Partner's Terms & Services

1. Identification of BASTION    

BASTION TECHNOLOGIES is a French simplified joint-stock company (“société par actions simplifiée”) registered with the Nanterre Trade and Companies Registry under number 921 179 925 whose head offices are located at 65 rue de la Croix, 92 000 Nanterre, France (“BASTION”).  

BASTION may be contacted at the following email address : contact@bastion.tech

2. Purpose

The purpose of these terms and conditions is to set out the legal, financial and technical terms and conditions (the “Terms and Conditions”) under which BASTION:

1. grants the partner, identified in the Quotation (the “Partner”), a non-exclusive, personal, and non-transferable licence (the “Licence”)

• to use the platform available at https://app.bastion.tech/ (the “Platform”),
• to operate the Platform for the purpose of providing it to its own clients (the “Clients”)  

2. and provides the services specified in article “Services”.

3. Contractual Documents

The contractual relationship is solely governed, by order of precedence, by the following documents:

The quotation (the "Quotation")

• It is based on the Client’s needs
• The Partner accepts it in writing (including by email) within 7 days of its issue. This acceptance implies acceptance of the Terms and Conditions in their version in force at the date of the Quotation;
• In case of contradiction, the Quotation shall prevail over the Terms and Conditions.  

In case of contradiction, the most recent Quotation shall prevail over the oldest one(s).  

The terms and conditions (the « Terms and Conditions »)

They define:

• BASTION’s terms of use of our Services,
• the obligations of the parties.

You can find them via a direct link at the bottom of the Platform.

The Data Protection Appendix (“Appendix 1”)

This appendix describes the processing that BASTION is authorized to carry out on the personal data of the Client’s employees.

4. Services

In consideration for the remuneration specified in article “Price”, BASTION will grant the Client:  

1. a non-exclusive, personal and non-transferable licence to use the Platform;  

In particular, the Partner will have access to the following cybersecurity services via the Platform:

• Cybersecurity audits,  
• Real-life simulations of phishing attacks,
• Detection of malicious activity from trusted and untrusted applications,
• Cybersecurity training,  
• Quarterly reports of these activities on the Platform and
• any other services mentioned in the Quotation.  

2. a licence to market the Platform for the purpose of providing it to the Clients  

(hereinafter referred to together as the “Licence”).  

To this end, the Partner will have access to the following services via the Platform:

• a dashboard with an overview of the Clients and the number of Clients Licences and accounts.  

The Clients’ accounts are the active Clients’ accounts amongst the Partner’s repertory available on the Platform (the "Clients’ Accounts”);

• if indicated on the Quotation, a prospecting tool for promoting the Services to the Clients and  
• any other services mentioned in the Quotation.

(hereinafter referred to together as the “Services”).  

The functional and technical specifications of the Services are described in the Quotation.  

5. Term

These Terms and Conditions start on the day of subscription for a month or as otherwise specified in the Quotation (the “Initial Period”).

It is tacitly renewed, for successive periods of the same duration as the Initial Period (together with the Initial Period, the "Periods"), from date to date, unless terminated by either Party by email sent to the other Party before the end of the period concerned.

6. Licence to use the Platform

6.1 Scope of the Licence

The Platform is BASTION’s property, as are the software, infrastructures, databases and content of any kind (texts, images, visuals, music, logos, brands, etc.) that BASTION uses. They are protected by all intellectual property rights or database producers' rights in force.  

The Licence does not entail any transfer of ownership to the Partner.

6.1.a. Licence to use the Platform

The Partner benefits from a non-exclusive, personal and non-transferable licence to use the Platform in SaaS mode for the term set out in article "Term”.  

During the duration of the Services, the Partner benefits from maintenance of the Platform, in particular corrective and evolutionary maintenance from BASTION. Therefore, access to the Platform may be limited or suspended.

Concerning corrective maintenance, BASTION shall make its best efforts to provide the Partner with corrective maintenance in order to correct any malfunction or bug found on the Platform.

Concerning the evolutionary maintenance, the Partner may benefit, upon acceptance of an additional Quotation by the Partner, to the addition of new functionalities and/or technical installations used within the framework of the Platform (such as, but not limited to, new modules or major features within modules, aiming at introducing minor or major extensions).

Access to the Platform may also be limited or suspended for planned maintenance, which may include the corrective and evolutionary maintenance operations mentioned above.

