DORA ADDENDUM - VERSION 2026-10-19
DORA Addendum
IMPORTANT - READ CAREFULLY: This DORA addendum to the EULA ("DORA Addendum") is a legal agreement between the customer ("Customer") (either an individual or a single entity) and DbVis Software AB ("DbVis"), which covers your use of the Software. Customer and DbVis are hereinafter individually referred to as a "Party" and jointly as the "Parties".
Introduction
Capitalised terms used in this Addendum shall have the meaning ascribed to such terms in this Addendum or in the Agreement.
Background
A. The Customer confirms that it is a “financial entity” subject to DORA.
B. DbVis has been engaged or is about to be engaged by Customer for the supply of the on-prem software program DbVisualizer in binary form, including its documentation and any third party software programs that are owned and licensed by parties other than DbVis and integrated with or made part of the software (the "Software"), pursuant to one or more agreements with Active Subscriptions between the Parties, (collectively, the "Agreement").
C. The Software constitute "ICT services" under the DORA. The Competent Authority applies and has integrated the DORA into its administrative practice and regulatory approach, in order to contribute to supervisory convergence at a European level.
D. Hence, for the purpose of bringing the Agreement into compliance with the DORA, the Parties have agreed to supplement or (as applicable) amend the Agreement by concluding this Addendum on the following terms and conditions.
1. General Principles
1.1 Definitions
Capitalised terms used in this Addendum shall have the meaning set out below or the meaning ascribed to such terms in the Agreement.
"Active Subscription" means a current, paid subscription licence held by Customer under the Agreement (as evidenced by the applicable License Certificate).
"Addendum" means this addendum.
"Agreement" means one or more agreements (i.e. end user license agreements) between DbVis and Customer relating to the supply of the Software, as referenced in the introductory section of this Addendum.
"Applicable Law" means all binding laws and regulations that are generally applicable to DbVis and the Software.
"Competent Authority" means the authority that supervises the Customer, such as any resolution authority.
"Customer" is defined in the introductory section of this Addendum.
"Customer Data" means all data and materials processed by the Software.
"DbVis" is defined in the introductory section of this Addendum.
"DORA" means Regulation (EU) 2022/2554 on digital operational resilience for the financial sector.
"GDPR" means the General Data Protection Regulation (2016/679).
"ICT-related Incident" means a single event or a series of linked events unplanned by the Customer that compromises the security of network or information systems of the Software and that have an adverse impact on the availability, authenticity, integrity or confidentiality of Customer Data or on the services provided by the Customer.
"Online Features" means the functionalities through which the Software may communicate with DbVis under certain conditions (e.g. updates).
"Party" or "Parties" is defined in the introductory section of this Addendum.
"Premium Support" means an Active Subscription (e.g. DbVisualizer Pro Premium Support (or an equivalent tier)) that provides Support Entitlement throughout the full subscription period, as set out in the then-current commercial terms.
"Software" is defined in item A of the background section.
"Support Entitlement" means Customer’s contractual right to receive support from DbVis (if any) under the applicable licence tier and the then-current commercial terms (e.g., as set out in the License Certificate, order form, or other written purchase documentation).
1.2 Order of priority
No terms of this Addendum shall override other provisions of the Agreement except to the minimum extent necessary to comply with DORA or explicit written instruction from a Competent Authority. Subject to the foregoing, DbVis shall have the right to amend the terms of this Addendum from time to time, in accordance with any amendment or variation rights contained in the Agreement, provided that any such amendment does not reduce the level of compliance with DORA.
1.3 Proportionality and Limitation
All rights, obligations, and requirements set out in this Addendum shall be construed in accordance with DORA’s proportionality principle. Nothing in this Addendum shall require DbVis to provide any assistance, cooperation, or information to a greater degree than is strictly required by DORA.
