Tag: SaaS agreement

SaaS Agreements – Freedom of Information Act – Disclosure

Were you aware that if you supply SaaS software to public authorities they can be legally obliged to release details of your SaaS agreement to competitors?

Public Tendering and Disclosure

Atos won a major tender to supply an IT system to a Government department to handle information requests and transactions between Government departments and the public. Atos was the only bidder for the tender.

In 2007 an individual made a request under the Freedom of Information Act (FOI) for disclosure of particular details of the IT agreement. The details requested included information on the liability of Atos, benchmarking and prices. The Data Commissioner ordered the Government department to disclose the details requested.

Right to Refuse Disclose of Confidential Information

The Government department refused to disclose the information pursuant to its rights under section 43 of the FOI, namely that the information requested was a trade secret and that disclosure would damage the commercial interests of the parties. An appeal was made to the Information Tribunal, and last week the Tribunal agreed with the Data Commissioner’s office and ordered that disclosure of some of the details requested was in the public interest.

Are Prices Trade Secrets?

What may be reassuring to SaaS suppliers is that not all of the information requested had to be disclosed on appeal. The Tribunal agreed with Atos that its pricing model was a trade secret and disclosure of this “could undermine the owner’s business and give competitors a commercial advantage”.  The Tribunal also agreed that the exact location of the Atos data centre must not be disclosed, for security reasons, but that the country of its location should be disclosed to show that there was compliance with the Data Protection Act.

Protecting Confidential Information

The above illustrates the real dangers of confidential information being disclosed by a customer, by law. In order to limit and control the information which can be requested and disclosed under a FOI request ,it is essential that adequate clauses are included, not just in any NDA which is signed during the tendering process, but also  in the confidentiality sections of the final SaaS agreement.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Need for an NDA prior to signing a SaaS Agreement

Prior to a SaaS agreement being negotiated with a customer, SaaS suppliers are often required to provide prospects with internal business sensitive information about their prices, polices and software functionality (confidential information) as part of the public procurement, tendering or sales process.

Need for an NDA

If prospects do not sign a non-disclosure agreement (NDA) or confidentiality agreement prior to a SaaS supplier disclosing its business secrets and confidential information, the prospect will have no duty to keep this information confidential.  Confidentiality terms in the later SaaS agreement will only protect information disclosed after this is signed. If the prospect does not become a customer, they will be free to use your confidential information as they please.

An NDA should therefore be signed before providing a prospect with any sensitive information and this should include some basic legal clauses to protect your business if you win the sale and more importantly, if you don’t.

Mutual Protection

Often a prospect will require a SaaS supplier to sign their standard NDA prior to discussing a possible SaaS agreement. More often than not, the prospect’s NDA will only protect their confidential information and not provide the supplier with any protection. It is therefore essential that the NDA includes mutual rights to protect your confidential information.

If the prospect is a public authority this is essential, as under the Freedom of Information Act, your competitors can exercise their right to try to obtain access to your documents via a FOI request if their bid was unsuccessful. If you have an NDA in place with the public authority you may be able to block such requests.

What Information is Confidential?

All information provided by you to a prospect during the sales process should be treated as confidential information. This should also include any documents referred to in the documents you provide as part of your proposal.  You will probably have given the prospect copies of price lists,  functional descriptions of your software and other internal documents which you do not want third parties to see.

If the proposal does not lead to a sale and the prospect is speaking to your competitors…. it is imperative that you have made your definition of confidential information as wide as possible. Additionally the prospect should agree to keep all information confidential and to return or confirm the destruction of all confidential information, if no sale is agreed.

Who may Access the Confidential Information

If you are dealing with a multi-national prospect, you need to carefully state which companies or individuals within the prospect’s group of companies are entitled to see your confidential information. The prospect should undertake to apply the terms of the NDA to all such parties. Conversely, if companies or individuals within your group of companies need to see the prospect’s confidential information, ensure that you have these rights in the NDA.

Please note that these are just some of the basic clauses that need to be included in a NDA. There are many other clauses which have not been referred to here and legal advice should be sought when negotiating the terms of an NDA.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS, ASP Agreements – Liability for Website Content

SaaS suppliers must protect themselves in their SaaS agreement against a third party claiming compensation for breaches of their rights as a result of customers uploading illegal content onto the supplier hosted website.

Service Providers and ISPs

SaaS suppliers are service providers not internet service providers (ISP)s. SaaS suppliers publish content on the Internet on the websites they are hosting for customers. ISPs simply transmit information on behalf of customers i.e. telecommunications companies like AOL and BT and are acting as “mere conduits“.

SaaS suppliers do not check content prior to it being uploaded by customers onto the hosted websites and once uploaded it is not usually monitored by the SaaS supplier. The following legal problems can arise when a third party claims that the content on the website breaches their rights.

Breaches of Intellectual Property Rights (IPR)

The SaaS supplier will be liable as the publisher of the website if any content on the website breaches the copyright or trademark of a third party. Common examples arise when customers:

  • upload content, pictures, colour schemes and fonts copied from other websites, books, newspapers
  • use third party software applications on the website, without authorisation
  • display trademarks or logos of clients, competitors or third parties on the website, without the owner’s permission

Defamation

Similarly, the SaaS supplier as publisher is liable for any defamatory comments made on the website. Such comments could be via a hyperlink or  information published on the website by the customer, its clients or third parties. For example sales text may include negative and untrue comments about the poor services of a named competitor.

Breaches of Other Laws

Many SaaS agreements cover e-recruitment or HCM (human capital management). The content on such websites must comply with mandatory local employment law and non-discrimination laws.  This is particularly important in the text of a job description for applicants. For example an advertisement for a white, British, female, lawyer between the ages of 25 and 35 would be illegal.

Liability for Illegal Content

The SaaS supplier will be liable for any of the above examples of illegal content being published on a customer website, unless Regulation 19 of the E-Commerce Regulations 2002 applies.  This sates that the SaaS supplier is not liable for illegal content

  • if the SaaS supplier does not have actual knowledge of the illegal information, or
  • upon obtaining knowledge or awareness it acts expeditiously to remove or disable access to the information.

It is therefore essential that the above liabilities are excluded in your SaaS agreement and that the SaaS supplier ensures that it has the contractual right in the SaaS agreement to apply the Regulation 19 exception.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS, ASP Agreements – Data Protection Issues with Sub-contractors – Standard Contractual Clauses

Using a sub-contractor to process your SaaS customer data is a problem under data protection law, where the sub-processor is based outside of the European Economic Area (EEA). Incorporating EU standard contractual clauses into your SaaS agreement is NOT the solution to this common problem.

EU Standard Contractual Clauses

Under data protection law personal data may only be transferred to countries outside of the EEA where there is adequate protection. In order to deal with the problem of transfers of personal data from a customer (data controller) in the EEA i.e. in the UK, to a SaaS supplier (data processor) outside of the EEA i.e. a SaaS supplier in Asia, the EU drafted standard contractual clauses. When such clauses are included in a SaaS agreement, the requirement to provide adequate protection for the data being transferred will be met.

New EU Standard Contractual Clauses

In July 2010 the EU standard Contractual Clauses were amended to cover the position where personal data is transferred from a data controller in the EEA (customer) to a data processor outside of the EEA (supplier) and then a transfer to a sub-processor located outside of the EEA.

This is a common scenario in a SaaS agreement where a customer based in the UK is accessing SaaS software provided by a supplier outside of the EEA and the supplier is using a hosting centre or outsourced IT development centre located in India or Asia to process the customer data.

Sub-Processor located outside of the EEA

Despite the above changes to the EU model clauses, where a data processor (supplier) based inside the EEA, instructs a sub-processor based outside of the EEA, to process a customer’s data, the transfer of data is not covered by the new or old standard contractual clauses. This is a common scenario in SaaS agreements where the customer and supplier are both based in the EEA but the SaaS supplier uses a data centre or IT personnel outside the EEA i.e. in Asia to process the customer data.

