Service Level Agreement (SLA) of regfish GmbH

Note on the authoritative language: This English text is a non-binding convenience translation. The legally binding and authoritative version is the German original (available at regfish.de/legal/sla). In the event of any discrepancy between this translation and the German version, or in the event of a dispute, the German version shall prevail.

This Service Level Agreement (hereinafter the “SLA”) governs the service quality levels promised by regfish GmbH, Bleichstraße 8a, 35390 Gießen (hereinafter “regfish”, “we” or “us”) for certain services, in particular the availability, the maintenance modalities, the response and restoration times as well as the credits (service credits) relating thereto. For reasons of better readability, a consistent gender-specific differentiation is dispensed with in the following. The terms “customers” (in the German feminine and masculine forms) refer to all contractual partners; in the following, the single term “customer” is used uniformly, which refers equally to all genders. This SLA contains provisions that apply exclusively vis-à-vis business customers (entrepreneurs within the meaning of section 14 of the German Civil Code (BGB)); such provisions are either marked in the respective provision as “vis-à-vis business customers only” or arise from this preliminary remark. The availability commitments, response times and service credits laid down in this SLA apply only vis-à-vis business customers and only insofar as an SLA has been expressly agreed or a service promised thereunder with an availability has been booked; vis-à-vis consumers within the meaning of section 13 BGB they are not elevated to an agreed quality (Beschaffenheit). Vis-à-vis consumers, the usual provision appropriate to the state of the art applies (cf. § 13 (2) of the GTC); the statutory claims for defects and damages remain unaffected and are not limited by this SLA.

(1) This SLA applies only insofar as it has been expressly agreed between regfish and the customer, or a service has been ordered for which an availability is promised under this SLA. Insofar as no availability is expressly promised under this SLA for a service (best-effort services, see § 4 paragraph 4), this SLA does not establish any availability claims and no service credits for that service. (2) This SLA supplements the General Terms and Conditions of regfish GmbH (hereinafter the “GTC”, available at regfish.de/legal/terms), the respectively applicable additional terms and service descriptions (available at regfish.de/legal/additional-terms) as well as the acceptable use policy (AUP) (available at regfish.de/legal/acceptable-use). It specifies the owed quality of the covered services in the sense of an agreement on quality and supplements it with the service credits set out in § 9. (3) In the event of contradictions between the contractual documents, the following order of precedence applies, whereby the respectively higher-ranking document supersedes the lower-ranking one insofar as a contradiction exists: – individual agreement between regfish and the customer, – data processing agreement (exclusively for the area of data protection, available at regfish.de/legal/dpa), – additional terms and service description, – this SLA, – GTC, – acceptable use policy (AUP). (4) Higher or individual service levels (enterprise SLA) may be agreed separately (see § 12). Any such individual agreement takes precedence over this SLA as an individual agreement.

(1) This SLA determines which service quality is deemed to be in conformity with the contract and grants the customer, in the event of a shortfall below the promised availability, the service credits set out in § 9. (2) The customer’s statutory warranty and damages claims remain unaffected by this SLA. The service credits under § 9 are not the customer’s exclusive remedy. Insofar as the customer is entitled to statutory claims going beyond the service credits, these remain in existence; granted service credits are, however, credited against further-reaching claims for damages based on the same set of facts in accordance with § 9 paragraph 6. (3) The liability of regfish is otherwise governed by the provisions of the GTC (regfish.de/legal/terms). Liability for intent and gross negligence, for injury to life, body or health, for the culpable breach of material contractual obligations as well as under the German Product Liability Act and to the extent of an expressly assumed guarantee remains unaffected. Material contractual obligations are those obligations whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer may regularly rely.

