Specific Terms — Managed Services and Web Hosting — Kimoun

Kimoun’s Specific Terms for managed services (infogérance) and web hosting on infrastructure rented from a third-party provider. To be read alongside the General Terms and Conditions.

English translation provided for convenience. This English version is provided as a courtesy and for ease of reading only. In case of any discrepancy, ambiguity, or contradiction between this English translation and the French version, the French version (« CGV — Infogérance et hébergement web ») available at /legals/cgv/cgv-infogerance-hebergement-web/ shall prevail as the sole legally binding reference text.

Usage note. Specific Terms applicable to managed services (in French: infogérance) and web hosting performed by Kimoun on infrastructure rented from a third-party provider. To be read alongside the General Terms and Conditions of Kimoun (common trunk). To be reviewed by a lawyer or legal counsel before publication.

Specific Terms — Managed Services and Web Hosting

Article 1 — Purpose and scope

1.1 Services covered

These Specific Terms (hereinafter “ST”) govern the managed services and web hosting Services performed by Kimoun on infrastructure rented from a third-party provider, including:

the rental, as the underlying infrastructure layer, of infrastructure resources (dedicated servers, virtual servers, cloud instances) from a third-party provider;
the initial installation of the hosting environment (operating system, web services, databases, runtime environments);
the routine administration of the servers and services installed on them;
the corrective and adaptive maintenance of this environment;
the security of the layers administered by Kimoun, in particular the update and patch policy;
monitoring and supervision of the environment;
backups at the server level, according to the terms set out in Article 7;
technical support on the managed hosting environment;
the effective hosting of the Client’s websites, applications and data.

1.2 Eligible audience

These ST apply exclusively to professional Clients within the meaning of Article 2 of the General Terms and Conditions of Kimoun (GTC). They do not apply to consumers within the meaning of the French Consumer Code.

The Client declares that it is contracting for the purposes of its professional, commercial, artisanal, liberal, associative, institutional or administrative activity.

1.3 Articulation with the General Terms and Conditions of Kimoun

These ST supplement the General Terms and Conditions of Kimoun (GTC), which remain applicable for all universal provisions (identification, confidentiality, GDPR, force majeure, subcontracting, assignment, applicable law, jurisdiction).

In case of contradiction between these ST and the GTC, these ST shall prevail, pursuant to Article 3 of the GTC.

Article 2 — Specific definitions

In addition to the definitions in Article 2 of the GTC, the following definitions apply:

Managed services (in French: infogérance): service whereby Kimoun assumes the technical, administrative and operational management of a hosting environment on behalf of the Client, in lieu of internal technical teams.
Underlying infrastructure: all the hardware and network resources (physical servers, virtualisation, storage, bandwidth, power, cooling, physical security of the data centre) provided by a third-party operator, on which the managed services rely.
Infrastructure provider: third-party operator renting to Kimoun the resources of the underlying infrastructure. Unless otherwise stated, Kimoun’s primary infrastructure provider is OVH (OVH SAS, operating under the brand OVHcloud).
Hosting environment: set of software layers installed and administered by Kimoun on top of the underlying infrastructure (operating system, web services, databases, runtime environments, monitoring and backup tools).
Security patch: software fix released by the publisher of a component intended to correct a security vulnerability.
Incident: any event causing a degradation, unavailability, compromise or malfunction of the hosting environment.
RTO (Recovery Time Objective): target time to restore a service after an incident.
RPO (Recovery Point Objective): maximum data loss between the last usable backup and the occurrence of an incident.
Business hours: working days from Monday to Friday (excluding public holidays in Guadeloupe), from 8:00 AM to 5:00 PM local time (UTC-4), unless otherwise stated in the Quote.

Article 3 — Kimoun’s role and underlying infrastructure

3.1 Status as managed services provider

Kimoun acts as a managed services provider. It installs, configures, administers, maintains and supervises the hosting environment on behalf of the Client, on infrastructure that it rents from a third-party provider.

Kimoun is neither the owner nor the operator of the underlying infrastructure: this infrastructure is owned and operated by the infrastructure provider.

