing, limited license (without the right to sublicense) to install, execute and use the Software Components solely: (i) in object code format, and (ii) for Your internal business purposes in the Licensed Location, with no right to make such software available to third parties either by transferring copies thereof or by providing a hosted service. The Installed Software may be used solely on the HWaaS, as installed thereon.
c. HWaaS. HWaaS is provided to You only as part of the Hybrid Solution. HWaaS is not sold to You, and no transfer of title in the HWaaS is effectuated in connection with the Hybrid Solution. The HwaaS shall not be deemed to be a fixture of any part of Your premises. For the License Period, DDFU grants to You a non-exclusive, non-transferable, revocable, fee-bearing, limited lease (without the right to sublease) to use the HwaaS solely: (i) as part of the Hybrid Solution and (ii) for Your internal business purposes in the Licensed Location, with no right to otherwise transfer the HwaaS to any third party, or otherwise grant access to third parties to use the HwaaS for any purpose, including but not limited to use of the HwaaS to provide a hosted service to third parties. No other use of the HwaaS is permitted. The HWaaS may not be used separate and apart from the Installed Software. You may not sell, lease, abandon, or give away the HwaaS or permit any unauthorized third party to access or use the HwaaS.
2.3 Your Responsibility for Maintenance of Appliance. You agree that You will: (a) store and operate the HwaaS in a manner so that the HwaaS remains in good operating condition and (b) not allow anyone other than DDFU or its authorized agent(s) to service or access the Software Components or HwaaS. In the event the HwaaS requires repair or replacement, DDFU will, in its sole discretion, repair or replace the HwaaS at DDFU’s expense, provided, however, that if the HwaaS is in need of repair or replacement as a result of Your actions, omissions, or violation of the Agreement, You authorize DDFU to invoice You a non-refundable fee equal to the costs incurred by DDFU to repair or replace the HwaaS and all shipping and handling fees associated with the repair or replacement. You agree to pay any such invoice within thirty (30) days of Your receipt of such invoice.
2.4 Restrictions. The HwaaS is not licensed for use in life support systems, human implantation, nuclear facilities or any other application where HwaaS failure could lead to loss of life or property damage. If You use the HwaaS for use in such applications or fails to comply with the manufacturer’s specifications, You acknowledge that (a) any such use or non-compliance is at Your sole risk, (b) DDFU and its licensors and suppliers are not liable, in whole or in part, for any claim or damage arising from such use, and (c) You shall indemnify, defend and hold DDFU, its licensors and suppliers harmless from any claims, damages, losses, costs, expenses and liabilities arising out of or in connection with such use, including if applicable (i) DDFU’s compliance with Your designs, specifications, or instructions, (ii) modification of any HwaaS by anyone other than DDFU, or (iii) use of the HwaaS in combination with other products or in violation of this clause.
2.5 Return of HwaaS. You agree to promptly return the HwaaS in an undamaged condition within ten (10) calendar days of non-renewal, cancellation, or expiration of the Hybrid Solution or issuance of replacement HwaaS to You (the “Return Period”). You are solely responsible for deleting Your Content stored on any HwaaS prior to returning the HwaaS to DDFU. You acknowledge and agree that DDFU will not be responsible for any use or disclosure of any of Your Content that remains on any returned HwaaS. You will be responsible for the (a) cost of shipping and handling in connection with the return of the HwaaS to DDFU and (b) risk of loss associated with the HwaaS until it arrives at DDFU’s warehouse. DDFU reserves the right to invoice You for the replacement cost of the HwaaS if DDFU does not receive the HwaaS by the end of the Return Period. All such payments are due within thirty (30) days of the invoice date.
3. Cloud Disaster Recovery Services (“CDR Services”)
The CDR (Cloud Disaster Recovery) Services consist of cloud-based, managed services that enable: (a) ongoing availability of Your information technology operations and (b) recovery of mission-critical applications, servers, and data in the cloud after a Disaster (as defined below).
