DORA Addendum

RECITALS

a. DORA entered into force on 16 January 2023, is
applicable from 17 January 2025 and includes obligations on financial entities that extend to the outsourcing of ICT Services.

b. You consider Yourself to fall within the scope of DORA.

c. The purpose of DORA is to harmonise operational and technical requirements applicable to ICT Services and to form a coherent approach to mitigate ICT Risk in the financial sector.

d. Pursuant to the Agreement, The Access Group is supplying ICT Services to You that fall within the scope of DORA.

e. A description of the functions and ICT Services supplied by The Access Group on Your behalf, and their respective Location are set out in the Order in your  Agreement and in accordance with clause 2.2.3.

f. You confirm that The Access Group’s ICT Services do not
support any of Your Critical or Important Functions.

1 DEFINITIONS

Definitions shall have the meaning as set out below or  in the Terms and Conditions. 

Data Processing Schedule means The Access Group’s Data Processing Schedule , available via the Terms and Conditions as updated from time to time.

ESAs shall mean the competent European Supervisory  Authorities of the Customer designated under DORA. 

ICT, ICT-Related Incident ICT Service [ICT Risk and 
Critical or Important Function] shall have the meaning  ascribed to them under DORA.

Location means any region or country where the ICT Services are being provided by The Access Group or  where Customer Data is being processed and stored as  set out in the Product Fact Sheet.

Terms and Conditions means The Access Group’s Terms and Conditions

2 AGREED SUPPLEMENTARY TERMS TO AGREEMENT

2.1 SERVICE LEVEL AGREEMENT

2.1.1 The Access Group will supply the ICT Services  according to the Service Level Agreement outlined in the  Access Group Terms and Conditions, available at Terms and Conditions as updated from time to time.

2.2 SECURITY AND RECOVERY OF DATA

2.2.1 The Access Group will implement, maintain and ensure the availability, authenticity, confidentiality and integrity in relation to the protection of Your Customer Data as described in the respective Data Processing Addendum available in our Terms and Conditions. The relevant Data Processing Schedule is determined by reference to the Governing Law applying to The Access Contracting Party.

2.2.2 The Access Group will provide reasonable assistance to You in the event of an ICT incident that is related to the ICT Services provided by Us to You. In the event of an ICT-related Incident and You require assistance beyond what´s included in Your Agreement, We will provide reasonable assistance, at the then applicable hourly rate (such cost to be determined exante) as per Art 30(2)(f) of DORA; and

2.2.3 The Access Group will provide the ICT Services  as specified in the Order in your Agreement, and the Location of the process and storage of  Customer Data applicable to the ICT Services are set out in the Product Fact Sheet accessible via our “GDPR Portal” at The Access Customer Success Portal | Home. If you are not already registered on the portal you will need to do so.  If you have problems registering, please contact [email protected]. We will notify You via email in advance if The Access Group envisages changing any Location.

2.2.5 In the event The Access Group becomes insolvent or in resolution, discontinues its business operations or if the Agreement is otherwise? terminated, the Parties agree The Access Group will, within thirty (30) days of termination? make Your Customer Data available for access, recovery and return in an easily accessible format for a period of (30) Days. 

2.2.6 Notwithstanding clause 2.2.5, You may request that the Access Group delete Your Customer Data, whereupon The Access Group will use reasonable efforts to delete Your Customer Data that is in Our possession or control and will confirm such deletion, within 30 business days, in writing

2.2.7 Where reasonably required by You to meet Your security awareness programs and Your digital operational resilience training, The Access Group will make available subject matter expertise relevant to the ICT Services to attend Your relevant training schemes. These will be virtual sessions, can be requested once every 2 years and will not exceed 3 hours. You will compensate The Access Group for any costs incurred at the then applicable hourly rates. 

2.2.8 The Access Group will fully cooperate with the competent authorities and the resolution authorities of the Customer, including persons appointed by them.

2.3 TERMINATION

2.3.1 You may terminate the ICT Services in whole or part, with immediate effect if:

a. The Access Group is in significant breach of applicable law, regulations or the provisions of the Agreement;

b. Impediments arise capable of altering the performance of the ICT Services, including material changes which affect the arrangement or the situation of the ICT Services;

c. There are evidenced weaknesses in the way The Access Group ensures the availability, authenticity, confidentiality and integrity of Customer Data; or

d. The ESAs can no longer effectively supervise You as a result of the conditions of, or circumstances related to, the Agreement, or You are otherwise instructed by the ESAs to terminate the Agreement with The Access Group.

2.3.3 Notwithstanding the above, prior to exercising termination under this Addendum, a 30-day remediation period shall be provided to address and rectify the issues leading to the proposed termination. If the issues are not resolved to your satisfaction within this period, You may proceed with termination. However, such termination shall not relieve You of the  obligation to pay any fees due for the remaining  duration of the Initial Term or Further Term, as  applicable. 

2.3.4 If the Agreement is terminated, the obligations on The Access Group in clauses 2.2.5 and 2.2.6 will survive termination and continue to apply for a period of 3 months.

3 OTHER TERMS

3.1 All other terms and fees agreed in the Agreement remain unaffected, and in full force.

3.2 1.2. To the extent there is any conflict between the other terms of this Agreement and this DORA Addendum, this DORA Addendum shall prevail to the extent required to overcome such conflict.