V2.1, 2016-09-29

DFN-AAI Service Provider Agreement(the Agreement)

between

DFN-Verein, Alexanderplatz 1, 10178 Berlinand__________________________________________________(the Parties and each a Party)

WHEREIN:A.

The DFN-AAI is an infrastructure (Federation) for a group of organizations (the HomeOrganizations and Service Providers), which cooperate in the area of inter-organizational authentication and authorization;

B.

Details of the DFN-AAI and a short explanation of the Federation Services may be accessed at https://www.aai.dfn.de;

C.

The Service Provider wishes to co-operate with the DFN-AAI and to receive certain services from the DFN-AAI (the Federation Services) and to comply (a guaranteed compliance) with a common set of policies and practices;

THEREFORE, THE PARTIES AGREE AS FOLLOWS:

1

V2.1, 2016-09-29

1 Definitions
Capitalized terms used in this Agreement have the following meanings:
AAI

Refers to Authentication and Authorization Infrastructure

Affiliate

Means, as to a person or entity, another person or entity
which exercises control over such person or entity, or isunder control by it, or is under common control by thesame person or entity

Attributes

End User data needed for access control decisions (authorization)

Dependencies

The technical pre-requisites, which the systems of the service provider should meet

End UserA registered member of a Home Organization

Federation Services

Refers to (i) the development and operation of the central
AAI system, including the operation of central Discovery
Services; (ii) a central metadata registry, and related services; and (iii) the operation of a competence centre (testlab, training, consulting)Force Majeure

Refers to, in relation to either party, any event beyond its
reasonable control including any strike, act of God, natural
disaster, fire, war, riot or national turmoil

Home Organization

Participating institutions (other than Service Provider)such as universities or research institutes which register
End Users

Resources

Material to which access is granted, e.g. applications, websites, databases, systems, etc.

Discovery Services (DS)Also known as WAYF "Where-Are-You-From" services. A
DS provides a browser-based interface where an End user
selects his or her Home Organization in order to gain AAIbased access to a specific Resource

2 Services provided by DFN-AAI
The services provided hereunder are Federation Services as set forth on DFN-AAI website(https://www.aai.dfn.de) and as modified and extended from time to time.

3 Rights and Obligations of DFN
3.1

DFN will provide the Federation Services with due care, taking into account generally
accepted business practices, the legitimate interests of the Home Organizations andService Providers as well as the available resources of DFN and with a view to efficiently
controlling costs of service delivery.

3.2

DFN will be relieved from providing the Federation Services if the Dependencies are notmet, in case of Force Majeure or if the Service Provider uses or permits the use of theFederation Services in violation of the terms of this agreement or the applicable law.

3.3

DFN may change or modify the Federation Services upon reasonable prior notice published on the dedicated DFN-AAI website.

2

V2.1, 2016-09-29
3.4

Upon a written request by the Service Provider setting forth a misuse of the services by
an End User, DFN will undertake commercially reasonable efforts to have the respective
Home Organization suspend or cancel the account of such End User. Furthermore, DFN
will offer reasonable assistance in identifying an End User in case of a severe misuse.

4 Rights and Obligations of the Service Provider
4.1 The Service Provider will ensure that the following Dependencies are met:
Download, installation, integration and operation of the AAI software and tools, including updates.

Provide up-to-date technical and administrative contact information to DFN.

Use of server certificates provided by an accredited CA for all their AAI elements.

4.2

The Service Provider will cooperate with DFN and perform all obligations reasonably
required to enable the proper functioning of the services with due care, taking into
account generally accepted business practices. It will refrain from altering or otherwiseinterfering with the Federation Services and systems provided by DFN except as required for the proper operation thereof.

4.3

The Service Provider will timely inform DFN if services have not been delivered by theagreed time or if quality of service is insufficient, stating the reasons for its dissatisfaction in detail. Late notice will result in the forfeiture of all related rights.

4.4

The Service Provider will enter into appropriate arrangements with one or several Home
Organizations concerning the delivery of or access to Resources as well as all aspects ofdata protection. For the avoidance of doubt, such arrangements are the sole responsibility of the Service Provider and DFN shall have no obligations or responsibilities relating thereto.

5 Representations and Warranties
5.1 The Parties represent and warrant that:(a) they have full power to enter into and perform their obligations under this Agreement and have taken all necessary action to that effect; and(b) they have obtained and will maintain throughout the term of this Agreement, allrights, licenses, permissions and approvals, including all registrations in accordancewith and as required by the applicable data protection legislation, which are necessary to provide and obtain the respective services in accordance with this Agreement.
5.2

DFN represents and warrants that it will perform its obligations under this Agreementin accordance with the standards of performance set forth herein. For the avoidance ofdoubt, DFN does not make any representations or warranties with regard to the reachor coverage of the AAI, neither as regards the number of End Users or Home Organizations nor as regards the existence or availability of any particular Attributes.

