Corstorphine Building Society - Master Services Agreement v1

Order forms. Each service is bought under an order form that sits under this agreement. The executed order form decides the contracted tier, price, term and service levels. Where an order form and this agreement disagree on a commercial point, the executed order form prevails. Where they disagree on a regulatory or outsourcing point, the Outsourcing Schedule prevails.

Drafts. A draft order form or proposal is superseded on the day the executed order form is signed.

Definitions.

Part B: The Services

The Supplier will deliver the Services described in each order form with reasonable skill and care. The Enterprise tier includes single sign-on and SCIM, an executive sponsor and the service levels stated in the executed order form. Premium support, the Sandbox and dedicated data residency are available only where an order form lists them.

The Supplier will connect only the systems named in an order form, and will tell the Society before it changes any connector in a way that could affect how data is indexed.

Part C: Fees and payment

Fees, the implementation fee, any discount and the billing frequency are set out in the order form and nowhere else. Invoices are payable within thirty days of the invoice date. Subscription fees are billed annually in advance unless the order form says otherwise. Fees are stated and invoiced in pounds sterling.

The Supplier will not change fees during a term. At renewal, the price book in force at that date applies, and the Supplier will give written notice of any change well ahead of the renewal date.

Part D: Data protection and security

1. The Society remains controller of Society Data. The Supplier acts only on the Society's documented instructions.
2. Society Data stays in the Environment. The Supplier will not copy it outside the Environment without the Society's written approval.
3. The Supplier will keep access to the Environment to named staff, protected by individual credentials and multi-factor authentication, and will remove access promptly when a person leaves or changes role.
4. The Supplier will tell the Society without undue delay, and in any case within the period required by the Society's regulators, of any incident affecting Society Data.
5. The Supplier will support the Society's security review and will answer reasonable follow-up questions in writing.

Part E: Service levels and credits

Availability, first-response times for priority-one issues and the nightly refresh commitment are stated in the executed order form. For the Enterprise tier, service credits apply to availability and to data freshness, as set out in that order form. Availability and freshness are measured separately: a brain that answered on stale data was available, but it may still breach the freshness commitment.

Part F: Outsourcing Schedule

The Society treats the Services as a possible Material Outsourcing. This schedule applies for as long as the Services are provided and for the exit period.

Audit and access rights

• The Society, its internal and external auditors and its regulators may audit the Supplier's delivery of the Services, including records, controls and premises used for the Services.
• The Supplier will give access to relevant staff, documents and systems on reasonable notice. No notice is needed where a regulator requires immediate access.
• The Supplier will co-operate fully with any regulator and will not restrict the Society from sharing information with its regulators.
• Each party bears its own costs of an ordinary audit. The Supplier bears the cost of remedying any failing the audit finds.
• Audit rights cover any sub-outsourced part of the Services (see below).

Notice of sub-outsourcing

• The Supplier will not sub-outsource any part of the Services without the Society's prior written consent.
• A request for consent will name the proposed provider, describe the work, the data involved and its location, and explain how the provider will meet the terms of this agreement.
• The Supplier remains fully responsible for every sub-outsourced part of the Services.
• The Supplier will give the Society written notice, with enough time for the Society to assess it, before any material change to an approved arrangement. The Society may object, and if the objection is not resolved the Society may end the affected Services without penalty.
• The Supplier will keep a current register of approved sub-outsourcing and share it on request.

Exit plan

• Within a reasonable period after signature, and before go-live, the parties will agree a written exit plan. The Supplier will review it with the Society at least once a year and after any material change.
• The exit plan will cover: the data and artefacts the Society can take, in what format, and how; the roles of each party; the order in which connectors are switched off; the handling of the Environment; and the support the Supplier will give.
• On termination or expiry, for whatever reason, the Supplier will continue the Services for a transition period if the Society asks, on the terms in force.
• Because the Services run in the Environment, the Society keeps its data, indexes and configuration. The Supplier will remove its own access and confirm removal in writing.
• The Supplier will not withhold exit assistance because of a dispute about fees.

Business continuity

The Supplier will maintain and test a continuity plan for the Services and share a summary with the Society each year.

Part G: Liability, term and termination

Liability caps, exclusions and indemnities are to be agreed in review and are listed as open points below. Either party may end this agreement for the other's material breach that is not remedied within a reasonable period after written notice. The Society may also end it where a regulator requires, or where the Supplier becomes insolvent.

Part H: General

This agreement is governed by the law of Scotland, and the Scottish courts have jurisdiction. Neither party may assign it without the other's written consent. Changes must be in writing and signed by both parties.

Open points for review

Signatures

Not yet signed. This draft carries no signatures.

An authorised director of each party will sign the executed copy.