Swazzy Information Technology Maintenance Agreement (ITMA) & SLA Version 1.1

1. Introduction

This Information Technology Maintenance Agreement (ITMA) sets out the terms under which Swazzy Pty Ltd (ABN 29 897 020 065) ("Swazzy", "we", "us") delivers IT maintenance, managed services, and support to the Client ("you"). It also functions as Swazzy’s baseline Service Level Agreement (SLA) for our general customer base.

2. Objectives

• Define clear service scope, standards, and performance targets.
• Outline responsibilities for Swazzy and the Client.
• Measure and report service performance for accountability.
• Protect confidentiality, integrity, and availability of systems and data.
• Continuously improve service quality and client outcomes.
• Align to ITIL 4 and ISO/IEC 20000-1 service management principles.

2A. Service Management Governance

• Service Catalogue — A catalogue of covered services and SLAs is maintained and referenced by this Agreement.
• CMDB Linkage — Configuration items and dependencies are recorded in Swazzy's CMDB; changes update CI records.
• Lifecycle — Services follow design → transition → operation → continual improvement with gates and reviews.
• Auditability — Processes are aligned to ISO/IEC 20000‑1; information security aligns with ISO/IEC 27001.

3. Definitions

4. Scope of Services

• Proactive monitoring (24/7), alerting, and health checks.
• Patch, firmware, and update management.
• Endpoint & infrastructure support (remote & onsite as required).
• Cloud administration (e.g., Microsoft 365, Azure) and tenant hygiene.
• Backup, recovery, and business continuity management.
• Vendor coordination (ISPs, SaaS, hardware).
• Security event monitoring and incident handling.
• User lifecycle management (onboarding/offboarding) & access control.
• Documentation, runbooks, and periodic reporting.

Exclusions

5. Service Levels

All times measured in Business Hours unless a 24/7 add‑on is contracted.

5A. Advanced Metrics & Dashboards

• MTTA (Mean Time to Acknowledge) and MTTR (Mean Time to Restore) tracked monthly.
• First‑Contact Resolution and CSAT reported quarterly.
• Real‑time SLA compliance dashboard available to governance contacts upon request.

6. Maintenance Program

• Monthly proactive health checks & capacity review.
• Regular patching and firmware updates, with rollback plans.
• 24/7 monitoring of logs, alerts, and security signals.
• Quarterly performance & SLA report.
• Annual technology roadmap session.

7. Client Responsibilities

• Provide timely remote/physical access to infrastructure and relevant personnel.
• Maintain environmental standards, Internet connectivity, power, and rack space.
• Ensure end‑users follow acceptable use and security guidelines.
• Keep licenses/subscriptions active; notify Swazzy of significant changes.
• Report incidents promptly with steps to reproduce and impact details.
• Designate a primary contact and an authorised approver for changes.

8. Change Management (CAB)

1. Request — Submit via HelpHub/ticketing with business justification.
2. Impact Assessment — Technical, security, risk, and downtime analysis.
3. Approval — Client approval required for high‑impact changes.
4. Implementation — Executed by authorised engineers, with back‑out plan.
5. Verification & Documentation — Post‑change checks; CMDB/update notes.

Change Advisory Board (CAB): For enterprise clients, Swazzy participates in or convenes a CAB to govern major changes and releases.

Urgent security patches may be expedited with notification to the Client POC.

9. Fees & Payments

• Invoices issued monthly in advance unless otherwise agreed.
• Payment due within 7 days of invoice date.
• Ad‑hoc/non‑standard work billed at prevailing rates upon approval.
• Annual fee review with 30 days notice reflecting scope/third‑party costs.
• Overdue balances may incur admin fees and/or service suspension.

10. Service Credit Policy

Where Swazzy fails to meet the Service Level targets below, the Client may request credits within 10 business days of month‑end.

Credits apply to the next billing cycle; they are a performance assurance (not liquidated damages).

11. Data Sovereignty & Privacy

• Primary data residency in Australia or APP‑compliant jurisdictions; OAIC Notifiable Data Breach scheme supported.
• Data at rest encrypted (AES‑256) and in transit (TLS 1.2+).
• MFA enforced on support systems; least‑privilege access controls.
• Access and audit logs maintained for compliance and investigations.
• Sub‑processors bound by equivalent privacy and security obligations.

