1. No category

MARKETING APPLICATIONS SERVICE LEVEL ADDENDUM
MARKETING APPLICATIONS SERVICE LEVEL ADDENDUM
1. SCOPE AND PURPOSE
This Service Level Addendum (SLA) describes the
levels of service that a customer using the software
applications of the Teradata Integrated Marketing
Cloud will receive from Teradata. This SLA will
provide a degree of certainty to customers as to
the qualitative aspects of the services they can
expect to receive. This SLA should be read
alongside the Agreement between the customer
and Teradata. It forms an important part of the
Agreement between the customer and Teradata
and aims to enable the two parties to work
together efficiently.
The following services are covered by this SLA:
•
General Service Standard (Page 1)
•
Support and Maintenance (Page 2)
•
Availability Cloud Software (Page 5)
•
Information Security (Page 6)
Teradata will provide the services in accordance
with the provisions of this SLA in such a manner that
the achieved service levels are equal or higher
than the service levels defined in this SLA.
2. DEFINITIONS
2.1 “Business Day” means a working day other than
Saturday, Sunday or public holiday at Teradata’s
registered address.
2.2 “Cloud Software” means both SaaS and Hosted
Software and excludes On-Premise Software.
2.3 “Demarcation Point” means the point at which the
public Internet connects to the Software’s border
router.
2.4 “Force Majeure” means acts of God or
government, civil commotion, military authority,
Marketing Applications Service Level Addendum (Version 1.0, English)
Page 1
war, riots, terrorism, strikes, fire, or other causes
beyond the parties’ reasonable control.
2.5 “Hosted Software” means a separate single-tenant
instance of the Software, hosted and operated by
Teradata and accessed by Customer remotely via
a standard web browser.
2.6 “On-Premise Software” means Software installed
and
operated
on
Customer’s
premises/in
Customer’s data center and not hosted and
operated by Teradata.
2.7 “SaaS” means “Software as a Service” and refers to
a centralized instance of the Software serving
multiple Customers, hosted and operated by
Teradata and accessed by Customer remotely via
a standard web browser.
2.8 “Software” in the context of this SLA means any
Teradata
standard
software,
excluding
Deliverables, modifications and customizations,
licensed to Customer under an Agreement that
references this SLA.
2.9 “Teradata” shall be the Teradata entity that
concluded the Agreement with the Customer.
3. GENERAL SERVICE STANDARD
Teradata will provide the Services with reasonable
skill and care and in accordance with the best
practice prevailing in the industry from time to time.
In the provision of the Services, Teradata uses
personnel who possess a degree of skill and
experience which is appropriate to the tasks to
which they are allotted and the performance and
Service Levels which they are required to achieve
and who shall perform those tasks in a workmanlike
and professional manner.
MARKETING APPLICATIONS SERVICE LEVEL ADDENDUM
4. SUPPORT AND MAINTENANCE
4.1 Support and Maintenance covers assistance and
consultation to assist Customer in resolving
problems with the use of the Software, including
the verification, diagnosis and correction of
material errors and defects in the Software and the
provision of bug fixes, corrections, modifications,
enhancements, upgrades and new releases to the
Software to ensure the functionality of the
Software.
4.2 Support and Maintenance and warranties do not
cover any problem with or damage to the
Software to the extent caused by (i) negligence,
abuse, misuse, improper handling, improper use,
improper storage or modifications by anyone other
than Teradata or its contractors; (ii) failure to
operate the Software in accordance with its
documentation
and/or
with
Teradata’s
specifications or limitations; (iii) modifications to the
Software that have not been approved or
provided by Teradata; (iv) acts of third parties; (v)
third party products not under a maintenance
agreement with Teradata and (vi) Force Majeure.
4.3 Teradata shall have no Maintenance and Support
obligations with respect to any hardware or
software product other than the Software
(“Nonqualified Products”). If Teradata provides
Maintenance and Support for a problem caused
by a Nonqualified Product, or if Teradata’s service
efforts are increased as a result of a Nonqualified
Product, Teradata may charge time and materials
for such extra services at its then current rates. If, in
Teradata’s reasonable opinion, performance of
Maintenance and Support is or will be made more
difficult or impaired because of Nonqualified
Products, Teradata shall so notify Customer, and
Customer
shall
immediately
remove
the
Nonqualified Product at its own risk and expense.
