2011 – Bodle Law

SaaS Agreements – Need for an Escrow Agreement

20/12/2011 Irene Bodle

As a SaaS supplier you may want to consider offering escrow agreements to your customers, particularly if you run SaaS applications which are critical to your customer’s business.

What is Escrow

Escrow refers to a third party holding a copy of the SaaS software source code on behalf of the customer and the supplier.

What is an Escrow Agent

An escrow agent is a third party who stores a copy of the SaaS software source code. The escrow agent will release a copy of the source code to the customer if any of the events set out in the escrow agreement occur.

Why use Escrow

This is usually a customer driven requirement resulting from the fact that the source code for the SaaS software, the expertise to implement it and rights to the SaaS software are only licensed to, and not owned by, the customer for the term of the SaaS agreement.

Customers are concerned that the supplier may:

fail to maintain the software;
transfer ownership of intellectual property rights in the SaaS software;
become insolvent; or
become unable to carry on supporting and maintaining the software for some other reason.

By having an escrow agreement in place the customer has the right to continue to use the software, if the supplier is in default of its obligations under the SaaS agreement.

Advantages of an Escrow Agreement

Having an escrow agreement in place protects all parties involved in the development, supply and use of business critical SaaS applications. It provides customers with peace of mind for securing long-term availability of a critical SaaS application by enabling customers to update software and fix any bugs even if the supplier is no longer able to support them.

Disadvantages of an Escrow Agreement

Having the right to use the software under an escrow agreement is in reality of little use if the customer does not have the know-how and resources to actually use, maintain and support the source code itself.

Also, the costs of setting up an escrow agreement and maintaining it are relatively expensive. Escrow costs are usually paid for by the customer.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Reseller/Distribution – Need for a Reseller Agreement

06/12/2011 Irene Bodle

If you decide to use a local partner to resell your SaaS software to customers outside of the countries in which you are based, you will need to have a distribution/reseller agreement in place between yourself and each distributor/reseller.

What is a Reseller/Distributor?

A reseller is the same as a distributor. A reseller/distributor purchases the supplier’s SaaS software and services under the terms of a reseller/distribution agreement. The reseller/distributor then resells the SaaS software and services to its own local customers in the territory using its own terms and conditions (and SLA). The SaaS supplier has no legal relationship with the reseller/distributor’s customers. Customers enter into a SaaS agreement with the reseller/distributor directly.

Why use a Reseller/Distributor?

Most SaaS suppliers use distributors to enable them to sell their software and services to SaaS customers who would not otherwise purchase the SaaS software, due to the Supplier’s:

Lack of physical presence in the SaaS customer’s country;
Lack of sales channels and contacts in the SaaS customer’s country;
Inability to speak the local language;
Inability to provide SaaS customer support in the local language;
Inability to provide customer support within the SaaS customer’s local business hours;
Terms and conditions not being written in the SaaS customer’s language, or subject to local laws and regulations.

By using a distributor/reseller the above problems are resolved as the distributor/reseller sells the SaaS software directly to SaaS customers, in the local language, pursuant to local law, with local support as if the SaaS software was his own software.

Advantages

The main advantage of using a reseller/distributor is that the SaaS supplier will have no liability to SaaS customers – as there is no contract or legal relationship between the SaaS customer and the SaaS supplier. For example, any implementation issues or software errors that the SaaS customer encounters when using the SaaS software will be the reseller’s problem. The reseller will be liable to the SaaS customer and will be obliged to resolve such issues directly with the SaaS customer.

Disadvantages

The main disadvantage of using a reseller/distributor is that the SaaS supplier has no control over the sales process and in particular of the choice of SaaS customers. Also, the terms of the SaaS agreement itself will be subject to local anti-competitive laws and regulations.

Is an Agent the same as a Distributor?

Agents are often confused with distributors, but there are clear legal differences. An agent is a person or company who acts on behalf of the SaaS supplier to find leads and/or assist with sales of the supplier’s SaaS software to local SaaS customers in the agent’s territory.

