This Agreement is made between the Brocent company named in the Order Form (Brocent) and the customer named in the Order Form (Client). Unless the Order Form names another Brocent company, Brocent is [BROCENT CLOUD SERVICE CO., LIMITED], a company incorporated in Hong Kong [company number and registered address to be confirmed].
Master Terms
1. Definitions
1.1 Affiliate means a company that controls, is controlled by, or is under common control with a party.
1.2 Agreement means the Order Form, the Schedules and these Master Terms.
1.3 Business Day and Business Hours mean Monday to Friday, 09:00 to 18:00 local time at the Office concerned, excluding public holidays there.
1.4 Client Data means data, including Personal Data, that the Client or its Users provide to Brocent or that Brocent accesses on the Client’s systems in performing the Services.
1.5 Fees means the charges set out in the Order Form and any other charges payable under this Agreement.
1.6 Office means a Client location listed in the Order Form.
1.7 Order Form means the order, quotation or statement of work signed or accepted by both parties that refers to this Agreement.
1.8 Personal Data means information relating to an identified or identifiable individual, including “personal information” under PRC law.
1.9 Plan means the service level chosen for an Office in the Order Form: Startup, Established, Growth or Enterprise.
1.10 Services means the services described in Schedule 1 and the Order Form.
1.11 Service Levels means the response targets in Schedule 2.
1.12 Tokens means prepaid service units governed by Schedule 3.
1.13 User means an individual employee or contractor of the Client who is covered by a Plan.
2. Structure of the Agreement
2.1 Each Order Form forms a separate contract that incorporates these Master Terms and the Schedules.
2.2 If documents conflict, they apply in this order: (a) special terms in the Order Form; (b) the Schedules; (c) these Master Terms; (d) any other document referred to. Schedule 4 prevails on the protection of Personal Data.
2.3 Website content, estimates and proposals are not part of the Agreement unless the Order Form says so. The Client’s purchase terms do not apply.
2.4 A Client that receives Services in more than one country may choose either to (a) sign a single Order Form with Brocent’s Hong Kong company that covers all of its Offices, or (b) sign separate Order Forms with the local Brocent company in each country. These Master Terms apply in both cases. Under (b), each Brocent company is responsible only for the Order Form it signs, and that Order Form names the Brocent company, the invoicing currency and any local-law terms that apply.
3. Services
3.1 Brocent will provide the Services with reasonable care and skill, using suitably qualified personnel, and in line with the Service Levels.
3.2 Remote support is included in every Plan. On-site visits, project work and anything outside Schedule 1 are charged separately at the rates in the Order Form or Brocent’s published rates, or by drawing down Tokens.
3.3 Brocent provides the tools it needs to deliver the Services (ticketing system, user portal, monitoring agents and remote-support software). Their cost is included in the Fees. The Client may use them only to receive the Services and only during the term.
3.4 One-off projects are agreed in a statement of work with a fixed scope and price. This Agreement applies to each statement of work.
3.5 Either party may request a change to the Services. A change takes effect when both parties agree it in writing, including by email between authorised contacts.
4. Users and Offices
4.1 Fees for each Office are calculated on the number of active Users at the start of each monthly billing period. The Client will tell Brocent promptly when Users join or leave.
4.2 A Plan covers the number of devices per User stated in Schedule 1. Additional devices are charged as stated in the Order Form.
4.3 The Startup Plan is available only to an Office with 1 to 5 Users. An Office with more than 300 Users is priced individually in the Order Form.
4.4 The Client may add Offices or countries by a further Order Form. Each Office is priced and invoiced in its own currency.
5. Client responsibilities
5.1 The Client will:
- name at least one authorised contact who can give instructions and approve changes;
- give Brocent the remote and physical access, administrator credentials and information it reasonably needs;
- hold valid licences for its software and keep operating systems, hardware and applications within the manufacturer’s support period, or accept that support for unsupported items is on a reasonable-efforts basis;
- keep Brocent’s monitoring and security agents installed and running on covered devices;
- keep a current backup of its data, unless the Order Form includes a backup service for the system concerned;
- follow Brocent’s reasonable security recommendations, or accept the resulting risk in writing; and
- make sure its Users do not make changes that conflict with Brocent’s configuration without telling Brocent first.
5.2 Brocent is not responsible for a failure or delay caused by the Client not meeting clause 5.1. Brocent will tell the Client when this happens. Work needed to put things right is chargeable.
5.3 Credentials, documentation of the Client’s environment and the Client’s licences belong to the Client throughout the term.
6. Third-party products
6.1 Hardware, software licences and third-party subscriptions are not included in the Plan price. Where Brocent supplies them, they are listed and priced in the Order Form.