1.4 Active Subscription and Support Entitlement
This Addendum is applicable only while Customer has an Active Subscription. Any commitment under this Addendum beyond (i) regular Software updates made available under the Active Subscription, and (ii) general security alerts where DbVis becomes aware of a security incident affecting the Software or Online Features, is applicable only while Customer has Support Entitlement. If Customer requires Support Entitlement throughout the subscription period, Customer must subscribe to DbVisualizer Pro Premium Support (or an equivalent tier).
2. Description of the Software and Online Features
2.1 On-prem Software model
DbVis licenses the Software to Customer. The Software is installed, run and administered by Customer in Customer’s own environment. DbVis does not host, operate, manage, or have access to Customer’s systems or the data handled by the Software. The Customer acknowledge and accept that DbVis will not be responsible for Customer's use of the Software in its environment. A detailed description of the Software is available on DbVis's website, as adjusted from time to time.
2.2 Online Features
The Online Features are provided via DbVis-controlled systems and may involve the processing of limited customer data related to support matters.
3. Data Location
3.1 Customer acknowledge that the on-prem Software model means that the Customer, in its sole discretion, chose where to process the Customer Data, as the data generated by the Software is processed in the Customer’s environment.
3.2 For the avoidance of doubt, Customer remains responsible, and DbVis takes no liability for the location of the Customer Data.
4. Information Security
4.1 DbVis shall implement and maintain appropriate information security measures to protect the availability, authenticity, integrity and confidentiality of Customer Data when utilizing the Online Features. Information on DbVis's information security measures is available as Schedule A -Information Security to qualified parties under NDA.
4.2 The Customer acknowledge that DbVis access to Customer Data is limited to customer support related matters. In such support related matters, DbVis shall ensure that only such personnel that have a strict need to access ("need to know") any Customer Data will have access to said Customer Data.
4.3 For the avoidance of doubt, Customer remains responsible, and DbVis takes no liability, for security controls in Customer’s own environment (including endpoints, network controls, identity/access management, and database security) where the Software is installed and operated.
5. Access to Customer Data
5.1 Customer acknowledge that the on-prem Software model means that the Customer is secured Customer Data access through the setup, as the data generated by the Software is processed in the Customer’s environment.
5.2 For the avoidance of doubt, DbVis cannot ensure access, recovery or return of data handled locally by the Software in Customer’s environment.
6. Service Levels & Support and Updates
6.1 Customer acknowledge that no uptime or availability commitment is given for the on‑prem Software in Customer’s environment.
6.2 DbVis shall notify Customer of any developments that might have a material impact on DbVis's ability to effectively maintain the function or security of the Software or the Online Features and of any intended material changes to subcontracting arrangements for Online Features.
6.3 For the avoidance of doubt, the applicability and scope of DbVis’ commitments under this Addendum are subject to Clause 1.4.
7. Incident Reporting
7.1 DbVis shall provide assistance to Customer at no additional cost, or at a cost determined ex-ante, when an ICT-related Incident occurs that is related to the Software provided to Customer, by:
(a) assisting Customer in its classification of ICT-related Incidents occurred;
(b) assisting Customer in its reporting of major ICT-related Incidents occurred to Competent Authorities; and
(c) assisting Customer in its dealing with feedback from the Competent Authorities;
as required by DORA.
7.2 For the avoidance of doubt, incidents occurring solely in Customer’s local environment is outside DbVis’s operational control, and DbVis’s ability to assist is limited by the absence of access to Customer’s systems or local data.
8. Digital Resilience Training & Audit Rights
8.1 Digital Resilience Training
8.1.1 DbVis’s participation in Customer’s ICT security awareness or resilience training programmes shall be subject to (a) a minimum of three months’ prior written notice, (b) no more than once per calendar year, (c) DbVis’s right to designate which staff may participate, and (d) payment by Customer of DbVis’s reasonable costs (including opportunity cost and travel, if any).