6.1.b. Licence to operate the Platform

BASTION grants to the Partner, for the term set out in article "Term", a licence to operate the Platform, in its existing version on the date hereof and in any future versions, for the sole purposes of:  

• marketing to the Clients the Clients’ licences to use the Platform (hereinafter referred to as the "Clients’ Licences") and
• Managing the configuration of the Platform.  

6.2. Restrictions

The aforementioned operating Licence to operate the Platform is granted for the sole purpose of providing the Platform to the Clients.

Consequently, the Partner shall refrain from :

• Reproducing all or part of the Platform;
• Integrating all or part of the Platform into any computer system or any other software Platform other than those provided for under these Terms and Conditions;

The right to operate the Platform is granted to the Partner only subject to actual payment in full of the prices agreed upon in article "Price".

6.3. Warranty  

BASTION guarantees the Partner the full and peaceful enjoyment of the Licence to operate the Platform granted to it against any disturbance, action, claim or eviction whatsoever.

BASTION thus guarantees the Partner that it has all the rights and authorizations necessary to grant this Licence and that the Platform does not contain anything that could fall under the laws and regulations relating to counterfeiting, unfair competition, privacy, image rights, personality rights and more generally, infringement of third-party rights.

BASTION also warrants that it has not and will not grant to a third party any assignment or Licence to operate or use the Platform that is likely to prevent or hinder the full enjoyment of the rights granted to the Partner under the Terms and Conditions.

7. Implementation of the Licence

7.1. Marketing of the Platform by the Partner

The Partner shall use its best efforts to provide the Platform to Clients and may enter into any agreements for this purpose. The Partner is free to set out the conditions for providing the Platform, in particular Clients’ Licences’ prices, subject to compliance with the specifications of the Clients’ Licences described in the Quotation. The Partner expressly acknowledges and accepts that the end-user licence agreement (the “EULA”) shall be duly accepted by the Clients in order to use the Services.  

In particular, the Partner is free to offer the Clients’ Licences as part of a global cybersecurity services.

7.2. Promotion of the Platform

The Partner undertakes to make its best efforts to promote the Platform to Clients.

For this purpose, the Parties may also define together the communication and promotional actions that may be implemented for the promotion of the Platform.

BASTION shall make available to the Partner, by all useful means, the material supports and advertising elements of its choice, for the presentation and promotion of the Platform to the Clients.

The Partner may also implement, at its own expense, any advertising or promotional actions that it wishes, provided that these actions do not affect the brand image of BASTION and the Platform.

8. Services provided by BASTION

8.1. Registration of a Client on the Platform

The Partner undertakes to open the Client Account in accordance with the conditions indicated on the Platform

8.2. Configuration of the Platform

The Partner may either, at its own discretion and as available on the Platform, provide the Platform to the Clients:  

• under a white label by using its name, brand and/or logo or  
• under a grey label, with the respective names and logos of the Partner and BASTION.  

8.3. Support and corrective maintenance

BASTION provides the Clients with support and maintenance services under the conditions defined below:

8.3.a. Support and corrective maintenance

Support Services are provided under the following conditions:

1. Level 1 support, consisting of technical assistance and advice, is provided directly by the Partner to the Clients, using the methods it deems most appropriate;  

2. Level 2 support, consisting of corrective maintenance of the Platform, is provided by BASTION via the chat available on the Platform, and under the conditions set out in the EULA. For any issues outside of the scope of Level 2 support, BASTION undertakes to direct the Clients to the Partner.

8.3.b. Updates and news versions

BASTION shall provide the Clients, during the term of the Terms and Conditions:

• With any improvements to the functionalities of the Platform, related to its ergonomics, speed of execution or efficiency, and/or any revisions aimed at introducing minor extensions to the Platform (hereinafter the "Updates"),

• With any changes to the Platform and its documentation by adding new features (hereinafter the "New Versions").

The nature and regularity of such Updates and New Versions shall be at BASTION's sole discretion.

8.3.c. Other services  

BASTION shall provide directly the Partner with any other additional services on Partner’s request. If the Partner requests additional services, BASTION will send the Partner a separate quotation. The price for these additional services will be directly paid by the Partner to BASTION.

9. Hosting of the Platform

BASTION undertakes to ensure, under the terms of an obligation of means, the hosting of the Platform, in accordance with the practices of the profession and the state of the art, on its servers or through the intermediary of a professional hosting service provider, exercising its activity in accordance with the practices of the profession and the state of the art, having its servers located in a territory of the European Union.

