NETWORK API SERVICES GENERAL TERMS
Version: February 25
Our Terms in a nutshell: If you don’t feel like reading all our Terms, here’swhat it all comes down to:
• We sell APIs but not only.
• We store as little personal information as possibleand always hash all of it.
• We charge you monthly mainly on a usage basis.
• You commit to not using the solution and Services foranything illegal, ensuring respect for individuals and laws, nor for anythingcontrary to these online Terms.
• These Terms, our Services description and our pricingare available on our Site.
These General Terms constitute the agreement applicable between You and Orange,in respect of your use of any Network API Service provided by Orange.
To use a Network API Service, You must first agree to be bound with full andunreserved acceptance by these General Terms. Should You wish to use a NetworkAPI Service to which related Specific Terms apply, You will have to comply withboth General Terms and Specific Terms (together the “Terms”). In case ofdiscrepancy between the Specific Terms and the General Terms, Specific Termswill prevail.
1. DEFINITIONS
“Account” means an account for the Website which allows a user to, notably,register, log in online and access a private space to subscribe to an APIusage.
“API” or “application programming interface” means the set of codedinstructions that specify how You and your Business Customer Software mustinteract with the Network API Services. These instructions are made availableby Orange.
“Brand Features” is defined as the trade names, trademarks,service marks, logos, domain names, and other distinctive brand features ofeither Orange or You.
“Business Customer” means merchants, financial institutions and other entities,that have signed an agreement with You in order to use the Orange Servicesthough your Developer Products.
“Catalog” means the catalog of APIs, Software and Services proposed by Orange,as described on and accessible from the Website.
“Confidential Information” means all non-public information that a partydesignates, either in writing or orally, as being confidential, or which, underthe circumstances of disclosure, should be treated as confidential.Confidential Information includes information relating to (i) business policiesor practices of a party, (ii) customers or suppliers of a party, (iii)technical, commercial, strategic, financial and economic data, data related toresearch, to the technical specifications, to Software, to components and toproducts or (iv) information received from others that the disclosing party isobligated to treat as confidential, but does not include information that wasknown to the receiving party prior to disclosure by the disclosing party, orinformation that becomes publicly available through no fault of the receivingparty;
“Developer Product” means APIs, software or services that You create forprofessional purposes, as a developer and on your sole and full responsibility,that incorporate Orange Services, and which is intended for End Users usingyour Developer Product;
“End User” means an Orange customer who is subscribed to mobile and/or Internetservices and who may opt for services provided by You or your Business Customerapproved under these Terms.
“Fee” means any fee or fees payable to Orange, as specified in the SpecificTerms;
“General Terms” means these Networks APIs General Terms;
“Intellectual Property Rights” means all copyright (including but not limitedto rights in computer software),patents, trademarks, trade names, tradesecrets, registered and unregistered design rights, database rights andtopography rights, all rights to bring an action for passing off, any othersimilar form of intellectual property or proprietary rights, statutory orotherwise, whether or not registrable and shall include applications for any ofthem, all rights to apply for protection in respect of any of the above rightsand all other forms of protection of a similar nature or having equivalent orsimilar effect to any of these which may subsist anywhere in the world;
“ Open Source Software" shall mean (i) any software that allows orrequires as a condition of distribution of such software, that such software(1) be distributed in source code form; (2) be licensed under the conditionthat modifications and the creation of derived works are allowed; and/or (3)cannot be redistributed subject to license or contractual conditions that arein addition to the conditions contained in the original license. For clarification,this definition of Open Source Software includes, but is not limited to anysoftware that is available in source code form under licenses meeting the OpenSource Definition as promulgated by the Open Source Initiative, includingwithout limitation any license approved by the Open Source Initiative andlisted at www.opensource.org/licenses/, which licenses include withoutlimitation the GNU General Public License, the GNU Lesser General PublicLicense, the Berkeley Software Distribution (BSD) License and the ApacheLicense.
“Orange” means Orange SA, with registered address located at 111, quai duPrésident Roosevelt CS 70222 92449 Issy-Les-Moulineaux Cedex, France, (VATregistered: FR 89 380 129 866).
“Orange API” means an API made available through the Website .
“Orange Brand Features” means the Brand Features owned and managed by OrangeBrand Services Limited and other intangible proprietary rights used or approvedfor use by Orange to identify Orange goods and services and includes (withoutlimiting the generality of the foregoing) any element of the Orange brand andany marketing properties designated as elements of the Orange brand from timeto time.
“Orange Software” means Software which copyright is fully owned by Orange.
“Payment Provider” has the meaning set forth in Section 10.2.
“Private Key” means your Website account password and any API key (Client IDand Client secret) provided to allow the Developer Product to access an OrangeService and/or API.
“Sales Tax” means any sales or use tax, and any equivalent tax measured bysales proceeds that Orange is required to pass through to its customers.
“Service” or “Orange Service” or “Network API Service” means the access toand/or use of each Software, including APIs, Orange offers to You and asdescribed in each Specific Terms, a list is given in the Catalog, for thebenefit of your Developer Product, and in compliance with these Terms. We areconstantly enhancing the quality of Services rendered. Therefore, Orange isentitled to unilaterally update its Services, provided that the updatedServices are at least equivalent to the previous ones.
“Software” means all source and object code that Orange makes available to You,in connection with the provision, receipt, or use of the Services, includingbut not limited to APIs; WSDLs (Web Services Description Languages); samplecode; software libraries; command line tools; proofs of concept; templates;software development kit (“SDK”) ; associated documentation and other relatedtechnology, for your Developer Product.
“Specific Terms” means any terms provided by Orange for a specific Service.These Specific Terms apply to You for the use of Orange Services and APIs andto your Business Customers for the use of your Developer Product. In case ofdiscrepancy between the Specific Terms and the General Terms, Specific Termswill prevail.
“Website” means the website made available by Orange for the purpose of thedistribution and use of the Services and governed by the website Terms of Use)located at https://developer.orange.com/terms-and-conditions/.
“You” means a private individual or a company, organisation, or legal entityusing the Orange Services and APIs.
2. BINDING AGREEMENT
2.1 You agree that (i) your acceptance expressedelectronically, including without limitation by checking a box or clicking onan “subscribe”, “agree”, “accept”, or similar button, (ii) any data collectedfrom You using your Private Keys, and (iii) any data notified to You via theWebsite and/or any other related electronic means such as email, are processedand stored by Orange on its platform and will be considered binding anddefinitive. You expressly accept that data stored by Orange on its platformshall constitute definitive evidence of proof.
2.2 The provision of the Service shall only take effectwhen Orange expressly validates the Developer’s subscription request.
2.3 Orange will use reasonable security and othermeasures to protect data (including Personal Data) provided in the performanceof these Terms from unauthorized access, use, disclosure, alteration, anddestruction.
3. REGISTRATION
3.1 To access the Services, you must: (i) create yourAccount, (ii) read and accept these Terms, (iii) select the Services you areinterested in among the Catalog, (iv) verify your selection and correct it ifnecessary, and (v) enter your bank details information and confirm your order.Following acceptance of these Terms, which you acknowledge as having read andunderstood, and validation of the bank account details, You will be grantedaccess to the related Services through your Account. You will receive emailsconfirming the creation of your Account and your order.
3.2 You may not use any Orange Services or APIs and maynot accept these Terms (i) unless You are of legal age to form a bindingcontract and (ii) if You are barred from using or receiving Orange Services orAPIs under the laws of any country.
3.3 In order to access certain Services or APIs, You maybe required to provide certain information. You agree that You will keep anyinformation You provide accurate and up to date.
3.4 You agree to treat any Private Keys associated withyour Account as Confidential Information, and to use them only in accordancewith these Terms and as otherwise instructed by Orange. As a consequence, Yourepresent and warrant that You will protect such elements from unauthorisedaccess, use, disclosure, alteration or destruction and will immediately notifyOrange in writing if You have any reason to believe there has been a compromiseof any of your Private Keys.
3.5 By submitting any information (either personal ornon-personal information) or material (for example, description of yourDeveloper Product) to Orange, You grant Orange a restricted right to use suchinformation or material in particular for the purpose of managing your Accountand processing payment, as described in the Privacy Notice of OrangeDeveloper.. Therefore, You accept that Orange discloses your information to anyof its affiliated companies and/or Orange’s business partners. Your informationor material will not be used for any other purposes and will remainconfidential within Orange, its affiliates and Orange’s business partners. Incase You have the opportunity to work with Orange, any of its affiliates and/orany Orange’s business partners and wish to use any Services provided by Orange(including the distribution of your Developer Product), specific agreementswill apply to such services and suitable rights to use will be granted.
4. USING NETWORK API SERVICES
4.1 Orange grants You a limited right to use OrangeServices and APIs for the purpose set out in these Terms. Orange retains allright, title and interest in and intellectual property rights related to OrangeServices and APIs.
