Backup Services Agreement

Backup Services Agreement & Limitation of Liability

eSmith IT Consulting Inc. | Authorized IT & Managed Services Provider

This Backup Services Agreement (“Agreement”) is entered into between eSmith IT Consulting Inc. (“Provider”) and the undersigned Client (“Client”). This Agreement governs the provision of managed data backup, replication, and recovery services (“Backup Services”) delivered by the Provider and sets forth the complete limitation of the Provider’s liability with respect to those services.

1. Scope of Backup Services

The Provider agrees to make commercially reasonable efforts to configure, monitor, and maintain automated backup processes for the systems, datasets, and endpoints mutually identified during onboarding (“Covered Systems”). The specific backup frequency, retention periods, recovery point objectives (“RPO”), and recovery time objectives (“RTO”) shall be as defined in the applicable Service Order or Master Services Agreement (“MSA”) between the parties, or as otherwise communicated in writing. The Provider reserves the right to modify backup schedules, infrastructure, or third-party storage providers at its discretion, provided the Provider uses commercially reasonable efforts to maintain continuity of service.

2. Critical Limitation of Liability — Data Loss

THE CLIENT EXPRESSLY ACKNOWLEDGES AND AGREES THAT NO BACKUP SYSTEM OR TECHNOLOGY IS INFALLIBLE AND THAT DATA LOSS CAN OCCUR DESPITE THE USE OF INDUSTRY-STANDARD PRACTICES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

• The Provider shall not be liable for any loss, corruption, inaccessibility, or destruction of Client data, regardless of whether such loss occurs as a result of hardware failure, software defect, ransomware or malware attack, accidental deletion, human error, cloud provider outage, network interruption, or any other cause;
• The Provider shall not be liable for the failure of any backup job, the failure of any restoration attempt, or the discovery that a backup set is corrupt, incomplete, or otherwise unusable;
• The Provider shall not be liable for any delay in the restoration of data or systems beyond any estimated RTO, regardless of the cause of such delay;
• In no event shall the Provider’s total aggregate liability for any and all claims arising under or related to the Backup Services exceed the total fees actually paid by the Client to the Provider for Backup Services during the three (3) calendar months immediately preceding the event giving rise to the claim.

The Client understands that the liability cap set forth above represents the maximum recovery available to the Client under this Agreement and constitutes a fundamental element of the basis of the bargain between the parties.

3. Disclaimer of Warranties

THE BACKUP SERVICES ARE PROVIDED ON AN “AS-IS” AND “AS-AVAILABLE” BASIS. THE PROVIDER EXPRESSLY DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. THE PROVIDER DOES NOT WARRANT OR REPRESENT THAT:

• All Client data will be successfully captured, retained, or recoverable at any given time;
• Backup services will be uninterrupted, timely, secure, or error-free;
• Any specific file, folder, database, mailbox, virtual machine, or application will be restorable to any particular point-in-time;
• The backup infrastructure, including third-party cloud storage providers used by the Provider, will remain continuously available or free from failure.

No verbal or written statement by any representative of the Provider shall create a warranty beyond those expressly set forth in a duly executed MSA or written Service Order.

4. Exclusion of Consequential Damages

IN NO EVENT SHALL THE PROVIDER BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES WHATSOEVER, INCLUDING BUT NOT LIMITED TO: LOSS OF REVENUE, LOSS OF PROFITS, LOSS OF BUSINESS, LOSS OF GOODWILL, BUSINESS INTERRUPTION, LOSS OF ANTICIPATED SAVINGS, COST OF SUBSTITUTE SERVICES, OR DAMAGES ARISING FROM THE LOSS, CORRUPTION, OR UNRECOVERABILITY OF DATA — EVEN IF THE PROVIDER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF THE PROVIDER IS FOUND TO HAVE BEEN NEGLIGENT. THE FOREGOING EXCLUSION OF LIABILITY SHALL APPLY TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW.

5. Client Responsibilities

The Client bears primary responsibility for the integrity, security, and recoverability of its own data. The Client agrees to:

• Verify Coverage. Periodically verify that all critical systems, applications, and data sources are included in the backup scope and promptly notify the Provider of any additions, removals, or changes to Covered Systems;
• Test Restorations. Cooperate with and participate in periodic restoration tests as recommended by the Provider. Failure to participate in scheduled test restores shall relieve the Provider of any obligation to warrant restorability of untested data sets;
• Maintain Access. Ensure the Provider has continuous administrative and network access to all Covered Systems sufficient to execute backup operations. Downtime, credential changes, firewall modifications, or other access disruptions that prevent backup jobs from completing are the sole responsibility of the Client;
• Maintain Redundancy. Acknowledge that the Backup Services provided by the Provider do not substitute for the Client’s own independent business continuity planning, disaster recovery procedures, or any regulatory obligation to maintain data redundancy;
• Report Failures Promptly. Immediately notify the Provider upon discovery of any suspected data loss, backup failure notification, or ransomware or malware incident that may affect the integrity of backup data.

6. Third-Party Storage Providers

The Provider may utilize third-party cloud infrastructure and storage providers (including but not limited to Microsoft Azure, Amazon Web Services, Backblaze, Wasabi, or similar services) to store Client backup data. The Provider makes no representations or warranties regarding the uptime, data retention practices, security posture, or liability limitations of such third-party providers. The Client agrees that the Provider shall not be responsible for any data loss, breach, or service outage attributable to a third-party storage provider, and the Provider’s liability for such events shall be limited as set forth in Section 2 of this Agreement.

7. Ransomware, Malware & Cybersecurity Events

The Client acknowledges that ransomware, malware, and other cyberattacks may encrypt, corrupt, or destroy backup data, including backup repositories and snapshots, and that such attacks are becoming increasingly sophisticated in their ability to target backup infrastructure. The Provider shall not be liable for the loss, encryption, or corruption of backup data resulting from a cyberattack, whether directed at the Client’s primary environment, the Provider’s infrastructure, or a third-party storage provider. The Provider’s liability in connection with any cybersecurity event shall be limited as set forth in Section 2 of this Agreement.

8. Client Indemnification

The Client agrees to indemnify, defend, and hold harmless the Provider and its officers, directors, employees, shareholders, and contractors (collectively, “Indemnified Parties”) from and against any and all third-party claims, demands, suits, proceedings, losses, liabilities, damages, and expenses (including reasonable attorneys’ fees) arising out of or related to:

• The Client’s failure to fulfill any of its responsibilities set forth in Section 5 of this Agreement;
• Any claim by a third party (including regulatory authorities) arising from the Client’s failure to maintain adequate data redundancy, business continuity, or disaster recovery measures independent of the Provider’s Backup Services;
• Any data breach, ransomware incident, or regulatory non-compliance event affecting the Client’s data or systems; or
• Any claim that Client data stored in backup by the Provider violates any applicable privacy law, intellectual property right, or other legal obligation of the Client.

9. Regulatory Compliance

The Client is solely responsible for ensuring that its use of the Backup Services and the configuration of backup retention policies complies with all applicable laws, regulations, and industry standards, including but not limited to HIPAA, GDPR, PCI-DSS, SOX, and any applicable state data protection laws. The Provider does not assume and expressly disclaims any obligation to configure backup services in a manner that satisfies any particular regulatory framework unless such obligation is explicitly stated in a separate, duly executed written agreement (such as a HIPAA Business Associate Agreement). The Provider’s liability for any regulatory non-compliance arising from the Client’s use of the Backup Services is limited as set forth in Section 2 of this Agreement.

10. Service Modifications & Termination

The Provider reserves the right to modify, suspend, or discontinue any component of the Backup Services upon thirty (30) days’ written notice to the Client, except in cases of emergency security threats, third-party provider outages, or other circumstances beyond the Provider’s reasonable control, in which case the Provider will provide notice as soon as practicable. Upon termination or expiration of the Backup Services for any reason, the Provider shall retain Client backup data for a period of thirty (30) days following the effective termination date, after which all backup data may be permanently deleted without further notice. The Client is solely responsible for retrieving any backup data prior to expiration of this retention window.

11. Force Majeure

The Provider shall not be liable for any failure or delay in the performance of the Backup Services to the extent that such failure or delay is caused by circumstances beyond the Provider’s reasonable control, including but not limited to acts of God, natural disasters, pandemics, war, terrorism, civil unrest, government actions, widespread internet infrastructure failures, utility outages, third-party provider outages, or cyberattacks. In such events, the Provider will use commercially reasonable efforts to restore services as soon as practicable and will notify the Client promptly of the nature and anticipated duration of the disruption.

12. Precedence & Relationship to Other Agreements

In the event of any conflict or inconsistency between the terms of this Backup Services Agreement and any active Master Services Agreement (MSA) currently in effect between the Provider and the Client, the terms of the MSA shall take precedence. This Agreement is intended to supplement, and not supersede, the broader managed services relationship defined by any applicable MSA. The parties agree that electronic signatures and submissions via the Provider’s official Client Service Forms hub constitute valid “writing” and “signing” for the purposes of this Agreement and any associated amendments, as permitted under the Electronic Signatures in Global and National Commerce Act (ESIGN Act).