DORA Compliance Annexe

Non-Critical ICT Third-Party Service Provider

Please note: This English version is only for informational purposes. The French version is the only binding version between EuroDNS’ and the Customer.
This Annexe applies exclusively to EuroDNS’'s customers that qualify as financial entities under Article 2 of the Digital Operational Resilience Act (Regulation (EU) 2022/2554) and the relevant regulatory technical standards, implementing technical standards and any applicable guidelines or instructions issued by competent supervisory authorities (collectively, "DORA"). It contains the contractual provisions required by Article 30(2) of DORA for ICT services that do not support critical or important functions. It forms part of the Agreement once the Customer accepts it in the Customer Account.

Capitalised terms not defined in this Annexe have the meaning given in the Agreement.

Agreement has the meaning given in the General Terms and Conditions available at https://www.eurodns.com/general-terms, as amended from time to time.

Competent Authority means a competent authority as defined in Article 46 of DORA or a resolution authority competent for the Customer, and includes any person appointed by either of them.

ICT Incident means an ICT-related incident as defined in DORA, being a single event or a series of linked events that compromises the security of the network and information systems used by EuroDNS’ to provide the Services and has an adverse impact on the availability, authenticity, integrity or confidentiality of Account Data or on the Services.

Material ICT Incident means an ICT Incident with a significant adverse impact on the availability, authenticity, integrity or confidentiality of Account Data, or on the delivery of the Services to the Customer.

Subcontractor means a third party that provides an ICT service to EuroDNS’ within the same ICT service supply chain connected with the provision of the Services, within the meaning of the Implementing Technical Standards on the Register of Information under Article 28(9) of DORA.

2.1 This Annexe does not apply where the Customer does not qualify as a financial entity as defined in Article 2 of DORA, or is excluded under Article 2(3) or 2(4) of DORA.

2.2 EuroDNS’ acknowledges that the Customer is subject to obligations under DORA in relation to its use of ICT services provided by ICT third-party service providers such as EuroDNS’. EuroDNS’ will cooperate with the Customer, to the extent required by DORA in relation to the Services and subject to the cost provisions of this Annexe, to help the Customer meet those obligations.

2.3 The Customer shall not use the Services to support a critical or important function within the meaning of DORA, because EuroDNS’ depends on Providers, in particular registries, over which it does not have full control. If the classification of the Customer's use of the Services changes, the Customer will notify EuroDNS’ without delay and the Agreement will terminate with immediate effect on written notice from EuroDNS’, clause 8.4 applying.

2.4 The up-to-date list of Services subscribed to by the Customer is available at any time in the Customer Account and constitutes the description of the ICT services provided under this Annexe.

3.1 EuroDNS’ provides the Services principally from the territory of the Grand Duchy of Luxembourg. EuroDNS’ processes and stores Account Data, including personal data, in accordance with its Privacy Policy available at https://www.eurodns.com/privacy-policy.

3.2 Save as provided in clause 3.3, EuroDNS’'s processing of the Customer's data is limited to Account Data.

3.3 Depending on the Service ordered by the Customer, additional processing may be required, including by Providers and Subcontractors. The locations of processing and the identities of sub-processors are set out in the Privacy Policy.

3.4 EuroDNS’ will inform the Customer of any material change to the location of processing or storage of Account Data, including where the change is made by a sub-processor, with reasonable prior notice where practicable and in any event without undue delay.

EuroDNS’ provides the Services in accordance with the quality standards defined in the Agreement and, where applicable, the Service Level Agreement forming part of it. Unless expressly stated otherwise in this Annexe, article 11.1 of the General Terms and Conditions applies.

5.1 EuroDNS’ has implemented and will maintain appropriate technical and organisational measures to protect Account Data against unauthorised access, loss, alteration or disclosure. These measures are consistent with industry standards for data protection, information security and ICT risk management, and are reviewed periodically and updated to reflect the state of the art. They apply solely to Account Data. The Customer remains solely responsible for the Content it stores, hosts or transmits via the Services and for the security measures protecting that Content.

5.2 Throughout the term of the Agreement, EuroDNS’ will implement and maintain measures designed to ensure the availability, confidentiality, authenticity and integrity of Account Data processed in the context of the Services.

5.3 The Customer can export all of its Account Data at any time through the Customer Account on the EuroDNS’ platform, without any request to EuroDNS’. 

5.4 EuroDNS’ backs up Account Data in accordance with good industry practice, taking into account the nature and sensitivity of the data.

5.5 Upon termination of the Agreement and subject to legal retention requirements applicable to EuroDNS’, EuroDNS’ will delete or anonymise Account Data in all environments, and from backups in line with its backup rotation cycle. On request, EuroDNS’ will confirm the deletion or anonymisation in writing.

6.1 EuroDNS’ will notify the Customer of any Material ICT Incident without undue delay and in any event within one (1) Working Day after becoming aware that an ICT Incident is a Material ICT Incident. EuroDNS’ will provide the information reasonably required by the Customer to classify the incident and to meet its own reporting obligations under DORA.

6.2 Customer support is available on Working Days during the support hours published by EuroDNS’. Critical disruptions are managed in line with EuroDNS’'s incident response procedures, and EuroDNS’ will cooperate with the Customer in addressing and resolving any ICT Incident affecting the Services.

6.3 Notification under clause 6.1 is free of charge. Any other assistance provided by EuroDNS’ at the Customer's request in relation to an ICT Incident affecting the Services is charged at the hourly rate set out in article 8.2 of the General Terms and Conditions, as in force when the assistance is provided.

7.1 EuroDNS’ may use Subcontractors where necessary and will make reasonable efforts to ensure that the services they provide meet acceptable industry standards.

7.2 Providers, including registries and certification authorities, are third parties whose services are made available to the Customer according to the Services the Customer orders (for example, the top-level domain it registers) and under their own policies. Information on Providers, including registries, and on their policies is available at https://www.eurodns.com/registries-policies, and EuroDNS’ keeps it reasonably up to date. EuroDNS’ does not provide customer-specific lists of Providers. The Customer may identify the Providers relevant to it from the list of Services in its Customer Account and from the information published at that address, including for the purposes of its register of information under Article 28(3) of DORA. This clause also applies where a Provider qualifies as a Subcontractor.

7.3 EuroDNS’'s liability under this Annexe is governed by article 11 of the General Terms and Conditions, including the limit in article 11.9 and the exclusion of that limit in article 11.12 for fraudulent conduct or gross negligence. EuroDNS’ is not responsible for any loss or damage incurred by the Customer due to a service interruption outside EuroDNS’'s control, nor for any malfunction affecting the Internet in general, including EuroDNS’'s communications with Providers. EuroDNS’ gives no guarantee regarding the information systems continuity or availability of Providers such as domain registries and SSL certification authorities.

8.1 This Annexe terminates automatically on expiry or termination of the Agreement.

8.2 The Customer may terminate the Agreement, or only the affected Services, without penalty in any of the following cases:

(a) a material breach of the Agreement by EuroDNS’ that remains uncured thirty (30) days after written notice;

(b) a material change in EuroDNS’'s operations that adversely affects its digital resilience or security obligations under this Annexe, as notified by EuroDNS’ or evidenced by the Customer;

(c) weaknesses in EuroDNS’'s ICT risk management concerning the availability, authenticity, integrity or confidentiality of Account Data, evidenced by the Customer and remaining uncured thirty (30) days after written notice;

(d) the inability of the Competent Authority to supervise the Customer effectively as a result of the terms of the Agreement; or

(e) an order of a Competent Authority.

8.3 Termination under clause 8.2 takes effect on the date stated in the Customer's written notice. By way of derogation from article 14.3 of the General Terms and Conditions, the two (2) month notice period and the registered mail requirement do not apply to such termination.

8.4 Fees for Services provided up to the effective date of termination remain payable. Fees paid for domain names and other Services already registered, renewed or executed with a Provider are not refundable. Fees paid for other Services not yet provided are refunded pro rata.

8.5 Before any termination under clause 8.2(e), EuroDNS’ and the Customer will use reasonable efforts to resolve the grounds invoked by the Competent Authority.

8.6 In accordance with articles 14.3 and 14.4 of the General Terms and Conditions, the minimum notice period for termination of the Agreement by either party is two (2) months, except in the cases of immediate termination or suspension provided for in the Agreement. Where EuroDNS’ discontinues a Service under article 7.2 of the General Terms and Conditions, it will give the Customer as much prior written notice as reasonably practicable. EuroDNS’ cannot guarantee any minimum notice where the discontinuation results from a decision of a Provider, such as a registry ceasing to register domain names under a top-level domain or a certification authority discontinuing its service, or from a legal or regulatory requirement.

9.1 EuroDNS’ will cooperate in good faith with the Competent Authority and the Customer in respect of any lawful request relating to audits or oversight of the Services.

9.2 Audits and inspections requested by the Customer are subject to reasonable prior written notice, take place on Working Days, are limited to once per calendar year unless required by a Competent Authority or following a Material ICT Incident, and must not disrupt EuroDNS’'s operations or compromise the confidentiality, data or systems of EuroDNS’'s other customers. These conditions do not limit the powers of a Competent Authority.

9.3 EuroDNS’'s cooperation with a Competent Authority is not conditional on payment. EuroDNS’ will charge the Customer for the time spent on cooperation under this clause 9 at the hourly rate set out in article 8.2 of the General Terms and Conditions, as in force when the work is performed.

On request, EuroDNS’ will participate in the Customer's ICT security awareness programmes and digital operational resilience training in accordance with Article 13(6) of DORA. Participation is subject to prior agreement on scope, frequency and notice, and is charged at the hourly rate set out in article 8.2 of the General Terms and Conditions, as in force when the work is performed.

This Annexe complements the Agreement. In case of inconsistency, this Annexe prevails over the Agreement solely with respect to the obligations concerning DORA compliance. Nothing in this Annexe limits any provision of DORA that applies mandatorily to the Customer's contractual arrangements with EuroDNS’.