8.1.2 DbVis is not obliged to disclose proprietary or commercially sensitive information, nor to agree to non-standard contractual obligations or be bound by non-negotiated training materials.
8.2 Audit Rights
8.2.1 DbVis’s cooperation with Customer’s audit requests relating to the Online Features and DbVis-controlled supporting systems (and DbVis’s software update/patch management processes) shall be subject to (a) minimum of three months' prior written notice, (b) no more than once per calendar year unless required by a Competent Authority, (c) DbVis’s right to require that any audit is performed in accordance with a risk-based approach and commonly accepted audit standards, and (d) payment by Customer of DbVis’s reasonable costs (including internal time and opportunity cost and, if applicable, travel).
8.2.2 DbVis is not obliged to disclose proprietary or commercially sensitive information beyond what is strictly necessary for the audit and may propose alternative assurance measures where appropriate (e.g., providing relevant compliance/security documentation).
9. Sub-Outsourcing
9.1 DbVis may sub-outsource to any subcontractor the performance or supply of tasks, features or functions, provided DbVis remains responsible for its obligations under this Addendum.
9.2 DbVis shall use best efforts to notify the Customer of any planned change of subcontractors at least 15 days in advance. The Customer’s continued use of the Software (and/or impacted Online Feature(s)) after such notice shall constitute acceptance of the change of subcontractors.
9.3 In the event the Customer cannot accept the change of subcontractors, it shall be entitled to terminate the Software (and/or the impacted Online Feature(s)) with immediate effect.
10. Co-operation with Authorities
10.1 In the event that any Competent Authority requests information relating to Customer's use of the Software, Customer will at its own cost and expense, use all commercially reasonable efforts to resolve that request directly with the Competent Authority by using the standard features of the Software and the information and documents provided by DbVis to Customer. For this purpose, DbVis acknowledges and understands that information and documentation, which DbVis submits to Customer under the Agreement may have to be submitted to a Competent Authority and DbVis consents to such submission.
10.2 However, if Customer is unable to resolve the request from the Competent Authority on its own using all commercially reasonable efforts, then Customer may request DbVis to participate in resolving the request. DbVis agrees to do so and will fully co-operate to assist Customer with resolving the request.
11. Termination
11.1 Termination rights of Customer
11.1.1 Customer is entitled to terminate the Agreement (and/or the impacted Online Feature(s)) with immediate effect (without any compensation being required to DbVis save for fees and charges that are payable up until the termination) in the following situations:
(a) Customer identifies circumstances through monitoring that are deemed capable of negatively altering the performance of the Software including but not limited to material changes that affect the DbVis or any impediments capable of altering the performance of the Software;
(b) where DbVis demonstrates evidenced weaknesses in DbVis’s overall ICT risk management including but not limited to how DbVis ensures the availability, authenticity, integrity and confidentiality of Customer Data; and
(c) where a Competent Authority can no longer effectively supervise Customer as a result of the conditions of, or circumstances related to the Software, the Agreement or this Addendum or where such termination is instructed or required by a Competent Authority.
11.1.2 The Customer is not entitled to claim any refunds for fees and charges under the Agreement in the event of a termination under Clauses 9.3 or 11.1.1.
11.1.3 The Agreement shall include termination rights and related minimum notice periods in accordance with the expectations of Competent Authorities and resolution authorities.
11.2 Data retention
11.2.1 Without prejudice to GDPR or any other Applicable Law on data protection applicable in the EU/EEA, DbVis shall ensure, according to Customer's instructions, that all Customer Data will either be permanently deleted or erased and/or returned to Customer within thirty (30) days following the termination or expiration of the Agreement. Notwithstanding the foregoing, DbVis shall be entitled to retain the Customer Data where required under any Applicable Law applicable in the EU/EEA.
11.2.2 For the avoidance of doubt, DbVis cannot delete or return data that is created, stored or otherwise handled locally by the Software in Customer’s own environment, because DbVis has no control over, or access to, such data.