Ethernet Service Agreement Terms & Conditions

Version 1.0  |  Effective from 1 May 2024  |  Last reviewed August 2026

1. DEFINITIONS Word Meaning Agreement

Means the service contract which comprises the customer order form and these terms and conditions. Agreement date Means the date which the ‘customer order form’ and documentation was received by CEDARO LIMITED. Activation date Means the date by which the services become live and first made available for use by the customer. Committed Delivery Date (CDD) Means the date by which we anticipate the activation date of the services to begin. This is also the date by which CEDARO LIMITED is measured against service credits for failing to deliver on or before the CDD. Customer Premises Equipment (CPE) CPE such as modems and routers that is required for use with the service. Supplied by CEDARO LIMITED or their third parties where their provision is for the express use of this service. Customer Requirement Form (CRF) Is a document detailing contact details, building details and position of equipment etc, which needs to be completed prior to CEDARO LIMITED placing the circuit order with their base carrier suppliers. This ensures that we have the correct information from the outset of the agreement. Customer equipment Means apparatus belonging to the customer not forming part of the CEDARO LIMITED equipment, but which may be connected to the CPE. Data centre Is a dedicated building providing space, power and secure facilities for storing data equipment and services. Often called a carrier hotel (where a telecommunications ‘carrier’ will rent space or ‘rooms’ within a data centre). Ethernet circuit A fibre based product to the point of entry into a building. However, Ethernet circuits differ in that they are always presented as either an RJ45 connection (copper twisted pair Cat5e patch cable) or as a fibre patch cable presentation (termination type to be specified). Ethernet circuits operate at the International standard IEEE 802.3. Ethernet circuits are available usually at incremental speeds of 10Mb, where the minimum circuit speed is 10Mb, and the maximum will be multi gigabit circuits. CEDARO LIMITED equipment Means any apparatus or equipment provided by CEDARO LIMITED or any third party to the customer to enable provision of the service under this agreement. Initial term Means the term of the agreement as specified in the customer order form e.g., 36 months. The minimum initial term is always 36 months unless otherwise stated in the customer order form. Monthly Recurring Charge (MRC) Refers to the monthly recurring charge for service. Network Termination Equipment (NTE) Typically third party equipment supplied by CEDARO LIMITED or their third parties where their use is for the express purpose of provisioning the NTE as described in the customer order form. This equipment may reside within the customer’s premises, the end user’s premises, or CEDARO LIMITED and or their third parties’ premises. Point of Presence (PoP) Is a node within the CEDARO LIMITED or carrier network, sited within a data centre or telephone exchange. Public Switched Telephone Network (PSTN) In the UK this is generally assumed to be a BT product, referring to a copper wire, analogue telephone line, or ISDN circuit. Service contract Means the complete document which includes the customer order form and the documents as noted on the customer order form. Service Means the services described in the details within the customer order form and forming part of this agreement. Service levels Means the service levels relating to the services which are contained in the SLA. Service Level Agreement (SLA) Means the service level agreement as in clause 4.0 of this document or such other service level agreement which is agreed in writing between the parties from time to time. Target ready for service date (TRFS) Means the initial date which is supplied by the CEDARO LIMITED provisioning team as the estimation for an activation date. This is not a binding date, nor is it a CDD, and should be used as a guide only as to the likely activation date. Third party service provider Means the provider of any third party services. Third party services Means any part of the services which CEDARO LIMITED procures from a third party any third party telecommunications services and/or equipment which CEDARO LIMITED uses in order to provide the services.

2. INTRODUCTION

2.1 The terms of this agreement form part of the conditions of sale, and shall be incorporated into the customer order form signed by the customer.

3. ORDER PROCESS

3.1 CEDARO LIMITED will supply the customer with the services in accordance with these terms and the accompanying signed customer order form and fully completed CRF. The combination of which, will form a service contract between the customer and CEDARO LIMITED.

3.2 CEDARO LIMITED reserves the right to make any changes to these terms or to the service contract, including changes to the service and the SLA as is required from time to time, to reflect:

Technical and operational changes to the core CEDARO LIMITED network or that of one of our third party providers provided such changes do not materially affect the applicable service provided to the customer

Changes enforced by law, regulation or codes of conduct which may be altered or issued from time to time

3.3 CEDARO LIMITED will notify acceptance of a customer order form by email within a target of 5 working days. Orders will be accepted on the basis that the customer has provided:

A fully completed and signed copy of the customer order form (in duplicate)

A fully completed CRF detailing contact names, site addresses, and termination details as requested on the current published CRF The CEDARO LIMITED representative will supply the CRF, usually at point of order.