Customer shall remain solely responsible for the
compatibility and functioning of Nonqualified
Products with the Software.
4.4 When
Customer
requests
Support
and
Maintenance, it must assign a priority for each
incident/request based on the criteria set out
below and give Teradata immediate unrestricted
access to the affected Product. Teradata will
assign a priority if Customer fails to do so. A single
contact event for Support and Maintenance may
be made up of multiple incidents/requests.
A priority level will be assigned for each
incident/request reported.
4.5 Teradata shall provide Support and Maintenance
during the Hours of Operation and with the
Response Times as defined below. Response Times
are measured by the interval between Customer’s
initial contact with Teradata and the first contact
(via electronic message or phone call) with a
Teradata representative. Response Time intervals
are measured during Hours of Operation only.
Priority Rating
Hours of Operation
Response Time
PRIORITY 1 (CRITICAL)
A Priority 1 incident is a problem that prohibits use of the Software
or renders the Software inoperable, it is a catastrophic issue in the
Software which severely impacts the Customer’s production
systems, as they are inaccessible or there is a system wide
performance degradation making the Customer’s production
systems unusable.
PRIORITY 2 (SIGNIFICANT)
A Priority 2 incident is a problem that causes a significant impact to
the business; however, operations can continue in a degraded
fashion. It is a production issue in the Software where the
Customer’s systems are functioning but in a severely reduced
capacity due to defect or performance. The issue is causing
significant impact to portions of the customer’s normal business
operations and productivity. Either a workaround is not available or
the one that is available is not a reasonable resolution.
PRIORITY 3 (MINOR)
A Priority 3 incident is an issue that negligibly impacts the
customer’s ability to do business, it is an issue in the Software where
the customer is experiencing functional or usability restrictions that
are either not critical to the business or possess a reasonable
workaround, the customer has an issue with documentation or a
question associated with product usage or any other inquiry.
24h, 7 days a week
2 hours
Marketing Applications Service Level Addendum (Version 1.0, English)
Page 2
DMC:
Mo. – Fr. 9am - 6pm
(on Business Days)
Mo. – Fr. 9am - 6pm
(on Business Days)
Next Business Day
Mo. – Fr. 9am - 6pm
(on Business Days)
Next Business Day
MARKETING APPLICATIONS SERVICE LEVEL ADDENDUM
4.6 The times indicated above correspond to EST for
Americas Customers, to AEST for APJ customers,
and to CET for EMEA customers.
time (Monday to Friday 9am to 6pm). Scheduled
Maintenance shall be limited to maximum 8 hours
per calendar month.
4.7 In case the parties agree on geographical
restrictions on data access and data processing,
this impacts the Hours of Operation. Teradata
cannot leverage its global pool of experts for
geographically restricted customer systems and
therefore will only be able to provide Support and
Maintenance Monday to Friday 9am to 6pm
instead of 24 hours, 7 days a week.
4.12 For On-Premise Software and Hosted Software,
Teradata will provide Support and Maintenance for
Major and Minor Releases of the Software for no
less than thirty six (36) months from General
Customer Availability; where “General Customer
Availability” (“GCA”) shall mean the first date that
a Software Release is available to all users,
regardless of language or media; and a “Software
Release” shall mean the combined Major and
Minor Releases such that each of the following
versions are separate Software Releases: “X.Y” (e.g.
3.0, 3.1; 8.5, 8.6…). Software Releases will be
proactively provided for no less than twenty four
(24) months from GCA of its associated Minor
Release.
4.8 Teradata will always endeavor to resolve problems
as swiftly as possible. However, it is not possible to
provide guaranteed resolution times. This is
because the nature and causes of problems can
vary enormously. Teradata will make its best efforts
to resolve problems as quickly as possible and
frequent progress reports will be provided to the
customer.