3.1 Performance
a. DDFU will provide to You a disaster recovery plan (a “DR Plan”) as set forth in the Order Documentation. The Order Documentation and DR Plan will identify the service level purchased (e.g., 1 hour recovery, 24 hour recovery or 48 hour recovery), the Fees to be paid, the equipment covered by the CDR Services (the “Covered Equipment”) and the premises where the Covered Equipment is located (the “Covered Site”). DDFU will provide the CDR Services solely in connection with the Covered Equipment as configured at the Covered Site and as described in the DR Plan. Equipment and devices not identified in the DR Plan or not accurately described and/or configured in accordance with the DR Plan fall outside the scope of the CDR Services. If the Covered Equipment and/or configurations identified in the DR Plan are different than the Covered Equipment and configuration in the Order Documentation, and DDFU is required to expand greater resources to provide the CDR Services, DDFU will require You to enter into amended Order Documentation that accurately reflects the CDR Services to be provided in accordance with the DR Plan.
b. In the event that You: (i) are unable to use the Covered Equipment in a production environment at the Covered Site for its intended computer processing and related business production purposes (a “Disaster”); and (ii) provide DDFU notice of such Disaster in accordance with the DDFU procedures then in effect; then DDFU will provide You with remote access to a DDFU-hosted environment that duplicates the functionality of the Covered Equipment at the Covered Site as described in the DR Plan (the “Duplicate Environment”) and Your Content as hosted in the Duplicate Environment, subject further to the terms herein. DDFU will continue to operate the Duplicate Environment until You have informed DDFU via email that You are again able to use the Covered Equipment in a production environment at the Covered Site, and that the Disaster has ended (“Covered Site Restoration”).
3.2 Individuals Designated to Declare a Disaster. A Disaster may be declared only by the individuals authorized by You in the respective Order Documentation, DR Plan or otherwise identified by You in writing. You may change the designated individuals by written notice to DDFU.
3.3 Disaster Fees. In addition to the monthly fees for the CDR Services are set forth in the applicable Order Documentation, in the event of a Disaster, You will pay the additional Disaster specific fees then in effect. These include a per-server fee for each Disaster declaration.
3.4 Your Materials. You hereby grant to DDFU a non-exclusive, worldwide, royalty-free, right and license to reproduce and use the software, applications, and Your Content necessary for DDFU to create and maintain the Duplicate Environment (the “Your Materials”) solely as necessary to perform the CDR Services. Customer represents and warrants that: (a) it has all the rights necessary to grant the foregoing license and (b) that DDFU’s reproduction and use of Your Materials will not infringe the rights of any third party, including any intellectual property or privacy rights. You shall indemnify, defend and hold harmless DDFU for any claims, damages, or losses (i) relating to the use of Your Materials or (ii) arising from a third party’s claim that Your Materials infringe on such third party’s intellectual property rights.
3.5 Your Obligations.
a. General. You shall:
i. Notify DDFU of any changes to Your Covered Equipment or Covered Site and update Your portal accordingly. Changes to Your Covered Equipment or Covered Site include without limitation, adding servers or changes to servers.
ii. Determine whether the service level selected by You and specified in the applicable Order Documentation is sufficient to meet Your requirements for continuing its information processing activities in the event of a Disaster.
iii. Comply with DDFU’s policies and procedures, including such policies related to declaring a Disaster and confirming Covered Site Restoration.
iv. Perform Your obligations identified in the DR Plan or otherwise agreed upon by the parties and related to the CDR Services.
v. Maintain the Covered Equipment at the Covered Site in accordance with operational requirements, and to the extent that any Covered Equipment is third-party equipment, in accordance with the requirements of the third-party equipment manufacturer.
vi. Provide to DDFU a SAVSYS tape or SAVSYS optical media if the CDR Services are used in an IBM environment prior to commencement of the CDR Services each time the operating system on the Covered Equipment is upgraded and as otherwise may be requested by DDFU.
vii. Create and monitor the traffic on the tunnel if an IPsec tunnel is required (DDFU only provides the end target for the IPsec tunnel).
viii. Provide a site edge device to be supported by Cisco for IPsec tunneling to initiate the IPsec tunnel.
ix. Maintain and monitor the status and health of the domain controller.
x. Conduct disaster recovery testing as provided in Section 3.5(b) below.
xi. Support and maintain Your Materials in the Duplicate Environment in accordance with the Service Documentation and create and maintain a domain controller in the Duplicate Environment in connection with CDR Services with a 1-hour service level.
