Loading the contract library
A reusable subscription agreement for a Provider supplying hosted software-as-a-service to a Customer in another country, designed for US federal and UAE mainland legal contexts, with optional DIFC/ADGM dispute seats and cross-border data-transfer provisions.
United States (Federal) · UAE Mainland
Highlighted blanks are the details your parties fill in.
This agreement is dated the date on which it is signed by the last of the parties.
This agreement is made between [TO BE CONFIRMED — Customer legal name and details] (the "Customer") and [TO BE CONFIRMED — Provider legal name and details] (the "Provider").
"Purpose" means the Customer's internal business use of the Service.
"Service" means [TO BE CONFIRMED — Service].
"Documentation" means the Provider's then-current user documentation for the Service.
Explore more templates in this category or region.
"Order Form" means an ordering document signed by both parties that identifies the subscribed Service, subscription scope, fees and Subscription Term.
"Authorised Users" means the Customer's employees and contractors authorised by the Customer to use the Service for the Purpose.
"Subscription Scope" means [TO BE CONFIRMED — Subscription Scope].
"Service Levels" means the availability targets, support response targets and service-credit schedule stated in the applicable Order Form or support policy.
"Support Policy" means the Provider's then-current support policy supplied to the Customer before the Order Form is signed.
"Customer Data" means all data, content, personal data and materials submitted to, stored in or transmitted through the Service by or for the Customer or its Authorised Users.
"Security Measures" means appropriate technical and organisational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
"Data Processing Agreement" means the parties' separate data processing agreement, including its technical and organisational measures and subprocessor terms.
"Transfer Mechanism" means [TO BE CONFIRMED — Transfer Mechanism].
"Data Location" means [TO BE CONFIRMED — Data Location].
"Government Request Policy" means the Provider's documented process for reviewing and responding to legally binding government or law-enforcement requests.
"Fees" means [TO BE CONFIRMED — Fees].
"Currency" means [TO BE CONFIRMED — Currency].
"Payment Period" means 30 days after the invoice date.
"Late Payment Rate" means 1% per month or, if lower, the maximum lawful rate.
"Initial Term" means [TO BE CONFIRMED — Initial Term].
"Renewal Term" means 12 months.
"Non-Renewal Notice Period" means 30 days before the end of the current Subscription Term.
"Cure Period" means 30 days after written notice.
"Data Retrieval Period" means 30 days after termination or expiry.
"Provider IP" means the Service, Documentation, Provider materials, all improvements to them, and all related intellectual-property rights.
"Customer Materials" means Customer Data and all materials, instructions and branding supplied by or for the Customer.
"Liability Cap" means the Fees paid or payable under the applicable Order Form in the 12 months immediately preceding the event giving rise to liability.
"Insurance Requirements" means commercial general liability, technology errors and omissions/cyber liability, and any insurance required by applicable law, each with commercially reasonable limits.
"Governing Law" means [TO BE CONFIRMED — Governing Law].
"Dispute Forum" means [TO BE CONFIRMED — Dispute Forum].
"Arbitration Rules" means the arbitration rules of the selected arbitral institution in force when arbitration begins.
"Arbitration Seat" means [TO BE CONFIRMED — Arbitration Seat].
"Contract Language" means English.
"Notice Details" means the notice contacts and addresses stated in the applicable Order Form or otherwise notified in writing.
"Notarisation Requirement" means [TO BE CONFIRMED — Notarisation Requirement].
Each Order Form incorporated into this agreement is governed by this agreement. If there is an irreconcilable conflict, the Order Form prevails only to the extent it expressly identifies the provision overridden; otherwise this agreement prevails. No purchase order, portal term or other Customer document changes this agreement unless both parties sign it as an amendment.
Subject to the Customer paying the Fees and complying with this agreement, the Provider grants the Customer a non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to permit its Authorised Users to access and use the Service and Documentation within the Subscription Scope solely for the Purpose.
The Customer must not, and must ensure that its Authorised Users do not, knowingly: copy, modify or create derivative works of the Service except as permitted by law; reverse engineer, decompile or attempt to discover source code except to the extent a non-excludable law permits it; rent, lease, sell, sublicense or make the Service available to a third party except Authorised Users; bypass usage limits or security controls; introduce malicious code; or use the Service unlawfully or to infringe another person's rights.
The Customer must not use, and must ensure that Authorised Users do not use, the Service with High Risk Activities. “High Risk Activities” means any situation where use or failure of the Service could reasonably be expected to lead to death, bodily injury or environmental damage, including autonomous vehicle technology, medical life-support technology, emergency-response services, nuclear-facility operation and air-traffic control.
The Customer is responsible for its Authorised Users' compliance with this agreement and for safeguarding account credentials. The Provider will provide reasonable administrative controls to enable the Customer to manage Authorised User access.
The Provider will provide the Service in material conformity with the Service Levels and provide support in accordance with the Support Policy. If the Provider fails to meet an applicable Service Level, the Customer may claim the stated service credit in the manner and period stated in the Service Levels. Service credits are the Customer's sole monetary remedy for that failure, but do not limit its termination rights for a material breach.
With notice to the Customer, the Provider may modify the Support Policy, Service Levels or Security Measures to reflect new features or changing practices, but a modification may not be retroactive or materially decrease the Provider's overall obligations during a Subscription Term.
The Provider may perform planned maintenance on reasonable prior notice and emergency maintenance where necessary to protect the Service, Customer Data or users. The Provider will use reasonable efforts to minimise disruption. Planned maintenance and downtime caused by circumstances outside the Provider's reasonable control are excluded from availability calculations to the extent stated in the Service Levels.
As between the parties, the Customer retains all rights in Customer Data. The Customer grants the Provider a non-exclusive, worldwide right to host, copy, transmit, process and display Customer Data only as necessary to provide, secure, support and improve the Service, comply with law, and perform its obligations under this agreement and the Data Processing Agreement.
The Customer may choose to enable integrations with, or exchange Customer Data with, Third-Party Platforms. The Customer's use of a Third-Party Platform is governed by its agreement with the relevant provider, not this agreement, and the Provider is not responsible for Third-Party Platforms or how their providers use Customer Data. “Third-Party Platform” means any product, add-on or platform not provided by the Provider that the Customer uses with the Service.
The Provider will maintain the Security Measures and will not materially reduce their overall protective standard during the Subscription Term. The Provider will notify the Customer without undue delay after confirming an accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data, and will reasonably cooperate with the Customer in investigating and mitigating the incident.
The Provider will maintain commercially reasonable backup and disaster-recovery procedures for Customer Data. The Customer remains responsible for retaining copies of Customer Data that it needs independently of the Service, except to the extent the Order Form expressly includes archival or backup services.
Where the Provider processes personal data for the Customer, the Data Processing Agreement applies. If it conflicts with this agreement on personal-data processing, the Data Processing Agreement prevails to the extent of that conflict. Each party will comply with data-protection laws applicable to it in connection with this agreement.
The Customer must not, and must ensure that Authorised Users do not, submit Prohibited Data to the Service unless authorised by the Order Form or Key Terms. “Prohibited Data” means patient, medical or other protected health information regulated by HIPAA; credit, debit, bank-account or other financial-account numbers; social-security numbers, driver's-license numbers or other unique private government identification numbers; special categories of data as defined in the GDPR; and similar categories of sensitive information under applicable data-protection laws.
Each party will use the Transfer Mechanism for any restricted transfer of personal data under applicable law. The parties will execute or incorporate any supplemental terms, assessments or technical measures reasonably necessary to make that Transfer Mechanism effective, including requirements arising under applicable UAE, DIFC, ADGM, UK, EU or US state privacy law.
The Provider will store and process Customer Data in the Data Location, except where another location is necessary for support, security, disaster recovery, a subprocessor authorised under the Data Processing Agreement, or compliance with law. Before making a material change to the primary storage location, the Provider will give the Customer reasonable prior notice and comply with the Data Processing Agreement and applicable data-localisation rules.
The Provider will handle legally binding government and law-enforcement requests for Customer Data in accordance with the Government Request Policy. Unless prohibited by law, the Provider will promptly notify the Customer before disclosing Customer Data, provide reasonable cooperation to enable the Customer to seek protection, and disclose only the data legally required.
The Customer will pay the Fees in the Currency in accordance with the applicable Order Form. Unless the Order Form states otherwise, the Provider will invoice in advance and the Customer must pay each undisputed invoice within the Payment Period. The Customer will notify the Provider promptly of a good-faith dispute, pay the undisputed portion when due, and work in good faith to resolve the dispute.
Fees exclude taxes, duties and governmental charges, including VAT, sales, use and similar taxes, which the Customer must pay except taxes based on the Provider's net income, franchise taxes, or employment taxes. If the Customer must withhold tax by law, it will provide valid evidence of withholding and cooperate reasonably to reduce or recover it. The parties will issue reasonably required tax documentation.
The Provider may charge interest on undisputed overdue amounts at the Late Payment Rate, calculated from the due date until payment, and may recover reasonable collection costs where permitted by law. The Provider will not charge interest on an amount disputed in good faith until that dispute is resolved.
This agreement begins on the agreement date and continues for the Initial Term. Each Order Form continues for its stated subscription term and then renews for successive Renewal Terms unless either party gives written notice of non-renewal at least the Non-Renewal Notice Period before the end of the then-current term.
Either party may terminate this agreement or an affected Order Form by written notice if the other party materially breaches it and does not cure the breach within the Cure Period after receiving written notice describing the breach. Either party may terminate immediately if the other party becomes insolvent, enters liquidation, ceases business, or is subject to a comparable insolvency event, to the extent permitted by law.
The Provider may suspend the Customer's or an Authorised User's access only to the extent reasonably necessary to prevent a material security risk, comply with law, stop misuse, or address undisputed Fees more than 15 days overdue after written notice. The Provider will give prior notice where reasonably practicable, limit the suspension to the affected use or users, and restore access promptly after the cause is resolved.
On expiry or termination, the Customer's access rights end. For the Data Retrieval Period, the Provider will make Customer Data available for export in a commonly used machine-readable format, provided the Customer has paid all undisputed Fees. After that period, the Provider will delete Customer Data in accordance with the Data Processing Agreement and its standard retention procedures, except to the extent retention is required by law or reasonably necessary in backups until overwritten.
As between the parties, the Provider retains all rights in Provider IP. Except for the express access right in the Access and Use clause, no right in Provider IP is granted to the Customer. The Provider may use general knowledge, skills, experience and ideas retained in unaided memory, provided it does not disclose the Customer's Confidential Information or Customer Data.
If the Customer provides suggestions or feedback about the Service, the Provider may use it without restriction or payment, provided it does not identify the Customer or disclose the Customer's Confidential Information.
Each party may receive the other party's non-public business, technical, financial, security or commercial information that is identified as confidential or should reasonably be understood as confidential ("Confidential Information"). The recipient will use the discloser's Confidential Information only to perform or exercise rights under this agreement, protect it using at least reasonable care, and disclose it only to personnel, professional advisers and contractors who need to know it and are bound by confidentiality obligations no less protective than this clause. Confidential Information excludes information the recipient can show was lawfully known without restriction, independently developed, publicly available without breach, or lawfully received without confidentiality duty. A recipient may disclose Confidential Information where law requires, if it gives prompt notice where lawful and reasonably cooperates to seek protective treatment. On request, it will return or destroy Confidential Information, subject to legal retention and routine backups. These obligations continue for five years after disclosure, except trade secrets remain protected while they qualify as trade secrets under applicable law.
The Provider warrants that it will provide the Service with reasonable skill and care and materially in accordance with the Documentation. The Customer's exclusive remedy for breach is for the Provider to use commercially reasonable efforts to re-perform the affected Service; if it cannot do so within a reasonable time, the Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid Fees for the unused period. Each party warrants that it has authority to enter into this agreement.
Except for the express warranties in this agreement and to the maximum extent permitted by law, the Service is provided "as is" and each party disclaims implied warranties, including merchantability, fitness for a particular purpose, non-infringement and uninterrupted or error-free operation. The Provider does not warrant that the Service will meet requirements not stated in the Documentation or operate with every third-party system.
If the Provider gives the Customer access to a Beta Product, the Beta Product is provided “AS IS” and the Provider warranty does not apply to it. The Customer acknowledges that Beta Products are experimental and may be modified or removed at the Provider's discretion with or without notice. “Beta Product” means an early or prerelease feature or version of the Service identified as beta or similar, or a version not generally available.
The Provider will defend the Customer against a third-party claim that the Service, when used as permitted, infringes that third party's intellectual-property right, and will pay damages, costs and settlements finally awarded or agreed by the Provider. The Provider has no obligation to the extent a claim arises from Customer Materials, modification not made by the Provider, combination with items not supplied by the Provider, or use contrary to this agreement or Documentation. If such a claim is likely, the Provider may procure continued use, modify or replace the Service, or terminate the affected Order Form and refund prepaid Fees for its unused period.
The Customer will defend the Provider against a third-party claim arising from Customer Materials or the Customer's or an Authorised User's use of the Service in breach of this agreement or applicable law, and will pay damages, costs and settlements finally awarded or agreed by the Customer. The Customer has no obligation to the extent the claim arises from the Provider's breach of this agreement, negligence, wilful misconduct, or modification of Customer Materials by the Provider.
An indemnified party must promptly notify the indemnifying party of a claim, allow it sole control of the defence and settlement, and provide reasonable cooperation at the indemnifying party's expense. Delay in notice relieves the indemnifying party only to the extent materially prejudiced. The indemnifying party may not settle a claim in a manner that admits fault by, imposes liability or obligations on, or restricts the rights of the indemnified party without that party's prior written consent, not to be unreasonably withheld.
Subject to the carve-outs in the Limitation of Liability clause, each party's aggregate liability arising from or relating to this agreement will not exceed the Liability Cap.