(1) “Service time” is the period during which a service is intended to be available. Unless otherwise stated in the list under § 4, the service time is 24 hours on 7 days a week (24/7), that is to say it comprises the entire measurement period. (2) “Measurement period” is the respective calendar month. Availability is determined separately per calendar month and per affected service. (3) “Measurement point” is the handover point of the regfish network to the public internet (data centre boundary or outer boundary of the infrastructure for which regfish is responsible). The reachability and functionality of a service is measured at this measurement point, not at the customer’s end device or connection. (4) “Availability” is the ratio, expressed as a percentage, of the actual operating time of a service to the service time within the measurement period, calculated in accordance with § 6. (5) “Outage” or “downtime” is the complete unreachability or inability to function of a covered service at the measurement point during the service time, for which regfish is responsible. Only a contiguous outage of more than five minutes’ duration is deemed downtime within the meaning of this SLA. Periods which, pursuant to § 7 (planned maintenance, emergency maintenance) or § 8 (exclusions), do not count as downtime are disregarded in the calculation. (6) “Planned maintenance” means works on the infrastructure or on the services announced in advance (for example updates, configuration changes, hardware or software maintenance) that are necessary to maintain and improve operations. (7) “Emergency maintenance” means measures that cannot be postponed and are intended to avert acute dangers to the operation, the security or the integrity of the services or the data, in particular to close critical security vulnerabilities or to ward off ongoing attacks that cannot tolerate any postponement until a planned maintenance window. (8) “Disruption” is an impairment of the contractually compliant function of a service. Disruptions are classified into priority classes in accordance with § 5. (9) “Status page” is the information page available at status.regfish.de on which regfish provides information about the operating status, disruptions and planned maintenance works.

(1) regfish promises for the services listed below the respectively stated availability per calendar month. The commitments apply separately per affected service. The promised percentage value is always authoritative; the minute equivalents stated in brackets serve only for illustration and are irrelevant in the event of a contradiction. The minute equivalents denote the maximum permissible creditable downtime per calendar month for a month assumed to have 30 days (43,200 minutes); in the event of a differing month length, the value calculated accordingly applies. (2) List of the promised availabilities: – Authoritative DNS / DNS hosting (authoritative name servers, DNSSEC, hidden primary): 99.9 percent per calendar month (maximum creditable downtime approximately 43 minutes and 12 seconds per month). – Web hosting and WordPress hosting: 99.5 percent per calendar month (maximum creditable downtime approximately 3 hours and 36 minutes per month). – Email services (mailboxes and forwardings): 99.5 percent per calendar month (maximum creditable downtime approximately 3 hours and 36 minutes per month). – Customer backend / control panel (management interface “dash”): 99.5 percent per calendar month (maximum creditable downtime approximately 3 hours and 36 minutes per month). (3) The availability relates in each case to the reachability and basic function of the service at the measurement point (§ 3 paragraph 3). The delivery of DNS responses presupposes that the respective zone is active and correctly configured at regfish; the functionality of the underlying domain registration itself is not the subject of this availability commitment (see paragraph 5). (4) For the following services, no availability within the meaning of this SLA is promised; they are provided as best-effort services with the care customary in the industry and do not establish any service credits: – web forwarding (HTTP forwarder), – public API (DNS/TLS automation), – DynDNS, – tools and functions provided free of charge as well as test, preview and beta offerings. The statutory rights of the customer remain unaffected also for these services. (5) No availability commitment within the meaning of this SLA exists for services whose provision or continued existence depends on third parties that are not subject to the area of responsibility of regfish. This concerns in particular: – the registration, renewal, transfer and continued existence of domains, since these depend on the operation and the decisions of the respective registry (in particular DENIC eG, EURid, nic.at, Nominet); details are governed by the additional terms (regfish.de/legal/additional-terms), – the issuance, renewal, suspension or revocation of TLS/SSL and other certificates, since these depend on the operation and the decisions of the respective certification authority (CA) (in particular DigiCert, Sectigo, GeoTrust, Thawte, RapidSSL) and the requirements of the CA/Browser Forum, – the handling of payments, which is effected via the payment service provider Stripe Payments Europe, Ltd. For these processes, regfish owes the careful handling within its own area of responsibility, but not the availability or the result of the systems for which third parties are responsible. (6) Insofar as a separate additional term or service description with differing availability values additionally exists for a service, the values agreed therein take precedence over the values of this section (see § 1 paragraph 3).

(1) For the purpose of determining the response and restoration times in accordance with § 10, disruptions are classified into the following priority classes. regfish carries out the classification at its dutiful discretion on the basis of the criteria set out below and the effects communicated by the customer. (2) Priority 1 (critical): A promised service has completely failed or is unusable in its core function, and there is no reasonable alternative. Examples: authoritative DNS delivers no responses; all mailboxes of a customer are unreachable; the web hosting of a customer is completely unreachable. (3) Priority 2 (significant): A promised service is impaired in material parts, but there is a limited usability or a reasonable alternative (workaround). Examples: significantly delayed delivery of emails; limited function of individual parts of the control panel. (4) Priority 3 (minor): A minor impairment without material effect on operations, a general enquiry or a change request. Examples: cosmetic errors in the interface; individual functions that are not operationally critical.

