This eSurfing Cloud Web Application Firewall Service Agreement is entered into between the user ("Party A" or the "Customer") and China Telecom ("Party B"). Party B shall provide the eSurfing Cloud Web Application Firewall Services to Party A through the eSurfing Cloud Website (www.esurfingcloud.com, the "Site" or "eSurfing Cloud") in accordance with this Agreement. Party A shall use the eSurfing Cloud Web Application Firewall Services in accordance with this Agreement.

Before using the eSurfing Cloud Web Application Firewall Services, Party A should fully read, understand and agree to accept and abide by this Agreement. By clicking the 'agree' button, or otherwise expressing or implying to accept this Agreement, or actually using the Web Application Firewall Services in any way, Party A agrees to and accepts this Agreement in whole, and this Agreement shall become a legally binding document between Party A and Party B. If Party A does not agree with this Agreement, it shall not use the eSurfing Cloud Web Application Firewall Services.

If Party A has any questions about this Agreement, it shall make queries via the means set out in this Agreement or on the Site and Party B will explain to and clarify with Party A. If Party A does not agree with any of the contents of this Agreement or is unable to accurately understand Party B's explanations, it shall not subscribe to or use eSurfing Cloud services.

Article 1   Product and Service Description

1.1           Party B provides Party A with the eSurfing Cloud Web Application Firewall Services (the "Services" hereinafter) in accordance with this Agreement. eSurfing Cloud Web Application Firewall protects users from cyber-attacks, intrusions, vulnerability exploitation, horse-hanging, tampering, backdoors, crawlers, domain name hijacking and other website and web business security issues by relying on the cloud security network formed by the eSurfing Cloud's cloud security nodes together with cloud-based big data analysis platform, thereby ensuring website security.

Article 2   Service Content

2.1       Party B shall provide Party A with the Services in accordance with this Agreement. The specific content of the Services is subject to the service displayed on the Site, applied by Party A and actually provided by Party B. Party B has the right to continuously update the service content.

2.2       Pre-conditions for provision of the Services: In order to use the Services, Party A shall first meet all the following conditions:

(1)        Agree to and accept the eSurfing Cloud User Agreement, successfully register as a user of the Site, and continue to have a legal and valid user account of the Site as at the time of signing this Agreement and throughout the performance of this Agreement;

(2)        Agree to and accept the terms of this Agreement;

(3)        Agree to and accept the eSurfing Cloud Service Agreement;

(4)        Subscribe to and use the Services in accordance with the Service Rules of the Site;

(5)        At the time of signing and during the performance of this Agreement, all the qualifications or government approval procedures required for legal operations have been obtained and maintained in accordance with the relevant national regulations, and the relevant qualification documents have been submitted in accordance with this Agreement to Party B and approved by Party B. The relevant licenses or approvals that Party A shall obtain and maintain include but are not limited to the following: 

1)          If Party A operates a website, it shall ensure that all the websites it operates have been licensed or approved by the relevant authorities of the relevant countries or regions;

2)          If Party A provides non-commercial Internet information services, it shall go through the filing procedures of non-commercial websites, and ensure that all the filing information submitted is true and valid, and submit the updated information in the filing system in a timely manner if there is any change in the filing information;

3)          If the website provides commercial Internet information services, Party A shall also obtain a commercial website license from the local communications administrative department;

4)          If Party A provides BBS and other electronic bulletin services, it shall conduct filing or obtain corresponding approval according to relevant laws and policies;

5)          If Party A operates an Internet game website, it shall obtain an Internet culture business permit in accordance with laws;

6)          If Party A operates an Internet video website, it shall obtain a license for publication of audio-visual programs through information network in accordance with laws;

7)          If Party A engages in Internet information services such as news, publishing, education, medical care, pharmaceuticals, and medical devices, it shall obtain the approval by relevant competent authorities in accordance with laws, administrative regulations, and relevant state regulations. Party A shall obtain the approval by relevant competent authorities in accordance with laws before applying for business licence or performing the filing procedures.

