Elba Enterprise Service Terms

Valid from: 11 March 2026

These Service Terms apply exclusively to enterprise customers who have executed an Order Form with Kolsetu. They supplement and form part of the Agreement as defined in the General T&C. In the event of conflict between these Service Terms and the General T&C, these Service Terms prevail for product-specific matters. All capitalised terms used but not defined here have the meanings given in the General T&C or the Data Processing Agreement.

1. Platform Description

Elba is a cloud-based AI voice automation platform built for regulated enterprises. It automates business communication workflows using AI voice agents, omnichannel orchestration, and deep integration with enterprise systems. Elba is offered exclusively on a SaaS basis; no software is installed on the Customer's systems.

Core capabilities include:

• AI Voice Automation: inbound and outbound AI voice agents for customer service, appointment scheduling, triage, and workflow automation

• Omnichannel Orchestration: unified management of customer interactions across voice, SMS, email, live chat, and WhatsApp

• Real-Time Data Ingestion: live data retrieval from and write-back to connected enterprise systems during AI-handled interactions

• Conversation Analytics: full interaction transcription, intent classification, sentiment analysis, and configurable reporting dashboards

• Enterprise Integrations: native connectors for Salesforce (CRM), SAP (ERP), and Microsoft Dynamics 365; REST API and webhook framework for custom integrations

• Agent Assist: real-time AI guidance and knowledge surfacing for human agents handling escalations

New features and capabilities are documented on our homepage. In the event of inconsistency between these Service Terms and the technical documentation, the technical documentation shall prevail for product-specific parameters.

2. Licence and Permitted Use

2.1 Subject to payment of Fees and compliance with the Agreement, Kolsetu grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Elba platform for the Subscription Term, for the Customer's own internal business purposes, at the capacity and configuration set out in the Order Form. This licence supplements and does not replace the licence grant in Section 4 of the General T&C.

2.2 The licence entitles use of the platform in the configuration set out in the Order Form, including voice channels, user seats, enabled modules, and integration connectors. Each additional voice channel, user seat, or module requires a written licence extension agreed in a supplemental Order Form.

2.3 All enterprise customers receive access to all platform channels and modules available in the Elba platform at the time of contract execution, subject to the tier and capacity limits in the Order Form. Feature availability and any limitations applicable to specific tiers are documented in the Order Form.

2.4 Use of the platform as a managed service bureau - that is, operating the platform on behalf of third parties who are not the Customer - requires prior written agreement with Kolsetu and is not covered by this licence.

3. Hosting and Infrastructure

3.1 Cloud Infrastructure

Elba is hosted on enterprise cloud infrastructure. The default deployment is Microsoft Azure (West Europe / Germany West Central). Where operationally required or agreed in the Order Form, Kolsetu may deploy on alternative cloud infrastructure providers, including Amazon Web Services. In all cases, the deployment region and cloud provider applicable to the Customer are specified in the Order Form. All primary data storage and AI inference processing takes place within the region and on the infrastructure specified in the Order Form, or within the default EU Azure region where no alternative is specified. Kolsetu will comply with applicable local data protection and data residency legislation in the jurisdiction of the agreed deployment region. Infrastructure compliance certifications and security assessments for the applicable provider are available on request.

3.2 Telephony

Voice channel connectivity is provided via Twilio. Where the Customer configures its own SIP trunk or third-party telephony provider, Kolsetu is not responsible for the data residency, security practices, or service availability of that provider, and any resulting downtime does not count against the availability commitment in Section 4.

3.3 AI Services

AI inference is provided primarily via Azure OpenAI Service (Microsoft Ireland Operations Limited). Additional AI sub-processors are listed in Annex I-C of the Data Processing Agreement. Service disruptions caused by AI sub-processors are classified as Exceptions under Section 4.2 and do not count against the availability commitment. Kolsetu will use reasonable efforts to implement failover or mitigation where technically feasible.

3.4 Sub-processors

The authoritative list of sub-processors is set out in Annex I-C of the Data Processing Agreement. Kolsetu will provide advance notice of sub-processor changes in accordance with the Data Processing Agreement.