11A. Data Processing Addendum (GDPR)

Where Swazzy acts as a processor on behalf of a Client (controller), processing is governed by a DPA that meets GDPR Article 28 requirements, including subject matter and duration, nature and purpose, data types, categories of data subjects, and controller obligations and rights. Sub‑processors are bound by the same obligations.

12. Cybersecurity & Incident Response

• Security controls align to ISO/IEC 27001 and NIST CSF; cyber hygiene aligned to Australia’s Essential Eight.
• Zero‑Trust posture where feasible; MFA and least‑privilege enforced on support systems.
• Ransomware Recovery Objective: For enrolled backup services, target restore‑point objective ≤ 4 hours.
• Annual penetration test and annual security awareness training commitment.

1. Detection & Isolation — Immediate containment of affected systems.
2. Notification — Client POC informed within 1 hour of confirmation.
3. Triage & Forensics — Scope root cause, indicators of compromise.
4. Remediation & Recovery — Patch, restore, harden.
5. Post‑Incident Report — Delivered within 48 hours of resolution and including lessons learned.

Support for OAIC Notifiable Data Breach obligations available on request.

13. Confidentiality

Both parties must protect Confidential Information and use it solely for valid service delivery purposes. Swazzy ensures staff and contractors are bound by confidentiality obligations and appropriate vetting.

14. Intellectual Property

Client owns all Client data and pre‑existing assets. Swazzy retains ownership of tools, scripts, templates, and configurations created to deliver services unless otherwise agreed in writing. A non‑exclusive license is granted to operate such materials within the Client environment.

15. Warranties, Liability & Indemnity

• Services delivered professionally and in good faith.
• To the extent permitted by law, Swazzy is not liable for indirect or consequential loss.
• Where liability cannot be excluded, it is limited to re‑supply of the service or the cost of re‑supply.
• Swazzy maintains appropriate professional and cyber liability insurance.

Nothing in this Agreement limits rights under Australian Consumer Law.

15A. Dispute Resolution

1. Good‑faith negotiation between designated contacts.
2. Mediation by an agreed independent mediator.
3. Arbitration or court proceedings in Victoria, Australia.

15B. Benchmarking

Once every 12 months, either party may request a review of SLA competitiveness against comparable market offerings. Agreed improvements will be incorporated into the next version.

15C. Talent & Vetting

• Engineers hold relevant certifications (e.g., Microsoft, Cisco, Ubiquiti) and role‑appropriate training.
• All personnel are background‑checked and bound by confidentiality.
• Ongoing professional development and minimum annual training hours.

15D. Optional Schedules

• Schedule A – Extended Hours (24×7)
• Schedule B – On‑site Response SLAs
• Schedule C – Cloud Backup & Disaster Recovery
• Schedule D – Vendor Management
• Schedule E – Data Protection Impact Assessment Template

15E. Innovation & Technology Roadmap

• Annual strategic review covering automation, AIOps, and cloud optimisation.
• Client participation in roadmap workshops and proof‑of‑concepts where relevant.

16. Term, Renewal & Termination

• Agreement is ongoing unless terminated with 30 days written notice.
• Either party may terminate for material breach not remedied within 7 days.
• Swazzy may suspend service for non‑payment or security risk.
• Upon termination, Swazzy will return access credentials and provide handover support as agreed.

17. Sustainability & ESG

Swazzy supports carbon‑offset and community initiatives through the Leaders of Change Foundation and related programs. We prioritise efficient, sustainable operations and responsible procurement.

18. Continuous Improvement

• Quarterly SLA performance reviews and service optimisation plans.
• Feedback loops via HelpHub CSAT and governance meetings.
• Automation-first mindset; ongoing staff certification.

19. Escalation Framework

20. Governing Law & Notices

Governing law: Victoria, Australia. Notices must be in writing and sent to the designated contact emails above; deemed received next business day.

Version Control

Print / Save as PDF