b. Testing. In accordance with the DR Plan and the CDR policies and procedures then in effect (“CDR Policies”), You will conduct disaster recovery testing (a “CDR Test”). During a CDR Test, You shall provide to DDFU Your encryption key(s) and the required accounts necessary for operating system access to recover machines, i.e. local administrator, domain administrator, root or (sudo) or QSECOFR. You shall remain responsible for all configurations of any third-party software according to third-party vendor specifications. You will perform the CDR Test, within a reasonable amount of time after purchase, in accordance with DDFU’s instruction. A CDR Test will be completed using Your actual servers, server application sets and server count, as defined in the DR Plan. DDFU will provide You with access to a Duplicate Environment in order to conduct a CDR Test, subject to the number of tests permitted under the level of CDR Services purchased by You, as set forth in the applicable Order Documentation. If You require additional CDR Tests, a Duplicate Environment may be available to You at DDFU’s then-current fees. You will schedule CDR Tests with at least sixty (60) days advanced written notice to DDFU and in accordance with the CDR Policies. Priority for use of the Duplicate Environment is given to customers that have a declared Disaster. Accordingly, DDFU reserves the right to reschedule CDR Tests. If during a CDR Test DDFU is unable to activate and operate the Duplicate Environment in material compliance with the DR Plan (the “CDR Test Target), DDFU reserves the right to troubleshoot and re-conduct the CDR Test. If after reasonable efforts DDFU is unable to meet the CDR Test Target, either party may terminate the CDR Services (and the applicable portion of any Order Documentation) and DDFU will refund to You any prepaid but unused fees as Your sole and exclusive remedy. Each party’s right of termination under this Section 3.5(b) must be exercised by written notice of its intention to terminate the CDR Services within forty-five (45) days of the failed CDR Test or such right of termination will be waived.
c. Disaster. At any time between the date that You declare a Disaster and the date of Covered Site Restoration (the “Disaster Recovery Period”), You will:
i. Provide assistance and otherwise perform the obligations as set forth herein.
ii. Comply with all CDR Policies, including that You will provide DDFU encryption keys as necessary to activate the Duplicate Environment.
iii. Re-route all external IP addresses and aliases to the IP addresses associated with the Duplicate Environment.
iv. Make available any equipment, software, workspace, supplies, and personnel and/or telecommunications services needed to activate and operate the Duplicate Environment, including those not specifically identified in the DR Plan.
v. Provide Your own equipment, such as laptops, in order to access and use the Duplicate Environment.
vi. Provide the appropriate skills and knowledge required to recover, support and maintain the business applications being recovered in the Duplicate Environment.
vii. Work diligently to install applications on the Covered Equipment at the Covered Site with the intent of obtaining Covered Site Restoration.
viii. Be responsible for all configurations of any third-party software according to third party vendor specifications.
ix. Provide the required accounts necessary for operating system access to recover the machines, i.e. local administrator, domain administrator, root or (sudo) or QSECOFR.
d. Remedy. You may, as the exclusive remedy for DDFU’s material breach of : (i) terminate the Agreement within five (5) days advance notice; and (ii) receive a refund equal to the fees paid to DDFU for the three (3) month period immediately preceding the Disaster. This remedy does not apply to (i) Your breach of Your obligations under the Agreement or any other cause beyond DDFU’s reasonable control, (ii) any self-service Disaster declarations, tests or failovers, or (iii) any period of time outside the DR Plan, including but not limited to the restoration of the Covered Equipment at the Covered Site.
4. Carbonite Information Archiving Services (formerly known as Zix Information Archiving Services) (“Archiving Services”)
Carbonite Information Archiving Services (formerly known as Zix Information Archiving Services) (“Archiving Services”)
4.1 Third-party accounts. You are responsible for configuring applicable third-party platforms or systems to transmit Your Content to the Archiving Services. You are responsible for obtaining any necessary consents from each individual end user (in compliance with applicable laws and regulations) to allow DDFU to provide the Archiving Services. Third-party email, social media, and other communication services are not offered, controlled, or provided by DDFU, and DDFU is not responsible for how a third party transmits, accesses, processes, stores, uses or provides data to Your Content sent on removable media to DDFU for import into the Archiving Services may be subject to import fees. In addition, such third-party services are subject to the terms and conditions and privacy policies applicable to those services, including, without limitation, the following terms:
YouTube terms and conditions: https://www.youtube.com/t/terms
Google services privacy: https://policies.google.com/privacy?hl=en-GB
Google Account Access permisions: https://security.google.com/settings/security/permissions
4.2 Data Retention. You are responsible for using the Archiving Services in accordance with applicable law, third-party email service terms and conditions, and Your own internal retention requirements. In order for Your Content to be retained after the Subscription Term to Archiving Services has expired, You must purchase extended data retention at an additional charge. At the end of the Subscription Term (or upon termination, if earlier). The Archiving Services allow You to download archived information, and professional data exportation may be available at an additional charge by signing a separate Order Documentation.