(1) The availability of a service is calculated per calendar month according to the following formula: Availability in percent = (service time − creditable downtime) / service time × 100. Here, the service time is the total duration of the measurement period (§ 3 paragraphs 1 and 2) and the creditable downtime is the sum of the outages within the meaning of § 3 paragraph 5 less the periods not to be credited pursuant to § 7 and § 8. (2) Authoritative for the measurement is the reachability at the measurement point (§ 3 paragraph 3). regfish measures the availability by means of its own, continuous monitoring. regfish provides information about material disruptions, their beginning and end as well as about planned maintenance works via the status page status.regfish.de. (3) The customer is obliged to report any unavailability it identifies without undue delay in accordance with § 11, so that regfish can determine the cause and remedy the impairment.

(1) regfish is entitled to carry out planned maintenance works. Planned maintenance is announced at least 72 hours in advance, as a rule via the status page status.regfish.de and, insofar as appropriate, by email. Planned maintenance is, insofar as technically possible, scheduled for low-traffic times (as a rule between 00:00 and 06:00 Central European Time) and limited to the necessary extent. (2) Properly announced and time-limited planned maintenance does not count as downtime and is disregarded in the calculation of availability pursuant to § 6. (3) regfish is entitled to carry out emergency maintenance (§ 3 paragraph 7) without observing the announcement period, insofar as this is necessary to avert acute dangers. regfish informs the customer about emergency maintenance without undue delay, as a rule via the status page, and limits the measure to what is necessary to avert the danger. Emergency maintenance does not count as downtime in this respect and is disregarded in the calculation of availability.

(1) Periods of unavailability that are based on the following circumstances do not count as downtime within the meaning of this SLA and are disregarded in the calculation of availability: – force majeure as well as other events for which regfish is not responsible and which are outside the reasonable sphere of influence (for example natural events, war, terror, pandemics, official orders, large-scale power or telecommunications outages, strikes and lockouts); – causes for which the customer or its vicarious agents are responsible, in particular misconfigurations, improper use, faulty content or applications of the customer, breaches of the acceptable use policy (AUP) as well as a suspension on account of default in payment in accordance with the GTC; – disruptions in networks, services or systems of third parties outside the area of responsibility of regfish, in particular in third-party networks, at transit and network operators and at the customer’s telecommunications providers; – outages, blocks, delays or other impairments at registries (in particular DENIC eG, EURid, nic.at, Nominet); – outages, blocks or revocations at certification authorities (in particular DigiCert, Sectigo, GeoTrust, Thawte, RapidSSL) as well as measures on account of the requirements of the CA/Browser Forum; – disruptions in the handling of payments via the payment service provider Stripe; – attacks by third parties, in particular overload attacks (DDoS), insofar as they are not the responsibility of regfish; – planned maintenance and emergency maintenance pursuant to § 7; – periods during which regfish must suspend, block or restrict the service on account of a statutory obligation, an official or judicial order or a binding decision in a dispute resolution proceeding (for example DENIC Dispute, UDRP, URS, ADR), insofar as the order or measure is not based on a circumstance for which regfish is responsible. (2) The exclusions under paragraph 1 leave the statutory rights of the customer unaffected and do not release regfish from the obligation to work towards the restoration of the service within its own area of responsibility with the care customary in the industry.

(1) If the actual availability of a service calculated pursuant to § 6 falls below the value promised pursuant to § 4 in a calendar month, the customer may demand a credit (service credit) in accordance with this section. The provisions of this section apply only vis-à-vis business customers; vis-à-vis consumers, the statutory rights remain unaffected and are not limited by this SLA. (2) Legal nature: Service credits are a lump-sum minimum compensation for damages in the form of a credit. They are expressly not a contractual penalty. The customer remains free to prove that no damage at all or damage of a substantially lower amount has arisen; regfish remains free to prove that no or a lower damage has arisen. (3) Amount of the credit: The service credit is measured by the net basic fee incurred in the affected calendar month for the affected service and amounts to: – in the event of a shortfall below the promised value, but with an achieved availability of at least 99.0 percent: 10 percent of the net basic fee of the affected service; – in the event of an achieved availability of at least 95.0 percent, but less than 99.0 percent: 25 percent of the net basic fee of the affected service; – in the event of an achieved availability of less than 95.0 percent: 50 percent of the net basic fee of the affected service. (4) Upper limit: The sum of the service credits for a service is limited per calendar month to 100 percent of the net basic fee incurred for that service in the relevant month. (5) Assertion: The customer must assert the service credit in text form within 60 days after the end of the affected calendar month, stating the affected service as well as the period and the duration of the unavailability. After the expiry of this period, the assertion of the service credit for the relevant month is excluded; further-reaching statutory claims and their limitation periods remain unaffected by this. The recognised service credit is offset against the next invoice or, if no ongoing fee is incurred any longer, paid out. (6) Crediting: Granted service credits are credited against further-reaching claims for damages of the customer that are based on the same unavailability. The statutory rights of the customer, in particular in the event of intent and gross negligence, in the event of injury to life, body or health as well as in the event of the breach of material contractual obligations, remain unaffected.