3.2 Choice of infrastructure provider

Unless otherwise stated in the Quote, Kimoun rents its infrastructure from OVH. Kimoun may, depending on the Client’s needs, the nature of the services, service continuity or technical conditions, use one or more other infrastructure providers. The provider effectively used for a given Service is communicated to the Client upon request, in the order confirmation, or by any other written means.

3.3 Respective scopes

A clear distinction is drawn between the respective responsibilities of the infrastructure provider, Kimoun and the Client.

Infrastructure provider’s responsibility (OVH or other):

provision of physical hardware (servers, racks, power, cooling);
network connectivity and bandwidth of the infrastructure;
hardware maintenance and replacement of defective components;
physical security of the data centre;
availability of the underlying infrastructure according to its own terms and SLA.

Kimoun’s responsibility:

installation, configuration and administration of the operating system;
installation, configuration and administration of services (web, database, cache, queues, etc.);
application of security patches;
monitoring and supervision of the environment;
management of backups at the server level, according to the terms provided;
management of administrative accesses;
technical support on the administered layers;
coordination with the infrastructure provider in case of hardware incident.

Client’s responsibility:

application code, applications, scripts, CMSs and their extensions;
application updates (CMS, plugins, themes, libraries);
content published online and its legal compliance;
application-level security (in the sense of code and configuration);
management of application user accounts;
compliant use of allocated resources.

Unless expressly stipulated to the contrary in the Quote, Kimoun does not intervene on the Client’s application layer.

Article 4 — Order, activation and lifecycle

4.1 Order

Any order for a managed services and web hosting Service must specify at least:

the nature of the rented infrastructure resources (server type, capacity, options);
the scope of managed services subscribed to (support level, options, on-call service if applicable);
the services to be installed and configured;
the associated domain(s);
the term of the engagement;
any specific options (extended backups, recovery plan, security audits).

4.2 Activation

The effective activation of a hosting environment includes:

the rental and provisioning of the underlying infrastructure by the provider;
the initial installation and configuration by Kimoun;
joint validation of essential parameters with the Client.

The activation timelines indicated are provided for indicative purposes only and depend in part on the provisioning of the infrastructure by the underlying provider.

4.3 Acceptance testing

Upon completion of the installation phase, Kimoun makes the environment available to the Client for acceptance testing. This availability is formally notified to the Client by email with acknowledgement of receipt (or any equivalent traceable means), specifying:

the nature of the environment made available;
the elements to be verified;
the protest period granted;
the consequences of the absence of reservations within this period.

From this notification, the Client has a period of ten (10) business days to formulate any reservations, in writing and with reasons. In the absence of reservations issued within this period and according to this formalism, the entry into service is deemed accepted as is.

Reservations on points clearly outside Kimoun’s administered scope (the Client’s application layer, content, third-party configurations) do not suspend acceptance.

4.4 Environment changes

Any significant change to the environment (server size upgrade, addition of services, scaling, migration to a new infrastructure provider) may be carried out subject to:

technical feasibility;
the Client’s prior agreement when the change implies a tariff change or a scheduled unavailability;
compliance with applicable rules of the infrastructure provider;
a reasonable operational timeframe.

Article 5 — Managed services

5.1 Initial installation and configuration

Kimoun performs the initial installation and configuration of the hosting environment, including:

installation of the operating system;
basic secure configuration (hardening, firewall, SSH access by keys, fail2ban or equivalent);
installation of services necessary for the uses declared by the Client (web server, database, application language, caching services, etc.);
setting up the monitoring system;
setting up the backup mechanism provided;
creation of administrative and user accesses.

5.2 Routine administration

Throughout the duration of the Service, Kimoun ensures the routine administration of the environment, including:

supervision of the proper functioning of the administered services;
routine interventions (service restart, configuration adjustment, log management, disk space management);
access management for administrators;
coordination with the infrastructure provider in case of hardware incident;
production of incident reports upon Client request.

5.3 Security and patch policy

Kimoun applies to the components it administers a structured security update policy:

critical patches (vulnerabilities rated critical by the publisher or by reference sources such as CVE, CERT-FR): deployed as soon as technically possible, and at the latest within seven (7) business days of publication, except in case of justified technical constraint;
major patches: deployed within a planned monthly window;
minor and corrective updates: integrated at the pace of maintenance windows.