3.4 CEDARO LIMITED will endeavour to issue a TRFS at the same time at which they acknowledge receipt and confirm the customer order. The TRFS is the day on which we expect (under normal circumstances) the service activation date commences, and therefore the date which the service contract starts.

3.5 Throughout the provisioning process, CEDARO LIMITED will need to communicate with named member(s) of the customer’s staff (or their nominated representatives) to arrangeaccess to the customer premises for CEDARO LIMITED and/or their third party suppliers. Any delays to these requests either by the customer, their representatives, or the Landlord of the termination premises will delay CEDARO LIMITED from meeting the TRFS and from issuing a CDD.

3.6 Typically within 10 working days of acceptance of an order, CEDARO LIMITED or their third party representative will perform a termination location, premises survey, also known as a ‘site survey’. It is typical that within a further 10 working days of the site survey, that CEDARO LIMITED will be able to issue a CDD.

3.7 The CDD is the date by which CEDARO LIMITED aim to have service ready for use (the activation date).

3.8 In the event that the customer takes a dual circuit solution from CEDARO LIMITED , where the tail circuits are provided by alternate carriers (or the same carrier but via geographically diverse PoPs) and one is configured as primary, with the other as a backup, then CEDARO LIMITED will provide a TRFS and a CDD for each circuit. The processes outlined within this document for delivery, will apply to each. Where the solution is quoted and sold at a fixed monthly, quarterly or annual price, CEDARO LIMITED reserve the right to charge for separate services as they are delivered. E.g. customer takes 100Mb Ethernet, with a 10Mb Ethernet backup. In this event, CEDARO LIMITED will charge for the first circuit and accompanying hardware (such as, but not limited to, routers, firewalls or cable trays) delivered on a pro rata basis, as this is a useable Internet connection. The final charges will be applied on delivery of the second circuit and its confirmed live backup status presented in a working condition. At this stage, the contract term of the agreement for the solution will start. E.g. customer taking a 36 month term contract, with a 100Mb primary and a 10Mb backup circuit. The 100Mb circuit is delivered (as working) 2 months before the backup circuit. Not until the delivery of the backup circuit will the 36 month term of the agreement start. This means that the customer will be liable to pay the installation, monthly rental and reasonable set up costs as described above, for the primary circuit for an additional 2 months in this example. In all cases, unless otherwise stated by the customer, CEDARO LIMITED and their third party suppliers as applicable will endeavour to provide both or any circuits as part of any given solution at the same time. However, when this is not practicable or any third part service provider will not accommodate such requests, then the customer will be liable for all service charges as they arise on the activation date of said services.

3.9 In the event that a customer takes an ADSL backup service to their primary circuit, CEDARO LIMITED will deliver the ADSL service and the Ethernet as close to the Ethernet CDD as possible using all reasonable endeavours. The exception to this will be when a customer asks for the ADSL service to be supplied in lieu of the Ethernet being fulfilled. In this instance, CEDARO LIMITED will charge pro rata for the delivery and rental of the ADSL service and accompanying hardware (such as, but not limited to, routers, firewalls or cable trays). The final charges will be applied on the activation date of the primary circuit.

3.10 For backup services, at no time will the provision of a backup service be subject to service delivery credits. In addition, the backup circuit terms and conditions specific to the installation and use of that line are separate from this document, and are available on request through your CEDARO LIMITED representative.

3.11 Where backup services are taken, it is the customer’s responsibility to ensure that where applicable there is an adequate, uncompromised analogue PSTN circuit. Should the customer not provide a valid telephone number for this PSTN circuit, CEDARO LIMITED will offer the service at an additional cost as supplied by a CEDARO LIMITED representative. Similarly, if the PSTN termination is not in the correct location (should be within 3 metres of the planned Ethernet termination point) then CEDARO LIMITED may not be able to provide the backup service.

3.12 Delivery terms for all backup services are outlined in the Broadband terms and conditions.

3.13 For all services, when an installation fee is levied (as per the customer order form) CEDARO LIMITED reserve the right to invoice this fee, which must be paid before we hand over the service.