4.9 Customer must allow Teradata to access the
Software remotely to enable Support and
Maintenance and other remote services. In
connection with providing the Support and
Maintenance described herein, Customer agrees to
perform any tests or procedures recommended by
Teradata for the purpose of identifying and/or
resolving any problems and at all times follow
routine operator procedures as specified in the
Documentation.
4.10 Customer
shall
establish
internal
support
coordinator(s) to whom all users shall be instructed
to direct all questions and problems regarding use,
operation and maintenance of the Software.
Customer agrees that its support coordinator(s)
shall be fully familiar with and trained in the use of
the Software and Customer agrees that only its
support coordinator(s) shall be entitled to contact
Teradata for Support and Maintenance.
4.11 For Cloud Software Teradata shall establish
scheduled maintenance windows (“Scheduled
Maintenance”) to conduct routine maintenance
during which time the Software may not be
available. Teradata shall notify Customer of any
Scheduled Maintenance reasonably (minimum 24
hours) in advance by email and/or via the
Teradata At Your Service portal. Teradata shall use
commercially reasonable efforts to perform
Scheduled Maintenance outside the core business
Marketing Applications Service Level Addendum (Version 1.0)
Page 3 - Teradata Confidential
The term “Release” as used in the definitions below
does not include (i) any new or supplemental
software product, component, or content released
by and licensed separately by Teradata (except
when such new or supplemental software is a
replacement to the Software) or (ii) any software,
component, or content that is designed for use on
operating systems other than the operating system
for which the Software is intended.
Teradata typically identifies Software Releases
using the format “X.Y.Z.n” where (i) “X” equals a
“Major Release” which shall be defined as the
publication of new software product or a new
release for general customer distribution of an
existing software product that contains substantial
new features, major enhancements, possible
operational changes and applicable corrections
from previous maintenance release; (ii) “Y” equals
a “Minor Release” which shall be defined as a
change to then-currently-distributed Major Release
that contains minor feature improvements or
enhancements and may contain applicable
corrections from previous release; (iii) “Z” equals a
“Maintenance Release” which shall be defined as
a change to the then-currently-distributed Major
and Minor Releases that contains applicable
corrections for reported software problems; and (iv)
“n” equals a critical patch level release that
contains expedited corrections for reported
software problems.
MARKETING APPLICATIONS SERVICE LEVEL ADDENDUM
CONTACT INFORMATION AND LANGUAGES FOR INCIDENT REPORTS
Teradata At Your Service Customer Portal:
http://tays.teradata.com
Teradata Customer Services global email:
ApplicationsTechnicalSupport@teradata.com
AMERICAS
Languages:
English 24x7 (for priority 1 incidents)
Primary Telephone Number:
877-MyT-Data (698-3282)
Local Telephone Numbers:
Mexico 001-888-239-0699, Argentina 0800-333-0275, Venezuela 0800-100-8816,
Nicaragua 888-249-6264, Colombia 01800-912-0548, Chile 800-646-546, El Salvador
800-6200, Peru 0800-53795, Nicaragua 1800-220-2131, Ecuador Andinatel,
Pacifictel, Pacifictel Spanish: 8772483150 + Country 593 City Guayaquil 4, Loja 7,
Quito 2
ASIA, PACIFIC, JAPAN (APJ)
Languages:
English 24x7 (for priority 1 incidents)
Mandarin 9x5
Primary Telephone Number:
1800-448-226
Local Telephone Numbers:
Australia 1800-448226, New Zealand 0800-445300, Japan 01209-84480, China 400881-1275, Taiwan 0800-666727, Malaysia 377-237177, South Korea 080-457-0880,
Philippines 1-800-441-3391, Indonesia 001-803-442424, Thailand 1-800-441-3391,
India 000-800-440-205, Hong Kong 307-13718
EUROPE, MIDDLE EAST AND AFRICA (EMEA)
Languages:
English 24x7 (for priority 1 incidents)
French, German 9x5
Primary Telephone Number:
0800-013-5689
Local Telephone Numbers:
UK 0800-013-5689, Norway 800-10761, Denmark 384-87678, Sweden 0851-761-603,
Finland 0972-519-224, Estonia 800-0044-358, Czech Republic 239-014184, Hungary
