The contract terms the EU's Digital Operational Resilience Act requires, for customers that are financial entities.
Last Updated: October 2026 | Version: 1.0
This Addendum supplements the Agreement between Oneiros Vision and a Customer that is a financial entity within the meaning of Article 2(1) of Regulation (EU) 2022/2554 (DORA). It applies from the date the Customer tells Oneiros Vision so in writing (Terms, clause 22.11), and it prevails over the Terms on the matters it governs. Part A applies to every such Customer. Part B applies only from the date the Customer tells Oneiros Vision in writing that it uses the Service to support a critical or important function (DORA Article 3(22)).
Oneiros Vision, as ICT third-party service provider: Oneiros Vision Research S.R.L., CUI 51610020, EUID ROONRC.J2025025914004, trading as Oneiros Vision. The change of the company's registered name to Oneiros Vision Research S.R.L. is being entered in the trade register; its registration code and trade register number stay the same. It holds no Legal Entity Identifier (LEI) at the date of this version.
A1. The Service, and subcontracting (Article 30(2)(a)). The Terms and the Documentation describe the Service. Oneiros Vision subcontracts the hosting of the Service and its database (Hostinger, Germany), its transactional e-mail (Hostinger) and its encrypted off-site backup (Backblaze, Netherlands), as Annex III of the DPA lists; clause 6 of the DPA governs changes to them, which are announced 30 days ahead. It does not subcontract the running of the Service, the computation of its Outputs or its support.
A2. Locations (Article 30(2)(b)). The Service runs in Germany. Encrypted backups are held in the Netherlands and on the operator's encrypted workstation, which stays in the European Economic Area or in Switzerland. Oneiros Vision tells the Customer at least 30 days in advance before it moves any of these to another country.
A3. Protection of data (Article 30(2)(c)). Oneiros Vision protects the availability, authenticity, integrity and confidentiality of the Customer's data, including personal data, through the measures in Annex II of the DPA and Schedule 1 of the Terms.
A4. Access, recovery and return of data (Article 30(2)(d)). The Customer can export its data at any time (Terms, Schedule 3). If Oneiros Vision becomes insolvent, is resolved, discontinues its business, or the Agreement ends, the Customer's data is returned in the formats of Schedule 3, in an easily accessible format, and remains retrievable for at least 30 days. Oneiros Vision keeps written procedures for restoring the Service from its backups and for producing those exports.
A5. Service levels (Article 30(2)(e)). The service levels are those in Schedule 1 of the Terms, with their updates and revisions. Oneiros Vision gives 30 days' notice of any revision that lowers a service level.
A6. Help with ICT incidents (Article 30(2)(f)). When an ICT incident affects the Service the Customer receives, Oneiros Vision helps the Customer at no additional cost. It gives the information the Customer needs to classify and report the incident under Articles 17 to 23 of DORA, without undue delay and within 24 hours of becoming aware of the incident; where the incident makes the Service unavailable, within 4 hours on Business Days between 09:00 and 18:00 Central European Time. It updates the Customer as the incident develops, and gives a written account of the cause and the remedy.
A7. Cooperation with authorities (Article 30(2)(g)). Oneiros Vision cooperates fully with the Customer's competent authorities and resolution authorities, and with the persons they appoint.
A8. Termination (Article 30(2)(h) and Article 28(7)). The Customer may end the Agreement by written notice, with effect on the date it chooses, where:
Oneiros Vision refunds, pro rata, the Fees paid for the period after the end. Its own minimum notice to end the Service is 90 days (Terms, clause 11.5).
A9. Security awareness and training (Article 30(2)(i)). On reasonable request, the people at Oneiros Vision who work on the Service take part in the Customer's ICT security awareness programmes and digital operational resilience training (Article 13(6)), at times and in a form agreed; anything beyond one session a year is at the Customer's cost.
A10. Information for the register (Article 28(3); Implementing Regulation (EU) 2024/2956). Oneiros Vision gives the Customer, and keeps current, the information its register of information needs: legal name, country, EUID and, once obtained, LEI; the type of ICT service; the locations in clause A2; and the subcontractors in clause A1.
B1. Service levels with targets (Article 30(3)(a)). The quantitative targets of Schedule 1 of the Terms (availability, support response and recovery) are the full service level description. Oneiros Vision reports monthly availability on request, and proposes corrective action within 10 Business Days of a missed target.
B2. Notice of developments (Article 30(3)(b)). Oneiros Vision notifies the Customer without undue delay of any development that might have a material impact on its ability to provide the Service effectively and in line with the agreed service levels, including a change of control, the loss of a key person, the loss of a data source, a change of hosting provider or an insolvency event.
B3. Contingency and security (Article 30(3)(c)). Oneiros Vision maintains a business contingency plan for the Service, tests it at least once a year, runs a restore drill at least every quarter, keeps security measures, tools and policies appropriate to the Customer's regulatory framework, and gives the Customer a summary of each year's test results.
B4. Threat-led penetration testing (Article 30(3)(d)). Oneiros Vision takes part in, and cooperates fully with, the Customer's threat-led penetration testing under Articles 26 and 27 of DORA, on terms agreed in advance to protect other customers.
B5. Monitoring, access, inspection and audit (Article 30(3)(e)).
B6. Exit and transition (Article 30(3)(f) and Article 28(8)). On any ending of the Agreement, the Customer may require a transition period of up to three months, during which Oneiros Vision continues to provide the Service at the Fees then in force, so as to reduce the risk of disruption and to let the Customer migrate to another provider or to its own systems. This is in addition to the switching rights in Schedule 3 of the Terms.
B7. Subcontracting (Delegated Regulation (EU) 2025/532). Oneiros Vision gives at least 30 days' notice of any material change to the subcontracting of the Service, lets the Customer assess and object to it, and does not implement the change before the end of the notice period while an objection stands. If the parties cannot resolve an objection, the Customer may end the Agreement under clause A8.
B8. Insurance and continuity. On request, Oneiros Vision states in writing its insurance cover and its continuity arrangements, including who can operate or hand over the Service if its operator is unavailable.
This Addendum may be signed electronically.