3.14 Subject to 3.8 and 3.9, the term of the service contract as indicated on the customer order form will not start until the final circuit or complete solution is delivered. I.e. the service charges and start dates of individual circuits may be staggered, but the service solution term of contract will start and end at the same time. This means that the first circuit to be provisioned will be invoiced prior to the term of the contract starting, and the invoice period in lieu of the backup or secondary circuit(s) will vary depending on the independent tail circuit CDDs. Wherever possible however, we will try to ensure that the CDD for each circuit in a multi circuit solution are as close together as possible.

3.15 CUSTOMER’S RESPONSIBILITY: It is the responsibility of the customer at all times to ensure the following:

3 pin standard UK plug socket is available for each piece of required electronic equipment supporting the service(s) provided. Typically this will be one socket for each carrier NTE, and one for each router (or CPE) supplied by CEDARO LIMITED to support the service. In addition, additional power sockets may be required as directed following initial site survey depending upon the solution(s) purchased

Where applicable for backup services, the customer must ensure that a non-service bearing standard analogue PSTN line is available for CEDARO LIMITED to enable the backup service. This PSTN line must terminate within 3 metres of the location of the CEDARO LIMITED CPE

That enough rack space, where the customer expects the carrier NTE and CEDARO LIMITED CPE to be positioned within a data rack (standard UK 19inch width), and that there is at least 3U of available space per single Ethernet circuit. As much as 10U may be required in certain circumstances but this is the exception rather than the rule and should be identified at survey

4. Service Level Agreement (SLA)

4.1 During active service, CEDARO LIMITED offer a 99.9% uptime service level for all Ethernet circuit products, extending to 99.99% where a backup service is taken.

4.2 CEDARO LIMITED target to repair all logical faults on Ethernet’s is 6 clock hours. Logical faults are those relating to any equipment, either the CPE provided by CEDARO LIMITED as part ofthe managed service, or NTE within the CEDARO LIMITED network and their supplier’s network.

4.3 Where there is a physical fault, which relates to fibre or copper wire faults, then the target time to resolve is within 24-48 clock hours.

4.4 Service availability is a measure of the relative amount of time a circuit is available for customer use during a given calendar month. ‘Service unavailability’ is defined as any period for which the service is unavailable, and is measured from the time:

That the customer reports service unavailability to CEDARO LIMITED, and opens a support ticket (customer must obtain a reference number for their call), until the time;

That CEDARO LIMITED advises the customer that the service is restored and operating in accordance with agreed specifications, and CEDARO LIMITED closes the support ticket. Any periods of time during which a support ticket is kept open at customer’s request following notification by CEDARO LIMITED that service has been restored, is not included in measuring the duration of a period of service unavailability

4.5 When Ethernet backup or other backup services are taken, then CEDARO LIMITED will provide a 99.99% SLA for the solution as a whole. Should the secondary (backup) circuit fail to engage within 1 clock hour, then additional service unavailability penalties will apply in the following way:

Where a backup is provided, and both the primary and the backup fail, then CEDARO LIMITED will pay service credits to the value of 1.25 times that which is stipulated within table 4.1. Exceptions are for when the backup service fails due to reasons beyond CEDARO LIMITED control. Such reasons can be, but are not limited to; third party activity, network failure outside of CEDARO LIMITED and their supplier’s networks, power cuts, atmospheric and weather induced problems, natural disasters or terrorist incidents.

Where a second Ethernet is installed in a failover or backup capacity, and both circuits fail, CEDARO LIMITED will pay service credits as per table 4.1, but will apply to the rental values of both circuits. Exceptions are for when the backup service fails due to reasons beyond CEDARO LIMITED control. Such reasons can be, but are not limited to; third party activity, network failure outside of CEDARO LIMITED and their supplier’s networks, power cuts, atmospheric and weather induced problems, natural disasters or terrorist incidents.

4.6 For customers taking back up services, should the primary circuit fail, and the backup service engage within the period (as 4.6) then CEDARO LIMITED will only be liable for service credits on the primary line, as described in table 4.1 but, subject to points 4.9 – 4.15. CEDARO LIMITED will provide this pro rata to the value of the rental of the primary circuit for customer’s on fixed single payment contracts.

4.7 Service credits: In the event of service unavailability, CEDARO LIMITED will credit the customer as per the below: Table 4.1 Total service unavailability per month Credit Less than 1 clock hour 0% of MRC

1 – 6 clock hours 5% of MRC

7 – 24 clock hours 10% of MRC

25 clock hours and above 15% of MRC

4.8 In no event will SLA credits in any calendar month exceed 100% of the total MRCs payable by customer for the service in that month.

