# SERVICE LEVEL AGREEMENT (SLA) ## Rule Step B.V. [besloten vennootschap; private limited liability company] --- **Version:** 1.0 **Date of entry into force:** 30 September 2026 This Service Level Agreement ("SLA") is, in addition to the General Terms and Conditions ("AW"), the applicable Supplementary Terms and Conditions Online Services ("AVO") and — insofar as applicable — the Order Form, applicable to every agreement between Rule Step B.V. and a Customer with regard to online services (hosting, VPS, app-hosting, domains, e-mail, certificates, back-up). For consulting services, the service levels in this SLA do not apply; these are delivered exclusively on a best-effort basis (see AVC Art. 2.4). Definitions from the AW (AW Art. 1.1) and AVO (AVO Art. 1.1) apply mutatis mutandis. --- ## Article 1 — Definitions In this SLA, the following is understood by: 1.1. **SLA**: this Service Level Agreement. 1.2. **Availability** (Beschikbaarheid): the degree to which the services of Rule Step are reachable and functional via the internet, expressed as a percentage of the total time in a calendar month. 1.3. **Downtime** (Storingstijd): the time during which the services are not Available, measured from the moment that Rule Step has registered the outage or ought to have registered it, until the moment at which the services are fully Available again. 1.4. **Scheduled Maintenance** (Gepland Onderhoud): maintenance work on the infrastructure announced in advance, necessary for stability, security or performance. 1.5. **Incident**: an unplanned event that leads to disruption of the Availability or the security of the services. 1.6. **Response Time** (Reactietijd): the time within which an employee of Rule Step begins to handle a report. 1.7. **Self-managed VPS**: a virtual private server of which the operating system, the software and the security are managed entirely by the Customer; Rule Step delivers exclusively the underlying hardware and network connectivity. 1.8. **Consumer** (Consument): a Customer who is a natural person and does not act in the exercise of a profession or business (B2C), as referred to in article 6:231 et seq. BW (Dutch Civil Code). 1.9. **Trader** (Ondernemer): a Customer who acts in the exercise of a profession or business (B2B), and is not a Consumer. --- ## Article 2 — Applicability and Place in the Document Structure **Statutory basis:** AW Art. 1.3 and 1.4. ### 2.1 Part of the agreement 2.1.1 This SLA forms part of the agreement between Rule Step and the Customer, in addition to the General Terms and Conditions, the Supplementary Terms and Conditions Online Services, the Order Form, the AUP and the DPA. 2.1.2 In the event of inconsistency between this SLA and the AW or AVO, the hierarchy of AW Art. 1.4 applies. In the event of conflict with mandatory consumer law (6:231 et seq. BW (Dutch Civil Code)), the mandatory provisions prevail. ### 2.2 Scope of validity 2.2.1 The service levels, guarantees and response times laid down in this SLA apply exclusively to online services. For consulting services, **no** SLA metric applies: response times are applied on a best-effort basis (see article 9.5). ### 2.3 Protection of the Consumer [B2C] 2.3.1 [B2C] If the Customer is a Consumer, deviations to the detriment of the Consumer in this SLA do not apply, and the rights of the Consumer are fully safeguarded in accordance with Book 6 Section 3 BW (Dutch Civil Code) (articles 6:231 et seq.). --- ## Article 3 — Uptime and Availability (Managed Hosting) **Statutory basis:** Articles 6:74 and 6:248 BW (Dutch Civil Code). ### 3.1 Guarantee 3.1.1 Rule Step guarantees a monthly Availability of ninety-nine point nine percent (99.9%) of the Managed Hosting services, calculated according to the formula: > Availability = ((total minutes in the calendar month − Downtime) / total minutes in the calendar month) × 100 3.1.2 This guarantee applies to Managed Hosting. For Self-managed VPS, article 7 applies (no uptime guarantee). For domain name registration, no uptime guarantee applies (availability dependent on the registry). ### 3.2 Consultancy excluded 3.2.1 For consulting services (such as advisory assignments, audits, analyses), no Availability guarantee applies. Response times to requests from the Customer are best-effort. ### 3.3 Measurement 3.3.1 The Availability is measured by the internal monitoring systems of Rule Step. External measurement methods of third parties are deemed not to provide evidence of a breach, unless the Parties expressly agree otherwise. 3.3.2 [B2C] The foregoing is without prejudice to the right of the Consumer to demonstrate a breach in the Availability by means of reasonable external monitoring instruments. The results submitted by the Consumer constitute rebuttable evidence. 