(1) regfish receives disruption reports via the channels named in § 11. The receipt and processing of Priority 1 reports takes place around the clock (24/7). Reports of Priorities 2 and 3 are processed within business hours (Monday to Friday, 9:00 to 17:00, excluding public holidays at the registered office of regfish). (2) Response time is the time span between the receipt of a proper disruption report via one of the channels named in § 11 and the start of processing by regfish (acknowledgement of receipt and commencement of the error analysis). regfish bindingly promises the following response times: – Priority 1: within 1 hour (within the service time 24/7); – Priority 2: within 4 hours within business hours; – Priority 3: within the next business day. (3) Restoration time is the time until the remedy of the disruption or until the provision of a reasonable alternative solution. regfish endeavours to remedy disruptions as quickly as possible depending on the priority. The restoration times set out below are target values which regfish undertakes to achieve to the best of its ability; they are not guaranteed deadlines for success, since the duration of the remedy depends on the type and cause of the disruption as well as on the cooperation of the customer and third parties: – Priority 1: remedy or alternative solution, as a rule, within 8 hours after response; – Priority 2: remedy or alternative solution, as a rule, within 2 business days; – Priority 3: remedy within the scope of regular operations. (4) Cooperation of the customer: During the processing of a Priority 1 or 2 disruption, the customer provides a reachable contact person, describes the error as precisely and reproducibly as possible and provides the information and acts of cooperation required for narrowing down and remedying it. Periods during which regfish is waiting for a required cooperation of the customer are not credited towards the response and restoration times.

(1) Disruptions are to be reported via the following channels: – by email to support@regfish.de, – by telephone at 0641 / 49 888 530, – via the ticket or support function provided in the customer backend. regfish publishes the current operating status as well as information on known disruptions and planned maintenance at status.regfish.de. (2) A disruption report should contain at least: the designation of the affected service, a description of the impairment and its effects, the time of occurrence as well as the contact details of a person reachable for queries. For Priority 1 disruptions, a telephone report with subsequent confirmation in text form is recommended. (3) Escalation levels: If a Priority 1 or 2 disruption is not processed within the response time promised pursuant to § 10, or if the progress of processing is not appropriate from the customer’s point of view, the customer may demand escalation. The escalation takes place in the following levels: – Level 1: processing by the responsible support; – Level 2: involvement of the technical team lead; – Level 3: involvement of the management. Upon request, regfish names to the customer the respectively responsible escalation point.

(1) Service levels going beyond or deviating from the provisions of this SLA (in particular higher availability commitments, extended service times, shorter response and restoration times, dedicated contact persons or differing service credit provisions) may be agreed separately between regfish and the customer in an individual agreement (enterprise SLA). (2) Any such individual agreement takes precedence over the provisions of this SLA (§ 1 paragraph 3). In all other respects, this SLA remains applicable insofar as the individual agreement does not make a differing provision.

(1) regfish is entitled to amend this SLA with effect for the future, insofar as this becomes necessary for valid reasons, in particular on account of a changed legal situation, technical developments, a change in market conditions or an expansion of the service offering, and the customer is not unreasonably disadvantaged thereby. Amendments are communicated to the customer in text form. The details, in particular regarding the right of objection and the entry into force of the amendment, are governed by the GTC (regfish.de/legal/terms). (2) Should individual provisions of this SLA be or become invalid or unenforceable, the validity of the remaining provisions shall remain unaffected thereby. In all other respects, the statutory provisions apply. (3) The law of the Federal Republic of Germany applies. The place of jurisdiction and further general provisions arise from the GTC (regfish.de/legal/terms). regfish GmbH, Bleichstraße 8a, 35390 Gießen Managing Directors: Carsten Müller, Andreas Mallek Commercial Register: Local Court of Gießen, HRB 6589 Telephone: 0641 / 49 888 530, Email: support@regfish.de