4.9 As a condition of entitlement to SLA credits, the customer shall cooperate with CEDARO LIMITED in addressing any reported service problems.

4.10 SLA credits are applied only upon customer’s written request, which must be submitted within 15 working days of a valid support call reporting the incident, and backed up by a reference number to support that claim. This can be submitted to the relevant CEDARO LIMITED staff by 1st class recorded mail, or by email.

4.11 All approved SLA credits claimed by a customer for a given month will be totalled and applied to that customer’s next invoice for the Service, or as promptly thereafter as is practical in the event of a dispute.

4.12 No SLAs apply to newly installed services or to service reconfigurations requested by customer, until five business days after:

The service activation date or completion of the Service reconfiguration, as applicable

4.13 The SLAs above apply only in respect of service that is provisioned through CEDARO LIMITED and, where applicable, to local access circuits provided by CEDARO LIMITED (via third party providers). Service credits will not be approved for network faults or fibre issues outside of our control. See section 4.15 for further detail.

4.14 SLA credits provided for in these terms and conditions are customer’s exclusive remedy with respect to items covered in these terms and conditions.

4.15 Exclusions: no SLA credit shall apply to the failure of the service to comply with an SLA, or to any period of service unavailability, caused, in whole or part, by any of the following:

A failure of customer’s own premises equipment or equipment of a customer’s vendor

A failure in local access facilities connecting the customer to services provided by CEDARO LIMITED which are not provided by CEDARO LIMITED

Any act or omission of customer or any third party (including but not limited to, Customer’s agents, contractors or vendors), including, but not limited to: o Failing to provide CEDARO LIMITED adequate access to facilities for testing o Failing to provide access to premises as reasonably required by CEDARO LIMITED (or its agents) to enable CEDARO LIMITED to comply with its obligations regarding the service o Failing to take any remedial action in relation to a service as recommended by CEDARO LIMITED , or otherwise preventing CEDARO LIMITED from doing so, or… o Any act or omission which causes CEDARO LIMITED to be unable to meet any of the SLAs

Customer’s negligence or wilful misconduct, which may include customer’s failure to follow agreed upon procedures

Any scheduled maintenance periods when customer has been informed of such maintenance, and emergency maintenance

Disconnection or suspension of the service by CEDARO LIMITED pursuant to a right to do so under the general terms and conditions or these terms and conditions

Outages attributable to ‘off-net circuits’, that is: o Long haul domestic local access circuits in the USA, between an CEDARO LIMITED PoP and a customer premises which is in a different local access transport area(LATA) and/or o Long haul international local access circuits provided in countries in which CEDARO LIMITED does not operate its own network and provides the service using the services of third party providers

5. Term of Service Contract and Termination

5.1 The term of each service contract shall start from the date on which, either the individual circuit (for single circuits and/or those with backups), or the final circuit (for a solution with Ethernet backup) is installed and made available for service (the activation date). The contract will then continue for the term stipulated within the customer order form. For the avoidance of doubt, the minimum term of contract for Ethernet services is 36 months. At the end of the term, the contract will automatically renew for a further period of six (6) months, on a rolling six (6) monthly basis, unless CEDARO LIMITED receive prior notice from the customer under the termination conditions stated below.

5.2 Either party may terminate such service contract by giving ninety (90) days written notice to the other, such notice to expire no earlier than the end of the initial term as stated on the customer order form. In the case of termination by the customer, any such written notice shall not be effective unless

Given by 1st class recorded post, or an email to a relevant, named member of staff within CEDARO LIMITED , and by an authorised member of the customer’s staff. Such notice must also outline full details of the service contract including all circuit details and addresses to be terminated, and that;

CEDARO LIMITED has confirmed receipt of such termination notice by email or letter within five working days of its receipt

5.3 In addition to CEDARO LIMITED other rights, CEDARO LIMITED may end any service contract and/or suspend the provision of any service under a service contract in the following circumstances:

Immediately following the expiry of 5 working days written notice from CEDARO LIMITED to the customer for non-payment of any charges and payment has not been made following such notice; or

Immediately in writing if the customer materially breaches these terms

Immediately if bankruptcy or insolvency proceedings are brought against the customer (or its parent company), a receiver or administrator is appointed over any of the customer’s (or its parent company’s) assets or the customer (or its parent company) goes into liquidation or enters into a voluntary arrangement with its creditors other than for the purposes of reorganisation (or any similar event in its country of incorporation takes place); or

As soon as required if CEDARO LIMITED is obliged to, by a decision or direction of any governmental body or regulatory authority

5.4 Upon termination of a service contract, all charges incurred by the customer for the use of the services up to the end of the initial term (together with a notice period of ninety (90) days) shall be due and payable in full and on demand and the customer shall have no right to withhold, deduct or set off any such amounts.

