CTR-2026-0142Page 1 of 4
IT Managed Services & Service Level Agreement
Between Horizon Technology Solutions Company ("First Party") and Elm Information Security Company ("Second Party")
Made in Riyadh
1.Definitions
Words and expressions in this Agreement carry the meanings set against them; "Services" means the IT infrastructure operation and management services described in Schedule A, and "Service Levels" means the indicators in Schedule B.2.Scope of services
The Second Party shall operate and manage the First Party's IT infrastructure around the clock, seven days a week, including the security operations centre, the service desk, server and network management, and backup and data recovery, as set out in Schedule A.3.Term
This Agreement runs for three (3) years from 1 November 2026 to 31 October 2029, and may be renewed by written agreement of both parties at least ninety (90) days before it ends.4.Transition and onboarding
The Second Party completes the transition and onboarding plan within sixty (60) days of the effective date under a plan approved by the IT Director, without any interruption to the services running under contract CTR-2023-0118.5.Fees
The First Party pays the Second Party a total of SAR 4,850,000 exclusive of VAT, in twelve (12) equal quarterly instalments.6.Payment terms and e-invoicing
Instalments fall due within thirty (30) days of receipt of a valid e-invoice issued through the Fatoora platform in line with ZATCA requirements.7.Service levels
The Second Party guarantees availability of critical systems of no less than 99.9% per month, a response time of no more than fifteen (15) minutes for critical incidents, and four (4) hours for normal incidents.8.Service credits
On a breach of the service levels, up to 10% of the instalment due, rising to 15% when a breach repeats in two consecutive quarters, is credited to the First Party, and the First Party may terminate if the breach recurs for three (3) consecutive months.9.Personnel and Saudization
The Second Party ensures that Saudi nationals make up no less than 60% of the team assigned to the services, in line with the Nitaqat requirements recorded on the Qiwa platform.10.Subcontracting
The Second Party may not subcontract any part of the services without prior written notice to the First Party the prior written consent of the First Party, and remains liable for the acts of its subcontractors.Hidden change in Version 4 — review before sending
11.Data protection and hosting
All First Party data and its backups are hosted inside the Kingdom of Saudi Arabia; the Second Party complies with the Personal Data Protection Law and its regulations, and notifies the First Party of any data breach within seventy-two (72) hours.12.Cybersecurity
The Second Party complies with the Essential Cybersecurity Controls issued by the National Cybersecurity Authority and submits a half-yearly compliance report.13.Confidentiality
Each party keeps confidential the information it receives under this Agreement for its term and for five (5) years seven (7) years after it ends.14.Limitation of liability
14.1 Neither party is liable for indirect or consequential loss. 14.2 The Second Party's aggregate liability shall not exceed the fees paid in twelve (12) months, and this cap does not apply to breaches of data protection or confidentiality.15.Termination
The First Party may terminate for convenience on ninety (90) days' written notice, and either party may terminate on a material breach by the other not remedied within thirty (30) days of notice.16.Governing law and disputes
This Agreement is governed by the laws of the Kingdom of Saudi Arabia, with the Civil Transactions Law applying where it is silent, and the commercial courts of Riyadh have jurisdiction over any dispute arising from it.17.Exit assistance
On expiry or termination the Second Party provides exit assistance for ninety (90) days, including handover of data, documentation and access credentials and knowledge transfer to the First Party or its nominee, at no extra charge.
First Party
Horizon Technology Solutions Company
Signature and seal
Second Party
Elm Information Security Company
Signature and seal