777-4708, 061-777-4739 outside Budapest, Poland 00-800-442-1123, Russia 81-08002299-1044, Bulgaria 800-118-4483, Spain 912-757-137, Egypt 0800-000-0043,
Pakistan 800-9004-4167, Turkey 800-4488-26575, Austria 0800-297281, France 805540655, Germany 0800-5893105, Switzerland 0800-561703, Netherlands 08004000009, Italy 800-917955, Belgium 800-81193, Ireland 1800-806281, Ukraine 888249-6264 (2 stage dialing call AT&T Direct® Code 0^00-11 country code 380 city
code Lvov 32, Kiev 44, Kharkiv 57)
Marketing Applications Service Level Addendum (Version 1.0, English)
Page 4
MARKETING APPLICATIONS SERVICE LEVEL ADDENDUM
5. AVAILABILITY CLOUD SOFTWARE
5.1 Teradata will use commercially reasonable efforts
to make Cloud Software available 24 hours a day,
7 days a week. Teradata shall provide at least the
following Minimum Uptime Availability for its Cloud
Software during any calendar month:
99 % Minimum Uptime Availability
Uptime Availability means that the connection
between the servers on which the Cloud Software is
hosted and Teradata's side of the Demarcation
Point is uninterrupted and Customer is able to log in
and access the cloud Software. The Minimum
Uptime Availability does not refer to test and
development servers.
5.2 Teradata measures the Uptime Availability of an
availability test page within the Cloud Software at
frequent
intervals.
The
Uptime
Availability
percentage of the respective calendar month is
calculated by dividing the number of successful
availability measurements (test page available) by
the total number of availability measurements of
the respective calendar month, excluding Exclusion
Times (as defined below). Uptime Availability
measurement shall be carried out by Teradata and
Teradata’s measurement shall be relied upon by
the parties and Teradata shall keep and shall send
to the Customer, upon request, full records of its
Uptime Availability measurement activities.
Exclusion Times are times during which the Cloud
Software is unavailable due to (i) Scheduled
Maintenance; (ii) Customer-caused or third partycaused outages or disruptions (except to the extent
that such outages or disruptions are caused by third
parties sub-contracted by Teradata to perform
Marketing Applications Service Level Addendum (Version 1.0, English)
Page 5
Teradata’s contractual services) and/or (iii) outages
or disruptions attributable in whole or in part to
Force Majeure.
5.3 If the actual Uptime Availability percentage falls
below the Minimum Uptime Availability in a given
calendar month (Service Delivery Failure),
Customer is entitled to a Service Credit. The
Service Credit amounts to 1 % of the software
license fees for the Cloud Software owed by the
Customer for the affected calendar month for
each 0,1 % by which the Uptime Availability
percentage falls below the Minimum Uptime
availability. The Service Credit shall be limited to
25 % of the applicable fees of the affected
calendar month. Service Credits shall be set off
against subsequent invoices only, shall not be
refunded to the Customer and shall lapse upon
termination of the Agreement. A Service Credit
shall not be credited unless the Customer requests
it within two months of the end of the affected
calendar month.
5.4 The Customer acknowledges and agrees that the
terms of this SLA relating to Service Credits in case
of a Service Delivery Failure constitute a genuine
pre-estimate of the loss or damage that the
Customer would suffer as a result of the Service
Delivery Failure, shall be Customer’s exclusive
remedy with respect to the Service Delivery
Failure and are not intended to operate as a
penalty for the Service Delivery Failure.
MARKETING APPLICATIONS SERVICE LEVEL ADDENDUM
are defined.
6. INFORMATION SECURITY
The following technical and organization measures shall
be applied to Teradata’s Cloud Software.
f)
The building or property is monitored outside of
business hours.
The monitored are is defined
Motion detectors are implemented.
Ingress and egress points are subject to video or
camera surveillance.
Alarm
systems
connected
to
response
authorities are implemented.
6.1 Physical Access Control
a)
Security perimeter
Security perimeters are defined and used to
protect areas that contain sensitive or critical
information.
b)
Physical entry controls
g)
All possible entry points have been secured
against unauthorized entry.