5.5 Upon termination of a service contract for whatever reason the customer shall immediately stop using the services prescribed in such service contract and the customer’s right to use such services shall immediately terminate.

5.6 Where CEDARO LIMITED suspends service for customer breach and subsequently reconnects services, the customer may be liable for a reasonable reconnection fee which shall be notified to the customer in advance.

5.7 If the customer cancels an order, or requests that an order already placed is significantly modified (e.g. changes in address; service type; point of presence or presentation), prior to the CDD, as defined in the relevant service contract, then notwithstanding CEDARO LIMITED other rights pursuant to the service contract, the customer shall pay all costs incurred by CEDARO LIMITED as a result of such cancellation or modification. For any other cancellation, the standard cancellation fees (shown in table 5.0) apply.

5.8 In addition to the customers other rights, the customer may end any service contract and/or suspend the provision of any service under a service contract in the following circumstances:

Immediately if bankruptcy or insolvency proceedings are brought against CEDARO LIMITED (or its parent company), a receiver or administrator is appointed over any of CEDARO LIMITED (or its parent company’s) assets or CEDARO LIMITED (or its parent company) goes into liquidation or enters into a voluntary arrangement with its creditors other than for the purposes of reorganisation (or any similar event in its country of incorporation takes place); or Table 5.0 Cancellation charge payable by the customer Cancellation charge payable by the customer Reason for cancellation (Percentage (%) of rental charges for the term of (Percentage (%) of installation charge) contract) Customer cancels for any reason post CDD and delivery of service before term of 100% 100% contract expires* *Exceptions: the only exception is when CEDARO LIMITED or their third party decree that the installation costs originally quoted (or which were included over the term if these costs are amortised) are not enough to cover the actual cost of the installation works. Such costs are known as excess construction fees, and these fees (where applicable) will be notified to the customer post site survey. At this point, the order will be placed on automatic ‘hold’ until the customer agrees (or not) to pay the excess construction fees. The customer has 5 working days to decide, and to notify CEDARO LIMITED in writing to the relevant member of staff of their decision. If the customer agrees to pay, the provisioning service will resume and a CDD issued in due course. Should the customer decline they have the right to cancel their order with no further charges. Should the customer fail to notify CEDARO LIMITED of their decision within 5 working days we may consider the order cancelled and the standard cancellation fees in the table above will apply.

5.9 For the avoidance of doubt, where installation charges are not payable because they are spread over the term or are discounted for a particular service contract, CEDARO LIMITED will base cancellation fees on the rental only, and applying the same percentage fees as in table 5.0. Additionally, CEDARO LIMITED may charge the customer for all costs which ithas incurred in relation to provision of the services (e.g. costs associated with network or infrastructure builds or obtaining way leaves,

etc) up to and prior to the date upon which it receives the early cancellation request from the customer.

5.10 If the customer cancels a service without cause after the CDD and prior to the end of the initial term, then all charges that would have been payable until the end of the initial term (together with the notice period of 90 days) shall immediately become due and payable.

5.11 For customers taking Ethernet backup or ADSL back up products, please note section 3.14 with regard to service contract start dates.

6. DATA PROTECTION

6.1 CEDARO LIMITED and the Customer shall comply with their respective obligations set out in Schedule 1. Schedule 1: Data Protection

1. INTERPRETATION

1.1 In this Schedule: “Controller” shall have the meaning set out in the GDPR; “Data Protection Laws” means the GDPR and the Privacy and Electronic Communication Regulations 2003, any amendment, consolidation or reenactment thereof, any legislation of equivalent purpose or effect enacted in the United Kingdom, or, where relevant, the European Union, and any orders, guidelines and instructions issued under any of the above by relevant national authorities, a judicial authority in England and Wales or, where relevant, a European Union judicial authority; “Data Subject” shall have the meaning set out in the GDPR; “Disclosing Party” shall mean the party to the Agreement who discloses or makes available Personal Data. “GDPR” means General Data Protection Regulation (EU) 2016/679 as in force from time to time; “Personal Data” has the meaning given to it by the GDPR, but shall only include personal data to the extent that such personal data, or anypart of such personal data, is processed in relation to the services provided under the Agreement; “Processor” shall have the meaning set out in the GDPR; “Receiving Party” shall mean the party to the Agreement who receives or obtains Personal Data whether directly from the Disclosing Party orindirectly; “Replacement National Legislation” means legislation in the United Kingdom which is enacted to cover, in whole or part, the same subject matter as the GDPR.

