If you decide to use a local partner to resell your SaaS software to customers outside of the countries in which you are based, you will need to have an international distribution/reseller agreement in place between yourself and each distributor/reseller. What is a Reseller/Distributor? A reseller is the same as
Continue readingBodle Law
SaaS and the legal cloud made simple
SaaS Agreements – Data Protection – Microsoft must disclose data on EU server
Many SaaS customers falsely believe that if their SaaS data is stored in a data centre located in the EU it will be protected against disclosure to the US authorities. This is incorrect. The recent US court ruling against Microsoft has confirmed the position, namely that SaaS suppliers and SaaS customers who use data centres located in the EU, owned by US companies, cannot prevent US authorities from accessing their data.
Continue readingSaaS Agreements – Data Protection – BYOD
Employees are increasingly using their privately owned devices (i.e. Ipads, tablets, mobile phones and laptops) for business purposes and may be accessing SaaS customer data using them. SaaS suppliers who allow staff to use such “bring your own devices” (BYOD) for work purposes should be aware of their duties to protect any SaaS customer personal data being accessed by staff using such BYODs.
Continue readingSaaS Agreements – Terms and Conditions – Risk Assessment
SaaS customers often complain that the security provisions in SaaS agreements are inadequate and lack transparency. Following a risk assessment, often using external auditors and regulators, SaaS customers often ask SaaS suppliers to add numerous additional terms and warranties to their SaaS terms. By including the security provisions set out below in your standard SaaS agreement, SaaS suppliers can avoid having more rigorous provisions imposed upon them.
Continue readingSaaS Agreements – Legal Requirements – Online SaaS Sales
SaaS suppliers making online sales of SaaS services to business customers in the UK need to ensure that they have the necessary legal documents and information available on their website to comply with English law. Simply having a SaaS agreement online will not cover all legal obligations in the UK when providing SaaS services online. Below is a summary of the documents and information that you should have available on a UK website.
Continue readingSaaS Agreements – Terms and Conditions – Safe Harbor Adequacy
European data protection authorities have recently raised serious reservations about the effectiveness of the safe harbour scheme and its ability to adequately protect SaaS customer data to the same standard as European data protection laws. If you are a SaaS supplier and are considering/or are already using a company located in the US to provide part of your SaaS services i.e. for hosting, you should be aware of the existence and limitations of the safe harbor scheme.
Continue readingSaaS Agreements – SLAs – Business Continuity and Escrow Agents
SaaS customers are increasingly asking for disaster recover provisions to be included within the terms of a SaaS agreement to ensure that they have access to their data and continuity of service if a problem arises at the SaaS supplier’s data centre. The costs of providing disaster recovery used to be prohibitive, due to the requirement of having mirrored servers and transferring data, however there is now a new market opening up with former escrow providers offering a variety of disaster recovery options at affordable prices.
Continue readingSaaS Agreements – Data Protection – Update on the EU Draft Data Protection Regulation
SaaS suppliers should be aware of the recent changes made by the EU Parliament to the draft EU Data Protection Regulation (Regulation). If this amended version of the Regulation becomes law next year the obligations of SaaS suppliers who process personal data on behalf of customers will radically change. A summary of the current main proposed provisions is set out below.
Continue readingSaaS Agreements – Data Protection – Email Marketing and Consent
As a SaaS supplier you will undoubtedly be sending marketing emails in your own name to existing and potential clients to advertise your own products and services, or possibly as a SaaS service on behalf of a customer. In any event you should be aware that the Information Commissioner’s Office (ICO) has issued new guidance on direct marketing, with regard to complying with the Data Protection Act (DPA) and the Privacy and Electronic Communications Regulations (PECR) both of which apply to sending direct marketing to consumers (BTC).
Continue readingSaaS Agreements – Confidential Information – FOIA and SARs
SaaS suppliers are increasingly dealing with subject access requests (SARs) and freedom of information requests (FOIAs) in relation to SaaS customers. Excessive time and costs can be spent dealing with such requests, unless a SaaS supplier’s obligation to comply with or assist a SaaS customer with such requests is clearly defined in the terms of the SaaS agreement.
Continue reading