5.3

The Service Provider represents and warrants that it will use the Federation Services inaccordance with all applicable licenses and laws including but not limited to data protection and privacy laws.

3

V2.1, 2016-09-29

6 Remedies
6.1

In case of any breach of the obligations and warranties of DFN hereunder, the Service
Provider will have the following remedies:(a) to request corrective action for all remedial breaches; or(b) to terminate the Agreement in accordance with Section 10 below.

7 Intellectual Property7.1

Except as provided herein, all rights and interest in the AAI concept, the know-how, thedocuments, the tools and the software employed, delivered or developed by DFN as partof the Service delivery vests in DFN.

7.2

For all such developments DFN grants to the Service Provider for the term of this Agreement, a worldwide, non-exclusive, non-transferable license to use and permit the Service Provider's agents, representatives and End Users to use such, solely in connection
with and for the purpose of delivering the Federation Services.

8 Liability
8.1

All and any liability of the Parties hereunder (if any) will be limited to damages incurredby gross negligence or wilful intent of the other Party, its employees, agents or subcontractors.

8.2

In no event shall DFN be liable for any acts or omissions (including but not limited toinstructions, notices and recommendations) of its employees, agents or subcontractors
resulting in:(a) any delayed addition, modification or deletion of entries in the Discovery Services;(b) any errors or faults in the registration or distribution of meta-data;(c) any errors or faults in the DFN tools;(d) the Federation Services being not available; and(e) any other damage, whether direct or indirect, exceeding an amount of EURO 1000..

9 Data Protection
9.1

Each Party will at all times throughout the term of this Agreement and as may otherwise
be necessary, comply with the applicable provisions and obligations imposed by theGerman Data Protection legislation so far as they relate to the Federation Services andto the processing of personal data.

9.2

The Service Provider will ensure that appropriate technical and organisational measures
are taken against unauthorised or unlawful processing of data and against accidental
loss or destruction of, or damage to, this data.

9.3

All matters concerning the processing and protection of personal data of End Users must
be agreed upon bilaterally between the Service Provider and the Home Organizations.
DFN shall have no obligations or responsibilities relating thereto.

4

V2.1, 2016-09-29

10 Term and Termination
10.1 This Agreement is entered into for an indefinite term. It may be terminated by either
Party by giving 2 months prior notice effective as per the end of a calendar year.
10.2 Notwithstanding this, a Party may terminate this Agreement(a) if the other Party commits a material breach which is not remedied within 30 days
after notice reasonably describing such breach;(b) in case of insolvency of one of the Parties;(c) if the Agreements with all participants are terminated; and(d) if and as entitled to do so pursuant to another Section of this Agreement.
10.3 Upon termination, the Service Provider will return all DFN and all other documents andsoftware (if any) received from DFN as part of the Federation Service delivery and willconfirm that it has destroyed all copies thereof, subject to mandatory archival duties.

11 General Provisions
11.1 This Agreement shall be governed by and construed in accordance with German law,
without reference to conflict of laws principles. This agreement is subject to the exclusive jurisdiction of German courts in Berlin.
11.2 Neither Party may assign or delegate this Agreement or any of its rights or duties under
this Agreement without the prior written consent of the other; provided that either Party
may assign this Agreement to an Affiliate which has assumed in writing all obligations
under this Agreement.
11.3 If any section, paragraph, provision, or clause in this Agreement shall be found or beheld to be invalid or unenforceable in any jurisdiction in which this Agreement is being
performed, the remainder of this Agreement shall be valid and enforceable and theParties will negotiate, in good faith, a substitute, valid and enforceable provision whichmost closely reflects the Parties' intent in entering into this Agreement.
11.4 The terms and conditions herein contained constitute the entire agreement between theParties and supersede and terminate all previous agreements and understandings,
whether oral or written, between the Parties hereto with respect to the subject matterhereof, including, without limitation, any distribution and related agreements in effectas of the date hereof.
11.5 This Agreement may be amended at any time by mutual written agreement among theParties. If and to the extent the Service Agreement with the Home Organizations isamended pursuant to the terms thereof, this Agreement will be amended accordingly,
thwith such amendment becoming effective as of the 30 day after having served a notice
thereof to the Service Provider.
11.6 Any notice required or permitted by this Agreement shall be given in writing or by email.

5V2.1, 2016-09-29

12Contact

12.1 Administrative Contact

Name / Surname,
Address

Phone, Fax

E-Mail12.2 Technical Contact
Name / Surname,
Address

Phone, Fax

E-Mail*****Berlin, …
DFN________________________________________

by:

by:

…

________________________________________

by:by:6