Binding access authorization procedures have
been implemented.
A physical access control system was set up.
c)
Determination of persons with physical access
authorization
Roles or group concept exists.
Role or group assignments are documented.
Responsibilities for role and group concepts are
assigned.
d)
Management of physical access authorizations
Rules on authorizations for accessing
business zone are defined.
The issuing of credentials is documented.
e)
the
Procedures for the loss credentials are defined.
Management of visitors and external personnel
Policies are implemented.
Visitors are monitored.
Rules for cleaning and maintenance personnel
Marketing Applications Service Level Addendum (Version 1.0, English)
Page 6
Monitoring rooms after business hours
Logging
For electronic access control equipment in use,
physical access logs are stored in a tamperproof manner for 12 months. Regular sampling is
carried out to detect improper use.
6.2 Access Control
a)
Authentication
Access to all data processing systems is
protected by user authentication.
Password conventions are defined including
requirements for password length (at least 8
characters) and complexity (upper-/lower-case
letters, number/character mix, etc). Trivial
passwords not allowed. The password must be
changed at the end of a certain period.
Where strong identity assurance is required for
maximum level of protection, two-factor
authentication is implemented.
The authentication credentials are always
encrypted when transmitted over the network.
MARKETING APPLICATIONS SERVICE LEVEL ADDENDUM
b)
De-activation and re-setting of blocked access
b)
Access is blocked on failed attempts.
A secure method exists for resetting the blocked
access (e.g. by assigning a new user ID).User
access is blocked after long periods of
inactivity.
c)
Each authorized person can access only the
data that he specifically needs to process the
current transaction according to the order and
which is configured in his individual profile.
To the extent that data of multiple customers is
stored in the same database or is processed
with the same data processing system, logical
access restrictions must be provided which are
aimed exclusively at processing the data for the
customer concerned (multi-tenancy).
Unique features are incorporated into the data
processing systems which enable the accessing
person to determine that the data processing
system is authentic.
The scope of the authorizations must be limited
to the minimum need to perform the authorized
person’s duties and functions.
Banning storage of passwords
Access passwords and/or form input are not
stored on the client itself or in its vicinity. Users
have been instructed on these requirements.
d)
Authorization and access management
A role concept is in place.
Access rights are assigned on an individual
basis.
The number of authorized persons was kept to
the minimum needed for operation.
Privileges are checked regularly for necessity.
There are no reusable access accounts.
A process for requesting, approving, issuing, and
accepting the return of credentials and access
authorizations has been be set up and
described and is being used.
Responsibilities
for
assigning
access
authorizations have been assigned.
A deputy arrangement is in place.
e)
c)
Logging
User workstation
If the workstation or terminal is inactive, a
password-protected screensaver must be
activated automatically using mechanisms
specific to the operating system.
Workstations and terminals are protected
against
unauthorized
use
when
users
temporarily leave the workplace. Users are
trained to apply this measure.
Data access management
A process for requesting, approving, assigning
and revoking and checking data access
privileges is implemented.
Data access privileges are linked to a personal
user ID and an account.
If the basis for an authorization no longer exists
(e.g. job change), this access privileges will be
immediately revoked.
Data access management processes are
documented and the documentation will be
retained for 12 months.
Suitable steps have been taken to prevent
different roles or access rights from being
concentrated in one person and thereby, in
combination, giving that person an excessively
powerful overall role.
All successful and failed access attempts are
logged and securely retained for at least 6
months.
To detect improper use, regular access log
reviews are carried out.
f)
Implementing access restrictions
d)
Logging
All read, input, modification and deletion
transactions are logged and securely retained
for at least 6 months.
To detect improper use, regular access log
reviews are carried out.
6.4 Data Transmission Control
6.3 Data Access Control
a)
Authorization concept
Rules and procedures exist for creating,
changing and deleting authorization profiles
and user roles.
Responsibilities are regulated.
Marketing Applications Service Level Addendum (Version 1.0, English)
Page 7
a)
Legal requirements
To ensure the legality of data transmission to
other countries, written approval of the
customer will be obtained (if applicable).