The above list does not exhaust all types of licenses or approvals required for commercial or non-commercial activities that Party A engages in. Party A shall obtain relevant licenses or approvals and shall comply with relevant laws and regulations promulgated by relevant countries and regions from time to time.

(6)        Other preconditions for using the Services as stipulated in this Agreement.

Article 3   Service Activation

3.1       After carefully reading the Service Rules corresponding to the purchased service, Party A can purchase the required service online through the Site according to its own needs, or have the account manager assist in activating it at the service console. After the service is activated, Party A can log in to the Site and complete the configuration and operation of the Services in the management console.

3.2       If there is any inconsistency in the text of this Agreement, attachments, Service Rules, service descriptions, price descriptions, confirmation terms on the order page, they shall be applicable on the following order of precedence: (1) service descriptions and price descriptions on the relevant webpages on the Site, and confirmation terms on the order page, (2) Service Rules, (3) the text of this Agreement, and (4) the attachments to this Agreement.

Article 4   Service Fees

4.1       Fixed monthly/annual billing is available for the Services. The Customer shall pay Party B the service fee as instructed on the subscription page and as agreed herein.

4.2       Resource Expiration/Data Deletion and Consequences of Payment Default

4.2.1    For fixed monthly/annual subscriptions, if the Customer intends to continue its use of the Services upon the expiration of the current service period, it shall renew and pay for the subscription in a timely manner. Otherwise, Party B will suspend the Customer's permissions to perform operation and freeze the resources on the cloud server instance upon the expiration of the service period. Party B will, following the expiration of the service period, reserve the resources of the cloud server instance and retain the Customer's data for another fifteen (15) days (i.e., starting from the moment the Customer's permissions to perform operation is suspended on the day of such suspension and ending on the same moment on the fifteenth day thereafter); if the Customer fails to renew and pay for the subscription within the said period of fifteen (15) days, Party B has the right to release the resources of the instance occupied by the Customer and delete the data thereon upon the expiration of such period.

Article 5 Service Specifications

5.1       The Customer understands and agrees that the use of the Services is its decision made after its independent and careful judgement, and that the Customer shall be responsible for its own judgement and operations, including but not limited to:

5.1.1   The Customer shall judge by itself the suitability of the Services to its business security requirements;

5.1.2   The Customer shall submit its configuration requirements through the Web Application Firewall console and ensure the accuracy of such requirements. The platform will complete the configuration based on the requirements submitted by the Customer. The Customer shall be solely responsible for all such operations and the consequences thereof; and

5.1.3   Unless otherwise agreed by the Parties, if the Customer uses other eSurfing Cloud services along with the Services, the Customer shall pay the service fee to Party B as set forth in the fee schedule for such other services and comply with the service terms thereof.

5.2      Party B shall provide the Services pursuant to this Agreement. The Services include only the Web Application Firewall Services and the extensions thereof. The Customer shall be solely responsible for the content connected to Web Application Firewall, and ensure the content connected to comply with the relevant policies and regulations.

5.3       In normal circumstances, during its use of the Services, if the Customer needs other eSurfing Cloud services (such as media storage, cloud server and alike), it shall activate, subscribe to, and pay separately for such infrastructure products, and Party B will provide services in accordance with the terms of service and service level agreements for such infrastructure products.

5.4       When the Customer uses the Services, it shall back up data and bear the risk of data loss, omission, or damage caused by its own reasons.

5.5       The Customer may not authorize any third party other than itself to use the Services hereunder by transferring, leasing the Services or providing access to the Services for free, or in any other manner.

5.6       If the Customer no longer intends to use the Services, it shall adjust the configuration and transfer the content connected away from the Web Application Firewall platform to ensure no more usage is generated. If the content is not transferred out of the Web Application Firewall platform in a timely manner, resulting in continued usage and cost of the Web Application Firewall platform, the Customer shall be deemed to continue to use the Services and shall pay Party B in accordance with this Agreement.

Article 6   Customer Service Warranty

6.1       Party B provides Party A with customer service via the service hotline +852 3100 0000.

6.2       Party B shall provide 24/7 after-sales service to Party A.

6.3       Party B provides Party A with customer services within a response time of no more than 30 minutes after acceptance of a fault; and of no more than 1 hour after acceptance of a non-fault case.

Article 7   Technical Support Warranty

7.1       After Party B accepts Party A’s fault or after Party B’s non-fault acceptance, it will provide Party A with technical support warranty according to the specific situation and Party A’s needs. The service time of Party B’s engineers is 7 days x 24 hours.

Article 8   Party A's Rights and Obligations

8.1       Party A has the right to use the Services and obtain technical support and after-sales service from Party B in accordance with this Agreement.

8.2       Party A shall provide Party B with necessary technical parameters, including but not limited to IP address segments and corresponding application types, server-related parameters, networking structure and network resources, and actively cooperate with Party B to complete the implementation and commissioning of the Web Application Firewall Services project to ensure the normal operation of the Services.

8.3       Party A understands and agrees that, out of concern about Party A’s data and system security, when Party A requires Party B’s engineers to directly operate its Services, Party A should authorize it by email, ticket, telephone and other means. Party A shall designate the only contact person as the authorizer (maintainer) who shall authorize Party B when necessary, which means that only the authorizer has the right to require Party B's engineers to operate its Services. Party A is only responsible for the availability of the Services itself, and the binding relations between the Services and other cloud products / instances are the responsibility of Party B. In addition, during the period of authorization, if Party A fails to communicate with Party B's engineers and conducts operations on its own, the business unavailability and other risks resulting from such failure shall be borne by Party A.

8.4       When Party A uses the Services, it shall back up data and bear the risk of data loss, omission, or damage caused by its own reasons, and Party B shall not be liable for this.

8.5       If Party A violates any of the warranties in this Agreement, and the eSurfing Cloud User Agreement, including but not limited to the following circumstances, Party A shall bear the corresponding liability for breach of contract:

8.5.1        Where Party A does not have all the qualifications and permits required to carry out business and perform relevant procedures when signing this Agreement, or loses all or part of its qualifications and permits during the validity period of this Agreement, Party B has the right to suspend the provision of cloud business services and require Party A to make corrections within the time limit. If Party A fails to make corrections within the time limit, Party B has the right to terminate this Agreement without assuming any responsibility. Party A shall bear the liability for breach of contract and compensate Party B for the corresponding losses;

8.5.2        Where Party A uses the Services to upload, download, store, and publish content that violates laws and regulations, departmental regulations, or national policies, and information that infringes on the legitimate rights and interests of others and/or other information or content that is detrimental to social order, public security, and public morals;

8.5.3        Where Party A carries out fraudulent and misleading behaviours such as gambling prizes and gambling games, or conducts Internet activities such as "private servers" and "plug-ins" that infringe on the intellectual property rights or other legitimate rights and interests of others;

8.5.4        Where Party A conducts malicious scanning, illegal intrusion into the system, illegal acquisition of data and other behaviours that damage or attempt to damage network security;

8.5.5        Where Party A runs irrelevant programs or intentionally writes malicious codes, resulting in a large amount of server memory, CPU or IP resources, and network bandwidth resources; or

8.5.6        Where Party A engages in any activities including but not limited to "DNS resolution", "security services", "domain name proxy", "reverse proxy" that may cause users to be frequently attacked (including but not limited to DDoS attacks), thereby affecting the eSurfing Cloud service platform or others.

8.6       Party A understands and fully recognizes that although Party B has established (and will continue to improve according to technological development) necessary technical measures to defend against matters or behaviours that endanger network security including computer viruses, network intrusions and attack damage (including but not limited to DDoS) (hereinafter collectively referred to as such Behaviour), however, in view of the limitations and relativity of network security technology and the unpredictability of such Behaviour, if Party A’s account experiences such Behaviour, which does harm to Party B or Party B’s network or server (including but not limited to local, foreign and international networks, servers), or affects the smooth communication between Party B and the Internet or between Party B and specific networks, servers, and Party B’s internal communications, Party B has the right to decide to suspend or terminate the Services. If a major network accident is caused to Party B for reasons attributable to Party A, Party B will reserve the right to claim compensation from Party A. If a crime is involved, Party A shall bear criminal responsibility according to the laws.

If Party B terminates the provision of the Services to Party A due to reasons set out in the above clauses, Party B will calculate the service fee based on the actual number of days used by Party A, and return the remaining payment (if any) to Party A's eSurfing Cloud account.

8.7       Party A shall be responsible for the integrity and confidentiality of the data stored on the eSurfing Cloud platform and the codes and passwords for entering and managing various products and services on the eSurfing Cloud platform, and shall take necessary and effective confidentiality and security protection measures, including but not limited to standardizing permission administration for data access and account use, setting strong passwords and changing them regularly. Party A shall bear the losses and consequences caused by the loss or leakage of the above-mentioned data, codes, passwords, and alike due to improper maintenance or confidentiality by Party A.

8.8       If services in Mainland China are involved, Party A must keep the access log records of its website in accordance with the provisions of the Network Security Law, the Administrative Measures on Internet Information Services and other laws and regulations, including the content of the published information, the time of publication, and the Internet Protocol address (IP), domain names, and alike, which shall be provided to the relevant state agency when it requires according to the law. Party A shall bear the corresponding legal liabilities arising from failure to keep relevant records as required.

Article 9   Term and Termination of the Agreement

9.1       This Agreement becomes effective from the date when Party A successfully purchases or applies for activation of the product, and terminates when the subscription service period of Party A expires, unless otherwise agreed by the Parties.

9.2       This Agreement may be terminated earlier if the Parties reach a consensus.

9.3       Party B has the right to terminate this Agreement under the following circumstances:

9.3.1        According to the requirements of laws and regulations or government agencies;

9.3.2        Where Party B believes that continuing to provide services to Party A will cause huge economic or technical burdens or major security risks to Party B;

9.3.3        Due to any legal or policy changes, it is not practical for Party B to continue to provide services to Party A;

9.3.4        Where Party A fails to pay relevant fees in full and on time;

9.3.5        Where Party A violates the eSurfing Cloud User Agreement, the eSurfing Cloud Service Agreement, the eSurfing Cloud Legal Statement or the eSurfing Cloud Privacy Policy;

9.3.6        Where Party A does not meet any of the pre-conditions for the Services set out in Article 2.2 herein; or

9.3.7       Where Party A violates other terms of this Agreement.

9.4       Except as stipulated in Article 0, if Party B terminates this Agreement according to this Agreement, Party B will calculate the service fee based on the actual number of days used by Party A, return the remaining payment (if any) to Party A's eSurfing Cloud account, and reserve the right to pursue liabilities from Party A for its breach of contract.

9.5       Party B may terminate the Services by publishing an announcement on the Site, or by sending Party A an internal notice or a written notice 30 days in advance, at which time, Party B shall return the amount paid by Party A but not consumed (without interest) to Party A's eSurfing cloud account.

9.6       If any clause in this Agreement is completely or partially invalid or unenforceable for any reason, the rest of the clauses in this Agreement shall still be valid and binding.

Article 10   Others

10.1     The termination of this Agreement will not affect the effectiveness of the eSurfing Cloud User Agreement between Party A and Party B. If the eSurfing Cloud User Agreement between Party A and Party B is terminated, this Agreement will be automatically terminated.

10.2     For matters not stipulated in this Agreement, the Parties shall abide by the provisions set out in the eSurfing Cloud User Agreement and the eSurfing Cloud Service Agreement. If there is any conflict on the same matter in this Agreement, the eSurfing Cloud User Agreement and the eSurfing Cloud Service Agreement, this Agreement shall prevail.

10.3     In the event of any conflict or inconsistency between the English and the Chinese versions of this Agreement, the English version shall prevail. If there is any unclear part in the Chinese version, please refer to the English version.