6.2 Third-party products are provided under the manufacturer’s or vendor’s own terms and warranty. Brocent passes those on to the Client and gives no further warranty for them.
6.3 If a vendor changes its price during a subscription term, Brocent may change the corresponding charge from the same date, on written notice with evidence of the vendor’s change.
7. Fees and payment
7.1 Plan Fees are invoiced monthly in advance. On-site visits, project work and other usage charges are invoiced monthly in arrears. Tokens are invoiced when ordered.
7.2 The Client will pay each invoice within 30 days of the invoice date, in the invoice currency, without set-off or deduction.
7.3 Fees exclude GST, VAT, consumption tax and similar taxes, which Brocent adds at the applicable rate. If the Client must withhold tax by law, it will increase the payment so that Brocent receives the invoiced amount.
7.4 If the Client disputes part of an invoice in good faith, it will tell Brocent in writing within 14 days of the invoice date and pay the undisputed part on time.
7.5 Brocent may charge interest on overdue amounts at 1% per month, calculated daily from the due date until payment.
7.6 If an undisputed amount is more than 14 days overdue, Brocent may suspend the Services after giving 7 days’ written notice. Fees continue to accrue during suspension. The Service Levels do not apply during suspension.
7.7 Brocent may change the Fees once in any 12-month period by giving at least 60 days’ written notice. A change takes effect only from the next renewal. If the Client does not accept an increase, it may end the affected Order Form by written notice before the increase takes effect, without any early termination charge.
8. Service Levels
8.1 Brocent will meet the Service Levels in Schedule 2. Brocent will report its performance against them to the Client each month.
8.2 If Brocent misses a first-response target for a Priority 1 or Priority 2 incident, the Client may claim a service credit under Schedule 2. Service credits are deducted from the next invoice. They are not refunded in cash except on termination.
8.3 Service credits are the Client’s only financial remedy for a missed Service Level. This does not limit the Client’s right to terminate under clause 10.1 or 10.2.
8.4 A Service Level does not apply to the extent a failure is caused by the Client, a third-party product or network outside Brocent’s control, agreed maintenance, suspension under clause 7.6, or an event under clause 19.1.
8.5 The first 60 days from the service start date in the Order Form are a handover and transition period. The Service Levels are not measured during this period: no service credits arise, and a missed target is not counted under clause 10.2. Brocent will still use reasonable efforts to meet the targets.
9. Term and renewal
9.1 This Agreement starts on the date in the Order Form and continues for the term chosen there.
9.2 Initial term. The initial term is 12 months from the service start date, or the longer period stated in the Order Form.
9.3 Renewal. After the initial term, the Agreement renews for successive periods of 12 months unless either party gives at least 30 days’ written notice before the end of the current period. Per-User rates are fixed for each term, subject to clause 6.3.
9.4 Fees are invoiced monthly throughout each term, as stated in clause 7.1.
10. Termination
10.1 Either party may end this Agreement immediately by written notice if the other party:
- commits a material breach and does not remedy it within 30 days of written notice describing the breach; or
- becomes insolvent, enters liquidation or receivership, or stops carrying on business.
10.2 The Client may end the Order Form for an Office by 30 days’ written notice if Brocent misses the Priority 1 first-response target at that Office in three or more months within any six-month period.
10.3 Brocent may end this Agreement by written notice if an undisputed amount remains unpaid 30 days after a suspension notice under clause 7.6.
10.4 If the Client ends this Agreement before the end of the current term, other than under clause 7.7, 10.1, 10.2 or 19.1, it will pay an early termination charge equal to 50% of the Plan Fees for the rest of the current term, based on the User count at the date of notice. The parties agree this is a fair price for the right to leave early.
10.5 Termination does not affect rights that have already accrued, or clauses that are meant to continue, including clauses 7, 11, 13, 14, 16, 17 and 20.
11. Exit
11.1 When this Agreement ends, Brocent will hand over to the Client or its new provider, following the Client’s reasonable transition plan:
- documentation of the Client’s environment;
- all credentials Brocent holds for the Client’s systems;
- exports of configuration that Brocent manages; and
- knowledge-transfer sessions with the incoming provider.
11.2 Handover work of up to 8 hours is included. Further transition work is charged at Brocent’s rates or by drawing down Tokens.
11.3 Within 30 days after the end date, Brocent will remove its agents and tools from the Client’s devices and delete Client Data from its systems, except for records Brocent must keep by law or needs to keep for billing and dispute purposes.
11.4 Brocent may postpone knowledge-transfer sessions while undisputed Fees are overdue. Brocent will not withhold the Client’s credentials for any reason.