4.2 If You act as an aggregator or a distributor ofOrange Services or APIs, You will ensure that your terms and conditions withyour Business Customer are consistent with these Terms.
4.3 You will use Orange Services and APIs only aspermitted by law.
4.4 You will only access (or attempt to access) anOrange Service or API by the means described in these Terms.
4.5 Orange may monitor, control and restrict the use ofOrange Services or APIs to ensure quality, improve our Services, and verifyyour compliance with these Terms.
4.6 Orange may at any time modify the contractual ortechnical conditions of any Orange Service or API (notably by modifying,deprecating or removing an Orange Service or API), after giving You at least aone-month notice, unless otherwise provided under the Specific Terms, beforethe modification comes into effect .
5. DEVELOPER PRODUCT REQUIREMENTS
5.1 Orange Services and APIs are offered to You toenhance your Developer Product(s). Orange reserves the right to investigate anyDeveloper Product on compliance with these Terms. Such investigation mayinvolve Orange accessing and using the Developer Product. You consent to anysuch investigation. Orange may suspend all or part of the access to OrangeServices and/or APIs by You, the Business Customers or the Developer Productwithout notice if we reasonably believe that You or your Business Customers arein breach of these Terms.
5.2 If your Developer Product requires access toOrange’s network, such Developer Product must not in Orange’s reasonablejudgement excessively use or unduly burden network capacity or bandwidth.
5.3 You will use reasonable endeavours to protect EndUser information collected by Developer Product, including personallyidentifiable information (PII), from unauthorised access or use and willpromptly report to your End Users any unauthorised access or use of suchinformation.
5.4 Orange does not acquire ownership of the DeveloperProduct, and by using Orange Services and/or APIs, You do not acquire ownershipof any rights in Orange Services and/or APIs or the content that is accessedthrough Orange Services and/or APIs.
5.5 Orange reserves the right to delete DeveloperProduct which remain inactive. An inactive Developer Product is considered as aclient application which has not seen any API traffic from any of its OrangeAPI subscriptions for a period of 12 months.
6. RESTRICTIONS OF USE
6.1 When using Orange Services and/or APIs, thefollowing restrictions apply:
a) You will not sublicense an Orange Service and/or APIfor use by a third party. Accordingly, You or your Business Customers will notcreate a Developer Product that functions substantially the same as an OrangeServices and/or API and offer it for use by a third party.
b) You and your Business Customers will not perform anaction with the intent of introducing to Orange Services and/or API anyviruses, worms, defects, Trojan horses, malware or any items of a destructivenature.
c) Except to the extent this restriction is expresslyprohibited by applicable law, You and your Business Customers will not reverseengineer or attempt to extract the source code from any Orange API or anySoftware.
6.2 In addition to Section 6.1, You agree that you shallnot:
d) Use cheats, exploits, automation software, bots,hacks, mods or any unauthorized software designed to modify or interfere withthe Services;
e) Interfere with, damage, or disrupt the Services,including through the use of viruses, cancel bots, Trojan horses, harmful code,flood pings, denial-of-service attacks, packet or IP spoofing, forged routingor electronic mail address information, or similar methods or technology;
f) Attempt to probe, scan, or test the vulnerability ofthe Services or network, or breach any security or authentication measures;
g) Disrupt or interfere with the security of, orotherwise cause harm to, the Services or any ORANGE systems, resources,accounts, passwords, servers or networks connected to or accessible through theServices;
h) Systematically retrieve data or other content fromthe Services to create or compile, directly or indirectly, in single ormultiple downloads, a collection, compilation, database, directory or the like,whether by manual methods, through the use of bots, crawlers, spiders, orotherwise.
7. CHANGES TO SERVICES
7.1 Orange may at any time and at its own discretiondiscontinue, modify or upgrade any feature, design or functioning of theServices (herein after the “Modifications”).
7.2 The Modifications may require You to take actionsat your own expense and Orange shall not be liable to You for any consequencesof such Modifications, whether direct or indirect.
7.3 The Modification period (“Modification Period”) willstart when the first Modification notification is sent to You via the e-mailaddress associated with your Website account and will last for a period definedin such notification, so as to allow You to adapt to the Modifications .
7.4 During the Modification Period, the Services willremain unmodified.
7.5 At the end of the Modification Period, theModifications will be effective.
8. SUSPENSION OF THE SERVICES
Orange reserves the right to suspend the Services immediately in one of thefollowing circumstances:
a) in order to carry out maintenance operations or incase of emergency;
b) where your use of the Services presents a risk to thesecurity of the Services, is abnormal, jeopardises the delivery of the Servicesor is considered by Orange as fraudulent;
c) in case of attack or attempted attack to the securityof the Services;
d) in case of default by You in relation to one of yourobligations under these Terms;
e) in case of late payment or non-payment;
f) in case of a request by a judicial or administrativeauthority.
Wherever possible, Orange will inform You in advance of a suspension of theServices and the duration of the suspension. In case of suspension, Orange isdischarged from its obligation to provide the Services subscribed to and cannotbe held responsible for any damage suffered by You during periods ofsuspension.
The Services subscribed to will be restored as soon as the event that led tothe suspension of Services has been remedied.
Failing such remedy, the suspension of the Services may result in terminationof the Terms in accordance with Section 13 Term and Termination.
9. SERVICES SUPPORT
We provide you with technical support in French or English, which is accessibleduring business hours through our support site https://developer.orange.comwith three (3) different levels (basic plan, developer plan, business plan), asdescribed and under the conditions specified on the Website.
10. PRICING - PAYMENT
10.1 The Fees of the Services are given in the eurocurrency, excluding VAT, in the Price List on the Website. Orange is entitledto modify these prices, notably to reflect changes to the Catalog. Orange willinform you, in advance, of any increasing Fees of the Price List, so you willtherefore be entitled to terminate your Account, in compliance with theprovisions of Section 13 Term and Termination of these Terms.
10.2 All Fees related to your Account and to your use ofthe Software and Services, are billed each month by Orange based on your actualconsumption in the course of the preceding month, with the cost of said usagebased on the Price list applicable in the course of the month in question. Youmust provide Orange with a valid credit card or online transaction account thatOrange accepts (“Payment Provider”) , prior to receiving any paid Services. Youwill promptly notify Orange of any change to your payment information. YourPayment Provider agreement , and not these Terms, governs Your use of thedesignated credit card or online transaction account. By providing Your paymentinformation, You agree that Orange may invoice You for all Fees when theybecome due to Orange without additional notice or consent. Orange may changeits charges and billing practices at any time, by posting notice of such changeon the Website, or notifying You via email in case of an increasing price.Renewal of monthly payments is tacit and automatic . Orange sends an e-invoiceto the email address associated with your Account. Moreover, we use theservices of payment services providers (e.g., card acceptance, merchantsettlement, and related services), being specified that Orange do not storecredit card data. By paying for the Services, You agree to be bound byChargebee's policy (https://www.chargebee.com/company/terms/) and ChargebeeEmbedded Payments terms (https://www.chargebee.com/embedded-payments-tou/ ).
10.3 All Fees are net of any applicable Sales Tax. SalesTax is automatically calculated and added to all orders where applicable.
10.4 All payments for the Services will be made free andclear of, and without reduction for, any withholding taxes. Any such taxesimposed on payments of Fees to Orange will be your sole responsibility. UponOrange’s request, You will provide Orange with official receipts issued by theappropriate taxing authority, or other such evidence that You have paid allapplicable taxes.
10.5 You must notify Orange in writing atcompta@ORANGE.com within seven (7) days after receiving your e-invoice, if Youdispute any of Orange charges on that statement or such dispute will be deemedwaived.
11. RESPONSIBILITY - WARRANTIES
11.1 You represent and warrant to Orange that:
a) You comply with the data protection requirementsdescribed in Appendix A;
b) You comply with the security requirements describedin Appendices B and C;
c) Either as private individual acting for yourself andon your own behalf or acting in the name and on behalf of a company,organisation, or legal entity as its duly authorised representative having fulllegal authority to act in the name and on behalf such company, organisation, orlegal entity and bind it to these Terms, You have the right and authority toenter into these Terms, to bind such company, organisation, or legal entity tothe Terms and to fully perform your obligations under these Terms;
d) The Developer Product is authorised for distribution,sale and use in each of the territories where You make it available andcomplies with the laws and regulations of those territories;
e) The Developer Product and services linked to it donot violate or infringe any copyright, trademark, patent or other intellectualor contractual rights of any person or entity; and
f) The Developer Product does not contain any offensive,obscene, or other materials or any content that is prohibited or restrictedunder local regulations or laws of any territory where You make it available.For the avoidance of doubt, You represent and warrant that the DeveloperProduct does not (i) depict explicit sexual activity; (ii) depict or endorseacts that cause or are intended to cause excessive pain or suffering; (iii)promote or endorse the misuse of alcohol, tobacco, illegal drugs or otheraddictive substances; (iv) promote intolerance or discrimination based onracial, political, ethnic, religious, gender or sexuality; (v) promote invasionof rights or privacy; (vi) promote unlawful gambling or (vii) promote illegalactivity.