MARKETING APPLICATIONS SERVICE LEVEL ADDENDUM
b)
Transport over networks
Data is transmitted between clients and servers
in encrypted form.
Connections to back end systems are
protected.
The connections between the back end systems
are protected.
Data requiring a high level of protection is
encrypted.
Data that leaves the protected zone (such as
the one in a computer center) is encrypted.
Data having a high level of protection is
generally encrypted when being transmitted to
external systems.
c)
Logical system access
Networks are segmented. DMZ design is
applied.
A network plan is in place.
Network / hardware firewalls are implemented.
Endpoint firewalls are implemented.
Firewalls are always active and cannot be
deactivated by users.
All systems and applications apply latest patch
versions.
Unnecessary hardware interfaces and services
are deactivated.
Default service accounts are deactivated.
Up-to-date anti-malware systems are applied.
Information
security
incident
response
procedures are implemented.
d)
a)
Information disposal
Data media and documents are destroyed in
compliance with data protection rules.
Marketing Applications Service Level Addendum (Version 1.0, English)
Page 8
Input logging
Input in the data processing system is logged.
The logs are retained for a period of 12 months.
6.6 Order Control
a)
Rules and limitations
Service specifications specify the allowed work.
Controls on the part of the customer have been
agreed on.
The customer will establish a process for
checking the electronic and paper-based
orders.
The incidents that must be reported have been
specified.
b)
Documentation
A documentation method is in place which
ensures that the individual steps required in
executing the order can be fully tracked.
6.7 Availability Control
a)
Storage and retention
Data is backed up in encrypted form.
Temporary storage areas are configured so that
their contents are automatically deleted
immediately after exiting or when the
application or operating system starts up at the
latest.
Procedures for the use of data media are
implemented.
The creation of copies is documented. This
documentation is retained for 12 months.
f)
6.5 Input Control
System interfaces
All system interfaces are documented.
Machine-to-machine
interfaces
implement
mutual authentication and ensure that each
machine has individual credentials.
e)
Data media are erased in compliance with
data protection rules before being used by
other users.
Hardware components or documents are
destroyed in such a way that they cannot be
recovered or only with extreme difficulty.
The complete and permanent erasure of data
and data media containing personal data in
compliance with data protection rules is
logged.
The logs must be retained securely for at least 24
months.
Backup concept
A backup concept is defined.
Regular backups are carried out.
Backup responsibilities have been assigned.
Regular
backup
recovery
checks
are
performed.
b)
Disaster recovery
A disaster recovery plan is in place with
procedures for notifying relevant stakeholders
including the customer in case of an incident.
Backups are retained at offsite secure facilities.
Uninterruptible power supply units and surge
protection devices are inspected regularly and
monitored continuously.
MARKETING APPLICATIONS SERVICE LEVEL ADDENDUM
Employees are obliged to maintain the
confidentiality of business and trade secrets.
Other special confidentiality obligations are
applied if necessary.
Employees are required to handle data and
data media properly and carefully.
Trainings are repeated regularly.
Trainings and participations are documented.
Rules for providing access to data processing
systems to external personnel are defined
including applicable obligations to data
secrecy and the requirement to receive training
prior to be allowed to use the data processing
systems.
6.8 Intended Use Control
a)
Data minimization
Only the minimum amount of data that is
needed to directly serve the actual purpose
and perform the contract work or carry out the
process is collected, stored or processed.
b)
Data separation
Technical and organizational measures exist to
ensure that data and/or data media used for
different contractual purposes are processed
and/or stored separately.
6.9 Organizational Control
a)
Policies and standards
Appropriate policies, standards and operating
procedures are defined and documented.
Implementation and compliance with policies
and standards are monitored.
b)
Training and obligations
Employees are trained on the principles of data
protection.
Marketing Applications Service Level Addendum (Version 1.0, English)
Page 9
c)
Separation of duties
Operating and administrative functions are
separated.
d)
Deputy arrangements
Deputy arrangements are in place for all
functions that are necessary for operation.