12. Data protection and security
12.1 Each party will comply with the data protection laws that apply to it. Schedule 4 applies where Brocent processes Personal Data for the Client.
12.2 Brocent will apply technical and organisational measures appropriate to the risk to protect Client Data against unauthorised access, loss, alteration and disclosure. Brocent’s access to the Client’s systems is granted per client and logged.
12.3 Brocent will tell the Client without undue delay, and in any case within 24 hours, after it becomes aware of a security incident that affects Client Data held or accessed by Brocent. Brocent will give the information the Client reasonably needs to meet its own legal duties.
12.4 The Client remains responsible for its own security decisions, for the accuracy and lawfulness of Client Data, and for any notices to regulators or individuals, unless the parties agree otherwise in writing.
13. Confidentiality
13.1 Each party will keep the other’s confidential information secret, use it only to perform or receive the Services, and share it only with staff, Affiliates, subcontractors and professional advisers who need it and are bound by equivalent duties.
13.2 This does not apply to information that is public other than through a breach, was already lawfully known, is independently developed, or must be disclosed by law, a court or a regulator.
13.3 These duties continue for three years after this Agreement ends. They continue without limit for Personal Data, credentials and trade secrets.
13.4 Brocent will not name the Client as a customer or publish a case study without the Client’s written consent.
14. Intellectual property
14.1 The Client owns the Client Data, and the documentation of its environment that Brocent prepares for it, once the Fees for that work are paid.
14.2 Brocent keeps all rights in its tools, scripts, templates, methods and know-how, including improvements made while providing the Services. Brocent grants the Client a non-exclusive licence to use anything of this kind that is built into a deliverable, for the Client’s internal business.
14.3 The Client grants Brocent the right to use Client Data and the Client’s systems only as needed to provide the Services.
15. Warranties
15.1 Each party confirms that it has the authority to enter into this Agreement.
15.2 Brocent confirms that it will provide the Services as stated in clause 3.1. If the Client reports within 30 days that a piece of work did not meet that standard, Brocent will redo it at no charge.
15.3 Brocent does not promise that the Client’s systems will be free of faults, interruptions or security incidents. No managed service can remove these risks completely.
15.4 All other warranties and terms implied by law are excluded as far as the law allows.
16. Liability
16.1 Nothing in this Agreement limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.
16.2 Subject to clause 16.1, neither party is liable for loss of profit, revenue, business or goodwill, or for indirect or consequential loss.
16.3 Subject to clause 16.1, each party’s total liability under an Order Form in any 12-month period is limited to the Fees paid and payable under that Order Form in the 12 months before the claim arose.
16.4 For a breach of clause 12 or 13 or Schedule 4, the limit in clause 16.3 is two times that amount.
16.5 The limits in clauses 16.2 to 16.4 do not apply to the Client’s duty to pay the Fees.
16.6 Brocent is not liable for loss of data to the extent the Client did not keep a backup as required by clause 5.1.
16.7 A party must bring a claim within 12 months of becoming aware of the facts behind it.
17. Non-solicitation
17.1 During the term and for 12 months afterwards, neither party will directly approach and hire an employee or engineer of the other who was involved in the Services, without the other’s written consent.
17.2 This does not prevent hiring someone who responds to a general advertisement.
17.3 A party that breaches clause 17.1 will pay the other six months of that person’s gross pay. The parties agree this is a fair estimate of the cost of replacing and training that person.
18. Affiliates and subcontractors
18.1 Brocent may deliver Services through its Affiliates and through subcontractors. In mainland China, Services are delivered by Brocent’s Affiliate 北京博迅尼科科技有限公司 (BROCENT Cloud Service (Beijing) Co., Ltd). Where Brocent has no local staff, on-site visits may be carried out by vetted partners working under a Brocent ticket.
18.2 Brocent remains responsible to the Client for the work of its Affiliates and subcontractors and binds them to confidentiality and data protection duties no less strict than those in this Agreement.
18.3 The Client’s only contracting party is Brocent. Brocent’s Affiliates and subcontractors may rely on clause 16.
19. General
19.1 Events outside control. Neither party is liable for a failure or delay caused by an event beyond its reasonable control, such as natural disaster, epidemic, war, government action, or failure of a public network or utility. This does not excuse payment. If the event lasts more than 60 days, either party may end the affected Order Form by written notice.
19.2 Notices. Notices must be in writing and sent by email to the contacts in the Order Form, and take effect on the next Business Day after sending. A notice of breach or termination must also be sent by courier to the registered address.
19.3 Assignment. Neither party may transfer this Agreement without the other’s written consent, which must not be unreasonably withheld. Either party may transfer it to an Affiliate or to a successor to its business by written notice.