In the event of a change of hosting provider, BASTION undertakes to notify the Partner as soon as possible, by any useful written means, specifying the identity of the new hosting provider, as well as the territory  in which its servers will be located.

In the context of the hosting service, BASTION undertakes to provide the Partner with sufficient storage and processing capacity for the operation of the Platform and its use by the Partner.

BASTION undertakes to implement all technical means, in accordance with the state of the art, necessary to ensure the security and access to the Platform and the Services, relating to the protection and monitoring of the infrastructures, the control of physical and/or immaterial access to said infrastructures, as well as the implementation of detection, prevention and recovery measures to protect the servers from malicious acts.  

BASTION also undertakes to take all useful precautions, with regard to the nature of the data and the risks presented by the automated data processing implemented for the purposes of the operating Licence for the Platform and Services described herein, to preserve the security of the data, and in particular to prevent it from being distorted, damaged or accessed by unauthorized third parties.

10. Financial conditions  

The Partner undertakes to pay BASTION the price set forth below.

10.1. Price

In consideration for the Licence and the performance of the Services, the Partner shall pay BASTION the prices indicated in the Quotation and including in particular (i) a fixed fee per Period, (ii) a price per active licence in the company directory (such that, but not limited to, Google Workspace Directory and Azure AD) or (iii) any other pricing mechanism agreed upon by both parties.

BASTION reserves the right, at its own discretion and on terms to be determined by it alone, to offer promotional offers or price reductions.

10.2. Currency and exchange rates

Unless otherwise stated, the prices of the Services are expressed in euros and are exclusive of tax.

When the calculation of the price requires the application of an exchange rate, the applicable rate is that of the date of payment of the price, with the Partner having to bear any applicable exchange charges.

10.3. Invoicing and payment

Unless otherwise stated in the Quotation, the prices of the Services are subject to monthly invoices that shall be sent by BASTION to the Partner by any written means, including email, at the end of each month.

The invoices are based on the number of Clients’ Licences and the categories to which they belong as created by the Partner directly via the Platform (the “Modules”).

Payment is made by direct debit monthly or as otherwise specified in the Quotation when subscribing to the Services.  

The Partner guarantees to BASTION that it has all the necessary authorizations to use the chosen payment mode.

BASTION’s invoices shall be paid within a maximum of 30 (thirty) days from the date of invoicing.

10.4. Payment delays and incidents  

Any payment delay of all or part of an amount at its due term, shall automatically entail, without prejudice to the provisions set out in article “Termination for breach”, and from the day following the payment date indicated in the invoices:

1. Forfeiture of the term of all amounts payable by the Partner, regardless of the terms of payment that had previously been agreed,

2. Immediate suspension of the Services until complete payment of all amounts due by the Partner is received,

3. Invoicing by BASTION of a late payment interest at the rate of 3 (three) times the legal interest rate, calculated on the total of all due amount that were not paid on time, as well as a lump sum of 40 (forty) euros for costs recovery, without prejudice of any further compensation in the event effective recovery fees should be higher than this amount.  

10.5. Price review

The price of the Services may be reviewed by BASTION, applicable as of the renewal of the Services in accordance with the "Term" article.

BASTION undertakes to inform the Partner of the price changes by any written means at least three months before the new prices come into force.

If the Partner does not accept the new prices, the Partner must terminate the Terms and Conditions as set out in the "Term" article in order to prevent the renewal of the Services.

The Partner is deemed to have accepted the new prices if it uses the Services after they have come into force.

11. Evidence agreement  

The Partner expressly acknowledges and accepts:

1. that the data collected on Platform and the BASTION's computer equipment are proof of the reality of the operations carried out within the Terms and Conditions,

2. that such data constitute the principal form of evidence admitted between the Parties, in particular for the calculation of sums due to BASTION.

The Partner may access this data via its account on the Platform.  

12. Obligations and warranties of the Partner

Without prejudice to the other obligations set forth herein, the Partner agrees to comply with the following obligations:

1. The Partner declares that it is aware of the features and specifications of the Platform and that it is informed of the technical configuration required for its use.

The Partner declares that it has received from BASTION all advice, instructions and details that are necessary for it to enter into the Terms and Conditions with full knowledge of the facts, that it thus has sufficient knowledge of the Platform and that it has, prior to these terms and conditions, sufficiently exchanged with BASTION to ensure that the Platform corresponds to its expectations, needs and constraints and to the expectations, needs and constraints of the Partner.

