Version 1 Effective date: 23 December 2025 Version history
These General Terms and Conditions of Service (the "Terms") are entered into between France Nuage SAS, with a share capital of 60 000 €, registered with the La Roche-sur-Yon Trade and Companies Register under number 995 331 071, whose registered office is at 11 avenue de la Promenade, 85140 Essarts-en-Bocage, France, operating under the Bunker brand ("Bunker"), and the business customer subscribing to a Service (the "Customer"). Use of the website itself is governed by the Website Terms of Use.
Article 1 Provider and assignment
1.1. The Services are provided by France Nuage SAS, with a share capital of 60 000 €, registered with the La Roche-sur-Yon Trade and Companies Register under number 995 331 071, whose registered office is at 11 avenue de la Promenade, 85140 Essarts-en-Bocage, France, operating under the Bunker brand. The legal notice gives its full contact details.
1.2. Bunker may assign the Agreement to a company that controls it or that it controls, within the meaning of article L233-3 of the French Commercial Code, after informing the Customer in writing. The Customer may then terminate the Agreement free of charge within 30 days of that notice.
Article 2 Definitions
Service: any hosting, infrastructure or managed service subscribed to by the Customer. Managed Service: software published by a third party, most often open source, that Bunker installs, operates and maintains for the Customer. Order Form: the signed document, or the accepted online subscription, that sets out the Service, the plan, the price and the Customer's contacts. Hosted Data: data that the Customer or its users place in a Service. Business Day: Monday to Friday, excluding public holidays in France.
Article 3 Contractual documents
3.1. The Agreement consists of the following documents, in decreasing order of precedence: (i) the accepted Order Form; (ii) the specific terms of the Service, where they exist; (iii) the Data Processing Agreement (DPA) and its annexes; (iv) the Service Level Agreement; (v) the Shared Responsibility Annex; (vi) these Terms, in the version in force on the date of acceptance.
3.2. Commercial pages, documentation and the trust center describe the practices of Bunker for information purposes. Only the commitments set out in the documents listed in article 3.1 have contractual value.
3.3. The Agreement is the entire agreement between the parties on its subject matter and supersedes any prior exchange on the same subject.
Article 4 Subscription, acceptance and term
4.1. The Services are reserved for businesses. The Customer accepts these Terms expressly: by ticking the box provided during the online subscription, or by signing an Order Form. Merely browsing the website does not constitute acceptance.
4.2. Unless the Order Form states otherwise, a subscription is entered into for one month, renewed automatically. The Customer may terminate it at any time from its console or in writing; termination takes effect at the end of the current period.
Article 5 Prices, invoicing and payment
5.1. Prices are those of the Order Form or, failing that, those published on the Pricing page on the subscription date. They are stated excluding VAT and are payable in advance, per billing period.
5.2. Any late payment automatically incurs penalties at the interest rate applied by the European Central Bank to its most recent refinancing operation, plus ten percentage points, and the fixed recovery fee of 40 euros provided for by the French Commercial Code.
5.3. After a formal notice that has remained without effect for 15 days, Bunker may suspend the Service concerned until payment, without this suspension terminating the Agreement.
Article 6 Use of the Services
6.1. The Customer uses the Services in accordance with the law and uses them neither to undermine the security of the platform, of other customers or of third parties, nor to host manifestly unlawful content.
6.2. Where a plan advertises "unlimited" users or volume, use remains reasonable, that is limited to the own needs of the Customer and its staff, without resale or provision to third parties. In the event of use manifestly beyond those needs, Bunker proposes a suitable plan in writing; it does not suspend the Service on that ground alone.
Article 7 Shared responsibility and Customer commitments
7.1. The Shared Responsibility Annex allocates, for each Managed Service, what falls to Bunker (infrastructure, system, software version and patches, instance backups, encryption of the secrets stored by the instance, monitoring) and what falls to the Customer (user accounts and rights, activation of the access options offered, choice of the connected sources, rights of the connection accounts, security and backup of those sources, lawfulness of the data and retention periods).
7.2. The Customer undertakes to: (a) connect its data sources through dedicated accounts, limited to what is strictly necessary and read-only where possible; (b) change those credentials at the request of Bunker or after any incident; (c) activate the single sign-on, multi-factor authentication, IP allow-list or private access options offered for its Service; (d) inform Bunker in writing before connecting sensitive data, password hashes or payment data.
Article 8 Security
8.1. Bunker implements the measures described in Annex 2 of the Data Processing Agreement (DPA), appropriate to the state of the art, the costs of implementation and the risks, in accordance with article 32 of the GDPR. This is a best-efforts obligation.
8.2. No system exposed to the Internet is free of vulnerabilities, in particular in software published by third parties. The security measures may change, without reducing the overall level of security.
Article 9 Patches and maintenance of Managed Services
9.1. Bunker deploys the corrective releases published by the software vendor, after checking their stability.
9.2. For a vulnerability that Bunker rates as critical, in particular when it can be exploited remotely without authentication or is reported as actively exploited, Bunker deploys the patch or implements a mitigation (restricted exposure, filtering, temporary suspension) as soon as possible after the patch is published.
9.3. These operations may take place without notice and outside the maintenance window. Planned maintenance is announced at least 5 Business Days in advance. Unavailability resulting from these operations is excluded from the service level calculation.
Article 10 Protective measures and suspension
10.1. In the event of an actual or reasonably suspected security incident, of an unpatched critical vulnerability, or of use that endangers the platform, other customers or data subjects, Bunker may take any proportionate measure without prior consent: network isolation, cutting public access, revoking sessions and tokens, rotating the secrets it manages, freezing an instance, preserving copies and logs.
10.2. It informs the Customer as soon as possible and lifts the measure as soon as its cause disappears. These measures do not give rise to its liability and are excluded from the service levels, unless they result from a breach by Bunker.
10.3. Outside these cases and article 5.3, Bunker only suspends a Service in the event of a serious breach of article 6 by the Customer, after a formal notice that has remained without effect for 8 days.
Article 11 Service levels
11.1. The availability targets, their measurement and the service credits are set out in the Service Level Agreement.
11.2. Service credits are the only compensation due for failure to meet the availability levels and count towards the cap of article 15.3. Other breaches fall under article 15.
Article 12 Backups and data loss
12.1. For each Managed Service, Bunker backs up the instance database and keeps those backups for 30 days, unless the Order Form provides for a different period.
12.2. In the event of loss or corruption of Hosted Data attributable to Bunker, it restores the latest available backup as soon as possible. This restoration and compensation for the reasonable costs of recreating the data created after that backup constitute the remedy due on that ground, within the limit of article 15.3, except in the event of gross negligence or wilful misconduct.
12.3. The Customer remains responsible for the security and backup of its data sources hosted outside Bunker.
Article 13 Personal data
Where Bunker processes personal data on behalf of the Customer, the Data Processing Agreement (DPA) applies. It sets out in particular the notification of data breaches (article 11) and the assistance to the Customer (article 6.12).
Article 14 Logs, evidence and notices
14.1. Access, administration and network logs are kept for 90 days. In the event of an incident, the relevant items are kept until the investigation is closed.
14.2. Time-stamped records from the systems of Bunker, emails and tickets are evidence of their content and date, unless proven otherwise.
14.3. Notices under the Agreement are sent to the addresses designated in the Order Form or, failing that, to the address of the Customer's account.
Article 15 Liability
15.1. Each party is liable for the direct and foreseeable damage, proven, caused by the non-performance of its obligations.
15.2. Indirect damage is excluded, namely loss of revenue, profit or customers and damage to reputation.
15.3. For all causes combined, the total liability of Bunker is limited, per twelve-month period, to the amount of the fees, excluding VAT, paid by the Customer for the Service concerned during the twelve months preceding the event giving rise to liability, and shall not be less than €10,000.
15.4. These limitations do not apply in the event of gross negligence or wilful misconduct, personal injury, or where the law prohibits them.
15.5. They apply only between the parties. They affect neither the right to compensation of data subjects under article 82 of the GDPR nor the powers of the supervisory authorities. Recourse between the parties under article 82.5 of the GDPR is exercised in proportion to each party's share of responsibility.
Article 16 Force majeure
Force majeure means any event meeting the conditions of article 1218 of the French Civil Code, including a cyberattack that could not reasonably have been foreseen and whose effects could not have been avoided by appropriate measures consistent with the state of the art.
Article 17 Confidentiality
Each party keeps confidential the non-public information received from the other under the Agreement, during its term and for 5 years after it ends, except where required by law or by order of an authority.
Article 18 End of the Agreement and reversibility
At the end of the Agreement, the Customer may retrieve its Hosted Data in open formats for 30 days. Bunker then deletes them, under the conditions of article 13 of the Data Processing Agreement (DPA).
Article 19 Changes to these Terms
19.1. Any new version of these Terms is numbered, dated, archived at a permanent address (version history) and notified to the Customer by email at least 30 days before it enters into force. A Customer that refuses it may terminate free of charge before that date.
19.2. No change applies to facts that occurred before it entered into force.
Article 20 Language
These Terms are drafted in French and translated into English. In the event of any discrepancy, the French version prevails.
Article 21 Governing law and jurisdiction
The Agreement is governed by French law. Failing an amicable settlement within 30 days of a formal notice, any dispute relating to the Agreement is subject to the exclusive jurisdiction of the Commercial Court of La Roche-sur-Yon (France), including for summary proceedings, multiple defendants or third-party claims.
Article 22 Miscellaneous
If a provision of the Agreement is held void, the others remain applicable. Failure to rely on a provision does not constitute a waiver of the right to rely on it later.