When an update requires a service interruption or restart, Kimoun informs the Client in advance and agrees on a suitable maintenance window, except in case of security emergency justifying immediate intervention.

5.4 Monitoring and alerting

Kimoun puts in place automated monitoring of the administered services covering, at a minimum:

the availability of essential web services;
resource usage (CPU, memory, disk, load);
the state of database services;
basic security indicators (intrusion attempts, abnormal events).

Alert thresholds are defined according to current practices and may be adjusted in the Quote. Alerts are processed by Kimoun according to the engagement timelines of Article 6.

5.5 Scope excluded from administration

Unless expressly ordered and invoiced as a service, Kimoun does not provide:

administration of the Client’s application layer (CMS, frameworks, code);
updating of the Client’s applications, extensions and themes;
security of the application code of the Client;
application-level database administration (modelling, optimisation of specific queries, application tuning);
specific developments;
in-depth security audits;
management of major security incidents (compromise, ransomware, data leak).

These services may be the subject of a complementary Quote under the ST Consulting and Web Services, or an amendment to these ST.

Article 6 — Service levels and Kimoun’s commitments

6.1 Scope of commitments

Kimoun’s service level commitments apply exclusively to the layers it administers and to the quality of its intervention. They do not cover the availability of the underlying infrastructure, which falls under the possible commitments of the infrastructure provider.

6.2 Incident response commitments

Unless otherwise stated in the Quote, the commitments for taking over incidents during business hours are as follows:

Incident level	Description	Initial response
Critical	Major unavailability of an essential service	within 8 business hours
Major	Significant degradation or incident affecting an important feature	within 2 business days
Minor	Request or anomaly with no blocking impact	within 8 business days

These timelines correspond to the taking over by Kimoun (analysis and beginning of intervention) and not to the resolution time, which depends on the nature of the incident and sometimes external factors (intervention by the infrastructure provider, component publishers, etc.).

6.3 Out-of-hours on-call service

Out-of-hours on-call service is not included in the standard Service. It may be subject to a dedicated option subscribed to in the Quote, with specific response commitments (typically 1 hour for a critical incident, 24/7).

6.4 Update policy

Kimoun undertakes to comply with the patch policy defined in Article 5.3 and to be able, upon request, to provide its traceability.

6.5 Best-efforts obligation

These commitments are a best-efforts obligation and not a results obligation. Kimoun undertakes to deploy the skills and tools necessary to comply with the announced timelines and policies, without being able to guarantee the total absence of incidents, delays or external events.

Article 7 — Backups and restoration

7.1 Standard backups

Unless otherwise stated in the Quote, Kimoun implements a backup mechanism with the following characteristics:

frequency: complete daily backup of critical data (websites and databases);
retention: conservation of backups for thirty (30) rolling days;
storage: backups stored either on the provider’s infrastructure (dedicated backup space) or on third-party infrastructure depending on the options subscribed to;
indicative RPO: 24 hours;
indicative RTO: 4 business hours for a partial restoration, 1 business day for a complete restoration.

7.2 Extended or specific backups

Extended backup options may be subscribed to in the Quote:

increased frequency (multiple backups per day);
extended retention (90 days, 1 year);
additional off-site storage;
immutable backups (ransomware protection);
Disaster Recovery Plan (DRP) with documented switchover.

7.3 Complementary backups by the Client

The Client is free, and strongly encouraged, to put in place its own backups for strategic data, in addition to those ensured by Kimoun, in particular for data whose loss would be critical.

7.4 Restoration

Any restoration request must be made in writing. Restoration is carried out within the indicative timelines set out in Article 7.1.

Restoration concerns data as backed up on the last usable date: Kimoun does not guarantee the restoration of modifications made after the last usable backup.

Article 8 — Overall service availability

8.1 Availability of the underlying infrastructure

The material, network and energy availability of the infrastructure is the responsibility of the infrastructure provider (OVH or other). When the provider publishes an infrastructure SLA applicable to the rented offer, this SLA applies between the provider and Kimoun, and indirectly benefits the Client.

Kimoun may, upon request, assist the Client in formulating a request for application of the SLA with the infrastructure provider, without being able to substitute itself.