Nothing in this agreement excludes or limits liability that cannot lawfully be excluded or limited, including liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence where applicable law prohibits limitation, or deliberate misconduct. The Liability Cap does not apply to the Customer's obligation to pay undisputed Fees or either party's liability for misuse of the other party's intellectual property or breach of confidentiality; however, liability for breach of confidentiality and data-protection obligations is capped at twice the Liability Cap.
To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill, anticipated savings or business opportunity, arising from this agreement, even if advised of their possibility. This exclusion does not apply to amounts payable to a third party under an indemnity, or to losses that applicable law does not permit to be excluded.
During the Subscription Term, the Provider will maintain the Insurance Requirements with reputable insurers. On reasonable written request, the Provider will provide evidence of coverage, subject to reasonable confidentiality restrictions.
Each party will comply with export-control, re-export-control and sanctions laws applicable to it. The Customer will not permit access to or use of the Service in a prohibited country or by a prohibited person, and will not provide Customer Data where doing so would cause the Provider to breach those laws. The Provider may suspend affected access where reasonably necessary to comply with this clause.
Each party will comply with applicable anti-bribery and anti-corruption laws and will not offer, promise, give, request or accept any improper advantage in connection with this agreement.
Neither party may issue a press release or use the other party's name, logo or trademarks in publicity without the other party's prior written consent, except that the Provider may identify the Customer as a customer in a factual customer list if the Customer has separately approved that use in writing.
Neither party is liable for delay or failure to perform caused by an event beyond its reasonable control, including natural disasters, war, terrorism, civil unrest, labour disputes, epidemic, government action, utility failure or widespread network failure, provided it promptly notifies the other party and uses reasonable efforts to mitigate the effect. This clause does not excuse payment of amounts already due or obligations to protect Confidential Information and Customer Data.
Either party may terminate an affected Order Form by notice if a Force Majeure Event prevents the Service from materially operating for 30 or more consecutive days. The Provider will give the Customer a pro-rata refund of prepaid Fees for the remainder of the affected Subscription Term. A Force Majeure Event does not excuse the Customer's obligation to pay Fees accrued before termination.
This agreement and any non-contractual obligations arising from it are governed by the Governing Law, excluding conflict-of-law rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
The courts specified in the Dispute Forum have exclusive jurisdiction over any dispute arising from or relating to this agreement. Nothing prevents either party from seeking urgent interim or injunctive relief in a court with competent jurisdiction to protect its Confidential Information, intellectual property or Customer Data.
Any dispute arising from or relating to this agreement will be finally resolved by arbitration under the Arbitration Rules. The seat of arbitration is the Arbitration Seat. The tribunal will consist of one arbitrator, the language is English, and the award is final and binding. Nothing prevents either party from seeking urgent interim or conservatory relief from a court of competent jurisdiction.
This agreement is executed in the Contract Language. If it is executed in more than one language, the version specified by the Contract Language prevails to the extent permitted by applicable law. The parties will cooperate in producing any translation required for filing, notarisation or enforcement.
Notices under this agreement must be in writing and sent to the Notice Details by personal delivery, internationally recognised courier, or email with confirmation of transmission. A notice is deemed received on delivery if delivered personally, two business days after courier dispatch, or when the sender receives confirmation of email transmission, except that notices of termination or legal claims must also be sent by courier. Either party may update its notice details by notice under this clause.
This agreement, its Order Forms and the Data Processing Agreement are the entire agreement between the parties about their subject matter and replace prior discussions and agreements about it. An amendment must be in writing and signed by authorised representatives of both parties. A waiver is effective only if written and applies only to the specific instance stated.
Neither party may assign this agreement without the other party's prior written consent, except that either party may assign it to an affiliate or in connection with a merger, reorganisation, sale of substantially all assets or change of control, provided the assignee is not a competitor of the other party and agrees in writing to be bound by this agreement. Any other attempted assignment is void.
The Provider may use subcontractors and permit them to exercise its rights and fulfil its obligations under this agreement, but the Provider remains responsible for their compliance with this agreement and for its overall performance under this agreement. This does not limit any additional terms for subprocessors under the Data Processing Agreement.
The parties are independent contractors, not agents, partners or joint venturers. Neither party is authorised to bind the other to any liability or obligation.
If a provision is unlawful, invalid or unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions remain in effect. The parties will negotiate in good faith a valid replacement that most closely reflects the original commercial intent.
This agreement may be executed in counterparts, each of which is an original and all of which together form one instrument. Electronic signatures and electronic delivery are effective to the fullest extent permitted by law.
The parties will complete the Notarisation Requirement and reasonably cooperate in providing authority documents, translations, notarisation, legalisation, attestation or registration required for validity or enforcement. Unless mandatory law provides otherwise, each party bears its own costs of that process.