4. Service Availability

4.1 Availability Commitment

Kolsetu commits to 99.95% platform availability, measured on a rolling calendar month basis, excluding Exceptions as defined in Section 4.2. Availability is measured in five-minute intervals across all core platform functions. The availability commitment applies to the Elba platform itself and does not extend to third-party services, integrations, or the Customer's own infrastructure.

4.2 Exceptions

The following are excluded from availability calculations and do not constitute downtime for the purposes of this Section 4 ("Exceptions"):

• Scheduled maintenance communicated to the Customer in accordance with Section 4.4

• Outages caused by Customer configuration errors, Customer-initiated actions, or misuse of the platform

• Failures or degradation of third-party providers outside Kolsetu's direct control, including but not limited to AI inference services (Azure OpenAI, Anthropic, or other AI sub-processors), telephony providers, and communication APIs

• Cyberattacks, DDoS attacks, or other malicious acts by third parties directed at Kolsetu's or its sub-processors' infrastructure

• Force majeure events as defined in the General T&C Section 15.5

• Failures of the Customer's own network, internet connectivity, or local infrastructure

• Suspension of access by Kolsetu for late payment in accordance with General T&C Section 6.3

4.3 Service Credits

Where monthly availability (excluding Exceptions) falls below 99.95% in any calendar month, the Customer may request a service credit in accordance with the table below. Credits are calculated as a percentage of the Customer's annual subscription fee (excluding usage-based charges and credit bundle purchases). Availability is measured independently for each calendar month; each month in which a shortfall occurs may give rise to a separate credit claim.

Credits are subject to the following conditions:

• The Customer must submit a written credit claim to legal@kolsetu.com within 30 days of the end of the calendar month in which the shortfall occurred. Claims submitted after this deadline are forfeited regardless of the number or severity of shortfalls in that month.

• Credits are applied as a reduction against the Customer's next annual renewal invoice. Credits are not redeemable for cash and are not transferable.

• The maximum aggregate service credit across all claims in any rolling 12-month period shall not exceed 8% of the annual subscription fee, regardless of the number of calendar months in which a shortfall occurred or the severity of those shortfalls. Once the 8% cap is reached, no further credits accrue for the remainder of that 12-month period.

• Credits are the Customer's sole and exclusive financial remedy for availability shortfalls, except in cases of Kolsetu's gross negligence or wilful misconduct.

• Credits are not available where the shortfall was caused wholly or partly by an Exception.

4.4 Scheduled Maintenance

Under normal operating conditions, Kolsetu performs maintenance and security patching without planned downtime. Where downtime is required, Kolsetu will communicate the maintenance window to the Customer's designated contact at least 48 hours in advance and will not proceed until the Customer has confirmed receipt. Maintenance windows are scheduled outside core Business Hours (Monday–Friday 09:00–18:00 CET/CEST) where operationally feasible. Scheduled maintenance communicated and confirmed in accordance with this section does not count as downtime and does not trigger service credits. Emergency security patches may be deployed without advance notice where delay would create material security risk; Kolsetu will notify the Customer as soon as reasonably practicable after deployment. Emergency patches do not require prior Customer confirmation but Kolsetu will use reasonable efforts to minimise service impact.

4.5 Release Management

Major platform releases are communicated at least one week in advance via release notes on our homepage, including migration guidance where applicable. Enterprise customers are provided a migration period of up to one calendar month before automatic migration to the latest major release. Minor releases and patches are deployed without a migration period.

4.6 Sustained Unavailability - Termination Right

Without prejudice to any other rights, the Customer may terminate the Agreement by written notice if: (a) monthly availability (excluding Exceptions) falls below 99.00% in three or more calendar months in any rolling six-month period; or (b) monthly availability falls below 95.00% in any single calendar month. This termination right is the Customer's sole remedy for sustained unavailability beyond the service credit mechanism in Section 4.3, except in cases of Kolsetu's gross negligence or wilful misconduct.

5. Support Services

5.1 First-Line Support “Frida”

Every Elba instance includes Frida, Kolsetu's embedded AI support assistant. Frida is available 24/7 within the platform and provides immediate first-line assistance for workflow configuration, platform navigation, troubleshooting of user-level issues, and guidance on platform features. The Customer should consult Frida in the first instance for day-to-day operational questions before escalating to Kolsetu's human support team. Frida's responses are based on the current platform documentation and do not constitute contractual commitments.

5.2 Incident Priority Classification

All incidents submitted to Kolsetu's support team are classified by priority in accordance with the following table. Priority classification is determined by Kolsetu in its reasonable discretion based on the information provided by the Customer at the time of submission.

Initial Response means acknowledgement by Kolsetu that the incident has been registered and is being actively worked. It is not a commitment to resolve the incident within any particular timeframe. Kolsetu does not commit to resolution timeframes for any incident priority, as resolution timelines depend on the nature, complexity, and root cause of the issue, including dependencies on third-party providers. Kolsetu will provide regular status updates on open P0 and P1 incidents until resolution.

5.3 Support Channels

Enterprise customers may submit incidents and support requests via: (a) the Kolsetu customer portal; (b) email to support@kolsetu.com; or (c) for P0/P1 incidents, the dedicated emergency contact provided in the Order Form. P0 and P1 incidents should be submitted via the emergency contact channel to ensure 24/7 response. Incidents submitted outside the emergency channel may not be picked up within the P0/P1 response target outside Business Hours.

5.4 Customer Responsibilities

The Customer shall: (a) provide sufficient detail when submitting incidents to enable Kolsetu to reproduce and investigate the issue; (b) make relevant personnel available to assist with diagnosis and testing; (c) implement reasonable workarounds suggested by Kolsetu or Frida where available; and (d) notify Kolsetu promptly of any changes to the Customer's environment that may be relevant to an open incident. Kolsetu's response time obligations do not apply where the Customer fails to fulfil these responsibilities.

6. Subscription Fees and Usage

6.1 Fee structure. The Customer's fees comprise two independent components: (a) an annual platform licence fee for the tier selected in the Order Form, invoiced in advance at the start of each contract year; and (b) credit bundle purchases as described in Section 6.3, invoiced at the time of purchase. There is no minimum usage commitment. The Customer purchases credits as needed and uses them at its own pace.

6.2 Service tiers. Elba is offered in four enterprise tiers (S, M, L, XL) differentiated by organisational scope, business unit count, geographic footprint, and regulatory burden. All tiers include access to all platform channels and modules. The applicable tier and annual licence fee are set out in the Order Form. Tier assignment reflects the Customer's operational profile at contract execution and is reviewed at each annual renewal.

6.3 Credit bundles. Platform usage is consumed in credits. Credits are purchased separately from the annual licence fee in bundles. Bundle sizes and per-credit pricing are set out in the Order Form or Kolsetu's then-current enterprise pricing schedule. The Customer may purchase additional bundles at any time during the contract year. There is no obligation to purchase any minimum number of bundles. Credit bundle pricing is not subject to the fee change protection in General T&C Section 6.4.

6.4 Credit pricing. Per-credit pricing is determined by bundle size on a volume discount basis: larger bundles carry a lower per-credit rate. Where the Customer purchases multiple bundles across a contract year, the per-credit rate applicable to each bundle is determined by that bundle's size at the time of purchase, not by cumulative volume. Kolsetu's then-current bundle pricing schedule is available on request.

6.5 Credit expiry. Credit bundles expire 24 months from the date of purchase. Credits are consumed on a first-in, first-out (FIFO) basis. Kolsetu will notify the Customer when a bundle is within 60 days of expiry. Expired credits are forfeited and non-refundable.

6.6 Credits on upgrade. Where the Customer upgrades to a higher licence tier during the contract year, unused credits from previously purchased bundles are carried over in full to the new tier. No credits are forfeited solely as a result of a tier upgrade.

6.7 Auto-renewal. The Agreement automatically renews for successive one-year Subscription Terms on identical terms unless either party gives written notice of non-renewal at least 90 days before the end of the then-current Subscription Term. This 90-day notice period constitutes the termination for convenience notice period referred to in General T&C Section 13.3.

6.8 Annual licence fee indexation. The annual platform licence fee is subject to adjustment at each renewal by the percentage change in the Harmonised Index of Consumer Prices (HICP) for Germany over the preceding 12 months plus 2 percentage points. Kolsetu will notify the Customer of the adjusted licence fee at least 60 days before the renewal date. This notification constitutes the fee change notice under General T&C Section 6.4. If the Customer does not accept the adjusted fee, it may terminate the Agreement by written notice before the renewal date in accordance with Section 6.7. Credit bundle pricing is not subject to automatic indexation and is governed by Section 6.3 and the renewal discussion under Section 6.9.

6.9 Annual renewal discussion. At least 60 days before each renewal date, Kolsetu will initiate a renewal discussion with the Customer covering: (a) actual credit consumption in the contract year; (b) the appropriate licence tier for the coming year based on the Customer's current operational profile; and (c) the Customer's anticipated credit requirements and preferred bundle structure. Where the parties agree revised terms, those terms are documented in a new Order Form executed before the renewal date and take effect from the renewal date. Where no new Order Form is executed before the renewal date, the Agreement auto-renews under Section 6.7 on existing terms, the HICP+2% fee adjustment under Section 6.8 applies, and the Customer may purchase credit bundles at Kolsetu's then-current list prices without volume discount. Kolsetu's indicative pricing basis for renewed credit commitments is the per-credit rate of the last bundle tier reached or exceeded during the preceding contract year, reflecting demonstrated volume - though final pricing is subject to negotiation and the executed Order Form.

6.10 Credits on termination. Unused credits at the time of Contract termination are non-refundable, except where Kolsetu terminates the Contract for its own convenience, in which case Kolsetu will refund the pro-rata value of unused credits purchased within the preceding 24 months.

7. Data Return and Deletion

7.1 Upon Contract termination or expiry, Customer Data is handled in accordance with the Export Window and deletion procedure set out in General T&C Section 13.4 and Data Processing Agreement Section 4.8. The Customer has 30 days from the termination date to export its data in a machine-readable format (JSON or CSV) via the platform export function. The Customer is solely responsible for initiating and completing the export within this window.

7.2 Following expiry of the Export Window, Kolsetu will delete all Customer Data within a further 30 days in accordance with the Data Processing Agreement. Written confirmation of deletion is available on request to privacy@kolsetu.com.

7.3 Where the Customer requests immediate deletion prior to or at termination, Kolsetu will: (a) deactivate the Customer's environment so that data is inaccessible; and (b) complete permanent deletion within five (5) business days. Immediate deletion forfeits the Export Window; the Customer is solely responsible for extracting any required data before requesting immediate deletion.

7.4 Statutory retention. Nothing in this section requires Kolsetu to delete data where retention is required under applicable law. Data retained for statutory purposes is processed solely for compliance and is not accessible for operational use.

8. Voice Data and AI Processing

8.1 Voice recording retention. Voice recordings processed through the Elba platform are retained for the period configured by the Customer in the platform settings, subject to a default maximum of 90 days unless a longer period is agreed in the Order Form. Conversation transcripts and interaction analytics are retained for the duration of the Contract unless the Customer configures earlier deletion. The Customer is solely responsible for configuring retention periods appropriate to its legal and regulatory obligations. Kolsetu will automatically delete voice recordings upon expiry of the configured retention period.

8.2 Recording consent. The Customer is solely responsible for compliance with all applicable laws governing the recording of voice interactions in its jurisdiction and in the jurisdictions of its end customers, including obtaining required consent under applicable telecommunications law, GDPR, and sector-specific regulations (including but not limited to financial services recording obligations). Kolsetu provides the technical capability to record; compliance obligations rest with the Customer as deployer.

8.3 AI training exclusion. Neither Kolsetu nor any of its sub-processors will use Customer Personal Data - including voice recordings, transcripts, or any data derived therefrom - to train, fine-tune, or improve any general-purpose AI or machine learning model. This restriction is set out in and governed by the Data Processing Agreement Section 4.5.1.

8.4 Automated decision-making. The Elba platform provides AI-driven automation capabilities including call routing, intent classification, and workflow triggering. The Customer, as deployer of these capabilities within the meaning of the EU AI Act and Art. 22 GDPR, is solely responsible for determining whether its use of these features constitutes high-risk AI use or automated decision-making with legal or similarly significant effects on individuals, and for implementing any required human oversight, safeguards, transparency measures, or consent mechanisms. Kolsetu provides the technical capability; regulatory compliance obligations as deployer rest with the Customer.

8.5 WhatsApp channel. Where the Customer activates the WhatsApp channel, the Customer is solely responsible for ensuring that its end customers are informed of the use of WhatsApp for communications and that such use complies with Meta's applicable terms of service and all applicable laws.

9. Platform Modifications

9.1 Kolsetu may update, modify, enhance, or deprecate features of the Elba platform from time to time. For modifications that materially remove or reduce existing functionality relied upon by enterprise customers, Kolsetu will provide at least 30 days' advance written notice. Kolsetu will not materially reduce core platform functionality during a paid Subscription Term without the Customer's prior written consent.

9.2 "Core platform functionality" means the capabilities described in Section 1 of these Service Terms as at the Order Form execution date, as documented in the then-current technical documentation on our homepage. Changes to the technical implementation, underlying infrastructure, or AI models used to deliver functionality do not constitute a reduction in core functionality provided the functional outcome is materially preserved.

9.3 Where Kolsetu proposes a modification that materially reduces functionality and the Customer reasonably objects, the parties will discuss in good faith. If no agreement is reached within 30 days, the Customer may terminate the Agreement effective at the end of the then-current Subscription Term without penalty.

10. Business Continuity and Disaster Recovery

10.1 Kolsetu maintains a documented Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) covering the Elba platform and supporting infrastructure. These plans are reviewed and updated at least annually and following any material change to the platform architecture or hosting infrastructure.

10.2 Kolsetu conducts disaster recovery tests at least once per calendar year. Recovery time and recovery point objectives are defined internally and are available to Enterprise customers on request to security@kolsetu.com, subject to execution of a Non-Disclosure Agreement.

10.3 In the event that Kolsetu invokes its BCP or DRP in connection with a disruption affecting the Customer's instance, Kolsetu will: (a) notify the Customer's designated contact within 1 hour of declaration; (b) provide status updates at least every 2 hours until normal service is restored; and (c) provide a written post-incident report within 5 business days of resolution, including root cause analysis and corrective actions.

10.4 Kolsetu's infrastructure providers independently maintain their own business continuity, disaster recovery, and resilience capabilities. Details are available on request.

11. Audit and Assurance

11.1 Kolsetu maintains an information security management programme covering the Elba platform and supporting infrastructure. Security documentation is available to Enterprise customers on request to security@kolsetu.com, subject to execution of a Non-Disclosure Agreement and at Kolsetu's discretion as to the scope of disclosure.

11.2 Enterprise customers may request a directed operational inspection of agreed platform controls no more than once per calendar year, subject to at least 30 business days' prior written notice to legal@kolsetu.com. Inspections shall be conducted in a manner that minimises disruption to Kolsetu's operations and other customers. The Customer shall bear its own costs; Kolsetu may charge reasonable costs for time and resources expended beyond standard documentation provision.

11.3 Kolsetu will cooperate with any competent supervisory or regulatory authority that requests information about the Services in connection with the Customer's regulatory obligations, subject to Kolsetu receiving prior written notice from the Customer and being given a reasonable opportunity to review the scope of any such request. Audit rights in respect of data protection matters are governed exclusively by the Data Processing Agreement Section 4.9.

12. Language and Translations

These Service Terms are made available in English and German, both of which have been reviewed for legal accuracy. The English text is the authoritative version for all purposes. The language and translation provisions of General T&C Section 15.10 apply to these Service Terms in full.

13. Definitions

The following terms are specific to these Service Terms. All other capitalised terms have the meanings given in the General T&C or the Data Processing Agreement.