11.2 The Developer Product and any data collectionconducted through it shall protect the privacy and legal rights of End Users inparticular regarding process purposes and legal basis. In addition, anyPersonal Data collected shall be used solely for the purpose of providing yourDeveloper Product or the Developer Product of your Business Customers. You mustalso protect such data from unauthorized access. You must comply with (i) theprovisions as set forth in Annex A of these General Terms, (ii) all applicabledata protection laws and rules and (iii) any additional data protectionrequirements that may be provided in Specific Terms .
11.3 You warrant not to use Personal Data of End Usersfor any purpose other than the purpose for which they have been communicated,as set out in the Specific Terms of the relevant Network API Service.
11.4 You represent and warrant not to engage in anyactivity, including the development, edition or distribution of any DeveloperProduct that interferes with, disrupts, damages, or accesses in an unauthorisedmanner the networks, devices, servers, or any other components or services usedfor the distribution and uses of the Developer Product.
11.5 You will be solely responsible for ensuring theDeveloper Product is safe and free of defects in operation and conception. Youwill also be solely responsible for any documentation and End User support andwarranty of the Developer Product.
11.6 Orange shall have no responsibility or liabilityfor the installation or use of the Developer Product by an End User.
11.7 You shall indemnify and hold Orange harmlessagainst any and all claims, suits, losses, damages arising from or attributableto the Developer Product and/or the use of the Developer Product by anyBusiness Customer and/or End User and/or attributable to your failure toperform any of your obligations under these Terms.
12. CHANGES TO TERMS
Orange may change these Terms at any time and when it does so, will inform Youby email and on the Website . Please regularly log in on the Website for anychanges to the Terms. Your continued use of Orange Services and/or APIs will bedeemed as acceptance of any changes to the Terms notified by Orange. If You donot accept any changes to the Terms, You must cease using the relevant OrangeServices and/or APIs immediately. Nothing in this section shall affect Orange’srights under Sections 2 Binding Agreement or 13 Term and Termination.
13. TERM AND TERMINATION
13.1 These Terms between You and Orange shall beapplicable upon You checking a box or clicking on an “subscribe”, “agree”,“accept”, or similar button and shall continue for so long as You are using aNetwork API Service, unless terminated in accordance with these Terms.
13.2 Orange may, at any time, immediately terminate therelevant Terms:
a) in case of late payment or non-payment;
b) if You have breached any provision of the relevantTerms;
c) if Orange is required to do so by law;
d) if You go into liquidation (in which case thetermination will be effective from the date of the judicial pronouncement ofthe liquidation) or any analogous insolvency process in the relevantjurisdiction; or
e) if You decline to accept any new terms or version ofthese Terms .
13.3 Orange and You may terminate the relevant Terms ofan Orange Service and/or API for any reason subject to thirty 30) days’ priorwritten notice .
13.4 If You want to terminate these Terms and thereforestop using all the Services, You may do so by going to the “Change / CancelAccount” page of your Account setting page on the Website or by contacting usvia email at contact.developer@orange.com, with at least thirty (30) days’prior written notice .
13.5 Termination of the relevant Terms for a Serviceand/or API between You and Orange will not automatically terminate any otherTerms for other Service and/or APIs between You and Orange.
13.6 Upon termination for any reason, You agree to ceasewithout delay all use of Network API Services, together with Orange’smaterials, Services and/or Private Keys in relation to these Network APIServices.
13.7 If the Terms are terminated, the Terms willcontinue to have their effects only to permit the recovery of amounts remainingdue, as applicable, by You on the Term’s termination date.
13.8 You undertake at the Term’s termination date tocease any use of the elements belonging to Orange, including brands, tradenames, logos, contents, and databases, and not to keep copies except forelements necessary for the recovery defined above.
13.9 The provisions relating to Responsibility -Warranties, Limitation of Liability, Confidentiality and Intellectual Propertyor any provisions which are either expressed to survive termination of theseTerms or, from their nature or context, are apparently intended to survivetermination of these Terms shall remain in full force and effectnotwithstanding termination of these Terms.
14. INTELLECTUAL PROPERTY RIGHTS
14.1 For each Service, Orange will indicate in therelevant Specific Terms the appropriate copyright notice, including theidentification of Open Source Software licenses or other specific license termsas the case may be.
14.2 Services may include third-party Software. Thisthird-party Software may be subject to Intellectual Property Rights, and, ifso, You may not use it unless You are licensed to do so by the owner of thatSoftware or are otherwise permitted by law.
14.3 Orange hereby grants You, for the duration of theTerms a non-exclusive, non-transferable, sub-licensable to Your BusinessCustomers, licence to (as applicable) access, use and permit access to and useof the Orange Software including in each case any Intellectual Property Rightstherein, to the sole extent necessary to enable You and Your Business Customersto receive, access, onward provide and benefit from such Orange Software aspermitted by these Terms; and
14.4 You hereby grant to Orange, for the duration ofthese Terms, a non-exclusive, non-transferable, sub-licensable (including toits subcontractors and affiliates), licence to access and use any of Your andany other materials provided by or on behalf of You (including any IntellectualProperty Rights therein), to the sole extent necessary for providing theServices in accordance with these Terms.
14.5 You shall not access or use the Services except asexpressly permitted by these Terms. For purposes of clarity and withoutlimiting the generality of the foregoing, You shall not, except as these Termsexpressly permits or except as expressly otherwise agreed in writing:
a) copy, download, modify, or create derivative works or improvements of theServices;
b) reverse engineer, disassemble, decompile, decode, adapt, or otherwiseattempt to derive or gain access to the source code of the Services, in wholeor in part.
14.6 You may, as deemed appropriate by You and in Yoursole discretion, provide Orange with suggestions, comments, input and otherfeedback regarding the Services or other Orange technologies, products, orservices (“Your Feedback”). In case You provide to Orange Your Feedback, Youhereby grant Orange a non-exclusive, worldwide, perpetual, irrevocable,royalty-free license of Your Feedback to: (a) use, copy, modify and createderivative works of Your Feedback; (b) publicly perform, publicly display,import, broadcast, transmit, disclose, distribute, license, rent, lease or lendYour Feedback (and derivative technology thereof); and (c) sublicense to thirdparties the foregoing rights, including the right to grant further sublicenses.Orange receiving Your Feedback acknowledges that (i) it has sole and absolutediscretion regarding whether it implements any of Your Feedback; and (ii) itassumes all risks associated with any implementation of Your Feedback.Notwithstanding anything to the contrary in the foregoing, nothing in thisSection 14.6 will be construed as granting Orange any rights in Your patents,trademarks, or service marks that may be included in or embodied by any of YourFeedback or by any implementation of Your Feedback in Orange’s offerings.
14.7 Orange may, as deemed appropriate by itself and inits sole discretion, provide You with suggestions, comments, input and otherfeedback regarding Your software or Your technologies, Your products, or Yourservices (“Orange Feedback”). In case Orange provides You any Orange Feedback,Orange hereby grants You a non-exclusive, worldwide, perpetual, irrevocable,royalty-free license to: (a) use, copy, modify and create derivative works ofOrange Feedback; (b) publicly perform, publicly display, import, broadcast,transmit, disclose, distribute, license, rent, lease or lend the OrangeFeedback (and derivative technology thereof); and (c) sublicense to thirdparties the foregoing rights, including the right to grant further sublicenses.You receiving Orange Feedback acknowledge that (i) you have sole and absolutediscretion regarding whether You implement any of Orange Feedback; and (ii) Youassume all risks associated with any implementation of Orange Feedback.Notwithstanding anything to the contrary in the foregoing, nothing in thisSection 14.7 will be construed as granting You any rights in Orange patents,trademarks, or service marks that may be included in or embodied by any OrangeFeedback or by any implementation of Orange Feedback in Your offerings.
14.8 No other rights, even implied, are granted herein,other than those expressly provided in this section.
14.9 There will not be any joint development ofIntellectual Property Rights under these Terms.
14.10 All Intellectual Property Rights owned by Orangeand made available as a part of these Terms, shall remain the property ofOrange.
14.11 If a third party notifies You and/or Your BusinessCustomers of any claim that the access to, and/or the use of a Software and/orService infringes any Intellectual Property Rights of a third party, You shallimmediately notify Orange.
If any such claim is made to You and/or to Your Business Customers and/or toOrange, at Orange's request:
• You shall immediately cease access and use of suchSoftware and Service; and
• You shall procure that Your Business Customersimmediately cease access and use of such Software and Service.