4.3 FINRA/SEC Archiving Obligations. This Agreement does not relieve You from any applicable responsibilities You may have under SEC Rules 17a-3 and 17a-4. If You elect to cease using the Archiving Services for some or all of Your records preservation, the obligation to maintain and preserve books and records reverts back to You and You must provide written instructions to DDFU in order to transfer Your records to an alternative recordkeeping service.
5. Carbonite Cloud-to-Cloud Backup Services (also known as CloudAlly SaaS Data Protection Platform) (“Cloud-to-Cloud Backup Services”)
5.1 Access to Data. Other than for the purposes of performing the Cloud-to-Cloud Backup Services, or for other services performed with Your consent, and subject to applicable law, DDFU will not access Your Content without Your permission, and Your Content will be decrypted only per Your authorization when You view, index, virus scan, export or restore such data. DDFU reserves the right to impose limits on abusive or excessive use, as determined by DDFU, in DDFU’s sole discretion. DDFU may set reasonable storage limits in the future. Upon termination of the Cloud-to-Cloud Backup Services, DDFU will use reasonable commercial efforts to send notification of such termination to the email address provided by You, informing You that Your access to the Cloud-to-Cloud Backup Services will be discontinued, and Your Content will be deleted after 14 days without a recovery option. DDFU will have no liability if You fail to receive the email or act in accordance with the email, or if Your Content is deleted following such period.
5.2 Limitation. You agree not to use or launch any automated system, including without limitation, “robots,” “spiders,” and “offline readers,” that accesses the Cloud-to-Cloud Backup Services, or any site or portal used to provide them, in a manner that sends more request messages to our servers in a given period of time than a human can reasonably produce in the same period by using a conventional online web browser. DDFU reserves the right to revoke these exceptions either generally or in specific cases.
5.3 Acknowledgement. YOU ACKNOWLEDGE THAT AN INTEGRAL FUNCTION OF THE CLOUD-TO-CLOUD BACKUP SERVICES IS PERFORMED THROUGH A THIRD-PARTY STORAGE PROVIDER SELECTED BY YOU OR, IF NOT OTHERWISE SPECIFIED BY YOU, USED BY DEFAULT (I.E., AMAZON S3 STORAGE IS THE DEFAULT) (THE “STORAGE PROVIDER”). DDFU THEREFORE CANNOT WARRANT AND HEREBY DISCLAIMS ANY RESPONSIBILITY WITH RESPECT TO THE INTEGRITY, RELIABILITY, SECURITY, QUALITY, COMPATIBILITY WITH YOUR SYSTEMS AND AVAILABILITY OF THE SERVICES PROVIDED BY THE STORAGE PROVIDER AND THEIR EFFECT ON THE CLOUD-TO-CLOUD BACKUP SERVICES AND/OR THE DATA. YOU ACKNOWLEDGE THAT THE DATA SHALL BE STORED AND HANDLED BY THE STORAGE PROVIDER IN ACCORDANCE WITH THE INTERNAL TERMS OF USE OF THE STORAGE PROVIDER (INCLUDING ANY AUP OR PRIVACY POLICY) TO WHICH YOU HEREBY AGREE TO ADHERE. ACCORDINGLY, YOU SHALL INDEMNIFY DDFU FROM ANY CLAIMS ARISING FROM A BREACH BY YOU OF THE SAME AND SUCH BREACH SHALL ENTITLE DDFU TO IMMEDIATELY SUSPEND OR TERMINATE THE CLOUD-TO-CLOUD BACKUP SERVICES.