Backup and Restoration Schedule

The Buffalo Company

Version: 1.0
Document date: 12 November 2026
Related document: Managed Services Agreement
Provider: Obed Klein, trading as The Buffalo Company
Customer: As identified in the applicable Service Confirmation

---

1. Purpose and application

1.1. This Backup and Restoration Schedule ("Schedule") governs backup and restoration services provided by The Buffalo Company ("Provider") to the Customer.

1.2. This Schedule forms part of the Managed Services Agreement ("Agreement") and applies whenever backup services are commissioned through a Service Confirmation or separate written agreement.

1.3. Backup services may be provided:

a. As part of an individually scoped Managed Infrastructure engagement; or

b. As a standalone recurring backup service for a Customer-managed website, server or other technically supported system.

1.4. This Schedule applies to both arrangements unless a provision expressly states otherwise or the Service Confirmation specifies a different arrangement.

1.5. The Service Confirmation identifies the systems covered, applicable fees, storage capacity, backup configuration and any customer-specific conditions.

1.6. In the event of a conflict, the precedence provisions of the Managed Services Agreement apply. The Data Processing Agreement prevails concerning personal data processing.

2. Scope of backup services

2.1. The Provider backs up only the systems and data expressly identified in the Service Confirmation.

2.2. Covered data may include:

• Website files.
• Website databases.
• Server files and directories.
• Application data.
• Configuration files.
• Other specifically agreed data.

2.3. The Service Confirmation must identify the relevant websites, servers, databases, directories or other data sources sufficiently to establish the agreed backup scope.

2.4. Data not expressly included in the agreed scope is not covered.

2.5. The Provider may exclude data or components that cannot reasonably or reliably be backed up or restored using the available technical arrangements.

2.6. Backup services do not automatically include administration, security, maintenance, updating or monitoring of the underlying system.

2.7. Where backup services are provided for a Customer-managed system, the Customer remains responsible for the underlying system, its availability, required access and changes made by the Customer or other providers.

3. Technical assessment and onboarding

3.1. Before activating a new backup service, the Provider performs an appropriate technical assessment.

3.2. The assessment may include:

• Availability and suitability of administrative or backup access.
• Technical compatibility of the system.
• Identification of the data to be backed up.
• Estimated storage requirements.
• Backup feasibility and relevant technical limitations.
• Available restoration options.
• Relevant third-party dependencies.
• Security and operational risks affecting backup reliability.

3.3. The Provider may decline a system where reliable or reasonably safe backup and restoration cannot be established.

3.4. Assessment, preparation, remediation or additional onboarding work may be separately quoted where meaningful effort is required.

3.5. Backup activation takes place after the required assessment and onboarding have been completed and the agreed configuration has been confirmed.

3.6. The recurring backup fee begins on the agreed activation date.

4. Standard backup policy

4.1. Unless otherwise specified in the Service Confirmation, the standard starting backup policy is:

Data or backup type	Standard frequency / retention
Website files	Daily
Website databases	Daily
Daily backup retention	7 days
Weekly backup retention	4 weeks
Monthly backup retention	3 months
Configuration backups	After significant changes and scheduled copies as agreed

4.2. The actual configuration may be adjusted to account for the system, technical feasibility, storage capacity and Customer requirements.

4.3. The Service Confirmation records any customer-specific backup frequency, retention period or configuration that differs from the standard starting policy.

4.4. Configuration backups after significant changes depend on the Provider being informed of the changes or otherwise being able to identify them within the agreed service scope.

4.5. The Provider may adjust backup scheduling where reasonably necessary for technical or operational reasons, provided the agreed contractual obligations are maintained. Material changes to the agreed backup frequency or retention require the Customer's agreement.

4.6. The Provider does not guarantee that every scheduled backup job will complete successfully.

5. Storage location and redundancy

5.1. Backup data will be stored using Microsoft Azure Blob Storage in an Azure region located in Germany.

5.2. The actual Azure region used for the Customer's backup data must be identified in the Service Confirmation before backup activation.