You shall not make or permit to be made any admission of liability; and Youshall procure that Your Business Customers shall not make or permit to be madeany admission of liability
15. CONFIDENTIALITY
15.1 You and Orange agree that at all times during theterm of these Terms, and for three (3) years thereafter, the recipient ofConfidential Information under these Terms will hold in confidence, and willnot use or disclose to any third party (other than in response to lawfulrequests from law enforcement authorities or contractors to the extent they areperforming the receiving party’s obligations under these Terms subject to confidentialityobligations that are at least as protective as those contained in this Section15), any Confidential Information.
15.2 Unless otherwise specified in these Terms, eitherOrange or You receiving (“Receiving Party”) Confidential Information from theother party (the “Disclosing Party”) must:
a) only use Confidential Information received from theDisclosing Party in the performance of these Terms; and
b) keep confidential and not use or disclose directly orindirectly to another party or entity, except to the extent provided herein,Confidential Information received from the Disclosing Party using the samedegree of diligence (but while respecting commercial practices), which theReceiving Party would use to protect its own Confidential Information. TheReceiving Party will only disclose Confidential Information to itsrepresentatives who need it and are bound by confidentiality obligations, andonly to the extent necessary to fulfil their obligations under these Terms. TheReceiving Party requires its representatives to comply with the provisions ofthis Section to the same extent that it does. A party or person receivingConfidential Information will be responsible for any disclosure of thisinformation by any representative to whom it discloses such information.
The Receiving Party must return or destroy all Confidential Informationreceived from the Disclosing Party, including copies made by the ReceivingParty, within thirty (30) days after receipt of a written request from theDisclosing Party to the Receiving Party, except for (a) ConfidentialInformation which the Receiving Party reasonably needs to fulfill itsobligations under these Termsand (b) a copy for archival purposes only.
To the extent that You receive Personal Data from Orange about the End User,You must comply with the security requirements set out in Appendices B and C.
15.3 Unless otherwise agreed upon, the obligations ofthis Section shall not apply to information which:
a) was, at the time of receipt, already in thepossession of or known to the Receiving Party, free from any obligation ofconfidentiality or restriction on use;
b) is or becomes publicly available or accessible by anylawful act of the Receiving Party or the directors, officers, staff members,agents or subcontractors of the Receiving Party;
c) is legitimately received from a third party having nodirect or indirect obligation of confidentiality or restriction on use towardthe Disclosing Party about such information;
d) is developed independently by the Receiving Party;
e) is approved for disclosure or use with the writtenpermission of the Disclosing Party (including in these Terms); or
f) shall be disclosed by the Receiving Party under anyapplicable law, rules, regulations or public order, any decree or officialpublication, or any authority, provided that the Receiving Party has madecommercially reasonable efforts to give sufficient notice to the DisclosingParty (where reasonably possible prior to disclosure) in order to enable it toseek protective solutions, and the Receiving Party shall also make reasonableefforts to ensure the confidentiality of the Confidential Informationdisclosed.
15.4 The Disclosing Party shall retain all rights,titles and interests to any Confidential Information that it discloses to theReceiving Party. Except as expressly provided in these Terms, no license shallbe granted by these Terms concerning Confidential Information (including in theform of a patent, brand or copyright), it being also understood that no suchlicense is implied solely by the disclosure of Confidential Information.
15.5 This confidentiality obligation will remain inforce for the duration of these Terms and for a period of one (1) yearfollowing the expiration or termination of these Terms.
16. BRAND FEATURES, ATTRIBUTION, PUBLICITY
16.1 The ORANGE word, name, symbol, device or anycombination thereof used in connection with the Services are exclusive propertyof the ORANGE Group and may not be used without our permission for any otherpurpose. Other trademarks, service marks and trade names that may appear on orin the Services are the property of their respective owners. You will notremove, alter or obscure any copyright, trademark, service mark or other proprietaryrights notices in or related to the Services.
16.2 Any intention to use any Orange Brand Feature,whether required in the Specific Terms governing the usage of a Network APIService, or for the purpose of promoting or advertising that You use NetworkAPI Services, must first be approved by Orange by sending an emailto contact.developer@orange.com . If your request is approved,You agree to adhere to the guidelines for using Orange Brand Features as setout on the Orange Design System website (https://system.design.orange.com). Youunderstand and agree that Orange has the sole discretion to determine whetheryour attribution(s) and use of Orange's Brand Features are in accordance withthese requirements and guidelines. All use by You of Orange's Brand Features(including any goodwill associated therewith) will inure to the benefit ofOrange.
16.3 Orange reserves the right to monitor the use of itstrademarks to ensure compliance with these Terms and the brand guidelines. Thismay include periodic reviews of Developer Products and related promotionalmaterials. If Orange determines that you are not in compliance with thetrademark usage guidelines, Orange will provide you with written noticespecifying the non-compliance and the actions required to remedy it. Uponreceiving a notice of non-compliance, you will have thirty (30) days to correctthe non-compliance to Orange's satisfaction. Failure to remedy thenon-compliance within this period may result in the suspension of the services.Orange reserves the right to pursue any legal remedies available underapplicable law, in the event of persisting unauthorized use or misuse of itstrademarks.
16.4 You may not issue any public statements regardingthese Terms or Network API Services without Orange’s prior approval, which maybe withheld in Orange’s sole discretion. Should you wish to issue a publicstatement regarding your use of Network API Services, then this request shouldbe addressed to contact.developer@orange.com.
16.5 Orange may, at any time and at its own discretion,issue a public statement or announcement relating to, or communicate on, youruse or distribution of Network API Services without your prior approval and,therefore, You grant Orange a right to use your name or logo in any advertisingor publicity for such purposes.
16.6 Orange may require Developer Products to includethe statement “Powered by ORANGE Network APIs ” or the equivalent in the formprovided in its brand guidelines. Orange may update brand guidelines from timeto time in its sole discretion, and you will make commercially reasonableefforts to comply with such updated brand guidelines in the next releaseversion of the applicable Developer Products. Orange hereby grants you anon-exclusive right and license to use and display the Orange trademarks onlyin connection with purpose set forth in this Section 16.
17. DISCLAIMER OF WARRANTIES, LIMITATION OF LIABILITYAND INDEMNIFICATION
17.1 Orange provides Orange Services “AS-IS” and“AS-AVAILABLE”. Your use of Network API Services is solely at your own risk,and You are solely responsible for any damage to your information system,services platform or any device or loss of data that results from such use. Tothe greatest extent permitted by law, Orange excludes any implied warranties orconditions, including those of product liability, merchantability, fitness fora particular purpose, workmanlike effort, and non-infringement of IPR, relatingto Orange Services. Without limiting any of the foregoing, Orange expresslydisclaims any warranties that access to or use of Orange Services will beuninterrupted or error free.
17.2 Under these Terms, You can recover from Orange onlydirect damages which shall not exceed the cumulative amount paid by You toOrange or received by Orange from You in the year preceding the date on whichthe claim or dispute occurred. Any action related to the Terms or Services mustcommence within one (1) year after it accrues or such action will bepermanently barred. You expressly acknowledge that Orange shall not be liableto You under any theory of liability for any indirect, incidental, special,consequential, punitive or exemplary damages or lost profits that may beincurred by You, including any loss of data, whether or not Orange or itsrepresentatives have been advised of or should have been aware of thepossibility of any such losses arising.
17.3 To the maximum extent permitted by law, You agreeto defend, indemnify and hold harmless Orange and its respective directors,officers, employees, and agents from and against any and all third partyclaims, actions, suits or proceedings, as well as any and all liabilities,assessments, losses, damages, costs and expenses (including reasonableattorneys’ fees) resulting from or arising out of: (i) your breach of theseTerms; (ii) your infringement or violation of any copyright, trademark, tradesecret, trade dress, patent or other intellectual property right, or defamationof any person or violation of their rights of publicity or privacy; (iii) yourbreach of or non-compliance to any data protection and/or privacy laws or rulesand (iv) misuse of Orange Services by a third party where such misuse was madepossible by your failure to take reasonable measures to protect your PrivateKeys.
17.4 In the event of a breach of Appendix A, andprovided that the damage suffered by Orange has been caused directly andmaterially by You, Your sole responsibility and the exclusive remedy of Orangefor a breach of Appendix A shall not exceed the maximum amount of seven hundredand fifty thousand euros (€750,000) or 300% of the agreed amount paid by You toOrange or received by Orange from You in the year preceding the date on whichthe claim or dispute occurred (hereinafter referred to as the “SpecificCeiling”).
Under no circumstances shall the annual Specific Ceiling, for a consecutiveperiod of 12 months from the date of entry into force, exceed the total amountof five million euros (€5,000,000).
You agree to reimburse Orange for the actual and reasonable costs incurred byOrange to respond to and mitigate the damage caused by breach of Appendices Band C caused by You, including all notice costs ("CompensatoryIndemnities"). Your obligations with respect to the payment ofCompensatory Indemnities, the settlement to which You consent, or the legalfees and defense costs of Orange are subject to the Specific Ceiling.