In this respect, the Partner is solely responsible for providing the Platform to the Clients, subject to the provisions of the article "Services provided by BASTION".

2. The Partner declares that it received written consent from the Client to enroll their domain and/or IP addresses in the platform's infrastructure module. The module may perform intrusive detection on the targeted infrastructure to surface risks and vulnerabilities.

3. The Partner undertakes to provide BASTION with all documents, elements, data and information necessary to fulfill BASTION's obligations under the Terms and Conditions.

In particular, the Partner undertakes to inform BASTION without delay:

• any dispute or difficulty that it may encounter concerning the use of the Platform,
• any complaint, request, claim or grievance on the part of Clients in connection with their use of the Platform.

More generally, the Partner undertakes to cooperate actively with BASTION for the proper execution of the Terms and Conditions and to inform BASTION of any difficulties related to such execution.

4. The Partner's role is to advise, inform, recommend and warn Clients with respect to the Platform.

Therefore, the Partner undertakes to put in place all the means and personnel necessary to provide the Platform, as well as to advise Clients on Clients Licences.

In particular, the Partner undertakes to employ qualified personnel who are familiar with the technical and functional specifications of the Platform and who are likely to provide any useful assistance to the Clients.

5. The Partner is solely responsible for the marketing of the Platform to the Clients. The Partner shall be personally responsible for all declarations and formalities, in particular administrative, tax and/or social security formalities, as well as authorizations of any kind, whether legal and/or administrative and/or contractual, required for the performance of the Terms and Conditions. It acknowledges that it is solely responsible for them and that BASTION's liability may not be engaged in any way in this respect.

The Partner shall be solely responsible for its general terms and conditions of sale with the Clients, which it shall ensure that they are not contradictory or infringe upon the provisions of the Terms and Conditions nor the EULA of the Platform, as well as, more generally, for its relations with the Clients and the fulfillment of its contractual commitments. In this respect, it undertakes to hold BASTION harmless in any disputes or litigation that may arise in these areas and to make it its own business to resolve them.  

The Partner guarantees against any misuse, non-compliant or illegal use that Clients may make of the Platform, in particular against infringements of the laws and regulations in force. The Partner is therefore exclusively responsible for the implementation of all procedures intended to prevent or repair the commission of such acts.

6. The Partner is solely responsible for maintaining the confidentiality of connection identifiers and/or passwords on its own behalf and on behalf of the Clients.

7. The Partner indemnifies BASTION against any and all complaints, claims, actions and/or demands whatsoever that BASTION may suffer as a result of the Client's breach of any of its obligations under the Terms and Conditions. The Partner agrees to pay BASTION all costs, charges and/or judgments it may incur as a result.

13. Obligations and liability of BASTION

Without prejudice to the other obligations listed in the Terms and Conditions, BASTION undertakes to comply with the following obligations:  

1. BASTION undertakes to provide the Partner with all documents, elements, data and information necessary for the marketing of the Platform.

More generally, BASTION undertakes to cooperate actively with the Partner with a view to the proper performance of these Terms and Conditions and to inform the Partner of any difficulties relating to such performance.

2. BASTION undertakes to perform its obligations under the Terms and Conditions diligently and according to the rules of the trade, it being specified that it has an obligation of means, to the exclusion of any obligation of result, which the Partner expressly acknowledges and accepts.

3. BASTION undertakes to provide the Partner with the advice, warnings and information necessary for the proper performance of the Terms and Conditions. It also undertakes to inform the Partner of any foreseeable difficulty, in particular regarding a difficulty in implementing the Services or their proper operation.

4. BASTION undertakes to make its best efforts to ensure the security of the Platform and the accounts opened in the name of the Partner and the Clients.  

However, BASTION shall not be held liable in the event that the Partner or the Clients fail to maintain the confidentiality of their login and password or physical devices.

5. BASTION undertakes to make Clients’ Licences available to the Partner in accordance with the provisions set out the Quotation placed by BASTION, so that the Partner can satisfy the needs of the Clients.

6. BASTION undertakes to carry out regular checks to verify the operation and accessibility of the Platform. In this respect, BASTION reserves the right to temporarily interrupt access to the Platform for scheduled maintenance reasons.