5.3. The preferred storage redundancy configuration is Zone-Redundant Storage (ZRS), where available and suitable in the selected German region.

5.4. Locally Redundant Storage (LRS) may be used where ZRS is unavailable or unsuitable.

5.5. Geo-redundant replication will not be used unless the location of all replicated backup copies has been verified and remains within Germany.

5.6. The actual storage redundancy configuration will be recorded in the Service Confirmation.

5.7. The storage-location commitment in this Schedule concerns the location of backup data and its configured replicas. It does not constitute a representation that every form of Microsoft service metadata, support processing or other ancillary service operation necessarily takes place exclusively in Germany.

5.8. The Provider may change the storage configuration where reasonably necessary, provided the agreed data-location requirements are maintained. A material change to the agreed storage region or data-residency arrangement requires the Customer's agreement.

6. Storage capacity and fees

6.1. Backup storage is provided within the capacity tier identified in the Service Confirmation.

6.2. The standard capacity tiers are:

Tier	Maximum storage capacity
Small	100 GB
Medium	250 GB
Large	500 GB
Extra Large	1 TB
Custom	Above 1 TB, individually quoted

6.3. Capacity is measured by the actual storage consumed by all retained backup copies in Azure Blob Storage, including daily, weekly and monthly copies.

6.4. Capacity is not measured solely by the size of the live website, server or source data.

6.5. The applicable recurring fee is stated in the Service Confirmation.

6.6. Where storage usage approaches the agreed capacity, the Provider will notify the Customer and explain the available options, which may include:

• Upgrading to a larger capacity tier.
• Reducing the backup scope.
• Adjusting retention periods.
• Agreeing a custom storage arrangement.

6.7. An increase in recurring fees requires the Customer's prior approval.

6.8. If the Customer does not approve an increase, the Parties will agree an appropriate adjustment to the backup configuration or scope.

6.9. The Provider is not obliged to provide unlimited storage or silently increase recurring charges.

6.10. The Provider may temporarily restrict additional backup storage activity where necessary to prevent uncontrolled storage consumption or technical failure, but will notify the Customer and seek an appropriate configuration adjustment as soon as reasonably practicable.

7. Backup monitoring and failure handling

7.1. Where technically supported, the Provider uses automated mechanisms to detect failed or incomplete backup jobs.

7.2. The Provider reviews material backup failures within the agreed service scope.

7.3. Where a material failure is identified, the Provider will notify the Customer and make reasonable efforts to investigate and resolve the issue within the agreed scope.

7.4. The Customer must provide any access, information or assistance reasonably required to investigate the failure.

7.5. Backup failures may result from circumstances outside the Provider's reasonable control, including:

• Underlying system or application failures.
• Changes to system configuration or access.
• Actions by the Customer or another provider.
• Insufficient storage or system resources.
• Hosting, cloud or telecommunications outages.
• Third-party software defects or limitations.

7.6. The Provider does not guarantee that every backup failure will be detected immediately or that every failure can be resolved.

7.7. Additional investigation, remediation or technical work outside the agreed scope may require a separate quotation and the Customer's prior approval.

8. Restoration testing

8.1. Each commissioned backup system is subject to restoration testing:

a. During onboarding; and

b. Quarterly thereafter while the backup service remains active.

8.2. Restoration tests are intended to verify that backup data can be accessed, retrieved and restored to an appropriate test environment or location.

8.3. Tests are performed without intentionally overwriting production data.

8.4. A test may include the restoration of selected files, directories, databases or configuration data, depending on the system and available technical arrangements.

8.5. The Provider records the relevant test information, which may include:

• Test date.
• System or data source tested.
• Backup copy selected.
• Restoration procedure.
• Test outcome.
• Identified limitations or failures.
• Corrective actions, where applicable.

8.6. Restoration testing is included in the commissioned backup service and does not consume the monthly routine restoration assistance allowance described in Section 9.

8.7. If a test identifies a material issue, the Provider will inform the Customer and recommend appropriate corrective action.

8.8. Additional remediation or work outside the agreed scope may be separately quoted.

9. Restoration requests and assistance

9.1. The Customer may request restoration of covered data by contacting the Provider at hello@thebuffalocompany.com.

9.2. The request should identify, as far as reasonably possible:

• The affected system.
• The data or files to be restored.
• The relevant date or backup version.
• The reason for restoration.
• The intended restoration destination.

9.3. The standard backup service includes up to 30 minutes of routine restoration assistance per managed system per billing month.

9.4. Routine restoration assistance covers technically straightforward restoration of specified files, folders or databases from an available usable restore point.

9.5. Unused restoration time expires at the end of each billing month and does not carry forward.

9.6. Additional routine restoration work is charged at €75 per hour, calculated in 15-minute increments, subject to the Customer's prior approval.

9.7. The following work is not included in routine restoration assistance and requires separate assessment and quotation:

• Full server recovery.
• Disaster recovery.
• Recovery of severely corrupted systems.
• Investigation of underlying application or infrastructure failures.
• Reconstruction of unavailable or damaged environments.
• Complex database recovery.
• Migration to replacement systems.
• Extensive troubleshooting or remediation.

9.8. A restoration request does not automatically constitute an incident response or security investigation. Security incidents and major infrastructure failures are handled under the relevant separately commissioned service scope.

9.9. Restoration depends on the availability and integrity of the relevant backup copy, the technical condition of the target system and any required third-party services.

9.10. The Provider will not intentionally overwrite production data without appropriate authorisation and safeguards.

10. Recovery expectations

10.1. The Parties do not agree to guaranteed Recovery Point Objectives (RPOs) or Recovery Time Objectives (RTOs) under the standard backup service.

10.2. The maximum potential data gap depends on the agreed backup frequency and the availability of the latest successful backup.

10.3. Actual restoration time depends on factors including:

• Data volume.
• System complexity.
• Availability of the relevant backup copy.
• Availability and performance of the target infrastructure.
• Third-party service availability.
• Nature and extent of the failure.
• Additional investigation or remediation required.

10.4. Any specific RPO or RTO commitment must be expressly agreed in writing, including its scope, measurement conditions, dependencies and applicable fees.

10.5. The Provider does not guarantee uninterrupted availability of the backup platform or restoration infrastructure.

11. Customer responsibilities

11.1. The Customer must provide and maintain the access and information reasonably required for the Provider to perform the backup service.

11.2. The Customer must notify the Provider promptly of changes that may affect backup feasibility or reliability, including:

• Changes to server or hosting arrangements.
• Changes to website or application structure.
• Changes to database configuration.
• Changes to access credentials or permissions.
• Changes made by other developers or service providers.
• Significant changes to the volume or type of data.

11.3. Where reasonably possible, planned changes affecting backup operations should be communicated in advance.

11.4. The Customer must not knowingly interfere with backup operations or remove necessary access without informing the Provider.

11.5. For standalone backup services, the Customer remains responsible for the security, maintenance, operation and availability of the underlying system.

11.6. The Customer is responsible for ensuring that the data supplied for backup may lawfully be stored and processed for the agreed purpose.

11.7. The Customer must identify any specific regulatory, contractual or data-residency requirements that affect the backup arrangement before activation.

12. Destructive and high-risk work

12.1. Before performing potentially destructive or high-risk work within the Provider's control, the Provider will verify that an appropriate backup or snapshot exists where technically possible.

12.2. If no usable backup is available, the Provider will inform the Customer and obtain approval before proceeding, where reasonably practicable.

12.3. This provision does not require the Provider to create a backup where doing so is technically impossible, unsafe or outside the agreed service scope.

12.4. The Provider will not knowingly represent an unverified backup as a confirmed usable recovery point.

13. Security and access

13.1. The Provider will take reasonable measures to protect backup data against unauthorised access, disclosure, alteration or loss.

13.2. Access to backup data and storage systems is restricted to persons and accounts requiring access for the commissioned services.

13.3. The Provider will use appropriate administrative and technical access controls in accordance with the applicable Technical and Organisational Measures.