18. GOVERNING LAW AND DISPUTE RESOLUTION
18.1 These Terms shall be governed by the laws ofFrance, without regard to its conflict of law provisions.
18.2 Any dispute, controversy or claim arising out of orin connection with the Terms between You and Orange, or the breach, terminationor invalidity thereof, shall be firstly amicably settled through a disputesettlement before any litigation procedure. In case of failure to reach anamicable settlement, the dispute, controversy or claim arising out of or inconnection with the Terms between You and Orange shall be settled exclusivelyby the courts of Paris, France .
18.3 This dispute-settlement process shall not beconstrued as preventing either You or Orange from terminating these Terms forany reason valid under any section permitting such termination.
19. MISCELLANEOUS
19.1 These Terms constitute the entire agreement betweenYou and Orange in respect of your use of Orange Services and related Services.
19.2 You and Orange acknowledge that other than thecontractual relationship established by these Terms, these Terms will not beconstrued as creating any other relationship, or agency, partnership,employment, joint venture, fiduciary duty, or franchise, or any other form oflegal association between You and Orange. Other than as expressly stated inthese Terms, these Terms are not for the benefit of third parties.
19.3 You agree that if Orange does not exercise orenforce any legal right or remedy which is contained in these Terms (or whichOrange has the benefit of under any applicable law), this will not be taken tobe a formal waiver of Orange's rights and that those rights or remedies willstill be available to Orange.
19.4 If one or more of the provisions of the Terms arefound by a competent court or authority to be invalid, illegal, orunenforceable in any respect under any applicable law or regulation, thevalidity, legality, and enforceability of the remaining provisions containedherein shall not in any way be affected or impaired, provided that in such caseOrange will use its best efforts to achieve the purpose of the invalid provisionby a new legally valid stipulation to the same (or substantially similar)purpose and effect.
19.5 Orange will be entitled to sub-contract withoutyour consent any of their obligations to a third-party sub-contractor. Orangeshall not be responsible for the acts and omissions of any sub-contractor.
19.6 The rights granted in these Terms may not beassigned or transferred by You without the prior written approval of Orange.You shall not be permitted to delegate your responsibilities or obligationsunder these Terms without the prior written approval of Orange.
19.7 Orange shall be entitled to assign or transfer orotherwise dispose of these Terms (or part thereof) to any company part of theOrange group, in their absolute discretion.
19.8 You shall not, under any circumstances, eitherdirectly or through an intermediary, hire or solicit the services of Orangeemployees, under any status whatsoever, whatever the cause, without the priorwritten consent of Orange. If You do not comply with this obligation, You agreeto compensate Orange by paying immediately and on request, a lump sum equal totwelve (12) times the gross monthly salary of the employee concerned at thedate of his/her departure from Orange.
19.9 Neither You or Orange will be liable for failure toperform any obligation under these Terms to the extent such failure is causedby a force majeure event. This includes acts of God, natural disasters, war,civil disturbance, action by governmental entity, strikes and other causesbeyond the party’s reasonable control. The party affected by the force majeureevent will provide notice to the other party within a commercially reasonabletime and will resume performance as soon as is reasonably practicable.
19.10 The headings used throughout these Terms aresolely for convenience of reference and are not to be used as an aid in theinterpretation of the Terms. As used herein, "may" means "hasthe right, but not the obligation to," "including" means "including,without limitation," and "will" means "is requiredto."
APPENDIX A
DATA PROTECTION REQUIREMENTS
1 Definitions
For the full understanding of the following terms, the terms “Controller,"“Subcontractor," “Concerned Person," “Recipient," "Breachof Personal Data," and “Processing" will have the meaning defined inthe "Applicable Data Protection Laws."
Similarly, the term "Personal Data" has the meaning given to it inthese same Laws.
The term "Applicable Data Protection Laws" means:
- Regulation (EU) 2016/679 of the European Parliamentand of the April 27, 2016 Council (General Data Protection Regulation)repealing Directive 95/46/EC;
- where appropriate, the texts adopted by the EuropeanUnion and local laws which may apply to the Personal Data processed under theseTerms.
2 General stipulations
You, as well as Orange, undertake to comply with the legal and regulatoryobligations relating to the protection of their personal data in theperformance of these Terms.
You acknowledge that Orange is the Controller of the processing of Orangecustomers’ Personal Data, implemented in the performance of these Terms, andthat You act as Subcontractor.
The nature and scope of the Processing, the Personal Data categories, and theirretention period by You for the Network APIs Service are described in theSpecific Terms.
When processing the Personal Data transmitted by Orange, You act only ondocumented instructions and in the context of written authorizations receivedfrom Orange.
You must notify Orange immediately if, in Your opinion, an instructionconstitutes a violation of applicable Data Protection Laws. You must notifyOrange at the following email address: contact.developer@orange.com.
You agree that the Personal Data provided by Orange to You within the frameworkand for the purposes of these Terms shall remain Orange’s property. You willnever own and shall never act as if You own the Personal Data transmitted byOrange in connection with the performance of these Terms.
3 Specific stipulations
The use of the Know Your Customer Match Service, the SIM Swap Service and theNumber Verification Service is subject to the consent of the End User, whichOrange is responsible for obtaining as Data Controller.
The End User's express consent will not be required as part of the ConsentOption for the SIM Swap Service and for the Know Your Customer match Service ifit is demonstrated that the Service Provider has a legitimate interest and thisis approved by Orange and part of the Number Verification Service option . Inthese cases, You must explain the justification for the Service Provider'slegitimate interest in the enrollment process of its application.
You undertake not to proceed with processing operations other than thosedefined in these Terms t on Personal Data transmitted by Orange in connectionwith its execution.
If You intend to make any changes that may affect the Processing of PersonalData, You undertake to notify Orange in advance, and not to implement suchmodifications without its prior written consent.
The Processing carried out under these Terms involves making a third party, theService Provider, acting as the Data Controller, the Recipient of the data. Thelatter is then obliged to fulfil all the obligations towards the personsconcerned or towards its compliance with the regulations.
It is Your responsibility to contract with this Service Provider in order toprovide for the legal and technical conditions under which the Service Providermay become a Recipient of the data described in the Specific Terms inaccordance with the provisions of these Terms.
You undertake to indicate to Orange, in any contract concluded with a ServiceProvider, that the Orange pages proposed in some of the options and describedin Appendix J (identification / connection / validation of consent) are notmodifiable.
You undertake to declare to Orange, in any contract concluded with a ServiceProvider, the legal conditions (in particular the possible collection ofconsent) and technical conditions provided for in these Terms for theProcessing in question.
In any contract with the Service Provider, You shall specify that Orange doesnot guarantee the content, availability, accuracy or any other aspect of theinformation provided in the Network APIs Service, which exclusively reproducesthe information declared by the Orange Account Holder.
3.1. Confidentiality of Personal Data
You undertake to:
- not disclose any Personal Data to a Recipient otherthan an approved Service Provider, whether a private or public, physical orlegal person, without Orange’s prior consent;
- not disclose any personal data processed under theseTerms to members of its staff who do not participate in the services providedunder these Terms;
- ensure that all its staff members, subcontractors andproviders providing services under these Terms know and comply with the rulesrelating to the confidentiality and protection of Personal Data and are subjectto a specific obligation of confidentiality.
3.2. Security, Breach of Personal Data and Notification
You must take the necessary technical and organizational security measures toprotect Personal Data from accidental or unlawful destruction, accidental loss,modification, disclosure or unauthorized access to Personal Data in accordancewith applicable Data Protection Laws.
You must notify Orange immediately after having detected or been informed bythe Service Provider of a Personal Data Breach, or any security breachresulting in the accidental or unlawful destruction, loss, alteration, orunauthorized disclosure of Personal Data transmitted, stored or otherwiseprocessed, or unauthorized access to such Personal Data.
The notification will be sent to Orange at the following email address:cert@orange.com
The notification shall specify the nature of the Personal Data Breach and itslikely and actual consequences on the People concerned, the nature of themeasures already taken or those proposed to remedy the Breach, the people withwhom additional information may be obtained, any unaffected subsidiaries orentities of Orange and the geographical areas concerned, and, if possible, anestimate of the number of People concerned who may have been affected by thebreach in question and all the elements for identifying them.
You undertake to establish, with Orange, in the framework of cooperationbetween the Parties, regular updates consistent with the urgency and gravity ofthe situation.
If one or more Service Providers are affected by the situation, You shallensure that they are involved in any exchange.
It is incumbent only on Orange, as the Controller, to inform and notify thecompetent control authorities and, where appropriate, the person(s) concernedby the Breach of their Personal Data. You shall not notify the competentauthority in Orange’s place.