Similarly, BASTION may not be held liable for any temporary difficulties or impossibilities in accessing the Platform caused by circumstances beyond its control, force majeure, or due to disruptions in the telecommunications networks.

7. Under no circumstances shall BASTION be held liable for :

• delays attributable to the late or defective communication by the Partner of all information and data necessary for the performance of the Terms and Conditions and, more generally, for any facts attributable to the Partner or to the Clients, as well as, more generally, for defects that are not directly and exclusively attributable to BASTION ;

• any damage not caused by a malfunction of the Platform, in particular difficulties arising from the Client's and/or Clients' IT infrastructures, personnel or equipment.

8. In any event, the liability that may be incurred by BASTION under the Terms and Conditions shall only relate to direct damage suffered by the Partner and shall be expressly limited to the total amount of the price received by BASTION during the 12 months preceding the event giving rise to liability.

Moreover, BASTION's liability may only be incurred if the Partner has made a claim, by registered letter with acknowledgement of receipt, within a period of one month following the said occurrence.

14. Parties’ Obligations

Each of the Parties undertakes, in the performance and use of the Services, to comply with the laws and regulations in force applicable in the context of the Terms and Conditions and not to undermine public order.

They also undertake to provide each other with all the documents, elements, data and information necessary for the proper performance of the Terms and Conditions. More generally, they undertake to cooperate actively and in good faith with a view to the proper performance of the Terms and Conditions and to inform each other of any difficulties relating to such performance.

Each Party shall take out and maintain in force such insurance policies as may be necessary to cover any damage to property or persons that may occur in the performance of the Terms and Conditions.

15. Intellectual Property

The Partner expressly acknowledges that the Terms and Conditions does not grant upon it any intellectual property rights over the Platform, which remains the exclusive property of BASTION.

The Partner only has a Licence to use the Platform under the conditions defined herein.

Consequently, any disassembly, decompilation, decryption, extraction, reuse, copy and more generally any act of reproduction, representation, distribution and use of any of the elements comprising the Platform, in whole or in part, without BASTION's authorization, are strictly prohibited and may be subject to legal proceedings.

16. Personal Data

16.1. General dispositions

As part of their contractual relations, each Party shall undertake to comply with the applicable regulations on personal data processing and, in particular, the General Data Protection Regulation (regulation EU 2016/679 of the European Parliament and of the Council of 27 April 2016) and to the French Data Protection Act of 6 January 1978 (hereinafter referred together as the “Applicable Regulation”).

Each Party processes personal data of contact person of the other Party involved in the execution of the Terms and Conditions, as controller within the meaning of the Applicable Regulation for the purpose of managing the contractual relations between the Parties and for the duration of the Terms and Conditions. These processing are carried out for the execution of the Terms and Conditions and only identification data (in particular surname, first name, email address, telephone number) are processed by the Parties.

Personal data are retained during the duration strictly necessary for the purposes of managing the business relationship between Parties. The staff of the Party controller of the processing, its control services (notably auditor) and its processors could have access to personal data.

The processing may result in the exercise by each Party’s contact person of their rights under the Applicable Regulation.

16.2. Processing of personal data by BASTION as a sub-processor

16.2.a. Role of the Parties

As part of the Services, BASTION processes the personal data of the Client’s employees on behalf of the Client, as a Sub-processor within the meaning of the Applicable Regulations. The Client is the Controller of its employees personal data and the Partner is the processor of the Clients within the meaning of the applicable Regulations.  

For the purposes of this section:  

(a) The Client is the Controller;  

(b) The Partner is the Processor;

(c) BASTION is the Sub-processor.

The characteristics of the processing are described in Appendix 1 of the Terms and Conditions.

16.2.b. BASTION’s obligations with respect to the Client

BASTION's obligations with respect to the Partner

• Data processing:

BASTION undertakes to process the personal data only for the purposes listed in Appendix 1 and in accordance with the Client’s documented instructions, including with regard to transfers of data outside the European Union. Where BASTION considers that an instruction infringes the Applicable regulation, he shall immediately inform the Partner thereof. Moreover, if BASTION shall process personal data and transfer them to a third country or an international organization, according to the applicable legislation of the Terms and Conditions, he shall inform the Partner of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

• Security and data confidentiality:

BASTION undertakes to implement the appropriate technical and organisational measures to ensure the security and integrity of personal data, their backup and the restoration of their availability in the event of a physical or technical incident. BASTION ensures that the persons authorized to process the personal data hereunder have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.  

• Sub-processors:

BASTION is authorized to recruit the entities (hereinafter "the Subsequent Sub-Processor") listed in Appendix 1 to carry out processing activities. BASTION shall inform the Client, in writing beforehand, of any intended changes concerning the addition or replacement of Subsequent Sub-Processors as listed. This information must clearly indicate which processing activities are concerned, the name and contact details of the Subsequent Sub-Processors. The Partner has a period of fifteen (15) calendar days from the date of receipt of this information to submit its legitimate and justifiable objections. In the absence of notification of objections after this period, the Partner shall be deemed to have authorized the use of the relevant Subsequent Sub-Processors. In the event of Client's continuing objections, the Parties shall meet in good faith and use their best efforts to discuss a resolution. BASTION may choose to (i) not hire the Subsequent Sub-Processors or (ii) take the corrective action requested by the Partner in connection with the objections before hiring the Subsequent Sub-Processors. If neither option is reasonably possible, and if BASTION cannot for legitimate reasons hire another processor for the intended processing, either Party may terminate the Terms and Conditions upon a thirty (30) days' notice.

The Subsequent Sub-Processors shall comply with the obligations hereunder on behalf of and in accordance with the Client’s instructions. BASTION shall ensure that the Subsequent Sub-Processors provides the same sufficient warranties regarding the implementation of appropriate technical and organisational measures so that the processing meets the requirements of the Applicable Regulation. If the Subsequent Sub-Processors fails to fulfil its data protection obligations, BASTION remains fully liable to the Partner for the Subsequent Sub-Processor performance of its obligations.

• Transfer of personal data outside the European Union:

BASTION is authorized to transfer personal data processed as part of the Terms and Conditions to countries located outside the European Union, if appropriate safeguards have been implemented as defined under Chapter V of GDPR.

• Assistance and provision of information:

BASTION undertakes to assist the Partner and to respond without undue delay to any request for information sent by the Client, whether in the context of a request for the exercise of their rights by data subjects, a privacy impact assessment, or a request made by a supervisory authority or the Client's data protection officer.

• Exercise of data subject’s Rights:

Insofar as this is possible, BASTION shall assist the Partner in fulfilling its obligation to respond to requests made to BASTION by data subjects to exercise their rights under the Applicable Regulation. Where requests are made directly to BASTION, BASTION shall promptly send such requests to the Partner by e-mail to the following email address: dataprivacy@bastion.tech.  

• Notification of personal data breach:

BASTION shall notify the Partner of any personal data breach relating to the processing operations covered by the Terms and Conditions, without undue delay after becoming aware of it and to provide the Partner with all relevant information and documentation relating to such personal data breach.

• Fate of the data:

BASTION undertakes, at the Client's election, to delete the personal data at the end of the Terms and Conditions or to return it to the Partner and not to keep a copy of it, unless required by the Applicable Regulation. The Partner has one (1) month from the end of the Terms and Conditions to exercise this choice. After this period, BASTION shall delete all personal data.

• Documentation:

BASTION shall make available to the Client, at the Client's request, all information and documents necessary to demonstrate compliance with its obligations and allow for audits. The Partner may carry out audits once a year, at its own expense to verify BASTION's compliance with the obligations set forth in this article. The Partner will inform BASTION of the audit at least two (2) weeks before. BASTION may refuse the identity of the auditor if it belongs to a competing company. The audit shall be conducted during work hours and with the least possible disturbance for BASTION’s activity. The audit shall not threaten (i) technical and organizational security measures implemented by BASTION, (ii) security and confidentiality of data of BASTION’s other clients, (iii) the proper functioning and organization of BASTION. When possible, Parties will agree beforehand on the scope of the audit. The audit report will be sent to BASTION as so to submit comments, which will be attached to the final version of the audit report. Each audit report will be considered as a confidential information.

• Client's obligations with respect to BASTION:

The Partner undertakes to:

1. provide BASTION with the personal data mentioned in Appendix 1, except any improper, disproportionate or unnecessary personal data, and except any “particular” personal data within the meaning of the Applicable Regulation, except if the processing activities justify it. In this case, the Partner will have to document these justifications and to take all measures, notably of prior information, to collect appropriate consent and appropriate security measures, appropriate for such particular data;

2. collect under its liability, lawfully, fairly and in a transparent manner the personal data provided to BASTION, for the performance of its services, and in particular, to ensure the lawfulness of processing and the information due to data subjects;

3. maintain a record of processing activities carried out and more generally, comply with the principles of the Applicable Regulation;

4. ensure, before and throughout the processing, compliance with the obligations set out in the Applicable Regulation.

17. Intuitu Personae

The Terms and Conditions shall be deemed to have been concluded in consideration of the person of the Parties and as such, the Parties shall not delegate or assign any of their rights under the Terms and Conditions, nor shall they entrust to a third party the performance of all or part of their obligations, without the prior written consent of the other Party.

18. Sub-contracting

As an exception to the article "Intuitu Personae", BASTION reserves the right to use subcontractors in order to provide the services defined above. In this case, BASTION shall notify the Partner and undertakes to ensure that its subcontractors comply with the same contractual obligations as those to which it is subject under the Terms and Conditions. BASTION shall in any event remain solely responsible for the proper performance of the services vis-à-vis the Client.

The Parties expressly acknowledge and accept that, in the event that these subcontractors are required to process personal data, the provisions of the article "Protection of Personal Data" shall apply.

19. Commercial references

The Parties may use their respective names, trademarks and logos and website references as commercial references for the duration of the Services and 3 years thereafter.

20 . Confidentiality

Each Party undertakes to keep strictly confidential all documents and information of a legal, commercial, industrial, strategic, technical or financial nature relating to the other Party or held by it which comes to its knowledge in connection with the conclusion and performance of the Terms and Conditions and not to disclose them without the prior written consent of the other Party.

In particular, the Partner undertakes to keep strictly confidential the connection identifiers and passwords it uses to connect to the tools provided by BASTION and, more generally, to access BASTION's data and computer system. He undertakes to implement all necessary security measures in order to preserve the security and confidentiality of his connection identifiers and BASTION's data. He undertakes to inform BASTION immediately in the event of loss or theft of his identifiers or in the event of any security breach of which he is aware.

This obligation does not extend to documents and information:

(i) of which the Party receiving them was already aware ;

(ii) which were already public at the time of their communication or which would become public without breach of the Terms and Conditions;

(iii) which would have been lawfully received from a third party;

(iv) the communication of which is required by the judicial authorities, according to laws and regulations, or in order to establish the rights of a Party under the Terms and Conditions.

This obligation of confidentiality extends to all employees, collaborators, trainees, managers, and agents of the Parties as well as their affiliated counsel and co-contractors, to whom confidential documents or information may be transmitted only if they are bound by the same obligation of confidentiality as provided herein.

This obligation of confidentiality shall continue to apply for a period of 5 (five) years from the expiration or termination of the Terms and Conditions, whatever the reason for the termination.

21. Social regulations

BASTION must provide the Partner with, at the Client's request and as often as necessary, until the end of the performance of the Terms and Conditions, the following documents:

1. document attesting to the company's registration dated less than 3 months (identification card in the case of registration with the register of trades, extract K or K bis in the case of registration with the RCS),

2. an up-to-date certificate of compliance attesting to the provision of social security declarations from the social security body responsible for collecting social security contributions.  

22. Termination for breach

In the event of breach by either of the Parties of any of their obligations under the Terms and Conditions, the Terms and Conditions shall be fully terminated 15 (fifteen) days after the Party in breach has received notice from the other Party by international registered letter with acknowledgement of receipt, and this having received no response, stating the latter's intention to apply this clause, and this without prejudice of any damages that could be claimed from the Party in breach.  

However, in the following limited cases, termination by BASTION may take place ipso jure without notice or formal notice, without payment of any compensation, and without prejudice to any other right of BASTION, in particular any damages which BASTION may claim, in the event of :  

(i) repeated breaches of the Client's obligations ;

(ii) failure by the Partner to comply with its obligations with regard to :

• Protection of personal data,
• Confidentiality,
• Intellectual property,
• Assignment and
• Subcontracting.  ‍

23. Termination effects

On the effective date of termination of the Terms and Conditions, for whatever reason, the Partner expressly undertakes to cease all marketing of the Platform and to cease presenting itself to Clients as a Partner of the Platform.

Termination of the Terms and Conditions entails closure of the Partner’s account on the Platform. The Clients’ Licences subscribed to by the Clients will remain in force for their own duration.

This does not affect the provisions hereof which are intended to continue beyond that period, and in particular the “Financial conditions”, "Confidentiality" articles and the present article.

24. Force majeure

In accordance with the provisions of article 1218 of the French Civil Code, neither Party may be held liable for failure to perform its contractual obligations if this failure is due to an event beyond the control of the Parties and constitutes force majeure.

Neither of the Parties shall be held liable for any temporary difficulties or impossibilities in the performance of the Terms and Conditions which are due to force majeure. The Parties agree to understand force majeure to mean events as well as strikes, terrorist activities, riots, downtime of the cloud services server, insurrections, wars, government actions, epidemics, natural disasters, or defect attributable to a third-party telecommunications provider.

The Party prevented from doing so must inform the other Party as soon as possible, indicating the nature of the case of force majeure. The Parties will work together to determine the most appropriate means of mitigating, if possible, the consequences of the event(s) constituting force majeure.

In the event of a case of force majeure that hinders the performance of its obligations by a Party and that continues beyond a period of one month, the Terms and Conditions may be terminated by either Party by registered letter with acknowledgment of receipt, without either Party having to pay the other any compensation whatsoever.

If, as a result of force majeure, the Party affected is prevented from fulfilling only part of its contractual obligations, it remains responsible for the performance of those obligations not affected by the force majeure and for its payment obligations.

As soon as the case of force majeure ceases, the Party prevented must immediately inform the other Party and resume performance of the affected obligations within a reasonable period of time.

25. Miscellaneous

25.1. Relationship between the Parties  

It is expressly agreed that neither of the Parties may use the provisions of the Terms and Conditions to claim, in any way whatsoever, the status of agent, representative or employee of the other Party, nor bind the other Party with respect to third parties, beyond the Services provided for by the provisions hereof.

Under the terms hereof, there is no particular legal structure between the Parties, each retaining its full autonomy, responsibilities, and its own clientele.

25.2. Residence

For the execution of the Terms and Conditions, the Parties elect residence at the addresses that appear at the beginning of the Terms and Conditions.

Both Parties undertake to notify each other of any change of address by international registered letter with acknowledgement of receipt.

If this is not respected, any mail sent to the address indicated on the first page of the Terms and Conditions shall be considered as having been legitimately received.

25.3. Agreement autonomy, severability, and amendment

The Terms and Conditions represent the entirety of the commitments existing between the Parties. It supersedes and cancels any previous oral or written undertakings relating to the subject matter of the Terms and Conditions.  

It is expressly understood between the Parties that, as the Terms and Conditions has been freely negotiated between them, any other document usually used by either Party, and in particular any general terms and conditions of sale or purchase, may not apply hereunder.

The nullity or inapplicability of any of the stipulations of the Terms and Conditions shall not entail the nullity of the other stipulations which shall retain their force and scope. The Parties shall then come together to decide in good faith on the amendments necessary to ensure that each of them is in an economic situation comparable to that which would have resulted from the Platform of the clause subject to nullity.

Any modification or amendment to the Terms and Conditions must be the subject of a written agreement between the Parties which, when this method is expressly provided for herein, may be made by the exchange of emails.

25.4. Written medium

Except for the conclusion of amendments to the Terms and Conditions as provided for in the article " Agreement autonomy, severability, and amendment", any reference to a written means within the framework of the Terms and Conditions shall be understood, unless expressly stated otherwise, to refer to any useful written means, in particular email.  

25.5. No waiver

The absence or renunciation by a Party of exercising or asserting any right whatsoever conferred on it by the Terms and Conditions may under no circumstances be assimilated to a renunciation of this right for the future, the said renunciation being effective only in respect of the event in question.

25.6. Law and Jurisdiction

The Terms and Conditions are subject to French law and shall be interpreted and governed by such.

Any dispute that may arise in connection with its interpretation, its validity, or its enforcement shall fall within the exclusive jurisdiction of the courts of Paris.  

Appendix 1 – Personal Data  

1. Description of the processing of personal data carried out by BASTION on behalf of the Client

Purpose(s) of the processing: Provision of the Services as defined in the Terms and Conditions

Nature of the processing : Collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Categories of personal data : Identification data (surname, first name), login data (email, password), test performance

Categories of data subjects : The Client’s employees information

Duration of the processing : Duration of the Terms and Conditions

2. List of the Subsequent Sub-Processor(s) authorized

Sub-Processor(s) authorized : AWS EU

Processing activities sub-processed : AWS EU

Localization of the processing : European Union