19.4 Entire agreement. This Agreement is the whole agreement between the parties on its subject and replaces earlier discussions and documents. Neither party has relied on a statement that is not in it.
19.5 Changes. A change to this Agreement must be in writing and agreed by both parties.
19.6 Severance and waiver. If part of this Agreement is unenforceable, the rest continues. A delay in enforcing a right is not a waiver.
19.7 Third parties. Except as stated in clause 18.3, a person who is not a party has no right to enforce this Agreement under the Contracts (Rights of Third Parties) Ordinance (Cap. 623).
19.8 Signature. This Agreement may be signed electronically and in counterparts.
19.9 Language. This Agreement is made in English and Chinese. If the two versions differ, the English version prevails.
20. Governing law and disputes
20.1 This Agreement is governed by the laws of the Hong Kong Special Administrative Region.
20.2 The parties will first try to settle a dispute through discussion between senior managers for 30 days after one party notifies the other of it.
20.3 Any dispute, controversy, difference or claim arising out of or relating to this Agreement, including its existence, validity, interpretation, performance, breach or termination, shall be referred to and finally resolved by arbitration administered by the Hong Kong International Arbitration Centre (HKIAC) under the HKIAC Administered Arbitration Rules in force when the Notice of Arbitration is submitted. The seat of arbitration is Hong Kong. There will be one arbitrator. The language is English. Brocent may instead bring a claim for unpaid Fees in any court with jurisdiction.
Schedule 1 — Services
1. Plans
The Order Form states the Plan for each Office. Different Offices may be on different Plans.
| Startup | Established | Growth | Enterprise | |
|---|---|---|---|---|
| Team size | 1 to 5 Users | From 5 Users | From 10 Users | From 25 Users |
| Assigned to the Client | Shared service desk | Named account manager | Dedicated service desk agent | Dedicated infrastructure engineer |
| Devices covered per User | 1 | Up to 3 | Up to 3 | Up to 5 |
| Onboarding hours included | 1 | 5 | 10 | 20 |
| Also included | The twelve services below | Everything in Startup | Everything in Established | Everything in Growth, plus vendor management for up to 10 vendors |
Every Plan includes a named vCIO.
2. Included in every Plan
- 24/7 NOC monitoring
- Help desk (remote service desk for Users)
- Managed firewall
- Patch management
- Antivirus and endpoint detection (EDR), run on the Client’s Microsoft 365 or equivalent licences
- Backup and disaster recovery operations, including immutable backup: monitoring jobs, following up failures and running restores on the Client’s backup platform
- Password and credential management
- DMARC monitoring
- Web content filtering
- Named vCIO and technology roadmap
- Documentation and credentials that remain the Client’s property
- Written response-time Service Levels (Schedule 2)
3. Onboarding
Taking over routine support (documentation, agent roll-out, portal set-up, User onboarding) is part of the Plan and carries no onboarding fee. The parties agree an onboarding plan at kick-off. Onboarding work beyond the included hours is charged at Brocent’s rates.
4. Reports
Brocent gives the Client written service reports that match the scope of the Services, at no extra charge. The standard set is: IT Asset Management, Patch Management, Configuration Management, System Account Management, Microsoft 365 Security, Backup and Recovery, SOC Log Management and Availability Monitoring (monthly), and Access and Permission Review (quarterly).
5. Not included in the Plan price
- On-site visits. They are charged at the rates in the Order Form, with a minimum of 2 hours per visit, plus 50% outside Business Hours and 100% on weekends and public holidays.
- Hardware, software licences and third-party subscriptions. Where Brocent procures them, it charges cost plus an 8% administration fee unless the Order Form states a price.
- Projects and new technology, such as migrations, office moves, new networks and new backup or disaster recovery platforms.
- One-off assessment and hardening services, penetration testing, SOC/SIEM, mobile device management, and major-incident response and forensic investigation, unless listed in the Order Form.
- Support for line-of-business applications beyond coordinating with the vendor.
Schedule 2 — Service Levels
1. Service windows
- Standard (8×5): Business Hours. This applies unless the Order Form states otherwise.
- Premium (24×7): all hours, every day, where stated in the Order Form.
- Priority 1 and Priority 2 incidents receive a first response within 15 minutes, within the service window that applies.
- Under the Standard window, requests raised outside Business Hours are handled under the emergency extension, with a first response within 2 hours.
2. Priorities and targets
Brocent’s service desk sets the priority of each ticket from its business impact and urgency.
| Priority | Definition | First response | Remote support starts | On-site | Resolution target |
|---|---|---|---|---|---|
| P1 Critical | System service halted or severely degraded. Users cannot access any business resources. | 15 min | 30 min | 4 BH or planned | 8 BH |
| P2 High | Part of the system halted or degraded. Users can access the system but encounter errors. | 15 min | 30 min | 4 BH or planned | 24 BH |
| P3 Medium | Some Users or systems have trouble accessing the system, but critical components are working. | 30 min | 60 min | NBD or planned | 48 BH |
| P4 Low | Some system features have a problem or need improvement, but Users can operate normally. | 60 min | 120 min | NBD or planned | 48 BH |
| P5 Routine | No system issue. Planned or routine IT request. | 60 min | 240 min | NBD or planned | 72 BH |
BH means Business Hours. NBD means next Business Day. Times run within the service window that applies. On-site times apply only where the Order Form includes on-site response for the Office. Resolution times are targets, not guarantees. The clock stops while Brocent is waiting for the Client or a third-party vendor.
3. Service credits
3.1 For each Priority 1 or Priority 2 incident where Brocent misses the first-response target, the Client may claim a credit of 5% of the monthly Plan Fees for the Office affected.
3.2 Credits for an Office in any month will not exceed 10% of that month’s Plan Fees for the Office.
3.3 The Client must claim a credit in writing within 30 days after the monthly report that shows the miss.
Schedule 3 — Tokens
- One Token equals one hour of on-site engineering time in Business Hours. Remote support is charged in 15-minute blocks; four blocks equal one Token.
- The minimum first purchase is 20 Tokens for each service zone. Offices in the same zone share one balance.
- Tokens are valid for 12 months from purchase. Brocent tells the Client 60 days before a balance expires. On request to the account manager, Brocent grants one goodwill extension of an unused balance in each contract year. Tokens are not refundable.
- Tokens are deducted as shown in the table below.
- Surcharges: heavy part transport, 1 Token; travel to a remote site, 1 Token under 30 km and 2 Tokens for 30 to 50 km; cancellation less than 24 hours before a scheduled visit, 2 Tokens.
- Brocent gives the Client a signed service report for each job, a weekly balance statement and a low-balance alert.
| When | On-site minimum | On-site, each further hour | Remote minimum | Remote, each further 15 min |
|---|---|---|---|---|
| Business Hours | 2 Tokens | 1 Token | 2 blocks | 1 block |
| Evening (18:00–22:00, Mon–Fri) | 3 Tokens | 1.5 Tokens | 3 blocks | 2 blocks |
| Late night and weekends | 4 Tokens | 2 Tokens | 4 blocks | 2 blocks |
| Public holidays | 6 Tokens | 3 Tokens | 6 blocks | 3 blocks |
Schedule 4 — Data protection
- Roles. The Client decides why and how Personal Data in the Client Data is processed. Brocent processes it only on the Client’s behalf: as a data processor under Hong Kong law, a data intermediary under Singapore law, and an entrusted party under PRC law.
- Processing details. Purpose: providing the Services. Duration: the term plus the exit period in clause 11.3. Method: remote and on-site IT administration, monitoring and support. Categories: business contact and account details of Users, device and log data, and any Personal Data held in systems Brocent administers. Individuals: the Client’s staff, contractors and contacts.
- Instructions. Brocent will process Personal Data only on the Client’s documented instructions, including this Agreement and tickets raised by authorised contacts, and will not use it for its own purposes.
- Security and staff. Brocent will apply the measures in clause 12.2 and make sure its staff are bound by confidentiality.
- Sub-processors. The Client agrees that Brocent may use the Affiliates and subcontractors in clause 18 and the providers of its service tools. Brocent will give the Client a list on request and notice before adding a new one. Brocent binds each of them to duties equivalent to this Schedule.
- Location. Brocent’s service desk operates from mainland China, Hong Kong, India and Malaysia. Personal Data collected in mainland China is handled there by Brocent’s PRC Affiliate. Brocent will not move it out of mainland China except on the Client’s instruction. The Client is responsible for any consent, standard contract, assessment or filing that PRC law requires for a transfer it instructs, and Brocent will cooperate.
- Incidents. Brocent will notify the Client as stated in clause 12.3 and help the Client investigate and meet its notification duties.
- Help with requests. Brocent will give reasonable help when an individual exercises a legal right or a regulator makes an enquiry about Personal Data that Brocent processes.
- Return and deletion. At the end of the Services Brocent will return or delete Personal Data as stated in clause 11.3 and will not keep a copy unless the law requires it.
- Records and audit. On reasonable notice, and not more than once a year, Brocent will give the Client the information needed to show that it complies with this Schedule.