1.2 Words and phrases with defined meanings in the GDPR have the same meanings when used in this Schedule, unless otherwise defined in this Schedule.

1.3 If the GDPR ceases to apply to the United Kingdom, references to the GDPR, to provisions within it and to words and phrases with defined meanings in it, shall be deemed references to Replacement National Legislation, the nearest equivalent provisions in it and the nearest equivalent words and phrases in it (as the case maybe).

2. OBLIGATIONS

2.1 Each party shall comply with the Data Protection Laws applicable to it in connection with the Agreement and shall not cause the other party to breach any of itsobligations under Data Protection Laws.

2.2 The parties have agreed that the Receiving Party will process Personal Data as the Processor on behalf of the Disclosing Party which shall act as a Controller of suchPersonal Data in connection with the Agreement. The Processor shall, or shall ensure that its sub-contractor shall:

2.2.1 process the Personal Data only on behalf of the Controller, only for the purposes of performing its obligations under the Agreement, and only in accordance with instructions contained in the Agreement or instructions received in writing from the Controller from time to time. The Processor shall notify the Controller if, in its opinion, any instruction given by the Controller breaches Data Protection Laws or other applicable law;

2.2.2 not otherwise modify, amend or alter the contents of the Personal Data or disclose or permit the disclosure of any of the Personal Data to any third party(including without limitation the Data Subject itself) unless specifically authorised in writing by the Controller;

2.2.3 document all processing in accordance with Article 30 GDPR;

2.2.4 only grant access to the Personal Data to persons who need to have access to it for the purposes of performing the Agreement;

2.2.5 ensure that all persons with access to the Personal Data are:

2.2.5.1 reliable, trustworthy and suitably trained on Data Protection Laws; and

2.2.5.2 subject to an obligation of confidentiality or are under an appropriate statutory obligation of confidentiality.

2.2.6 taking into account the nature of the processing and the information available to the Processor, assist the Controller (at the Controller’s cost) in ensuringcompliance with its obligations pursuant to Article 32 to 36 GDPR inclusive;

2.2.7 take such measures as are required pursuant to Article 32 GDPR in accordance the security obligations set out in the Agreement C (as amended from timeto time) and at the request of the Controller provide a written description of the technical and organizational measures implemented, or to be implemented, to:

2.2.7.1 protect the Personal Data against unauthorized or unlawful processing and accidental loss, destruction, damage, alteration or disclosure; and

2.2.7.2 detect and report personal data breaches within good time,

2.2.8 notify any loss, damage or destruction of Personal Data to the Controller as soon as reasonably practicable and in any event within

24 hours of becomingaware of such breach and provide all reasonable assistance to the Controller in relation to the notification of such breach to the Information Commissioner and any other applicable regulatory and any data subject;

2.2.9 provide all reasonable assistance to the Controller (at the Controller’s cost) in ensuring compliance with its legal obligations relating to data protectionimpact assessments.

2.2.10 not engage another processor (a “Sub-Processor”) to process the Personal Data on its behalf without specific written consent of the Controller, approvinga named Sub-Processor, such consent always subject to:

2.2.10.1 the Processor binding any Sub-Processor by written agreement, imposing on the Sub-Processor obligations in relation to the Personal Dataequivalent to those set out in the Agreement; and

2.2.10.2 the Processor remaining liable to the Controller for the acts and omissions of any Sub-Processor, as if they were the acts and omissions of theProcessor;

2.2.11 notify the Controller (within seven days) if it receives:

2.2.11.1 a request from a Data Subject to have access to that person’s Personal Data; or

2.2.11.2 a complaint or request relating to the Controller’s obligations under Data Protection Laws; or

2.2.11.3 any other communication relating directly or indirectly to the processing of any Personal Data in connection with the Agreement;

2.2.12 not take action in relation to such communication, unless compelled by law or a regulator, without the Controller’s prior approval, and shall comply (at theController’s cost) with any reasonable instructions the Controller gives in relation to such communication;