3.3. Cooperation with Orange
You undertake to cooperate with Orange:
- by providing Orange with all documentation andinformation it might need in the event of a referral to a regulatory authorityto demonstrate its compliance with applicable Data Protection Laws;
- in the management of requests from Persons Concernedfor the exercise of their rights, in particular their rights of access,correction, deletion and/or opposition, or any other request relating to theprotection of their Personal Data.
- Should the Person Concerned contact You directly toexercise their rights, You shall communicate to Orange the request received,within seventy-two (72) hours of receiving it. You shall not respond to therequest of a Person Concerned without Orange’s approval.
In the event that the Person Concerned contacts the Service Provider directlyto exercise his/her rights regarding the processing carried out by Orange, theService Provider shall communicate the request to You who shall pass it on toOrange under the conditions presented above.
- in carrying out an impact assessment that Orangeshould conduct in order to assess the risks associated with the processing ofPersonal Data and to identify the measures to be taken to deal with these risksand the possible consultation of the supervisory authority;
- in the event of a control or investigation by acompetent supervisory authority, the Parties undertake to cooperate reasonablywith each other and with the supervisory authority.
In the event that the control exercised by the competent authority concerns theProcessing carried out on behalf of Orange and in its name, You undertake toinform Orange of that control immediately after having been notified by thesupervisory authority itself, and not to commit itself on behalf of Orange orin its name.
If Orange is controlled by a competent authority, in particular with regard tothe Services provided by You, the latter undertakes to cooperate with Orangeand to provide Orange with any information it may need to demonstratecompliance with applicable Data Protection Laws.
3.4. Subsequent Subcontractors
You cannot subcontract all or part of the Processing of Personal Data to anyRecipient without Orange’s prior written consent.
You shall only call upon subsequent subcontractors providing sufficientsafeguards for the implementation of appropriate technical and organizationalmeasures to ensure Orange's compliance with applicable data protection laws,and undertakes to sign with its subsequent subcontractor a written contractimposing the same data protection obligations as those provided for in theseTerms, and including obligations relating to security, confidentiality, andcooperation in case of data breaches or international transfers of PersonalData;
You shall provide Orange, upon request, with a certificate guaranteeing theimplementation of the obligations relating to the protection of personal databy its subsequent subcontractor and a description of the processing carried outby the subsequent subcontractor, indicating, in particular, the purposes of theprocessing, the categories of data processed, the categories of people havingaccess to the data, and the storage location(s) of the data;
If the subsequent subcontractor fails to comply with the data protectionobligations, You, as an original subcontractor, remain entirely responsible toOrange for the proper fulfillment of the obligations of its subsequentsubcontractor.
3.5. Transfer of Data Outside the European Union (EU)
If You are located in a country not recognized by the European Commission asproviding adequate protection, or is likely to transfer Personal Datatransmitted by Orange to a Service Provider located in a country not offeringsuch protection, it undertakes to comply with the formalities laid down in theapplicable Data Protection Laws to regulate data transfers outside the EuropeanUnion.
Personal data cannot be transferred to a third country outside the EuropeanEconomic Area without Orange’s prior written consent.
Orange authorizes You to sign on its behalf and for its account the StandardContractual Clauses of the European Commission, or any other instrumentgoverning the transfer of Personal Data outside the European Union, and/or tohave them signed by the Service Providers.
3.6. Audit
Orange reserves the right to verify compliance with the obligations andguarantees stipulated in these Terms and, in particular, to request that Yousubmit its data processing capabilities, data files and documentation requiredfor processing to an audit.
This audit shall be conducted in accordance with the procedure and modalitiesdescribed in Section 5 of Appendix C (Orange Security Requirements) to theseTerms.
3.7. Fate of Personal Data After Processing
You undertake to comply with the retention times set for the Data transmittedto it by Orange for the purposes of these Terms.
In addition, You undertake to delete all documents and files containingPersonal Data after the end of the Processing provided under these Termswithout delay and without further formalities and not to retain any copy of thePersonal Data.
You shall provide Orange, upon request, with a Personal Data DeletionCertificate.
Failure by You to comply with the provisions of this Appendix will result intermination of these Terms under the conditions specified in Section 13 Termand Termination. Orange will also have the right to request an injunction orother provisional remedy for any actual or potential breach of this Appendix,without prejudice to any other rights and remedies that Orange may have.
Appendix B – SECURITY REQUIREMENTS FOR YOUR NETWORK
1. DEFINITIONS
The terms defined in this Section have the meanings below as they appear inAppendix B, unless the context in which they are used requires a differentmeaning or a different definition is indicated for a particular Section orprovision.
1.1. “Confidential Information” means: Orange customerdata and proprietary network information, data relating to systems, networks,Orange services and security checks implemented on these systems and networks,data relating to Orange staff, proprietary Orange and/or commercial secretinformation, and other confidential information or data or proprietary data inaccordance with the terms of these Terms.
1.2. "Industrial Standard” means: accepted set ofbest practices (1) used or adopted by a substantial number of companies engagedin a similar type of business ("comparable companies") to managesimilar types of information, (2) prescribed for use by a body or group ofapplicable industrial standards or (3) established by experts who arerecognized in the field as acceptable and reasonable.
1.3. "Penetration Test" means: part of theRisk Assessment Process in which one or more qualified, experienced and trainedindividuals, known as "ethical pirates," engage in a coordinated andplanned attack of computer systems and networks to uncover potentialvulnerabilities and ensure that logical controls can resist deliberate attemptsto circumvent them.
1.4. "Program" means: processes and proceduresthat are documented and implemented to achieve common objectives and monitorthis achievement, which may be updated from time to time.
1.5. "Risk Assessment Process” and “RiskAssessment" mean: a process that is documented and implemented foridentifying system security risks and determining the likelihood of occurrenceand the resulting impact, and identifying additional protections or changesthat would appropriately eliminate and/or mitigate this impact.
1.6. "Risk Management Program" means: aprocess that is documented and implemented to identify, control and mitigaterisks that are inherent to the information system. It includes the process ofassessing the qualitative and/or quantitative risks of the industrial standard,the cost-benefit analysis, and the selection, implementation, testing andevaluation of protections, including a determination of the steps necessary tomeet the four objectives of Security Assurance.
1.7. “Security Assurance” means: evidence that the foursecurity objectives (integrity, availability, confidentiality andcompatibility) are adequately met by a specific information system."Properly met” means (1) a feature that performs sufficiently, (2)sufficient protection against unintentional errors (users or software), and (3)sufficient resistance to intentional penetration or circumvention.
1.8. “Threat Source" means: (1) intent and methodtargeted at the intentional exploitation of a vulnerability or (2) situationand method that may inadvertently cause a vulnerability.
1.9. “Threat Analysis” means: review and documentationof sources of threat against system vulnerabilities to identify potentialthreats to a specific information system in a particular operationalenvironment.
1.10. “Vulnerability” means: a defect or weakness infunctionality, design, implementation, internal controls of the informationsystem or security procedures that can be applied (triggered accidentally orintentionally) and cause a security vulnerability or breach of the system’ssecurity policy.
2. GENERAL REQUIREMENTS
2.1. This document, “Security Requirements”(“Document”), applies to Your performance when personally identifiableinformation relating to Orange End Users is provided to You, including, but notlimited to, the development, offer, use and/or maintenance of any service,software or other product thereunder, and all editions, versions, updates,improvements and related changes ("software" or "hardware"as applicable).
2.2. You shall implement and maintain administrative,physical and technical security checks of the industrial standard that aresufficient in their nature and scope to protect (1) the confidentiality,integrity and availability of personally identifiable information as well as(2) the availability and integrity of the Orange service, network andoperations.
2.3. You shall complete the administrative, physical andtechnical security checks described in this document.
3. USE OF INFORMATION
3.1. You guarantee that personal data will only be usedto combat fraud, identify a mobile phone, complete a form and provide access todata for its customers or other needs specified in these Terms.
3.2. You will take appropriate measures to securepersonal data during transit and storage by means of protective mechanisms inaccordance with industrial standards (such as encryption). This protection willinclude all forms of portable media (such as flash drive/USB, laptop, CD, DVD,Blu-ray, portable hard drive, cellular phone/smartphone, MP3 player, etc.).
4. INFORMATION SECURITY POLICIES AND PROGRAM
4.1. You shall implement and maintain a Risk ManagementProgram in accordance with the following industry standards including, but notlimited to:
4.2. You shall have a security policy describing thesecurity and confidentiality controls implemented in its operations to satisfythis Document (“Information Security Policy”). You shall establish a RiskManagement Program to implement its Information Security Policy including, butnot limited to:
4.2.1. A risk assessment process that ensures that theYour operating environments, development environment, systems, applications,networks and procedures are regularly assessed to identify and address securityvulnerabilities.
4.2.2. A program for detecting intrusions and securitybreaches, and preventing and responding to incidents.
4.2.3. A program to manage the system, network andapplication configuration.
4.2.4. A program for implementing and administeringlogical access control(s) to the data, systems and network.
4.2.5. A program for implementing and administeringphysical access control(s) to the premises and data.
4.3. You shall have the Risk Management Programmonitored by an internal or external auditor at least once a year to assesscompliance with the requirements inherent in its Information Security Policy.
5. DEVELOPMENT CYCLE
5.1. Your controls associated with the development,pre-production testing and delivery of any software or equipment, whatever itmay be, will include, but not be limited to, an obligation to:
5.1.1. Implement security controls of the industrialstandard for its operating environment, systems, networks and all premises inwhich the software is developed and/or hosted.
5.1.2. Develop, implement and comply with the bestsecurity coding practices of the industrial standard.
5.1.3. Establish processes with, where appropriate, theuse of source code scanners, performance testing tools for operating systemsecurity, web application scanners or other tools or techniques, or eveninformation acquired through industry standardization bodies to assessvulnerabilities in software or hardware security before starting production.
5.1.4. Follow industrial standard practices to mitigateand protect against all known and reasonably foreseeable securityvulnerabilities, including: (1) unauthorized access, (2) unauthorized changesin systemic configurations or data, (3) interruption, degradation, or denial ofservice, (4) unauthorized escalation to a user privilege, (5) service theft,and (6) unauthorized disclosure of confidential information.
5.2. You must ensure that all entities andconfigurations remain operational following any updates, modification orupgrades to software and hardware, unless Orange has given its prior writtenauthorization.
6. SECURITY ASSURANCE
6.1. You shall maintain a Risk Assessment Processshowing Your Software and Hardware Security Assurance. This process shallinclude:
6.2. Your obligation to organize and conduct a RiskAssessment of its software and hardware through a third-party security testprovider. You shall repeat the Risk Assessment at the beginning of (1) eachmajor release launch or (2) for any software or equipment deployed in theOrange Network or hosted by You. This Risk Assessment shall include:
6.2.1. analysis of threats to software or hardware,
6.2.2. software or hardware penetration test,
6.2.3. risk assessment for administrative, technical,logical and physical security controls in the operating environment, systems,networks and premises where the software or equipment is hosted, if they arehosted by You.
6.3. You must address all high- or medium-riskvulnerabilities identified in the Risk Assessment before starting production.
6.4. Orange may request an electronic copy of the fieldof work from the third party above tasked with testing the security assurance(Section 6.1).
7. SECURITY BREACH AND INCIDENT RESPONSE
7.1. You shall establish and maintain documentedescalation processes for all security breaches and responses to incidents, withprocedures for notifying Orange within twenty-four (24) hours after a breachinvolving personally-identifiable information communicated by Orange.
7.2. You shall cooperate and provide information ifrequested by Orange or any consultant, contractor, lawyer or other third partyauthorized by Orange to investigate a security breach in Your operatingenvironment.
7.3. In the event of a security breach affecting Orange,You must send Orange, within forty-eight (48) hours after its discovery, a postmortem report with (1) identification of all the potentially compromised Orangeinformation, (2) actions by You to mitigate the damage caused, and (3)protection to prevent the recurrence of said breach.
8. RIGHT TO RISK ASSESSMENT
8.1. Orange reserves the right to perform a RiskAssessment on Your software and hardware. The risk assessment may, at thediscretion of Orange, take place once a year or after each software and/orhardware launch and include, but is not limited to, vulnerability assessmentsand penetration tests of: (1) software and hardware, (2) underlyinginfrastructure and operating environment in which software and/or equipment operateor are hosted, (3) network and premises inherent in the operation ormaintenance of software and/or hardware and (4) Your administrative, technicaland/or physical controls inherent in such software and/or hardware. For RiskAssessments requiring Your involvement, resources, premises or systems, theParties shall come to an agreement (1) on the extent of its involvement, (2)the resources, premises, or systems that would be required, and (3) the RiskAssessment schedule.
8.2. The right granted to Orange to carry out its ownRisk Assessment shall not replace or be a substitute for, under anycircumstances, Your Risk Assessment Process specified in this Document. Athird-party security provider may, at the discretion of Orange, be used tocarry out this Risk Assessment.
9. VULNERABILITY MANAGEMENT
9.1. You shall implement and maintain an IndustrialStandard Vulnerability Management Program. You shall assign one or more staffmembers to the monitoring of appropriate public channels for the disclosure ofthe vulnerability (such as the NIST, National Vulnerability Database) thataffect its software or hardware. This program will include (1) the underlyingplatform (e.g. operating system, database product, web server, etc.) and (2)all third-party software or (3) freeware that is part of Your software orhardware. This program shall include:
9.2. Assignment by You of one or more staff member(s) toliaise with the Orange Vulnerability Management staff.
9.3. You shall address the vulnerabilities identified inits hardware and software at its own expense.
9.4. With respect to Your software and hardware includedin the Orange network and managed by Orange, You will be required to provide apatch with a regression test within fifteen (15) days from the date on whichthe vulnerability was initially disclosed or to which You were notified byOrange.
9.5. With respect to Your software and hardware hostedin the Orange network and managed by Orange, You will be required to implementin production a patch with a regression test within fifteen (15) days from thedate on which the vulnerability was initially disclosed or on which You werenotified by Orange.
9.6. With respect to Your software and hardware hostedoutside of the Orange network, You will be required to implement in productiona patch with a regression test within fifteen (15) days from the date on whichthe vulnerability was initially disclosed or on which You were notified byOrange.
Appendix C - ORANGE SECURITY REQUIREMENTS
Orange allows You to access its APIs remotely for the sole fulfillment of itsServices commitments.
This access to the Orange programming interface will be authorized under thefollowing terms and conditions.
1. Definitions
The terms defined in this Section have the meanings below as they appear inAppendix C, unless the context in which they are used requires a differentmeaning or a different definition is indicated for a particular Section orprovision.
"Services" means all services ordered and provided by You, for whichaccess to the Orange Network is required.
"Orange Network" means the internal network managed by Orange and allthe Orange network access infrastructures that are necessary to ensurecommunication between the resources of each party.
"Access Point” means the technical network interface between Orange andYou. This Access Point consists of different types of equipment managed byOrange and made available to You. This Access Point will be used to create adedicated network between several partner sites. This Access Point will alwaysbe used for all network connections and communications between You and Orange.
"Contributors" means everyone formally authorized by You to accessthe Orange Network remotely to perform only the Services. The Contributors maybe Your staff members, agents or subcontractors.
"Resources" means the programming interfaces, networks, hardware,software, and/or data belonging to and/or managed under the responsibility ofYou and Orange to provide the products stipulated or perform the Services.
2. Access Control
You shall:
a. only use the Access Point to perform the Services,and
b. ensure that only Your Contributors and only Your dulyauthorized resources are interconnected and in communication with Orange’sresources.
c. implement and manage the organizational and technicalprocesses necessary to accurately identify a person using this remote accessand its use or action associated with Orange resources.
With regard to the connection provided by Orange to the Contributors to accessOrange’s resources, You shall:
a. not divulge to any third party, other than theauthorized contributing members, any authentication of the data giving accessto Orange’s resources, and
b. implement and manage all organizational and technicalprocesses to identify and authenticate a person using this connection.
3. Resource Management and Use
You shall:
a. update, as soon as possible and as much as necessary,its IT security tools to maintain the level of security required for itsresources, such as updated and effective anti-virus software,
b. implement logoff mechanisms after a short period ofinactivity to protect access to its resources,
c. implement and organize a password management policyand connections to its own resources, so that passwords are changed regularlyand are hard to guess,
d. implement all the means necessary to ensure theintegrity of the data exchanged between Orange and You,
e. implement all necessary means to ensure that the datatransmitted to Orange by You are not infected with malicious codes, and
f. return to Orange all its equipment, or return toOrange or destroy all the data that are its property after the Services arecompleted.
You will only use the Orange Resources they need to deliver the Services.
You will only use their resources if they are needed to deliver the Services.
Access by physical interconnection (Pase Interco, for example)
In the event that Orange allows You to access its network via a Pase Intercotype infrastructure to execute these Terms, You shall:
a. ensure that premises hosting the Orange equipmentwhich constitutes this Access Point are subject to physical control and areonly accessible by authorized Contributors,
b. ensure that remote access or control is not possibleon its own interconnected equipment,
c. comply with the addressing rules imposed by Orange.
You recognize and accept that routers and accesses are provided andadministered by Orange.
4. Security Incident Management
You shall designate a point of contact who will be notified in the event of asecurity incident and promptly notify Orange of any changes affecting thispoint of contact.
You or Orange will notify each other if it detects a malicious action, systemfailure, or security incident that may affect the resources of the other usingthe procedures and contacts previously determined by the Parties.