An agent has no legal relationship with the SaaS customer as the agent has no contract with the SaaS customer. The SaaS supplier enters into a SaaS agreement, with the SaaS customer using the SaaS supplier’s own terms and conditions and SLA. The SaaS supplier is liable to the SaaS customers for issues and errors that may arise during use of the SaaS software.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Google Analytics in Germany

22/11/2011 Irene Bodle

If your website uses Google analytics and you provide SaaS services to customers based in Germany you are now required to provide specific information to users in order to comply with recent changes to German data protection law.

Google Analytics and German Data Protection

Google analytics collects statistics about website users by „tracking” an individual’s use of a website. This information is then made available to website operators free of charge. Following an agreement between Google and the German data protection authorities it is now the responsibility of the operators of websites to implement certain measures when using Google analytics.

Making your Website Compliant

Under German data protection law website users must be able to stop user profiles being created and prevent their complete IP address from being saved, unless they have specifically consented to this. If you are a SaaS website operator you now need to include the following in your privacy policy:

inform users that you use Google analytics; and

advise users that they can turn off Google analytics tracking in their browser settings

In addition you should use a Google software solution that masks the IP address of the user.

Application to UK Websites

Although this is a German data protection issue, if your website is directed at German customers, or the majority of your customers are located in Germany, it is advisable to make these changes in order to avoid any potential breach of German data protection law.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLA – Data Backup

08/11/2011 Irene Bodle

When providing SaaS services you must specify in your SaaS agreement who is responsible for the backup/loss of customer data. The extent of your backup duties should be included in the service level agreement (SLA) and these will be dependent on a number of factors set out below.

Backup Process

You should set out details about the nature of the backups and the data media being used, for example:

will the backup be made to tape or disk or using some other media
how often will the backup media be changed/rotated/updated
how often will backups be made i.e. hourly/daily/monthly
will incremental backups be made

Security

In view of customer concerns over data security it is essential that you provide details of where and how the backup media will be stored, for example:

will this be at a physically separate location
will a provider other than the hosting centre be used
what security is in place at the storage location
who has access to the facility
is emergency power available

Disaster Recovery

This should be considered as an add on extra, to cover the eventuality that the hosting centre (where the SaaS software and data backups are created) becomes unusable. The disaster recovery centre should be physically remote from your hosting centre to avoid a double hit! Other points to consider are:

carefully define what a “disaster” is
set out expected data recovery times
test your disaster recovery procedure at least once a year

Commercial Considerations

The exact nature and extent of any data backup (and related disaster recovery) services that you offer to SaaS customers will depend on:

how much has the customer pays for the SaaS solution, maintenance and support
whether or not service credits are offered for breaches of error fix times
whether the SaaS application is business critical i.e. online banking
what is standard in that particular business area

Exclusions

Ensure that errors or problems caused by something beyond your control are excluded from your obligations i.e. loss of data caused by the customer’s failure to use the specified browser, hardware, virus checking programmes etc.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLA – Security Issues

25/10/2011 Irene Bodle

As a SaaS supplier you will have noticed the increasing concerns about security voiced by SaaS customers. Your SaaS agreement should therefore provide comfort to your customer by including security provisions in the service level agreement (SLA). The specific matters you should consider including are set out below.

Access

The persons able to access the hosting centre should be very limited and the individuals should be defined. Access should only be allowed for hardware and software maintenance. A record of all visits should be logged, which can be easily achieved if swipe cards are used. Remember that when using a third party hosting centre, access will be controlled by, and should reflect, the terms of your hosting agreement with the hosting centre.

Physical Security

This should prevent unauthorised access to the hosting centre to prevent damage, loss or theft to hardware and software. Surveillance of the hosting centre is essential and details of whether or not this is 24 x 7, via video camera, watchmen or electronic alarm systems should be included in the SLA. Within the hosting centre itself, racks themselves should be separately secured.

Hosting Environment Security

In order to provide a continuous service to customers, the hosting centre must have:

an uninterrupted power supply;
a dual power source;
air conditioning; and
fire and flood detection systems.

Server Security

In order to protect your servers, you should use:

up to date virus protection;
up to date security patches; and
firewalls.

Data Security

In order to protect customer data you should set out:

how, where and when data will be backed up;
how often data will be backed up;
where backups will be stored; and
when discs/tapes will be rotated.

ISO 27001 Certification

ISO 27001 is an internationally recognised security certification which is often required by SaaS customers who are looking for assurance that adequate levels of data security are in place to protect their data. Having this certification demonstrates to customers your commitment to data security by confirming that you comply with “best practice” security management.

Disaster Recovery

Is this offered at all, consider whether is it included in your standard subscription fee, or if a premium will be charged. Also, remember that your disaster recovery centre should be physically remote from your hosting centre, and with a different provider.

Commercial Considerations

The level of security obligations offered to SaaS customers will depend upon:

how much a customer pays for the SaaS solution, maintenance and support;
whether the SaaS application is business critical i.e. online banking;
what is standard in that particular business area.

Exclusions

Ensure that your SaaS agreement contains appropriate security obligations applicable to your customer, for example using up to date virus programmes. Exclude liability for any security breaches which are caused by something beyond your control or an act, omission or breach of your customer’s security obligations under the SaaS agreement.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Entire Agreement Clauses

26/09/2011 Irene Bodle

In the recent Court of Appeal decision Axa Sun Life Services Plc v Campbell Martin Ltd an entire agreement clause did not exclude liability for pre-contractual misrepresentations although the clause was reasonable under the Unfair Contract Terms Act (UCTA).

What is an Entire Agreement Clause?

An entire agreement clause asserts that the SaaS agreement constitutes the whole agreement between the parties and seeks to prevent the parties from relying on any preceding agreements, negotiations or discussions in any subsequent claims.

Entire agreement clauses form part of the standard provisions of many SaaS agreements, and are frequently used by SaaS suppliers to argue that a customer cannot rely upon pre-contractual misrepresentations. (e.g. verbal promises, product claims, or previous agreements).

Unfair Contract Terms Act (UCTA)

The validity of an entire agreement clause in a SaaS agreement will be determined by a court by applying UCTA. In the AXA case as the agreement was based on AXA’s standard terms of business, UCTA states that a party contracting on its standard terms cannot exclude or restrict liability in respect of its breach unless the clause is reasonable.

Axa Sun Life Services Plc v Campbell Martin Ltd

AXA standard terms contained the following entire agreement clause:

“This Agreement…constitute[s] the entire agreement and understanding between you and us in relation to the subject matter thereof…[and] shall supersede any prior promises, agreements, representations, undertakings or implications where made orally or in writing”

The Court of Appeal held that this entire agreement clause did not exclude AXA’s liability for pre-contractual misrepresentations, even though it was reasonable under UCTA.

Excluding Liability for Pre-Contractual Misrepresentation

It is essential that clear wording is used to exclude liability for misrepresentation. It is not enough to simply state that the agreement “supersedes” any previous representations. The entire agreement clause of your SaaS agreement should state that you have no liability in respect of errors or misleading information that may have been communicated by one party to another and liability for misrepresentation must be specifically excluded.

However, note that under English law liability for fraudulent misrepresentation cannot be excluded or limited.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – E-Discovery

09/09/2011 Irene Bodle

As a SaaS supplier you may be ordered by a court as part of a litigation process to identify and disclose physical documents and electronically stored information (e-discovery). This creates problems for SaaS suppliers on a number of levels.

Location of the ESI

Data is often stored or replicated in an external hosting centre, the SaaS software application itself or a corporate data centre. If numerous data centres are used they are usually in different physical locations and in various countries. Discovery rules may conflict with compliance and privacy requirements in the countries where the data is held, however for the purposes of complying with your obligations under a country’s e-discovery rules the actual location of the data is irrelevant.

For example in AccessData Corporation v ALSTE Technologies GmbH a US court ordered a German company to disclose emails stored in Germany as part of the disclosure process in a court case, although the company argued that this breached the German Data Protection Act.

Compliance Issues

SaaS agreements should therefore permit SaaS suppliers and customers to comply with e-discovery requests, to avoid breaches of requests for disclosure. Although it is unlikely that any sanctions will be taken by the court against the SaaS supplier, the customer may try to claim damages for any losses it sustains. The SaaS supplier should therefore ensure that they exclude liability under the SaaS agreement for a technical or any other type of failure to comply with a disclosure request.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Jurisdiction – Information made Available on the Internet

14/06/2011 Irene Bodle

The Court of Appeal has asked the European Court of Justice (ECJ) to determine where publication takes place when information is made available via the internet in relation to a claim for breach of database rights in the UK.

Current UK Rules

Currently the infringement takes place in the country where the hosting server is based (SaaS provider hosting centre), rather than in the country where the information is actually read or used (downloaded). However, the Court of Appeal has asked the ECJ to clarify the position, to confirm whether infringement takes place in the hosting country or the country where the information is downloaded, or both.

Football Dataco v Sportradar

This issue arose when Football Dataco Ltd created statistics on behalf of the English and Scottish football league and claimed that Sportradar GmbH (a German company with a Swiss parent company, and with servers outside of the UK) had breached its database rights by making the information available to users in the UK.

The High Court used laws covering satellite television to determine that the country from which the information was sent i.e. where the servers were based was the place where the infringement occurred. However it has asked the ECJ to clarify the position.

Implications of the ECJ Decision

It will be important for all SaaS providers to closely monitor the ECJ decision in due course, as hosting servers are not always based in the same country as the users accessing the information and the decision could have wider implications for copyright infringement claims in relation to SaaS Agreements.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLA – Error Fix Times

23/05/2011 Irene Bodle

There are no standard fix times for remedying software errors, problems and bugs in a SaaS agreement. Fix times need to be tailored to the services being provided and should be set out in the service level agreement (SLA). The following factors need to be considered when SaaS suppliers establish fix times in their SaaS agreement.

Duty to Acknowledge, Respond and Fix Errors

Time to acknowledge, respond or fix a SaaS software problem should start to run upon receipt of a customer message, from acknowledgement of the error, or some other trigger event.

Nature and Severity of the Problem

How severe is the problem or error? i.e. critical, medium or low

Is the problem an error (a software problem that can be reproduced) or is it a bug?

Type of SaaS Solution

Is the SaaS application business critical? i.e. online banking

What is standard in that particular business area? i.e. online recruitment, accounting, banking

Commercial Considerations

How much has the customer paid for the SaaS solution, maintenance and support?

Are service credits offered for breaches of the fix times?

Practical Issues

Is there a global support hotline?

Are IT staff available to work 24 x 7?

Does the SaaS provider have access to the third party data centre?

What are the terms of the hosting agreement with the third party data centre?

Exclusions

Ensure that errors or problems caused by something beyond your control are excluded from fix times i.e. the customer’s inability to connect to the Internet.

Exclude errors or problems in the SaaS agreement which are caused by the customer i.e. the customer’s failure to use the specified browser, hardware etc.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Binding Corporate Rules

16/05/2011 Irene Bodle

The German data protection commissioner has recently approved the Binding Corporate Rules (BCRs) of Deutsche Post DHL. This permits the company to transmit personal data internationally in accordance with its privacy policy without having to seek consent from data subjects on an individual basis.

What are Binding Corporate Rules?

BCRs are a set of rules adopted within a particular company or corporate group that provide legally binding protections for data processing within the company or group to cover global data transfers.

Advantages of Binding Corporate Rules

Under the Data Protection Act personal data cannot be transferred to countries outside of the EEA, unless the receiving country has adequate protection. To date only Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and Japan have been deemed “adequate” and US companies are accepted as having equivalent protections if registered under the Safe Harbor regime.

For large businesses with complex corporate structures and numerous cross border data transfers outside of the EU, BCRs can be a real alternative.

Disadvantages of Binding Corporate Rules

Currently only a small number of global companies have implemented BCRs as the rules have to be accepted by each individual EU country’s data protection commissioner. There is also a considerable cost involved and the whole procedure is time consuming and can last a number of years.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: