Service Level Agreement

Last updated: 23 March 2016

This document (the SLA) describes the service level commitments that AuthenticateIT Pty Ltd (ABN 30 155 162 253) (AuthenticateIT) provides to a customer (the Brand Owner) in connection with the services provided under a Services and Licence Agreement between AuthenticateIT and the Brand Owner (an Agreement). This document is subject at all times to the terms of the Agreement.

AuthenticateIT reserves the right to amend this SLA from time to time and will endeavour to provide written notice of any material changes to the Brand Owner. The applicable version of this SLA is the most recently updated document available on the AuthenticateIT website, or otherwise provided by AuthenticateIT to the Brand Owner.

1. Support Services
1. Description

During the Term, AuthenticateIT will:

1. provide the Brand Owner with telephone, e-mail or internet-based assistance with respect to the System, through a Help Desk facility referred to below; and
2. make available to the Brand Owner a Help Desk facility during the hours of operation specified in section 1.3 below. The functions of the Help Desk facility include:
1. telephone or email assistances in relation to: functions and features of the System and the Documentation;
2. guidance in the operation of the System, and in the installation of any Upgrades as they are made available; and
3. a means for the Brand Owner to report and be provided with answers to enquiries by the Brand Owner about problems or issues affecting the System (the Support Services).

Services described in this section are provided by the AuthenticateIT Support Centre (ASC).

2. Obligations of the Parties

When reporting a problem or issue (an Incident), or making a request for services (Service Request) to AuthenticateIT, the Brand Owner will comply with the procedures and provide the information described in this SLA. If the Incident is attributable to the System, AuthenticateIT will use commercially reasonable efforts to rectify that problem or manage its effects, in accordance with the response levels set out at section 1.7.

3. Hours of Operation

AuthenticateIT will provide the Support Services during the hours specified below:

Method	Availability	Contact Details
Telephone	8:00 am–5:00 pm (AEST), Monday to Friday (excluding Australian national public holidays) (Business Hours). [A separate "after hours" service, which applies from 8:00 am to midnight (AEST), 7 days a week (including public holidays) (Extended Hours), is available where agreed between AuthenticateIT and a Brand Owner, paid for by the Brand Owner, to be provided at AuthenticateIT's standard service rates.]	+61 3 9924 4405 International Dial In
Email	Availability: 24 hours / 7 days a week. Responses: 8:00 am–5:00 pm (AEST), Monday to Friday (excluding Australian national public holidays) *	support@authenticateit.com

1. * Incidents considered by the Brand Owner to be « Critical » (P1) or « High Priority » (P2) must be notified by telephone in the first instance.
2. All phone calls are answered by an AuthenticateIT technician (or, if during Extended Hours, by an after hours call center) who will review the Incident or Service Request and assign a priority and where possible, convey a target time to the Brand Owner for resolution based on the assigned priority of the Incident or Service Request, as determined under this SLA.
3. All emails to the ASC are logged as Incident or Service Request in AuthenticateIT’s service management system.
4. During Business Hours, the ASC will respond to Brand Owners directly. Where applicable, AuthenticateIT will use reasonable endeavours to address Critical (P1) and High Priority (P2) Incidents reported during Extended Hours by on-call engineers. All other requests will be managed from the next Business Day.
4. Incident and Service Request Reporting Procedures
1. Prior to contacting the ASC regarding an Incident, the Brand Owner must ensure that the Incident is not caused by the Brand Owner’s equipment or otherwise attributable to an issue that is not supported by AuthenticateIT under this SLA (including section 1.9).
2. When contacting the ASC regarding an Incident or Service Request, the Brand Owner must provide the following information:
1. Brand Owner name;
2. Description of the Service affected by the Incident;
3. Description of the Incident;
4. Details of any diagnostics or troubleshooting performed by the Brand Owner;
5. Name and contact details of the Brand Owner contact person;
3. When an Incident or Service Request is logged, the ASC will:
1. advise the Brand Owner of the level of priority to be allocated to the Incident;
2. record the Incident or Service Request into Authenticateit’s internal system;
3. manage any escalations or contact with third party vendors or service providers, as it considers reasonably necessary to address the Incident or Service Request;
4. for an Incident:
1. use commercially reasonable endeavours to resolve the Incident in accordance with the target resolution times;
2. if required, update the Brand Owner with the progress of the Incident at such intervals agreed at the time of incident lodgement (or as otherwise reasonable); and
3. if required, notify the Brand Owner when the Incident has been resolved; and
5. for a Service Request:
1. use commercially reasonable endeavours to address the Service Request within the target resolution times;
2. if required, update the Brand Owner with the progress of the Service Request; and
3. if required, notify the Brand Owner when the Service Request has been addressed.
5. Service Level: Response and Resolution Times

AuthenticateIT will provide the Support Services, and use commercially reasonable endeavours to meet the target service levels documented below:
For Incidents:

Priority Level	Target Response Time		Status Reporting	Target Resolution Time
P1	Business Hours:	15 mins	As reasonably determined by ASC, or other times agreed at lodgement of Incident.	4 hours
	Extended Hours:*	60 mins		4 hours
P2	Business Hours:	30 mins		8 hours
	Extended Hours:*	60 mins		8 hours
P3	30 mins		At Incident Resolution	1 day

* Extended Hours only applicable where Extended Hours services have been agreed in writing between AuthenticateIT and the Brand Owner
For Service Requests:

Priority Level	Target Response Time	Status Reporting	Target Resolution Time
P1	120 mins	After Service Request has been addressed.	1 day
P2	120 mins		5 days
P3	120 mins		5 days

6. Priority Levels

AuthenticateIT will consider the impact and the urgency of an Incident or Support Request, and categorise those in accordance with the priority levels documented below:

Priority	Description
« Critical » (P1)	An essential component not available with a serious impact to the System, the Brand Owner’s business or a significant number of end users.
« High Priority » (P2)	An essential or major component not available, or working with some reduced functionality, with some impact on the System, the Brand Owner’s business or a significant number of end users.
« Low Priority » (P3)	A non-essential component not available or working with reduced functionality, with minor impact on the System, the Brand Owner’s business or a number of end users.

7. Escalation

If AuthenticateIT, in the course of performing the Support Services, considers that an Incident or Service Request requires escalation, it will do so as follows:

Escalation Level	Description
1	All Incidents and Service Requests reported during Business Hours will be investigated by AuthenticateIT personnel, to provide basic hardware and software troubleshooting remotely. AuthenticateIT may use remote access facilities to diagnose any software failure reported and rectify on AuthenticateIT’s hosted infrastructure.
2	Where an Incident is reported during Extended Hours, or an Incident or Service Request is escalated from Level 1, the Incident or Service Request will be addressed by AuthenticateIT engineers or other technical personnel to the extent required to resolve the Incident or address the Service Request.
3	Where an Incident or Service Request cannot be addressed under Levels 1 and 2, due to a requirement for third party vendor or service provider involvement, an AuthenticateIT engineer or other technical personnel will provide appropriate diagnosis and assistance to address the Issue or Service Request with the relevant third party vendor or service provider.

8. General Exclusions

Unless otherwise stated in the Agreement, AuthenticateIT is not required to provide support, or may impose an additional fee in relation to problems arising out of:

1. the Brand Owner’s failure to implement a current Upgrade;
2. the Brand Owner not installing or using the software of accessing the System in accordance with the Documentation;
3. changes to the Brand Owner’s (or any authorised user’s) business systems or environment on which any AuthenticateIT software is operating;
4. unauthorised modifications to the AuthenticateIT software;
5. a failure by the Brand Owner to provide qualified and trained staff for the operation of the software, or its business systems or the environment on which any AuthenticateIT software is operating;
6. accident, negligence or misuse; or
7. operator, Brand Owner or authorised user, or end user error.

For the purposes of this section, « Documentation » includes this SLA.

9. Additional Exclusions

AuthenticateIT is not required to provide support, or may impose an additional fee in relation to problems arising out of:

1. servicing, operation or other issues related to third party equipment (including printing equipment) or service providers (such services to be provided by agreement between the Brand Owner and the supplier or such services or equipment); and
2. any issues related to the printing, use or presentation of barcodes (including the quality of printing).
2. System Availability
1. Description

During the Term, AuthenticateIT will take reasonable steps to ensure the availability of the System during the hours of operation specified at section 2.2.

2. Service Level: System Availability

Subject to any Maintenance Period specified at section 2.3 below and any genuine emergency period, AuthenticateIT will use commercially reasonable endeavours to ensure that the System is available to the Brand Owner and its customers in accordance with the following formula.

Service	Service Criteria	Target Service Level
Service Availability (« A »)	A = Total Availability – (Downtime – Maintenance Downtime)	99%

Where:

1. « Total Availability » means a full calendar month (in minutes);
2. « Downtime » means the period of time that the System is unavailable to any substantial proportion of customers (in minutes); and
3. « Maintenance Downtime » means the period of time in which AuthenticateIT has deliberately taken the System offline during any Scheduled Maintenance periods set out in section 2.3 below.
3. Scheduled Maintenance

AuthenticateIT may take the System offline (in whole or in part) in accordance with the Scheduled Maintenance Period specified below:

Scheduled Maintenance Period
Target notice period	10 business days (where practicable)
Maintenance Hours	5:00 pm to 8:00 am (AEST)
Maintenance Days	Monday to Friday
Completion Time	5:00 am (AEST)

The System may also be taken offline as a result of AuthenticateIT service provider scheduled maintenance and in the event of any genuine emergency requiring unscheduled maintenance to be undertaken. In either event, AuthenticateIT will take commercially reasonable steps to provide as much notice as is reasonably practicable and return full access to the System as soon as reasonably practicable.

4. Exclusions

The service level commitments included in this section 2 do not apply to the extent that a failure or unavailability is wholly or substantially attributable to:

1. a Force Majeure Event (as described in the Agreement);
2. any matter excluded under sections 1.10 or 1.11; or
3. suspension of the services or the System by AuthenticateIT as a result of the Brand Owner’s default in accordance with AuthenticateIT’s rights under the Agreement.
3. Change Management
1. Description

Changes to the AuthenticateIT System or Services may be made (at AuthenticateIT’s sole discretion) in accordance with this section 3 and any applicable change management procedures that AuthenticateIT adopts from time to time.

2. Changes by Brand Owner

The Brand Owner may request a change to the AuthenticateIT System or Services by lodging a Service Request in accordance with the terms of this SLA. AuthenticateIT may also consider that a change is necessary in order to resolve an Incident lodged under this SLA. Where a change is accepted by AuthenticateIT, it will provide the Brand Owner with notice of any applicable fees, and if agreed, will consult with the Brand Owner to organise timing for implementation of the change.

3. Changes by AuthenticateIT

AuthenticateIT may, at its sole discretion, consider that a change to the System or the Services is necessary for continued operation, including security reasons or legislative change. AuthenticateIT will take commercially reasonable steps to provide the Brand Owner with at least 10 business days’ notice of any change. This provision does not limit AuthenticateIT’s obligations to provide the System and the Services to the Brand Owner in accordance with the Agreement.

4. Service Credits and Reporting
1. Description

If AuthenticateIT fails to satisfy any service level commitments set out in section 4.2 to which Service Credits apply then the Brand Owner will be entitled to a credit to its fees in the next applicable month in respect of that failure (a Service Credit). Those Service Credits

1. will be calculated in accordance with section 4.2 and the service level commitments at sections 1 and 2;
2. are not redeemable for cash, represent an adjustment to the fees to reflect the reduced value of the Services provided and are not intended to, and do not, represent liquidated damages or any form of compensation for loss or damage that the Brand Owner may suffer as a result of the failure of the System to be provided in accordance with the service level commitments;
3. will not exceed the applicable caps on Service Credits referred to in section 4.4; and
4. represent the sole and exclusive remedy of the Brand Owner in respect of the items to which they apply.
2. Service Credits

The following Service Credits are applicable in respect of the service level commitments (Service Levels) specified in this SLA:

Service Level	Service Level Failure	Percentage of monthly fees credited (« Service Credit »)
Service Availability (« A ») (as defined in section 2.2)	A ≥ 99.000%	-
	A < 97.000%	25%
	A < 95.000%	50%

3. Procedures
1. To claim a Service Credit, the Brand Owner must provide a written notice to AuthenticateIT specifying the relevant Service Level, relevant information related to failure of the Service Level and any additional information relevant to investigation of the claim (including any form provided by AuthenticateIT for that purpose).
2. A claim for a Service Credit must be made within 20 business days of the end of the month in which the service level failure occurred.
3. AuthenticateIT will promptly investigate and in good faith confirm the level of compliance with the relevant Service Level, at its own cost, providing the Brand Owner with written notice of the results of such investigation (Service Credit Report).
4. Where a Service Credit Report from AuthenticateIT concludes that Service Credits are applicable to the failure, the Service Credits will be credited as a discount to any fees that become payable by the Brand Owner to AuthenticateIT under the Agreement during the following month.
4. Service Credit Cap

For the avoidance of doubt, the maximum Service Credit creditable in a particular month will in no event exceed 50% of the total monthly fees otherwise payable by the Brand Owner to AuthenticateIT for the services under the Agreement for that month (Service Credit Cap). The Service Credit Cap applies even where the aggregate of multiple Service Level failures would otherwise result in a Service Credit greater than 50% in that month.

5. Monitoring and Reporting

AuthenticateIT will maintain records of its performance against the service level commitments set out in this SLA, as sufficient to substantiate any reasonable claim by the Brand Owner in relation to AuthenticateIT’s performance of those service level commitments under this SLA.