8.2 Availability of layers administered by Kimoun

On the layers administered by Kimoun (system, services, monitoring, backups), Kimoun undertakes a best-efforts obligation within the meaning of Article 6.

No quantified availability rate (such as “99.9%”) is guaranteed by default. A quantified commitment may be negotiated in the Quote for environments with particular criticality.

8.3 Maintenance windows

Planned maintenance windows are announced to the Client in writing with reasonable advance notice. Except in security emergencies, they are positioned outside the Client’s business hours whenever technically possible.

Interventions imposed by the infrastructure provider may result in unavailability without notice. Kimoun informs the Client as soon as it becomes aware.

Article 9 — Excluded services

Unless expressly provided for in the Quote, the following services are excluded from the standard scope and may be the subject of a separate Quote:

specific application development;
application maintenance (CMS, plugins, themes);
in-depth security audit (pentest, code audit);
management of major security incidents (compromise, ransomware, data leak);
migration from or to another provider;
application rewriting, refactoring or optimisation;
urgent intervention out-of-hours (except with on-call service option);
training of the Client’s teams;
Disaster Recovery Plan (DRP);
Business Continuity Plan (BCP);
legal assistance in case of dispute or authority request.

Article 10 — Subscription, prices and payment

10.1 Prices

Prices are indicated in euros, in net amounts. VAT not applicable, Article 293 B of the French General Tax Code.

Prices, managed services plans, options and specific terms are indicated in the Quote, the contract or the order confirmation.

10.2 Composition of the price

The price of the Service may include, where applicable:

the rental of the underlying infrastructure (re-invoiced at cost or included in the package);
the managed services proper;
the subscribed options (extended backups, on-call service, DRP, etc.).

10.3 Term and renewal

Unless otherwise stipulated:

the Service is concluded for a firm duration specified in the Quote, generally annual;
it is tacitly renewed for equivalent periods, except in case of termination by either Party subject to a notice period of three (3) months before the expiration date, by email with acknowledgement of receipt or registered letter.

10.4 Tariff evolution

Kimoun may pass on to the Client the tariff evolutions applied by the infrastructure provider (variation in wholesale rental rates, change of commercial model, removal of an offer). Any evolution is notified to the Client in writing with reasonable advance notice and takes effect, at the earliest, at the next renewal due date.

10.5 Payment terms

Unless otherwise stipulated in the Quote, invoices are payable within 30 days net from the date of issuance, by bank transfer.

10.6 Consequences of late payment

Any late payment results, without prejudice to amounts still due, in:

suspension of pending requests handling;
possible suspension of services;
application of late payment penalties at a rate of three (3) times the legal interest rate in force;
the fixed legal indemnity for recovery costs of €40, pursuant to Article L.441-10 of the French Commercial Code.

Article 11 — Support and incident management

11.1 Support channels

Support is provided by email at oliver@kimoun.com. Depending on the scope subscribed to, an additional channel may be set up (Slack, ticketing platform).

11.2 Support levels provided by Kimoun

Level 1 (L1): qualification, orientation, administrative requests, standard accompaniment.
Level 2 (L2): system and services administration, intervention on the environment, resolution of incidents on the administered layers.

11.3 Coordination with the infrastructure provider

Incidents falling strictly within the underlying infrastructure (hardware failure, network unavailability at the provider level, intervention in the data centre) are escalated by Kimoun to the infrastructure provider and followed up according to its terms. Kimoun ensures the information relay to the Client.

11.4 Timelines and commitments

The response timelines are defined in Article 6.2.

11.5 Out of scope of standard support

Standard support does not include:

interventions outside business hours without on-call service option;
intervention on the Client’s application layer;
management of major security incidents;
legal services.

Article 12 — Client’s obligations and prohibited uses

12.1 Client’s obligations

The Client undertakes to:

provide accurate, complete and up-to-date information;
comply with the applicable rules of the infrastructure provider (in particular OVH’s AUP);
preserve the confidentiality of its accesses, identifiers and passwords;
maintain the up-to-date status of the application components for which it is responsible;
not exceed the resources allocated to the subscribed plan;
promptly report any anomaly, incident, compromise, information leak or unauthorised use;
carry out its own backups for strategic data;
respond promptly to requests for validation, justification or information necessary for service continuity or security.