2.2.12 provide the Controller with reasonable co-operation and assistance (at the Controller’s cost) in relation to any complaint or request made in respect ofany Personal Data including by:

2.2.13.1 providing the Controller with details of the complaint or request;

2.2.13.2 complying with a data access request within the relevant timescales set out in the Data Protection Legislation and in accordance with theController’s reasonable instructions; and

2.2.13.3 providing the Controller with any Personal Data it holds in relation to a Data Subject making a complaint or request within the timescalesreasonably required by the Controller;

2.2.14 on termination of the Agreement and otherwise at the Controller’s request, delete or return to the Controller the Personal Data, and procure that anyparty to whom the Processor has disclosed the Personal Data does the same;

2.2.15 where reasonably possible, store the Personal Data in a structured, commonly used and machine-readable format;

2.2.16 not transfer Personal Data outside of the European Economic Area without the prior written consent of the Controller except that the Data Processor may disclose Personal Data to its employees providing maintenance and support services provided that such disclosure is solely for the purpose of, and nomore than is necessary for, the purpose of maintenance and support under the Agreement. Where the Controller consents to the transfer of Personal Data outside the European Economic Area, the Processor shall comply with:

2.2.16.1 the obligations of a controller under Articles 44 to 50 GDPR inclusive by providing an adequate level of protection to any Personal Datatransferred; and

2.2.16.2 any reasonable instructions of the Controller in relation to such transfer;

2.2.17 have a data protection officer where required by the GDPR, and where a data protection officer is not required, have a named individual that isresponsible and available to deal with data protection issues as and when they arise in conjunction with the Controller; and

2.2.18 allow the Controller, or its external advisers who are not in the reasonable opinion of the Processor competitors of the Processor (subject to reasonable notice and the execution of appropriate confidentiality undertakings), to inspect and audit the Processor’s data processing activities and those of its relevant agents, group companies and subcontractors during normal business hours, and C comply with all reasonable requests of the Controller, to enablethe Controller to verify and procure that the Processor is in full compliance with its obligations under this Schedule.

3. LIABILITY

3.1 Subject to paragraphs 3.1 and 3.2, the Processor shall indemnify and keep indemnified the Controller against any fine imposed by any applicable regulatory body(and where applicable any appellate court or tribunal of competent jurisdiction) under Data Protection Laws if and to the extent that such fine is imposed on the Controller solely and directly as a result of a breach by the Processor and/or any SubProcessor of its obligations under this Schedule, unless such indemnity is prohibited on grounds of public policy.

3.2 The Processor’s maximum liability under this Schedule shall be capped at a sum equal to the value of the payments received by the Processor under theAgreement in the previous year or [£50,000], whichever is the higher.

3.3 The Processor’s obligations under paragraph 3.1 shall be subject to the conditions that the Controller: (i) promptly gives the Processor written notice of the claim;

(ii) gives the Processor sole control of the defence and/or settlement of the claim including the bringing of any appeal that may be available (provided that the Processor may not settle the claim in any manner that the Controller reasonably regards as adverse to its interests without the consent of the Controller, which shall not be unreasonably withheld or delayed)); and (iii) provides the Processor, at the Processor’s expense, with all reasonable assistance in the defence and/orsettlement of the claim.

4. INTELLECTUAL PROPERTY RIGHTS

4.1 All intellectual property rights in the Personal Data vest and shall remain vested absolutely in the Disclosing Party, that transferred the relevant Personal Data tothe Receiving Party.

4.2 Electronic media and other means of transport containing the Personal Data received by the Receiving Party and all copies or reproductions thereof shall also remain the property of the Disclosing Party, that transferred these media or provided other means of transport.

5. COMMERCIALS

5.1 Monthly rental pricing confirmed in service agreement provided alongside terms & conditions.

5.2 All single circuits ordered on a 36-month contract come with an inclusive managed router and a free of charge install, which is subject to site survey where excess construction charges may apply Excess construction fees, and these fees (where applicable) will be notified to the customer post site survey. At this point, the order will be placed on automatic ‘hold’ until the customer agrees (or not) to pay the excess construction fees. The customer has 5 working days to decide, and to notify CEDARO LIMITED in writing to the relevant member of staff of their decision. If the customer agrees to pay, the provisioning service will resume and a CDD issued in due course. Should the customer decline they have the right to cancel their order with no further charges.