The transfer of customer data to the sub-processor will not comply with data protection law if the new or old standard contractual clauses are used and an alternative solution will need to be found. This will usually take the form of an additional data protection agreement between the relevant parties.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS, ASP Agreement – SLA – Maintenance and Support Requirements

The maintenance and support section of a SaaS agreement should contain the following essential elements.

Duty to Acknowledge, Respond and Fix Errors

Clearly identify these three actions in the SLA. State when your duty to act starts. Does time for you to acknowledge, respond or fix a problem start to run upon receipt of a customer message, from your acknowledgement of the error, or some other trigger event?

Support and Maintenance Times

Clearly define times for all of your actions. Business hours and days need to be carefully defined in the SaaS agreement. If you have customers outside of the UK, or maintenance and support staff located across the globe, make sure that your business hours and business days are reflected in the SLA.

Supporting Global Customers

In a SaaS agreement which includes non-English speaking customer users, is support only offered in English? Does the service level agreement permit the customer to notify problems in any language other than English?

Response and Fix Times

These should be dependent upon the nature and severity of the problem. The differing levels of the severity of problems reported by the customer in the SLA should be determined by the supplier, not the customer. It is vital in the SaaS agreement to differentiate between errors (problems that can be reproduced) and bugs, when deciding upon severity levels, response and fix times.

Exclusions

Finally, do not forget to exclude errors or problems which have been caused by something beyond your control i.e. the customer’s inability to connect to the Internet. Also exclude errors or problems in the SaaS agreement which are caused by the customer i.e. the customer’s failure to use the specified browser, hardware etc.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Cloud based Software, Cloud based Technologies, Cloud based Services

What is Cloud based Software

Applications that live in the cloud, are also known as SaaS (Software as a Service), on demand, hosted or online applications. Such cloud based services are proving to be useful tools for businesses looking to save money and ease the burden on IT. An increasing number of organisations are entering into SaaS Agreements for their customer relationship, email, financial, recruitment and talent management.

Advantages of Cloud Based Software

In contrast to the traditional, installed software model, SaaS solutions can reduce the administrative burden on IT, personnel and the strain on physical resources caused by supporting and maintaining traditional software. Upfront capital expenditure can also be reduced, as SaaS software is rented on a monthly basis, rather than being purchased outright for a large upfront fee.

The appeal of cloud based software is clear. Businesses are no longer responsible for purchasing, configuring, loading, and maintaining applications onto their own hardware. In very simple terms all that is needed is an Internet connection.

Avoiding Problems

However, due to the unique nature of SaaS applications it is important to obtain specialist legal advice on the terms of the SaaS agreement to ensure that it covers the requirements of your organisation. For example is disaster recovery included, what are the provisions for return of customer data, have you seen a copy of the SLA (service level agreement), are the data protection and security provisions adequate, will the source code be held in escrow by a third party?

If things go wrong, your data is lost and your customers start to move to your competitors –  making a claim for breach of contract will not repair the damage already sustained to your finances and business reputation. These issues should be dealt with upfront, as part of the commercial negotiation process, with the assistance of an experienced specialist SaaS lawyer. Thereby your interests can be adequately covered to minimise the risks of the above scenario occurring.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Cloud Computing and the Legal Cloud

Everyone is talking about “cloud computing” but what is it?

What is Cloud Computing

Cloud computing is a new and rapidly expanding delivery model, often used to supply IT services to customers via the Internet. Cloud computing involves the sharing of resources, software and information on the Internet for users to use on their computers and other devices, on-demand.

Other Related Terms

Where software is supplied using the cloud you will hear people refer to SaaS, software as a service, ASP services and software on demand to describe the provision of the services.

Why refer to a “cloud”

The term “cloud” is used as a metaphor for the Internet, based on the cloud drawing used in the past to represent the telephone network, and later to depict the Internet. Typical cloud computing providers deliver business software applications online which are accessed from another web service or software i.e. a web browser while the software and customer data are stored on servers, hosted by the service provider.

The Legal Cloud

Most cloud computing infrastructures consists of services delivered through hosting centres. The service provided to users are usually set out in a service level agreement (SLA) and the software licence for use of the services and software will be set out in a SaaS agreement.

Help

For assistance with cloud computing matters, SaaS, ASP, software on demand contracts or any other IT legal issues contact:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS, ASP Agreements – Transfer of Personal Data outside of the EEA

There are no restrictions on transferring personal data within the EEA.  However, due to the global nature of SaaS agreements personal data often needs to be  transferred outside of the EEA, for example to an IT outsourcing provider in India, a subsidiary of your company in China or a data centre or software development centre in Vietnam.

Restrictions on Export of Data Outside of the EEA

Under the Data Protection Act 2018 and the GDPR before any personal data may be exported to any country outside of the EEA, you must ensure that there are adequate levels of protection in place. The European Economic Area consists of the 28 EU member states plus Norway, Iceland and Liechtenstein. There are four ways in which adequate levels of protection can be achieved:

  • consent
  • equivalent protection/ safe harbor
  • use of the EU model contract clauses
  • binding corporate rules

Consent

The easiest method of compliance is to obtain specific consent from the data subject before the transfer takes place. If the data subject consents to the transfer, you will comply with the Data Protection Act and the GDPR. Consent is usually obtained by having a data subject agree to the transfer of its personal data outside of the EEA and full details about the transfer itself should be set out in your privacy policy.

Equivalent Protection and Safe Harbor

Alternatively, the transfer is permitted if the non-EEA country to which the personal data is being transferred has equivalent data protection legislation. Currently only Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and Japan are recognised as having adequate protection. Certain companies in the USA are also recognised under the EU-US Privacy Shield, provided that the company to which the personal data is being transferred has an up to date Privacy Shield registration.

EU Model Clauses

The European Commission has issued its own model clauses to cover transfers of personal data outside of the EEA. If these model clauses  are used in the SaaS agreement with the data subject and the agreement with the third party IT outsourcer, data centre or software developer to whom the data is being transferred, there will be adequate protection. However, these clauses are not ideal due to the different legal responsibilities of the data processor and the data controller which still remain unclear in the situation where there is a sub-processor.

Binding Corporate Rules

BCRs are designed to cover transfers of personal data within multi-national companies where they have subsidiaries based in many countries. These rules only permit the inter-company transfer of personal data and do not cover transfers to third parties such as IT outsourcing providers or data centres. To date very few companies have adopted binding corporate rules due to the expense and time it takes for the rules to be recognised within the EU.

Help

For assistance with transfers of personal data within or outside the EEA, SaaS, ASP, software on demand contract  or any other IT legal issues contact:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS, ASP Agreements – FAQs – Disaster Recovery

Do I need disaster recovery provisions in a SaaS agreement?

Disaster Recovery

Disaster recovery sets out the processes and procedures to be followed in the event of SaaS software, or customer data, no longer being accessible due to a problem with the technology infrastructure at the supplier’s data centre.

For example if there is a power cut, flood or fire at the data centre, the server on which the software is running will no longer function and the customer will no longer have full access to the software and its data. If the customer is using the software for a live website, the website will cease to function correctly, or possibly at all.

Supplier Obligations

The disaster recovery provisions of a SaaS agreement should be set out in the SLA and should as a minimum, include the following supplier obligations in the event of a disaster:

  • customers must be notified of the disaster;
  • any third parties used for disaster recovery should be identified;
  • the estimated time for restoring the servers and access to the software and services should be specified; and
  • details should be given about the supplier’s testing procedures i.e. how often its disaster recovery processes are tested.

Costs

The extent and speed of the disaster recovery offered by the supplier will depend upon the fee charged for this service. Suppliers often include the costs of basic disaster recovery in their licence fees. In addition, or as an alternative, they may offer higher levels of disaster recovery for additional fees. The faster and more individual the disaster recovery process is, the higher the fees.