3.3.3 The loss of Availability is not measured in a manner that deviates from the market standard, in order to prevent misleading advertising claims within the meaning of Directive 2005/29/EC (Unfair Commercial Practices (Oneerlijke Handelspraktijken)). --- ## Article 4 — Excluded Downtime **Statutory basis:** Articles 6:74 and 6:231 et seq. BW (Dutch Civil Code). ### 4.1 Exclusions The guarantee of Availability referred to in article 3.1.1 does not apply to the following periods of non-availability: (a) **Scheduled Maintenance** (Gepland Onderhoud), provided that Rule Step announces this in writing at least forty-eight (48) hours in advance; (b) **Force majeure** (see AW Art. 11 and AVO Art. 11), including but not limited to natural disasters, war, terrorism, civil unrest, government measures, pandemics, labour disputes, outages in utilities, outages in the internet backbone and disruptions in the supply chain; (c) **Outages at suppliers and upstream providers**, including network and data centre outages that fall outside the direct sphere of control of Rule Step; (d) **DDoS attacks**, insofar as these attacks are handled and migrated within the response times referred to in this SLA; (e) **Problems caused by the Customer**, including incorrect configurations, errors in software installed by the Customer, and the exceeding of the allocated server resources. ### 4.2 B2C assessment 4.2.1 [B2C] The exclusion of Scheduled Maintenance applies exclusively if it is reasonable and does not unacceptably prejudice the Consumer within the meaning of articles 6:237 and 6:236 BW (Dutch Civil Code). The exclusion of force majeure and supplier outages does not affect the rights of the Consumer to dissolution in the event of prolonged impossibility. --- ## Article 5 — Service Credits and Compensation **Statutory basis:** Articles 6:74, 6:236 BW (Dutch Civil Code). ### 5.1 Traders 5.1.1 For Traders (Ondernemers), the following compensation scheme applies: if the Availability in a calendar month is lower than 99.9%, the Trader is entitled to a service credit to the value of ten percent (10%) of the monthly fee for the relevant service for each full hour of Downtime by which the guarantee is exceeded. 5.1.2 The total service credits per calendar month are limited to a maximum of one hundred percent (100%) of the monthly fee for the service concerned. 5.1.3 Service credits are for Traders the sole and exclusive compensation for failure to achieve the Availability. The Trader must submit a claim in writing within thirty (30) days after the end of the calendar month concerned, upon submission of relevant monitoring data. 5.1.4 Service credits are set off against the next invoice. Payment in money shall never occur. ### 5.2 Consumers 5.2.1 [B2C] For Consumers, the same service credit scheme applies as in article 5.1.1. The liability of Rule Step towards the Consumer for all other damage (direct and indirect) per event is capped at one million euros (EUR 1.000.000), in order to comply with the reasonableness and fairness of article 6:231 et seq. BW (Dutch Civil Code). 5.2.2 [B2C] The Consumer may at all times request payment of service credits in money. The granting of service credits is without prejudice to the right of the Consumer to full compensation for damage, if the limitation of service credits as sole compensation would unreasonably prejudice the Consumer. 5.2.3 [B2C] The periods and liability limitations referred to in this article are regarded as essential obligations of Rule Step. --- ## Article 6 — Incident Response and Reporting **Statutory basis:** Cybersecurity Act (Cyberbeveiligingswet, Cbw, Dutch implementation of the NIS2 Directive (EU) 2022/2555); AVG (GDPR) articles 33-34. ### 6.1 Response times 6.1.1 For critical Incidents (full unavailability or impairment of integrity/confidentiality), an acknowledgement period of fifteen (15) minutes and a Response Time of one (1) hour applies. 6.1.2 Within twenty-four (24) hours after the initial response, Rule Step draws up an incident report containing cause, impact and mitigating measures. ### 6.2 NIS2/Cbw reporting 6.2.1 If an Incident falls under the reporting obligations of the Cybersecurity Act (Cyberbeveiligingswet, NIS2 implementation), Rule Step reports in accordance with the statutory deadlines to the competent supervisory authority (CSIRT/NL): early warning within twenty-four (24) hours, full report within seventy-two (72) hours. 6.2.2 Insofar as an Incident is a personal data breach within the meaning of article 4(12) AVG (GDPR), the notification obligations of the AVG (GDPR) (articles 33-34) also apply, as elaborated in the Data Processing Agreement (Verwerkersovereenkomst, DPA Art. 7) and the Privacy Policy (PP Art. 9). 6.2.3 Insofar as the Incident entails a high risk for the rights and freedoms of data subjects within the meaning of AVG (GDPR) article 34, the data subjects are informed without unreasonable delay. ### 6.3 B2C variant 6.3.1 [B2C] The periods referred to in this article are regarded as essential obligations of Rule Step. Failure to meet the response deadlines gives the Consumer the right to dissolve the agreement if the breach justifies the dissolution, without prejudice to the right to compensation for damage. --- ## Article 7 — Self-managed VPS Exclusion **Statutory basis:** Articles 6:248 and 6:231 et seq. BW (Dutch Civil Code). ### 7.1 No uptime guarantee 7.1.1 For Self-managed VPS, no Availability guarantee applies. Rule Step delivers exclusively a best-efforts obligation (inspanningsverbintenis) for the infrastructure layer (hardware, network connectivity, power supply). 7.1.2 The Customer who makes use of a Self-managed VPS is itself responsible for the operating system, the security patches, the software configuration and the general security of the server. Support by Rule Step is directed exclusively at problems with the infrastructure layer. ### 7.2 B2C protection 7.2.1 [B2C] The exclusion referred to in paragraph 7.1.1 is without prejudice to the statutory duty of Rule Step to deliver a service that meets the reasonable expectations of the Consumer. A complete and prolonged unavailability of the infrastructure layer nevertheless entitles the Consumer to dissolution and compensation for damage. --- ## Article 8 — Data Residency and EU Sovereignty **Statutory basis:** AVG (GDPR) articles 44-50. ### 8.1 EU/EEA data residency 8.1.1 Rule Step guarantees that the processing of personal data and customer data takes place exclusively within data centres in the European Union and the European Economic Area (EEA). The primary infrastructure is located with hosting partners within the EEA. Back-ups are stored in data centres within the European Economic Area (EEA). ### 8.2 Transfer to third countries 8.2.1 No data transfer to third countries takes place, unless on the basis of standard contractual clauses (SCCs) approved by the European Commission, adequacy decisions, or the EU-US Data Privacy Framework (2023). The details are elaborated in the Data Processing Agreement (Verwerkersovereenkomst, DPA Art. 10). ### 8.3 Essential characteristic for the Consumer [B2C] 8.3.1 [B2C] The guarantee of data residency referred to in paragraph 8.1.1 is regarded as an essential characteristic of the agreement. Acting in violation of this guarantee is considered a breach, and entitles the Consumer to full compensation for damage and dissolution. Such a violation may also be regarded as a misleading commercial practice within the meaning of article 6:193a BW (Dutch Civil Code). ### 8.4 AVG (GDPR) role and DPA 8.4.1 The processing of personal data by Rule Step in the capacity of processor (article 28 AVG (GDPR)) is regulated exclusively in the Data Processing Agreement (Verwerkersovereenkomst, DPA). This SLA is not sufficient to comply with the requirements of article 28 AVG (GDPR). ### 8.5 Retention periods 8.5.1 The retention periods for personal data and customer data are laid down in the Privacy Policy (PP Art. 5). In the event of conflict between this SLA and the Privacy Policy, the retention periods of the Privacy Policy prevail. --- ## Article 9 — Support and Response Times **Statutory basis:** Articles 6:74 and 6:231 et seq. BW (Dutch Civil Code). ### 9.1 Priority levels 9.1.1 For online services (excluding Self-managed VPS), the following response times apply: (a) **Critical**: full unavailability or critical security incidents — Response Time one (1) hour; (b) **High**: considerable limitation of the functionality — Response Time four (4) hours; (c) **Medium**: functional limitations with temporary workarounds — Response Time one (1) business day; (d) **Low**: questions or requests that do not limit the functionality — Response Time three (3) business days. ### 9.2 Priority queue B2B 9.2.1 Traders (Ondernemers) who have concluded a specific support contract (priority support) are eligible for a priority queue, whereby the response times referred to in paragraph 9.1.1 are shortened by fifty percent (50%). ### 9.3 B2C reasonable period 9.3.1 [B2C] The response times referred to in paragraph 9.1.1 apply as reasonable periods within the meaning of article 6:74 BW (Dutch Civil Code). Failure by Rule Step to respond in a timely manner to a Critical or High problem is a breach in the performance of the agreement; the Consumer may, after the expiry of the period, dissolve