13.4. Where the Provider processes personal data in connection with backup services on behalf of the Customer, the applicable Data Processing Agreement governs that processing.

13.5. The Customer must not provide unnecessary credentials or access to unrelated systems or data.

13.6. The Provider will revoke access credentials when they are no longer required.

14. Data protection and subprocessors

14.1. Where backup services involve processing personal data on behalf of the Customer, the applicable DPA must be in place before that processing begins.

14.2. Microsoft Azure may be used as a storage provider for commissioned backup services.

14.3. The applicable Subprocessor Schedule identifies relevant subprocessors involved in processing Customer personal data, where required.

14.4. The Provider will notify the Customer of intended additions or replacements of relevant subprocessors in accordance with the DPA.

14.5. Backup data and related metadata will be handled in accordance with the Agreement, DPA, TOMs and applicable data protection law.

15. Service limitations

15.1. Backup services are intended to provide an additional means of recovering covered data. They do not guarantee that data can always be recovered.

15.2. The Provider is not responsible for:

• Data irrecoverably lost before the backup service began.
• Data that was never successfully backed up.
• Data outside the agreed backup scope.
• Failures caused solely by systems or third parties outside the Provider's responsibility.
• Restoration failures caused by unavailable or incompatible target infrastructure outside the Provider's control.
• Consequences of Customer or third-party changes that materially affect backup operations and were not communicated where notification was reasonably possible.

15.3. These limitations do not exclude the Provider's liability for negligent failure to perform express backup obligations where such liability cannot legally be excluded or limited.

15.4. The liability provisions of the Managed Services Agreement apply, together with any backup-specific liability arrangement expressly recorded in the Service Confirmation.

15.5. Any agreed backup liability cap must be assessed in relation to the actual backup scope, frequency, retention, capacity, testing and restoration obligations and must comply with mandatory law.

16. Termination and backup deletion

16.1. On termination of the backup service, scheduled backup jobs stop on the agreed service end date.

16.2. Existing backup data remains available for up to 30 days after the effective termination date, allowing the Customer to request a final restoration or export, subject to technical availability.

16.3. The Customer must submit any final restoration or export request within that period and provide any necessary instructions or destination details.

16.4. After the 30-day period, active backup data may be deleted, subject to technical feasibility and applicable legal retention requirements.

16.5. Residual backup copies expire according to the underlying storage and deletion mechanisms. Their deletion may not occur simultaneously with deletion of active backup data.

16.6. Extended retention requires express written agreement and may incur additional fees.

16.7. The Provider will not retain backup data indefinitely merely because the Customer has not requested an export or restoration.

16.8. Termination does not affect any outstanding payment obligations or the Provider's liability for obligations arising before termination.

17. Fees and additional work

17.1. The recurring backup fee and applicable capacity tier are identified in the Service Confirmation.

17.2. Technical assessment, onboarding, additional storage, exceptional external costs and work outside the agreed scope may be separately charged where agreed.

17.3. Additional routine restoration work is charged at €75 per hour in 15-minute increments, subject to prior approval.

17.4. Extensive recovery, disaster recovery, complex investigation and migration work require a separate quotation.

17.5. No additional recurring charge will be introduced without the Customer's approval.

18. Amendments and technical configuration

18.1. The Provider may make reasonable technical changes to backup tools, software or implementation methods where necessary to maintain or improve the service, provided the agreed scope, storage-location requirements and contractual obligations are maintained.

18.2. Material changes to backup frequency, retention, capacity, storage region, redundancy configuration or other agreed service characteristics require the Customer's agreement.

18.3. Any customer-specific variation must be recorded in the Service Confirmation or a subsequent written amendment.

19. Final provisions

19.1. This Schedule forms part of the Managed Services Agreement.

19.2. Terms not specifically defined in this Schedule have the meaning assigned to them in the Managed Services Agreement.

19.3. If a provision of this Schedule conflicts with mandatory law, the mandatory legal provision prevails.

19.4. Amendments to this Schedule must be agreed in writing. Email is sufficient unless mandatory law requires a stricter form.

---

End of Backup and Restoration Schedule