In case of a serious incident related to Your connection (such a virus orintrusion into the system) likely to affect or threaten the security of Orangeresources, Orange may suspend remote access to the Orange Network withoutnotice until the security incident is fully resolved.
5. Right of Audit and Logging
Orange reserves the right to:
a. log Your accesses to Orange's resources,
b. implement management and monitoring tools on accessinfrastructure, and/or,
c. if needed, ask You for the identity of the useraccessing the Orange Network and, where applicable, its subcontractors.
In addition, Orange or any third party authorized by You will be responsiblefor auditing Your resources to verify that it complies with the commitmentsstipulated.
You shall assist in the proper conduct of the audit. It will therefore have toagree to provide all the information necessary for this audit. This informationwill be covered by a non-disclosure agreement. You and Orange will agree on thepreparation and drafting of the audit requirements.
In the event that Orange allows You to access its network via a Pase Intercoinfrastructure to execute these Terms or prepare the audit requirements, Youwill provide, in writing, to Orange or any authorized third party in charge ofthe audit:
a. its policy for combating and avoiding malicious codes(such as names of anti-virus products used on workstations and servers,strategies to update signatures and anti-virus engines, and applications ortools on workstations and servers),
b. a diagram of Your networks and of the equipmentconnected to the Orange Network, and
c. any other information necessary for this audit(security policy item, daily log files, etc.).
If any non-compliance is revealed by the audit, You shall establish acompliance program within ten (10) days after notifying Orange. The programshall contain all the measures to be implemented and their implementation dateswithin a reasonable timeframe. Once authorized by Orange, this complianceprogram shall be applied by You. Otherwise, Orange may suspend remote access tothe Orange network without notice and terminate these Terms as stipulated inSection 13 Term and Termination.
6. Subcontracting
You shall give Orange prior written notice of any changes inherent to thesubcontracting parties involved during execution of the Services.
You shall ensure that its Contributors - including subcontractors - comply withthe terms and conditions of this section, in particular with regard to thestrict confidentiality or integrity of all information to which they shouldhave access to deliver the Services. Orange may, depending on the type of informationdisclosed, ask You to sign a non-disclosure agreement.
7. Information
You shall notify Orange and specify in writing any modification of the items itmust provide to Orange in accordance with the provisions of this Section, suchas name of security contact or security rules.
NETWORK API SERVICE SPECIFIC TERMS
SIM SWAP
Article 1 - FOREWORD
To use the Network API Service, as referred to above, You must first agree tobe bound with full and unreserved acceptance by these Specific Terms. TheseSpecific Terms incorporate by reference the Networks APIs General Terms(together the “Terms”). In case of discrepancy between the Specific Terms andthe General Terms, Specific Terms will prevail.
Article 2 - DEFINITIONS
For the purposes of the, the following terms shall have the followingdefinitions:
"End User Data": the data listed in Appendix A, Network API ServiceDescription, that may be provided to You and Business Customer under theNetwork API Service of these Terms. Only the Data referred to on the Form dulyvalidated by Orange shall be submitted by You to Your Business Customerreferred to on the Form.
"MSISDN" or "Mobile Station International Subscriber DirectoryNumber": the mobile phone number of the End User holding an Orange mobilesubscription attached to the SIM card.
"Orange Account Holder": the End User who has anon-professional Orange subscription in their name for their personal needs. Orange subscriptions are:
- mobile Orange subscriptions ;
- bundle subscriptions (Mobile + Internet) ;
- Internet subscriptions.
Article 3. RELIABILITY OF SHARED INFORMATION ON END USERS
The End User Data transmitted in connection with the delivery of the NetworkAPI Service is the data declared by the Orange Account Holder as part of theirOrange subscription. Therefore, Orange does not guarantee the accuracy of thedata transmitted to You and Your Business Customer.
Article 4. YOUR ELIGIBILITY CRITERIA
In order to qualify for the Network API Service, You must meet the followingcumulative conditions:
- the Terms have not been suspended or terminated in thelast year following a breach of their contractual obligations;
- You have paid any amount You owe to Orange;
- You have not attempted fraud against Orange;
- You respect all of the Orange Group’s ethical rulesand compliance policies available on orange.com, especially those regardinganti-corruption, money laundering and economic sanctions.
In the event that You, during the duration of these Terms, no longer meet anyof the conditions listed above, these Terms may be terminated by Orange underthe conditions set out in Section 13 of the General Terms.
Article 5. TARIFF CONDITIONS
In return for the supply of Orange’s Network API Service, the rates conditionscharged to You will be those set out in Appendix C to these Terms.
Any unpaid amounts due at the scheduled time will automatically result in thepayment of interest on arrears. It will be calculated on the basis of theamount due multiplied by the ECB's rate + 10%, the sum of which is divided by26. This clause cannot compromise the debt’s payability. These penalties shallaccrue from the first day following the payment deadline until Your actualpayment is deemed effective on the day on which the Orange Bank Account iscredited. The ECB's rate is the overnight rate of the day after the paymentshould have been made.
In addition, in the event of a late payment, a lump sum payment for recoverycosts will also be applied in full to You, starting on the first day of delayand without prior formal notice. The amount of this indemnity shall be equal toforty (40) euros as set by Article D 441-5 of the Commercial Code on the dateof the first late day.
You shall have a period of one (1) month from the date of issue of the invoiceto express the duly substantiated reservations that You consider necessary toOrange. Beyond that time limit, You will no longer be able to contest theinvoice, which will be considered as final.
Orange is duly authorized to offset any amount unpaid by You with any amountowed by Orange to You or belonging to You and held by Orange.
Appendix A Network APIs SERVICE DESCRIPTION
1. General stipulations on the protection of personaldata for the Network APIs service
The nature and scope of the Processing, the Personal Data categories, and theirretention period by You for the Network APIs service are described in the tablebelow:
4. Specific conditions of the SIM Swap Service
4.1. Objective: Reduce fraudulent identifications toYour Business Customer by providing information about the on the recency of theEnd User's current SIM card.
4.2. Method: Two ways of providing of informationrelating to the recency of the SIM card are offered to Your Business Customer:the transmission of the date of activation of the SIM card or a YES/NO answerto a question about the age of the SIM card.
4.3. Implementation conditions: This Service does notimply the prior and express consent of the End User in the User's option asthis is only offered when the legitimate interest is demonstrated by YourBusiness Customer and approved by Orange. The justification for this processingmust be documented to Orange by You . If necessary, Your Business Customer willinform the End User, by any means in accordance with the regulations, that thenumber declared may need to be verified with Orange
4.4. End User Data transmitted:
Orange will provide You with the following End User Data: the activation dateof the SIM card in use or a YES/NO answer to a question about the age of theSIM card.
In addition to the definition of “Orange Account Holder” (Article 2DEFINITIONS), the SIM Swap Service is also aimed at prepay customers orcustomers who have signed up for a mobile package for the VSE sector.
4.5. Use and Retention of End User Data:
You cannot retain End User Data obtained from Orange. However, Your BusinessCustomers may retain End User Data obtained from You under the terms agreedupon with Your Business Customer concerned. In addition, You may retaininformation relating to transfers (other than Personal Data) forrecord-keeping, financial reporting and audits for its own account.
4.6. API calls: See Appendix B “Technical Conditions”for details on API.
- Verify the End User if the End User information isavailable to Your Business Customer or if the End User account is eligible forthe use case.
- If the End User's account is eligible for the usecase, Orange will provide You with the following End User Data: the activationdate of the SIM card in use or a YES/NO answer to a question about the age ofthe SIM card.
- Optionally and at Your request, Orange will activatethe Eligibility API functionality.
Appendix B - TECHNICAL CONDITIONS
A- TECHNICAL FLOWS
2. SIM Swap Service
B- REQUIREMENTS FOR DATA FROM YOU
The fields below will be sent to Orange by You under the Orange APIs asappropriate.
1. RequestId - registration of the transactiontransmitted by Your Business Customer to You.
2. AgreggatorTransactionId - randomly generated numberso that You can track the transaction.
3. Your Business Customer name - to ascertain whom theidentifiers were transferred to.
4. MSISDN - to confirm the subscriber who has beenauthenticated.
5. ConsentID - code for obtaining authorization from theUser.
6. Date/Time - time stamp of the request (or response)transaction.
7. StatusCode - success/failure.
8. ReasonCode - if necessary, reason for thetransaction’s failure (non-existent, user auth. failure, etc.).
C. SERVICE QUALITY AND MAINTENANCE
Data recovery response time < 1 sec. in 95% of cases.
Incident availability time: 95%
Disaster availability time: 96%
C: Standard
SLA Bronze Level 2
Impact
Sensitive Guaranteed operation 12x5
RIO incident = 1 day
RTO damage = 5 days
RPO damage = 1 day
No redundancy Availability
Incident 95% annual
Damage 96% annual
To contact the support channel, please fill this form:
SIMSwap