the agreement if the breach justifies the dissolution, without prejudice to the right to compensation for damage. ### 9.4 Self-managed VPS 9.4.1 For Self-managed VPS, the response times of paragraph 9.1.1 apply exclusively to infrastructure layer incidents (hardware, network connectivity, power supply). For OS and application level, no Response Time guarantee applies. ### 9.5 Consulting — best-effort 9.5.1 For consulting services, the response times of paragraph 9.1.1 do not apply. Rule Step applies best-effort Response Times for consulting, without any rights being able to be derived therefrom. Urgent requests are handled as soon as possible. --- ## Article 10 — Duration and Termination ### 10.1 Duration 10.1.1 This SLA enters into force on the date of signing of the Order Form and applies for the duration of the main agreement. 10.1.2 Termination of this SLA takes place only simultaneously with the termination of the main agreement, with due observance of the notice periods included therein. ### 10.2 B2C variant 10.2.1 [B2C] The Consumer has at all times the right to terminate the agreement prematurely against pro rata repayment of fees already paid in advance for the period during which the service is no longer delivered, without prejudice to the statutory provisions regarding termination by notice and dissolution. --- ## Article 11 — Liability **Statutory basis:** AW Art. 9 and 10; AVG (GDPR) article 82. ### 11.1 B2B liability 11.1.1 The liability of Rule Step towards the Trader for direct damage is limited to the amount that the Trader has paid to Rule Step in the twelve (12) months preceding the damage-causing event for the relevant service, with a maximum of fifty thousand euros (EUR 50.000) per event. Indirect damage is fully excluded towards the Trader. ### 11.2 B2C liability 11.2.1 [B2C] The liability of Rule Step towards the Consumer for direct damage is unlimited insofar as it concerns death, bodily injury, intent or deliberate recklessness. For all other damage (direct and indirect), the liability of Rule Step towards the Consumer is capped at one million euros (EUR 1.000.000) per event, in order to comply with article 6:231 et seq. BW (Dutch Civil Code). ### 11.3 Third parties (hosting partners, registrars) 11.3.1 Rule Step is never liable for damage resulting from injudicious use by the Customer, or from errors of third parties that fall outside the sphere of control of Rule Step. 11.3.2 [B2C] The exclusion of liability for damage caused by third parties does not apply towards the Consumer. Rule Step remains liable towards Consumers for damage caused by suppliers (such as hosting partners) and cannot invoke a third-party clause (derdenbeding) to limit this liability, in accordance with AW Art. 9.4 and article 6:231 et seq. BW (Dutch Civil Code). ### 11.4 Intent or deliberate recklessness 11.4.1 The liability limitations referred to in this article do not apply if the damage is the result of intent or deliberate recklessness of Rule Step or its executives. --- ## Article 12 — Dispute Resolution **Statutory basis:** AW Art. 16; Regulation (EU) No 1215/2012 (Brussels I bis). ### 12.1 Dutch law 12.1.1 This SLA is governed exclusively by Dutch law. ### 12.2 B2B forum 12.2.1 [B2B] Disputes are submitted in first instance to the competent court in the arrondissement [judicial district] in which Rule Step B.V. has its statutory seat (Amsterdam). ### 12.3 B2C forum 12.3.1 [B2C] The Consumer has the choice to submit the dispute to the court in the arrondissement [judicial district] of his place of residence, in accordance with article 18(1) of Regulation (EU) No 1215/2012 (Brussels I bis). Furthermore, the Consumer may make use of the European Online Dispute Resolution Platform (Europees Onlinegeschillenbeslechtingsplatform) (see AW Art. 16.3). ### 12.4 B2C withdrawal 12.4.1 [B2C] If the Customer is a Consumer, the Consumer has, during the first fourteen (14) calendar days after the conclusion of the agreement, the right to dissolve it in accordance with the statutory cooling-off period (bedenktijd) (article 6:230p BW (Dutch Civil Code)), without prejudice to the statutory exceptions. If the Consumer has expressly consented to immediate performance of the service, the right of withdrawal (herroepingsrecht) is limited in accordance with AVO Art. 3. --- ## Execution This SLA has been adopted by the management board (bestuur) of Rule Step B.V. and enters into force on 30 September 2026. Place: Amsterdam, the Netherlands Date: 30 September 2026 ________________________________________ **J.J. van Grondelle** Director (alleen/zelfstandig bevoegd [solely/independently authorised]) --- *For questions about this SLA: hello@rulestep.com*