12.2 Prohibited uses

The Client shall not use the services administered by Kimoun for:

sending spam or unsolicited bulk emails;
engaging in phishing, identity theft or fraud;
distributing malicious software;
hosting, redirecting or promoting manifestly illegal content;
circumventing security measures, conducting intrusions, abusive scans or unauthorised penetration tests;
conducting crypto-asset mining operations that divert the resources made available;
consuming resources abnormally or abusively;
harming the image, security or infrastructure of Kimoun, the infrastructure provider or their providers.

In case of manifestly illicit, abusive, dangerous or non-compliant use, Kimoun and/or the infrastructure provider may suspend all or part of the services, without notice where urgency or security so requires.

Article 13 — Suspension and termination

Kimoun, directly or through the infrastructure provider, may suspend or terminate all or part of the Services in case of:

unpaid invoices;
breach of these ST, the GTC or the applicable rules of the infrastructure provider;
abusive, fraudulent, dangerous or illicit use;
false, incomplete or non-updated information;
threat to the security of the platform or third parties;
decision by an administrative, judicial or regulatory authority;
unilateral decision of the infrastructure provider.

When the suspension or termination is imposed by the infrastructure provider, Kimoun cannot oppose it.

Termination does not give rise to refund of fees already incurred, services already performed, periods already started or amounts due to the infrastructure provider, unless otherwise agreed in writing or required by mandatory legal provision.

Article 14 — Security and access

14.1 Measures implemented by Kimoun

Kimoun implements, on the layers it administers, reasonable measures in line with industry practices, in particular:

hardening of operating systems;
access management via SSH keys and strong authentication;
implementation of firewalls and anti-bruteforce mechanisms;
environment separation when relevant;
encryption of sensitive transmissions;
security update policy (Article 5.3);
monitoring of security events (Article 5.4).

14.2 Client’s responsibility

The Client remains responsible for:

the security of its applications, code, scripts, CMSs and their extensions;
the update of its application components;
the security of its workstations and accesses;
the confidentiality of identifiers and keys provided to it;
the security of the data it handles within its applications.

The Client must promptly report any suspected compromise, identity theft, diversion, information leak or unauthorised use.

Article 15 — Restitution of data and end of service

15.1 Notice and continuity

At the end of the Service, whether termination by the Client, by Kimoun or by the infrastructure provider, the Client is invited to anticipate the migration and backup of its data within a reasonable timeframe before the effective cessation of service.

15.2 Export and portability

During the duration of the Service, the Client may, at any time, request:

an export of the hosted data, sites and databases;
a copy of the available backups;
an environment documentation (configuration, installed services, essential parameters) for migration purposes.

These operations may be subject to invoicing on a time-spent basis according to the Quote or the prevailing rate.

15.3 Deletion after cessation

After service cessation, unless otherwise agreed in writing:

the hosted data may be retained for thirty (30) days within the environment, to allow for any final recovery;
beyond this period, the environment is dismantled and the data deleted irreversibly.

The Client acknowledges that data loss after deletion may be definitive and that the Client is solely responsible for prior backup.

15.4 Exit support service

When the Client wishes to be accompanied in the migration of its environment to another provider, this service is the subject of a separate Quote and is not included by default in these ST.

Article 16 — Personal data

16.1 Reference to the General Terms and Conditions

The processing of personal data by Kimoun is governed by Article 5 of the General Terms and Conditions of Kimoun, supplemented by the Kimoun Data Processing Agreement (DPA). The provisions below specify the particularities of the managed services and web hosting.

16.2 Capacity of the Parties

When the environment administered by Kimoun processes personal data on behalf of the Client (under an application, website or database of the Client), Kimoun acts as a processor within the meaning of the GDPR, and the infrastructure provider acts as a sub-processor for the provision of the hardware infrastructure.

The Client expressly authorises the use of the infrastructure provider (OVH or other) as a sub-processor. This authorisation supplements the provisions of Articles 5.2 and 7 of the GTC and is detailed in the Kimoun DPA.

16.3 Data location

Unless otherwise stated in the Quote, data is stored in the European data centres of the infrastructure provider (in practice, in France or in the European Union for OVH centres). The Client is informed that certain technical operations (administration, support, supervision) may occasionally involve accesses from other countries.

16.4 Security measures

The technical and organisational measures relating to data security are implemented by Kimoun on the layers it administers (Article 14), and by the infrastructure provider on the underlying infrastructure.

Article 17 — Liability

17.1 Best-efforts obligation

Kimoun is bound by a best-efforts obligation on the layers it administers, within the limits of the service level commitments of Article 6.

17.2 Specific exclusions

Kimoun shall not be held liable:

for interruptions, unavailabilities, failures or slowdowns affecting the underlying infrastructure, when attributable to the infrastructure provider;
for decisions, modifications, suspensions or terminations imposed by the infrastructure provider;
for maintenance windows scheduled or not by the infrastructure provider;
for vulnerabilities, defects, malfunctions or compromises affecting the Client’s applications, code, CMSs, extensions, themes or content;
for data loss resulting from a lack of backup by the Client, when such backups were the Client’s responsibility;
for a misconfiguration of the Client’s applications, websites or DNS records;
for misuse of services by the Client or its users;
for indirect damage (loss of revenue, damage to image, loss of clientele, loss of opportunity);
for the non-compliance of a site or hosted content with the legal provisions applicable to the Client’s sector of activity.

17.3 Liability cap

For professional Clients, Kimoun’s total liability, all damages and all causes combined, is limited to the amount effectively paid by the Client for the relevant service over the twelve (12) months preceding the triggering event.

This limitation does not apply in case of gross fault, wilful misconduct, bodily harm or any contrary mandatory legal provision.

Article 18 — Force majeure (reference to the General Terms and Conditions)

The provisions of Article 6 of the General Terms and Conditions of Kimoun apply in full to these ST. The following events in particular constitute events of force majeure or equivalent events, without this list being exhaustive:

a failure or disaster affecting the infrastructure of the underlying provider;
a disaster in a data centre of the infrastructure provider;
a large-scale cyberattack affecting the infrastructure or administered components;
a “zero-day” vulnerability of a major component, in the first hours preceding the availability of the patch;
a general internet outage or telecommunications networks failure;
an administrative, judicial or regulatory decision affecting the infrastructure provider;
an external technical blockage imposed by a third-party operator.

Article 19 — Language and translation

These ST are drafted in French. An English translation may be provided for informational, courtesy and convenience purposes for English-speaking Clients.

In case of divergence, ambiguity or contradiction between the French version and its English translation, the French version shall prevail alone and constitutes the contractual reference text.

Article 20 — Archiving and evidence

Email exchanges, Quotes, contracts, invoices, confirmations, technical logs, incident reports and management data may be used as evidence.

The Parties acknowledge the validity of email validations, scanned handwritten signatures and electronic signatures, subject to applicable legal rules.

Article 21 — Articulation with the General Terms and Conditions of Kimoun

These ST are read in conjunction with the General Terms and Conditions of Kimoun (GTC), which remain applicable for all universal provisions not covered here, in particular:

confidentiality (Article 4 of the GTC);
personal data protection, supplemented by Article 16 of these ST (Article 5 of the GTC);
force majeure, supplemented by Article 18 of these ST (Article 6 of the GTC);
subcontracting, supplemented by Article 16.2 of these ST (Article 7 of the GTC);
assignment of contract (Article 8 of the GTC);
modification of the GTC (Article 9 of the GTC);
no waiver and severability (Articles 10 and 11 of the GTC);
amicable resolution, applicable law and competent jurisdiction (Article 12 of the GTC).

In case of contradiction between these ST and the GTC, these ST shall prevail.

Reminder. This English version is provided as a courtesy translation only. The French version of these Specific Terms is the sole legally binding reference text. In case of any conflict between the two versions, the French version shall prevail.

Kimoun Specific Terms — Managed services and web hosting — version 1.01 — entered into force on 28 April 2026
Kimoun — Route de Boisvin, 97160 Le Moule — SIRET 477 746 275 00031 — oliver@kimoun.com — kimoun.com

On this page: