PulseHeberg Lifeline — Specific Terms

Article 1 - Purpose, contractual documents and definitions

1.1 Purpose

These Specific Terms (“ST”) define the conditions under which SAS PulseHeberg, registered with the Toulon Trade and Companies Register under number 824 070 619, with its registered office at 9, boulevard de Strasbourg, 83000 Toulon (“PulseHeberg”), provides the “PulseHeberg Lifeline” add-on (the “Add-on”) and One-off Interventions on its customers’ VPSs.

1.2 Contractual documents

These ST supplement PulseHeberg’s General Terms of Use and Sale (“GT”). Under Article 1.3 of the GT, these ST prevail in the event of a conflict. The terms applicable to the VPS itself remain unchanged.

1.3 Definitions

• Eligible VPS: a Linux VPS purchased from PulseHeberg that meets Article 2.1.
• Request: a request submitted by the Customer through a ticket in their client area concerning an Eligible VPS.
• Intervention: all actions undertaken by PulseHeberg to handle a Request: analysis, diagnosis, actions on the VPS, checks and the report.
• Period: three (3) consecutive months starting on the Add-on’s activation date or its new activation under Article 3.1, regardless of the billing cycle.
• Credit: the Intervention time included in the Add-on for each Period.
• System Scope: the services described in Article 2.2.
• Assistance: assistance with software installed by the Customer, described in Article 2.3 and termed “Concours” in the French original.
• One-off Intervention: an individually ordered Intervention on an Eligible VPS without the Add-on.
• Pre-intervention Snapshot: a snapshot of the VPS created by PulseHeberg before any modification, under Article 4.4.

Article 2 - Eligibility, scope and exclusions

2.1 Eligibility

The Add-on and One-off Intervention are available on PulseHeberg Cloud Linux VPSs whose operating system:

• was installed using PulseHeberg’s automatic installation (as of these ST: Debian, Ubuntu, AlmaLinux and Rocky Linux);
• is a version still maintained by its publisher.

A system installed from an ISO image qualifies only for Assistance. Windows systems, dedicated servers, Bring Your Own Server (BYOS) services and Business Universe services governed by their own terms are not eligible. One Add-on covers one VPS only.

Technical conditions. To benefit from the Add-on or a One-off Intervention, the Customer must have:

• installed and kept the QEMU guest agent (“QEMU Agent”) running on the VPS;
• installed the public SSH key supplied by PulseHeberg for the Add-on (“PulseHeberg Lifeline Key”), following PulseHeberg’s published procedure.

These conditions are checked for each Request. If either is missing, no Intervention can take place until the Customer remedies this, without extending the Period or carrying Credit forward.

2.2 System Scope

PulseHeberg works on the VPS operating system for individual Customer Requests, including:

• system boot (bootloader, fstab, kernel) and service management;
• distribution package management and one-off system updates, including upgrading to a new major version;
• VPS access: SSH, keys, users, groups, permissions and sudo;
• network configuration (IPv4, IPv6, DNS resolution, routing) and the local firewall;
• storage: partitions, file systems, mount points and disk space;
• performance diagnosis and system log analysis;
• installation and commissioning of a package provided by the distribution;
• securing the system after a security incident, under the conditions below.

This list is indicative. In case of doubt, PulseHeberg informs the Customer which category applies during the assessment under Article 4.2, before any time is deducted.

Security measures after an incident. If the VPS has been compromised, PulseHeberg may, at the Customer’s Request and where possible, revoke suspicious access and keys, remove identified malicious elements, apply security updates and harden SSH and firewall configuration. This service does not guarantee elimination of every compromise. PulseHeberg may recommend a complete reinstallation from a clean source where needed to restore a trustworthy environment, without an absolute guarantee of eliminating every risk. It operates without prejudice to measures under the GT, including stopping the VPS, and under their conditions for restoring service.

2.3 Assistance

Beyond the System Scope, PulseHeberg may assist with software installed by the Customer: web servers, languages, databases, containers, control panels, email and certificates. This assistance consists of analysis, diagnosis, advice and correction where possible.

PulseHeberg may refuse or discontinue Assistance when continuing no longer appears useful. Time spent on this assistance is deducted from Credit.

2.4 Exclusions

The Add-on and One-off Interventions exclude:

• development, modification or debugging of application code;
• data, website or server migrations;
• in-depth investigation of a security incident: forensic analysis, identifying its origin or perpetrator;
• recovery of deleted or corrupted data, except restoration of an existing snapshot;
• continuous or scheduled services: monitoring, preventive maintenance, periodic updates and backups;
• training;
• systems and configurations ineligible under Article 2.1.

An excluded service may be subject to a separate quotation, which PulseHeberg remains free to offer or not.

2.5 No managed service

The Add-on is not a managed service: PulseHeberg acts only at the Customer’s Request. The Customer retains administration, operation and security of the VPS, and responsibility for its data and backups.

Article 3 - Credit and time accounting

3.1 Credit

The Add-on provides sixty (60) minutes of Credit per Period and VPS. Credit is available from activation. When the Add-on ends, Credit cannot be used. If the Customer subscribes again for the same VPS before a previously started Period ends, only that Period’s unused balance is restored, without a new allocation or extension; the next Period starts on the original schedule. No Credit may be used between termination of the previous subscription and activation of the new one. If the new subscription begins on or after the previous Period expires, a new three-month Period starts on activation of the new Add-on, with sixty (60) minutes of Credit.

3.2 Time accounting

Intervention time is counted in indivisible fifteen (15) minute increments, with a minimum of one increment per Request, subject to the caps approved under Article 4.2. Analysis, diagnosis, actions on the VPS, checks and writing the report are counted. The following are not counted:

• initial assessment exchanges before the Intervention;
• Requests declared out of scope during assessment;
• restoration of the Pre-intervention Snapshot requested by the Customer within seven (7) days of the Intervention.

3.3 Allocation

Time is allocated to the Period during which it is spent. An Intervention spanning two Periods uses Credit from each.

3.4 No rollover

Unused Credit expires at the end of a Period. It cannot be carried forward, refunded, assigned or transferred to another VPS.

3.5 Tracking

Each report states time deducted and remaining Credit. The Customer may request their Credit balance by ticket at any time.

Article 4 - Intervention procedure

4.1 Request

The Customer submits a Request by ticket from their client area, selecting the relevant VPS. They describe symptoms, when they appeared, error messages and actions already tried. Assistance is provided exclusively through tickets; telephone assistance is not included.

4.2 Assessment and estimate

PulseHeberg informs the Customer whether the Request falls within the System Scope, Assistance or an exclusion. Before the Intervention starts, PulseHeberg provides an estimate stating the planned actions, accountable duration, Credit that may be used, applicable rate and maximum amount payable including VAT, taking billing increments into account. Once approved by the Customer, this estimate caps Credit deductions and charges for the Request. If more time is needed to handle the same Request, PulseHeberg covers the difference: it is neither invoiced nor deducted from Credit. A shorter intervention is accounted for based on actual time spent, subject to the applicable increments and minimums.

4.3 Authorisation

No Intervention starts without the Customer’s express authorisation, given by the account holder or an authorised contact after approval of the estimate under Article 4.2. This authorisation is collected in writing in the ticket together with acceptance of the estimate. For a One-off Intervention, if the Customer wishes performance to start before the withdrawal period ends, the agreements under Article 9.5 are also expressly recorded in that ticket. It covers VPS access, creation of the Pre-intervention Snapshot, necessary restarts and time accounting and billing within the approved caps. This authorisation only covers the Request; a separate service requires a new estimate and agreement. Exceeding the estimate for the same Request does not justify asking for an additional payment. PulseHeberg may refuse a Request whose author cannot be identified.

4.4 Pre-intervention Snapshot

Before any modification, PulseHeberg creates a Pre-intervention Snapshot where possible using its infrastructure administration tools, including on plans where customers cannot create snapshots, such as Economy. If this Snapshot uses customer-accessible slots and all are occupied, the Customer identifies a snapshot to delete or may waive the Pre-intervention Snapshot in writing.

If creating the Snapshot is impossible or fails, PulseHeberg informs the Customer before modifying the VPS. The Customer chooses in writing whether to continue without a Snapshot or postpone the Intervention. A successfully created Snapshot is kept for seven (7) days and then deleted unless the Customer requests otherwise, subject to available capacity. It is not a backup.

4.5 Access

PulseHeberg accesses the VPS using the PulseHeberg Lifeline Key and, if SSH is unavailable, its infrastructure administration tools. Presence of the key does not constitute authorisation: PulseHeberg only uses it for a Request authorised under Article 4.3, and each connection appears in the report. PulseHeberg holds the corresponding private key, restricted to persons responsible for Interventions. If the key is rotated or suspected of compromise, PulseHeberg informs the Customer and supplies instructions to replace the public key and revoke the old one. This notice does not constitute automatic replacement on the VPS. The Customer may remove the key at any time, subject to Article 2.1. PulseHeberg never asks the Customer to disclose a password by ticket or email.

4.6 Hours and response times

Requests are received and handled seven days a week, without weekend or public-holiday surcharges. PulseHeberg endeavours to take them up as promptly as possible, generally within the day on weekdays. This is indicative only and is not a guaranteed response time, a service-level agreement (SLA), or a guarantee of resolution within the day.

4.7 Report

After the Intervention, PulseHeberg records in the ticket the actions performed, files and settings changed, any recommendations, time deducted, remaining Credit and, where applicable, additional billable time, its cost and time covered by PulseHeberg beyond the estimate.

4.8 Refusal and interruption

PulseHeberg may refuse or interrupt an Intervention when:

• the Request falls outside the Add-on’s scope;
• the Intervention risks the integrity of the Customer’s data or the infrastructure;
• the VPS is used for unlawful activity or activity contrary to the GT;
• the Customer behaves abusively towards the team.

Time already spent remains deducted, unless refusal occurs during the initial assessment.

Article 5 - Overage and One-off Intervention

5.1 Insufficient or exhausted Credit

If the estimate includes time beyond available Credit, PulseHeberg prices it at the subscriber overage rate in indivisible fifteen (15) minute increments and obtains approval of the maximum amount before starting. Charges are based on actual time spent, within the approved estimate. Any time needed beyond that estimate for the same Request is covered by PulseHeberg, with no additional charge or Credit deduction. The Intervention is not suspended solely because Credit is exhausted or the estimate is exceeded in order to request an additional payment. Other grounds for refusal or interruption under these ST remain applicable.

5.2 One-off Intervention

A Customer whose Eligible VPS has no Add-on may order a One-off Intervention. Articles 2 to 4 apply. PulseHeberg assesses the Request and obtains approval of the estimate and maximum amount payable before any payment. The Intervention starts after payment of an initial thirty (30) minute block, the minimum charged for any One-off Intervention. Time beyond this initial block is billed at the one-off rate in indivisible fifteen (15) minute increments, within the approved amount. If the same Request takes longer than estimated, PulseHeberg covers the difference without requesting an additional payment.

5.3 Billing

Overage and additional One-off Intervention time are invoiced after the Intervention and payable on receipt.

Article 6 - Customer obligations

In addition to Article 8 of the GT, the Customer agrees to:

• maintain an independent backup of their data; the Pre-intervention Snapshot is not a substitute;
• provide accurate and complete information about the Request and the VPS context;
• report specific constraints: production services, preferred intervention window and sensitive data;
• not modify the VPS during an Intervention without informing PulseHeberg;
• hold the rights and licences required for the software concerned;
• check that services work after the Intervention and report any issue in the ticket within seven (7) days.

Article 7 - Liability

7.1 Obligation of means

All Lifeline services, whether concerning the Linux system or software installed by the Customer, are performed under an obligation of means pursuant to Article 9.1 of the GT. PulseHeberg applies the necessary skills and diligence in accordance with professional standards, without guaranteeing resolution of the issue, restoration of VPS operation or any specific technical outcome. The estimate and its approval define the proposed actions and the authorised time and cost; they do not constitute a guarantee of outcome.

7.2 Customer-related circumstances

Except in the event of its own fault, PulseHeberg is not liable for damage resulting from the VPS’s condition before the Intervention, inaccurate or incomplete Customer information, a modification by the Customer or a third party, or absence of a backup.

7.3 Business customers

Article 9.2 of the GT applies subject to this paragraph. Under these ST, PulseHeberg’s total liability is capped at amounts paid by the Customer for the Add-on, overages and One-off Interventions for the relevant VPS in the twelve (12) months before the event giving rise to liability. For business customers, damage arising from loss of business, loss of revenue, or loss or corruption of data is excluded. The Customer remains responsible for maintaining independent backups under Article 6. This cap and these exclusions do not apply to gross or wilful misconduct, personal injury, where they would deprive an essential obligation of its substance, or where prohibited by mandatory law. Consumer Customers are governed by Article 7.4.

7.4 Consumers

For consumer Customers, PulseHeberg’s liability is governed by ordinary law and applicable mandatory provisions. Liability caps and exclusions intended for business customers, and any GT provision reducing a consumer’s right to compensation for PulseHeberg’s breach of its obligations, do not apply to them. These ST do not limit the Customer’s statutory consumer rights.

Article 8 - Personal data and confidentiality

8.1 Roles and subject matter

Where an Intervention requires processing personal data hosted on the VPS on the Customer’s behalf, this article constitutes the processing agreement required by Article 28 GDPR for those operations. The Customer acts as controller or, when acting for another party, as a processor duly authorised to engage PulseHeberg. PulseHeberg acts respectively as processor or subprocessor. These roles concern processing on the Customer’s behalf; PulseHeberg’s own account management, billing and legal compliance processing remains governed by its privacy policy.

Processing is solely for the preparation, performance and follow-up of the authorised Request. It lasts as long as needed for those services and subsequent handling under Article 8.6. Depending on the VPS and Request, operations may include access, consultation, analysis, modification of configurations containing data, limited copying of useful diagnostic extracts, and creation and restoration of the Pre-intervention Snapshot. Only where necessary, the data may include identification and contact information, accounts and permissions, technical logs and data in the relevant files or databases. Data subjects may include the Customer, its users, employees, customers, prospects, correspondents and other persons whose data appears in those elements.

8.2 Instructions and Customer obligations

The Customer’s documented instructions comprise these ST, the Request, the accepted estimate and written instructions exchanged in the ticket. PulseHeberg processes data only under those instructions unless legally required otherwise, in which case it informs the Customer beforehand unless prohibited by law. It immediately informs the Customer if an instruction appears to infringe the GDPR or other applicable data protection rules.

The Customer determines the purposes and lawfulness of its processing, provides the necessary information and authorisations and communicates only useful data. Before the Intervention it identifies sensitive data, data concerning offences or particular confidentiality constraints so appropriate safeguards can be agreed. It sends no password or private key through tickets. This allocation does not release PulseHeberg from its own obligations.

8.3 Minimisation, confidentiality and security

PulseHeberg limits access and operations to strictly necessary data. Authorised persons are bound by confidentiality and act only on instructions. Under Article 32 GDPR, PulseHeberg implements technical and organisational safeguards appropriate to the risks: restricting and controlling access to authorised persons, protecting administration keys, securing communications, logging access and changes, protecting diagnostic extracts and applying the restoration measures under Article 4.4. Their effectiveness is checked regularly. Data is not reused for PulseHeberg’s own purposes.

8.4 Other service providers

Interventions are performed by PulseHeberg personnel or providers established in the European Union. Before a provider processes personal data on the Customer’s behalf, PulseHeberg obtains the Customer’s prior specific written authorisation after communicating the provider’s identity, location, assigned operations and relevant safeguards. These ST do not constitute general authorisation to engage subprocessors. PulseHeberg imposes the same data protection obligations on the provider in writing and remains responsible to the Customer for compliance. No transfer outside the European Economic Area is made in this context without documented instructions and compliance with Chapter V GDPR.

8.5 Assistance and data breaches

Taking account of the processing and information available, PulseHeberg assists the Customer with data subject requests and obligations concerning security, personal data breaches, impact assessments and prior consultations. It promptly forwards data subject requests concerning data processed on the Customer’s behalf and does not respond in its place without instructions or a legal obligation.

PulseHeberg notifies the Customer without undue delay after becoming aware of a breach of personal data processed on its behalf. It provides available information on the nature and likely consequences, affected persons and data, contact point and measures taken or proposed; further information is supplied as it becomes available. The Customer remains responsible for notifying the supervisory authority and data subjects unless expressly mandating PulseHeberg or PulseHeberg has an independent legal obligation.

8.6 Copies, retention and end of processing

No hosted data is retained outside the VPS except strictly useful log or configuration extracts placed in the ticket in a limited and protected manner. The Pre-intervention Snapshot follows Article 4.4. At the end of processing services, PulseHeberg deletes or returns data and copies processed on the Customer’s behalf according to the Customer’s documented choice, and deletes remaining copies unless legally required to retain them. Instructions may be given in the ticket. Residual technical copies are isolated, not reused for other purposes and deleted without undue delay as soon as justified technical constraints permit, without indefinite retention. Data retained by PulseHeberg to comply with a legal obligation is limited to what is necessary and remains protected. Data retained by the Customer on its VPS is not deleted merely because an Intervention ends.

8.7 Information and verification

PulseHeberg makes available information needed to demonstrate compliance with this article and allows and contributes to audits, including inspections, by the Customer or its appointed auditor. Review of available records and information is preferred where sufficient for verification; it does not prevent a necessary inspection.

Ordinary audits are arranged with at least thirty (30) days’ notice, limited to one audit in a twelve (12) month period, during business hours. An appointed auditor must be independent, not a competitor of PulseHeberg and bound by appropriate confidentiality obligations. Reasonable and proportionate costs of these ordinary audits are borne by the Customer under arrangements communicated beforehand. Arrangements protect other customers’ security and data without preventing effective exercise of audit rights.

These notice, frequency and auditor arrangements must not restrict urgent verification related to an incident or substantiated indication of non-compliance, a competent authority’s request or a legal requirement. Arrangements are adapted accordingly, without discretionary refusal by PulseHeberg. Reasonable and proportionate costs of these verifications remain payable by the Customer unless they establish a breach by PulseHeberg. This allocation must not obstruct verifications required by applicable mandatory provisions. The Customer may request information on safeguards applied to its Request by ticket.

Article 9 - Prices, billing, duration, cancellation and withdrawal

9.1 Prices

Applicable prices are those displayed on PulseHeberg’s website when subscribing or ordering, including VAT. As of these ST: Add-on at €25.00 per month, €75.00 per quarter or €270.00 per year; subscriber overage at €22.50 per fifteen (15) minute increment; One-off Intervention at €27.00 per fifteen (15) minute increment, thirty (30) minutes minimum. Price changes follow Article 5.3 of the GT.

9.2 Billing

The Add-on is billed in advance on the billing cycle of its VPS: monthly, quarterly or annually. This cycle does not affect Credit allocated per Period under Article 3.

9.3 Activation, duration and cancellation

The Add-on can only be subscribed to and activated from the management panel of an already active VPS in the client area. It is not offered during the initial VPS order. The Add-on is subscribed for an indefinite duration in successive billing periods. The Customer may cancel at any time through their client area. Cancellation takes effect at the end of the current billing period, without a pro-rata refund, under Article 12.2 of the GT. Cancellation or deletion of the VPS cancels the Add-on. When the Add-on ends, remaining Credit cannot be used, subject to restoration of the historical balance under Article 3.1 upon a new subscription for the same VPS. Deletion of the VPS permanently extinguishes that balance.

9.4 Suspension

Suspension of the VPS under the GT suspends the Add-on without extending the Period or carrying Credit forward.

9.5 Withdrawal

The general conditions for exercising withdrawal rights and obtaining reimbursement are those in Article 6 of the GT, subject to applicable mandatory provisions, including online withdrawal.

Performance before the fourteen (14) day withdrawal period ends requires the Customer’s express request. For the subscription, this request is collected when activating the Add-on in the client area, using an unticked checkbox. For a One-off Intervention, this request is expressly collected in writing in the ticket when accepting the estimate; the Customer also acknowledges in that ticket that the withdrawal right will be lost once the service has been fully performed. PulseHeberg retains the date, wording and contract reference associated with this agreement and provides confirmation to the Customer on a durable medium. Without an express request, performance does not begin until the withdrawal period has expired. This agreement to early performance is separate from the Intervention authorisation under Article 4.3.

On withdrawal, only services actually supplied up to notice of withdrawal are payable, proportionately to the agreed total price under Article L221-25 of the French Consumer Code. Nothing is due on this basis if the express request or legally required information is missing.

For the subscription, the assessment of services supplied is based on Credit actually consumed in each relevant Period: the proportion of that Credit to the Period’s sixty (60) minutes is applied to subscription amounts actually paid and attributable to that Period under the contract being withdrawn from. For annual billing, the amount paid is allocated proportionately between Periods within the year; a complete three-month Period is allocated one quarter of the annual price paid. For monthly billing, only instalments already paid and attributable to the Period are included, without reconstructing an unpaid quarterly price. This assessment is not based solely on elapsed calendar time, is not a separate rate and is capped at amounts paid. It cannot require more than the amount legally due for services actually supplied; if the total price is excessive, the market value of services supplied is used. For this assessment, only minutes of Intervention actually performed under the contract being withdrawn from, up to notice of withdrawal, are taken into account, without the rounding or minimums in Article 3.2. Consumption predating that contract and time merely reserved are excluded.

Example: if one monthly payment of €25 including VAT has been made and 30 minutes of Intervention have actually been performed, €12.50 including VAT remain due for the service supplied (30 / 60 × €25), subject to the legal conditions above.

A One-off Intervention fully performed before the withdrawal period ends loses its withdrawal right only if the consumer previously expressly agreed to performance and acknowledged loss of that right upon full performance, under Article L221-28(1). Performing an Intervention does not end the withdrawal right for a subscription still being performed.

Article 10 - Final provisions

10.1 Changes

PulseHeberg may amend these ST under Article 15 of the GT. Any material amendment is notified to the Customer with at least thirty (30) days’ notice. It takes effect at the start of the first billing period beginning after that notice period expires. A Customer who refuses it may cancel the Add-on before its effective date without penalty.

10.2 Applicable law and disputes

Article 17 of the GT applies.

10.3 Effective date

These ST, version 1.0, take effect on 23/10/2026.