If the supplier does not provide any disaster recovery services, or the customer is not satisfied with the disaster recovery offered, it should consider setting up its own disaster recovery procedure with a third party, particularly if a disaster would be business critical i.e. for a customer providing online banking services.

Avoiding Disasters

The most common disaster recovery risks are power failure, physical damage to the data centre or data and insolvency.

Power Failure

To minimise the risk of a power failure causing the servers to fail, ensure that the data centre has a continuous power supply (UPS) and power regulators to prevent fluctuations or interruptions in the power supply.

Backups

If the SaaS agreement includes backup of customer data, the regularity, media used for backups and storage should be set out in the SLA.  Backups should not be stored at the same physical location as the servers on which the data is being processed.

Encryption

The media on which customer data is backed up should be encrypted. Particularly, if backups are to be physically sent to the customer, or moved to another data centre in the event of a disaster.

Access to Data

In the event that the data centre or a third party making backups of customer data becomes insolvent, the customer usually has no right to access its data and backups. Provisions should be included in the SLA to give the customer the right to access its data and backups in such circumstances.

Help

For assistance with any disaster recover issues, SLA, SaaS, ASP, software on demand contracts or any other IT legal issues contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

SaaS, ASP Agreements – FAQs – Confidential Information

What confidentiality provisions need to be included in a SaaS agreement?

Define Confidential Information

Parties will obtain and have access to the business critical information of each other as a result of entering into a  SaaS Agreement. For example, they may have access to customer lists, banking information, IPR, source code and object code or business secrets and processes. Confidential information should be defined in the SaaS agreement to make clear what is, and what is not, confidential. Do not simply refer to documents which are “marked as confidential” or “which should be treated as confidential”. Not all confidential information exists in a physical format, particularly in a SaaS scenario – so do not restrict your definition to just documents.

Restrictions on Disclosure

Confidential information should not be passed on to third parties or used by either party for any purpose other than performing their duties under the SaaS agreement. However, under certain circumstance parties may be legally required to disclose confidential information to a third party and such disclosure must be permitted. Additionally, employees and agents of the parties (accountants, sub-contractors) may need access to the confidential information for the purposes of the SaaS agreement. Such disclosure should be permitted, but must be restricted to named or defined groups of sub-contractors i.e. the supplier’s hosting provider or the customer’s named IT outsourcing providers. Disclosure to competitors of either party should be specifically prohibited. If any third parties are to have access to a party’s confidential information they must be bound by the same confidentiality duties as the party disclosing the information to them.

Return or Destruction of Data

Once the SaaS agreement is terminated, or expires, all confidential information of each party should be returned or destroyed. Confirmation of destruction of data should be required in writing. This is particularly important in relation to any personal data, as under the Data Protection Act 1998 no personal data should be kept longer than necessary. The length for which such personal data may be stored will depend upon the type of data and the purposes for which it was collected and stored.

Freedom of Information Request – FOI

If the customer is a public authority or another body subject to FOIs, both the supplier and the customer will need to comply with any requests for releases of information within strict time limits. Provisions should be added to the SaaS agreement to give the supplier control over what is, and what is not, released to prevent third parties having access to its confidential information pursuant to such requests.

Subject Access Request – SAR

Similar provisions are contained in the Data Protection Act 1998 which allow data subjects to request a copy of the personal data held on them which the supplier is processing on behalf of the customer. The request is made to the customer, who will need to ensure that there are provisions in the SaaS agreement obliging the supplier to release appropriate data.

Audit Rights

Sometimes customer’s will have a regulatory duty (i.e. under the FSA) to check the supplier’s security structures and data storage systems. Any third parties used by the customer during the audit should be bound by the confidentiality provisions of the SaaS agreement before being permitted access to any confidential information.  This can be easily achieved by having the third party sign a non-disclosure agreement.

Help

For assistance with any confidentiality issues, SaaS, ASP, software on demand contracts or any other IT legal issues contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: