The NetFUNNEL Support Plan and Service Level Agreement ("SLA") applies in accordance with the NetFUNNEL License Agreement ("Agreement") between STCLab and the Customer. This SLA applies to customers using the NetFUNNEL SaaS subscription.

Furthermore, STCLab's support obligations are subject to conditions including the Customer's reasonable cooperation and timely payment. STCLab reserves the right to update or modify the terms of this SLA in accordance with the Agreement. In the event of a conflict between the policies of this SLA and the Terms of Service on https://netfunnel.io or other policies, the policies of this SLA shall prevail, but only to the extent of such conflict.

Service Commitment

STCLab will use commercially reasonable efforts to make NetFUNNEL available with a Monthly Uptime Percentage of 99.5% in the operating environment. If NetFUNNEL fails to meet the Monthly Uptime Percentage target of 99.5% in the production environment for a given month, you may be eligible for compensation as described in the "Compensation Policy" below.

Monthly Uptime Percentage

NetFUNNEL determines SLA compliance based on the Monthly Uptime Percentage calculation below.

Calculation Method

Monthly Uptime % = 100 * (Total Monthly Service Minutes - Unavailable Time) / (Total Monthly Service Minutes - Allowable Downtime)

Definitions

• Unavailable Time: Means the time when access to the NetFUNNEL service is not possible. "Allowable Downtime" is not considered Unavailable Time.
• Allowable Downtime: Means the time NetFUNNEL service is interrupted due to the following reasons:
  • Customer system or infrastructure failure.
  • Customer system or infrastructure failure.
  • Abnormal use of the service by the Customer.
  • Failure of third-party infrastructure used by STCLab or the Customer (e.g., AWS, Google, Microsoft, or other server/cloud infrastructure and general infrastructure) that is difficult to attribute to STCLab's negligence or breach of contract.
  • Force Majeure events.
  • Scheduled Downtime (See "Scheduled Downtime" below for details).

Compensation Policy

If the Monthly Uptime Percentage is less than 99.5%, STCLab will grant an additional period of use to the Customer's account based on the contracted license. Depending on the Monthly Uptime Percentage range, the Additional Period of Use or Monetary Credit Compensation provided to the Customer is as follows:

(Note: The Customer must select one of the two compensation policies at the time of the contract. Once selected, the compensation policy cannot be changed during the contract period.)

1. Additional Period of Use

• If charges are incurred during the additional use period, such charges will not be billed.
• The additional use period is available only for the Customer's account and cannot be refunded for cash.
• The additional use period cannot be transferred to another account.

2. Monetary Credit Compensation

• < 99.5%: A 10% discount of the amount paid for that month will be applied to the next contract renewal.
• < 99.0%: A 25% discount of the amount paid for that month will be applied to the next contract renewal.
• < 95.0%: A 100% discount of the amount paid for that month will be applied to the next contract renewal.

Calculation Method: This method applies a deduction equal to the percentage of the billing amount for the month in which the issue occurred. Example: If a 1-year contract is 120, and the service fails to meet the 99.5% target in a specific month, 10% of that month's amount (12), which is 1.2, will be deducted from the next billing.

Compensation Claim and Grant

• The Customer must apply for compensation within thirty (30) days after the end of the month in which the Monthly Uptime Percentage fell below one of the thresholds listed above.
• A support case for the relevant incident must have been created so that the impact can be verified.
• To claim compensation, the Customer must contact an STCLab sales representative.
• If a valid claim is submitted, STCLab will apply the compensation to the invoice for the following month.

Service Downtime

The definition of Scheduled Downtime under the SLA between the Company and the User is as follows:

Scheduled Downtime

• Notice: Scheduled Downtime must be notified at least 3 days (72 hours) in advance.
• Method: Notification will be made via the Customer email registered to the User account and the NetFUNNEL console.
• Content: The notice will include the downtime schedule, expected duration, reason for the interruption, and any necessary actions.
• Impact: Service interruption is expected during Scheduled Downtime. Users cannot use the service during this time.

The Additional Period of Use under this SLA is the exclusive remedy for unavailability (excluding cases of willful misconduct or gross negligence). Notice and support hours operate based on KST (Korea Standard Time), but notices for Japan Region customers will be provided in both KST and JST.

Service Support Hours

Service support hours are defined as follows:

• Basis: Calculated based on Business Hours.
• Business Hours: Means the time during Business Days.
• Business Days: Monday through Friday, 9:00 a.m. to 6:00 p.m. KST. (Excluding Korean national holidays).
• Response Time: The initial response time specified in the Plan contracted by the Customer is calculated based on the Service Support Hours defined in this document.

User Data Ownership

The Customer retains ownership of all data created, collected, and stored during the use of the Service. The Provider may not access, use, disclose, or provide the Customer's data to third parties, nor use the data without the Customer's explicit consent (written or electronic).

Data Storage Location

• Location: Customer data is stored on servers located in the AWS Data Center (Tokyo).
• Change Notice: The Provider must notify the Customer at least 30 days in advance if the data storage location changes.
• Data Type: Applies only to Non-Personal Information (Operational Data).

Data Migration

Upon service termination or at the Customer's request, the Provider will support the migration of Customer data in a safe and efficient manner.

• Data migration will be provided in a format designated by the Customer.
• All costs associated with the migration procedure will be borne by [STCLab].
• Requests for data migration must be submitted in writing or electronically, and the Provider will complete the migration within 30 days of receiving the request.
• Appropriate protective measures will be taken during the migration process to ensure data integrity and prevent data loss.

Data Protection Methods

The Provider applies the latest security technologies and standards to protect Customer data, including but not limited to:

• Encryption: Data in transit and at rest is protected using strong encryption technologies (e.g., AES-256).
• Access Control: Access to Customer data is strictly managed under the principle of least privilege, and only authenticated users are granted access. Access logs are retained for at least 6 months.
• Backup: Data is backed up regularly to prevent loss. Backup data is protected using the same security standards as primary data, with a backup frequency of at least once per week.
• Security Audits: Regular security audits are conducted to identify and remediate system vulnerabilities. Audit results are shared with the Customer.
• Intrusion Detection & Prevention: Real-time Intrusion Detection and Prevention Systems (IDS/IPS) are operated to monitor and respond to abnormal access and activities.

Data Breach Response

• Notification: In the event of a data breach, the Provider will notify the Customer immediately (within a maximum of 24 hours).
• Action: The Provider will take all necessary measures to identify and protect the leaked data.
• Follow-up: After the breach, the Provider will investigate the cause and submit an improvement plan to the Customer to prevent recurrence. Response procedures must comply with relevant legal standards.

Data Handling Upon Expiration or Termination

Upon expiration or termination of the Agreement, personal information held in connection with the provision of the Service will be completely deleted in accordance with Article 16 of the Enforcement Decree of the Personal Information Protection Act, the Standards for Measures to Ensure the Safety of Personal Information, and Notice No. 2021-2 of the Personal Information Protection Commission.

• (Note: Currently, [Responsible Entity] does not handle personal information and only handles Non-Personal Information (Operational Data).)
• Retention: Upon contract expiration, all service-related data is retained for 28 days by default according to the service usage policy, after which it is completely deleted. Upon a separate request from the Customer, data will be deleted immediately upon contract expiration.
• Method: When deleting data, the Provider will completely delete the data, including all backups and copies, in an irreversible manner.

Third-Party or Subcontractor Relationships

We entrust some of the tasks necessary for service provision to external companies and manage/supervise the entrusted companies to ensure compliance with relevant laws and regulations.

• We do not process personal information in the Japan Region; this Service processes only operational data.
• Data is stored and processed within the Japan (Tokyo) Region, and there is no overseas transfer.
• Subprocessor (AWS): Processes only non-personal information in the Japan Region.
• Notice: Notification will be given at least 30 days prior to changing or adding a Subprocessor. The Customer may raise an objection if there are reasonable grounds.

Use of Cloud Server

Customer Obligations

1. Reporting: Upon discovering an issue, the Customer must immediately contact STCLab via "Inquiry" within NetFUNNEL or at support@stclab.com. A Support Case is created when STCLab receives a support inquiry.
2. Contact Information: The Customer must designate at least one primary contact and one alternate contact to receive support services provided by STCLab under this Agreement.
3. Cooperation: The Customer must cooperate to improve STCLab's service support performance. This includes, but is not limited to, providing all information requested by STCLab for diagnosis or action in a timely manner and implementing corrective actions requested by STCLab.