Common use of Service Request Acknowledgement Clause in Contracts

Service Request Acknowledgement. Within 2 business days at a maximum during normal operations. On a best effort basis for crisis scenarios as defined in our Business Continuity plan. n n n Service Request Support Support included for all Service Requests a month where Service Request effort <= 1 hour. n Support included for 4 Service Requests a month where Service Request effort <= 1 hour. n Platform Incident Notification Critical incidents are notified to customers within 30 minutes of detection by Bottomline. n n n Customer Data Retention Bottomline retains customer data for 12 rolling months as standard. The Customer data may be retained as any combination of online data and archive files. n n n PLATFORM MAINTENANCE & TESTING Standard Gold Platinum Scheduled Maintenance Notification BT provides 30 business days notice for scheduled maintenance during Service Availability hours. Scheduled maintenance includes changes such as upgrades relating to operating systems, infrastructure components and inter-banking network enhancements. n n n Mandatory Maintenance Notification BT provides 2 business days notice for mandatory maintenance. Mandatory Maintenance involves changes that Bottomline deems necessary for implementation prior to the next scheduled maintenance window. n n n Emergency Maintenance Notification Emergency changes are unplanned - notification is provided upon event. n n n Test Environment Accessibility 24 * 7 * 365, except -scheduled test environment maintenance windows -crises as defined in the Business Continuity Plan n n n Test Environment Availability 09:00 - 17:00 business days during normal operations. Bottomline cannot guarantee test environment availability during maintenance windows. If customers wish to ensure test environment availability (i.e. that no maintenance is underway), they must book a test environment slot under the following conditions: - Request for test slot not to be made more than 20 days in advance - Testing period is 5 business days maximum. Test Environment availability, even if pre-booked, is not guaranteed for any crisis outlined in the Business Continuity Plan. n n n Test Environment Monitoring Start of business day check on availability of test environment and customer is notified upon unavailability. n n SWIFT Upgrades For SWIFT Customers -SWIFT FIN standards release provided for Customer testing 6 weeks before cutover date. -SWIFTNet upgrades implemented 1 month before end of life. -SWIFT Quarterly security updates applied in line with SWIFT requirements n n REPORTING Standard Gold Platinum Critical Incident Report Initial Critical Incident Report sent to affected Customers within a maximum of 5 business days of event. Initial report sent with available information. Follow-up updates will be provided where applicable. n n n Service Availability Report Report listing service availability for period and conformity with availability rate provided monthly. n Report listing service availability for period and conformity with availability rate provided during scheduled service reviews with customers. n n n Volumes Report Report containing daily average volumes exchanged over last 12 months provided during scheduled service reviews with customers. n n n Disaster Recovery Report Report detailing the annual Disaster Recovery Test / Role Swap to be provided on request. n n n BUSINESS CONTINUITY & DISASTER RECOVERY Standard Gold Platinum Business Continuity A Business Continuity Plan (BCP) in place and is updated annually. A BCP business Impact analysis exercise is conducted annually. n n n Business Continuity Plan available Copy of Business Continuity Plan available upon request. n n n Disaster Recovery Test Frequency Disaster Recovery Test / Disaster Recovery Role Swap occurs once annually. Customers are notified in advance of this annual test. n n n Switch to DR Timeframes In accordance with table below: n n n SWITCH TO DR DETECTION DECISION TO SWITCH RESTART SERVICES (RTO) MAXIMUM LOSS OF DATA OBJECTIVE (RPO) Full loss of primary site H + 15 min H + 2 hours H + 4 hours <= 15 min (no data corruption) <= 6 hours (data corruption) Major application Incident without data corruption H + 15 min H + 2 hours H + 4 hours <= 15 min Major application Incident comprising data corruption H + 15 min H + 2 hours H + 4 hours <= 6 hours No connectivity to a banking network from the primary site H + 15 min H + 1 hr 15 min H + 4 hours None *Business Days: Working days excluding weekends (Saturdays and Sundays – unless otherwise specified) and national holidays defined under Public Holiday. **Public Holidays: New Year’s Day (Jan 1st); Good Friday; Labour Day (May 1st); Christmas Day (Dec 25th); Boxing Day (Dec 26th) In addition, for EMEA Customers Easter Monday; In addition, for UK Customers May Bank Holiday (early May); Spring Bank Holiday (May); Summer Bank Holiday Note that if a bank holiday falls on a weekend, a ‘substitute’ weekday becomes a bank holiday, normally the following Monday. In addition, for APAC Customers

Service Request Acknowledgement. Within 2 business days Business Days at a maximum during normal operations. On a best effort basis for crisis scenarios as defined in our Business Continuity plan. n n n Service Request Support Support included for all Service Requests a month where Service Request effort <= 1 hour. n Support included for 4 Service Requests a month where Service Request effort <= 1 hour. n Platform Incident Notification Critical incidents are notified to customers within 30 minutes of detection by Bottomline. n n n Customer Data Retention Bottomline retains customer data for 12 36 rolling months as standard. The Customer data may be retained as any combination of online data and archive files. n n n PLATFORM MAINTENANCE & TESTING Standard Gold Platinum Scheduled Maintenance Notification BT provides 30 business days Business Days’ notice for scheduled maintenance during Service Availability hours. Scheduled maintenance includes changes such as upgrades relating to operating systems, infrastructure components and inter-banking network enhancements. n n n Mandatory Maintenance Notification BT provides 2 business days 5 Business Days’ notice for mandatory maintenance. Mandatory Maintenance involves changes that Bottomline deems necessary for implementation prior to the next scheduled maintenance window. n n n Emergency Maintenance Notification Emergency changes are unplanned - notification is provided upon event. n n n Test Environment Accessibility 24 * 7 * 365, except -scheduled test environment maintenance windows -crises as defined in the Business Continuity Plan n n n Test Environment Availability 09:00 - 17:00 business days Business Days during normal operations. Bottomline cannot guarantee test environment availability during maintenance windows. If customers wish to ensure test environment availability (i.e. that no maintenance is underway), they must book a test environment slot under the following conditions: - Request for test slot not to be made more than 20 days in advance - Testing period is 5 business days Business Days maximum. Test Environment availability, even if pre-booked, is not guaranteed for any crisis outlined in the Business Continuity Plan. n n n Test Environment Monitoring Start of business day check on availability of test environment and customer is notified upon unavailability. n n SWIFT Upgrades For SWIFT Customers -SWIFT FIN standards release provided for Customer testing 6 weeks before cutover date. -SWIFTNet upgrades implemented 1 month before end of life. -SWIFT Quarterly security updates applied in line with SWIFT requirements n n REPORTING Standard Gold Platinum Critical Incident Report Initial Critical Incident Report sent to affected Customers within a maximum of 5 business days Business Days of event. Initial report sent with available information. Follow-up updates will be provided where applicable. n n n Service Availability Report Report listing service availability for period and conformity with availability rate provided monthly. n Report listing service availability for period and conformity with availability rate provided during scheduled service reviews with customers. n n n Volumes Report Report containing daily average volumes exchanged over last 12 months provided during scheduled service reviews with customers. n n n Disaster Recovery Report Report detailing the annual Disaster Recovery Test / Role Swap to be provided on request. n n n BUSINESS CONTINUITY & DISASTER RECOVERY Standard Gold Platinum Business Continuity A Business Continuity Plan (BCP) in place and is updated annually. A BCP business Impact analysis exercise is conducted annually. n n n Business Continuity Plan available Copy of Business Continuity Plan available upon request. n n n Disaster Recovery Test Frequency Disaster Recovery Test / Disaster Recovery Role Swap occurs once annually. Customers are notified in advance of this annual test. n n n Switch to DR Timeframes In accordance with table below: n n n SWITCH TO DR DETECTION DECISION TO SWITCH IMPLEMENT EMERGENCY PROCEDURES RESTART SERVICES (RTO) MAXIMUM LOSS OF DATA OBJECTIVE (RPO) Full loss of primary site H + 15 30 min H + 2 hours H + 4 hours <= H + 8 hours H + 12 hours < 15 min (no data corruption) <= 6 hours (data corruption) Major application Incident without data corruption H + 15 30 min H + 2 hours H + 4 hours <= H + 8 hours H + 12 hours < 15 min Major application Incident comprising data corruption H + 15 min H + 2 hours H + 4 hours <= 6 hours No connectivity to a banking network from the primary site H + 15 min H + 1 hr 15 30 min H + 4 hours None *Business Days: Working days excluding weekends (Saturdays and Sundays – unless otherwise specified) and national holidays defined under Public Holiday. **Public Holidays: New Year’s Day (Jan 1st); Good Friday; Labour Day (May 1st); Christmas Day (Dec 25th); Boxing Day (Dec 26th) In addition, for EMEA Customers Easter Monday; In addition, for UK Customers May Bank Holiday (early May); Spring Bank Holiday (May); Summer Bank Holiday Note that if a bank holiday falls on a weekend, a ‘substitute’ weekday becomes a bank holiday, normally the following Monday. In addition, for APAC CustomersH + 8 hours H + 12 hours <= 6 hours

Service Request Acknowledgement. Within 2 business days at a maximum during normal operations. On a best effort basis for crisis scenarios as defined in our Business Continuity plan. n n n Service Request Support Support included for all Service Requests a month where Service Request effort <= 1 hour. n Support included for 4 Service Requests a month where Service Request effort <= 1 hour. n Platform Incident Notification Critical incidents are notified to customers within 30 minutes of detection by Bottomline. n n n Customer Data Retention Bottomline retains customer data for 12 rolling months as standard. The Customer data may be retained as any combination of online data and archive files. n n n PLATFORM MAINTENANCE & TESTING Standard Gold Platinum Scheduled Maintenance Notification BT provides 30 business days notice for scheduled maintenance during Service Availability hours. Scheduled maintenance includes changes such as upgrades relating to operating systems, infrastructure components and inter-banking network enhancements. n n n Mandatory Maintenance Notification BT provides 2 business days notice for mandatory maintenance. Mandatory Maintenance involves changes that Bottomline deems necessary for implementation prior to the next scheduled maintenance window. n n n Emergency Maintenance Notification Emergency changes are unplanned - notification is provided upon event. n n n Test Environment Accessibility 24 * 7 * 365, except -scheduled test environment maintenance windows -crises as defined in the Business Continuity Plan n n n Test Environment Availability 09:00 - 17:00 business days during normal operations. Bottomline cannot guarantee test environment availability during maintenance windows. If customers wish to ensure test environment availability (i.e. that no maintenance is underway), they must book a test environment slot under the following conditions: - Request for test slot not to be made more than 20 days in advance - Testing period is 5 business days maximum. Test Environment availability, even if pre-booked, is not guaranteed for any crisis outlined in the Business Continuity Plan. n n n Test Environment Monitoring Start of business day check on availability of test environment and customer is notified upon unavailability. n n SWIFT Upgrades For SWIFT Customers -SWIFT FIN standards release provided for Customer testing 6 weeks before cutover date. -SWIFTNet upgrades implemented 1 month before end of life. -SWIFT Quarterly security updates applied in line with SWIFT requirements n n REPORTING Standard Gold Platinum Critical Incident Report Initial Critical Incident Report sent to affected Customers within a maximum of 5 business days of event. Initial report sent with available information. Follow-up updates will be provided where applicable. n n n Service Availability Report Report listing service availability for period and conformity with availability rate provided monthly. n Report listing service availability for period and conformity with availability rate provided during scheduled service reviews with customers. n n n Volumes Report Report containing daily average volumes exchanged over last 12 months provided during scheduled service reviews with customers. n n n Disaster Recovery Report Report detailing the annual Disaster Recovery Test / Role Swap to be provided on request. n n n BUSINESS CONTINUITY & DISASTER RECOVERY Standard Gold Platinum Business Continuity A Business Continuity Plan (BCP) in place and is updated annually. n n n A BCP business Impact analysis exercise is conducted annually. n n n Business Continuity Plan available Copy of Business Continuity Plan available upon request. n n n Disaster Recovery Test Frequency Disaster Recovery Test / Disaster Recovery Role Swap occurs once annually. Customers are notified in advance of this annual test. n n n Switch to DR Timeframes In accordance with table below: n n n SWITCH TO DR DETECTION DECISION TO SWITCH RESTART SERVICES (RTO) MAXIMUM LOSS OF DATA OBJECTIVE (RPO) Full loss of primary site H + 15 min H + 2 hours H + 4 hours <= 15 min (no data corruption) <= 6 hours (data corruption) Major application Incident without data corruption H + 15 min H + 2 hours H + 4 hours <= 15 min Major application Incident comprising data corruption H + 15 min H + 2 hours H + 4 hours <= 6 hours No connectivity to a banking network from the primary site H + 15 min H + 1 hr 15 min H + 4 hours None *Business Days: Working days excluding weekends (Saturdays and Sundays – unless otherwise specified) and national holidays defined under Public Holiday. **Public Holidays: New Year’s Day (Jan 1st); Good Friday; Labour Day (May 1st); Christmas Day (Dec 25th); Boxing Day (Dec 26th) In addition, for EMEA Customers Easter Monday; In addition, for UK Customers May Bank Holiday (early May); Spring Bank Holiday (May); Summer Bank Holiday Note that if a bank holiday falls on a weekend, a ‘substitute’ weekday becomes a bank holiday, normally the following Monday. In addition, for APAC Customers