Cross-Border SaaS Subscription Agreement

Orders and Precedence

The Provider will supply the Service to the Customer under this agreement and each accepted Order Form. An Order Form may specify the Subscription Scope, commercial terms and implementation details. If there is a conflict, the DPA prevails for personal-data processing, then the applicable Order Form where it expressly identifies and overrides this agreement, then this agreement, then other referenced materials. No Customer purchase order or other unilateral terms modify this agreement unless signed by both parties.

Subscription Access

Subject to the Customer paying the Subscription Fee and complying with this agreement, the Provider grants the Customer a non-exclusive, non-transferable, non-sublicensable right during the Term to allow its authorised users to access and use the Service within the Subscription Scope solely for the Purpose. The Customer is responsible for its authorised users and for maintaining the confidentiality of their credentials.

The Customer must not, and must not permit any person to: copy, modify or create derivative works of the Service except as law permits; reverse engineer, decompile or attempt to discover source code except to the extent that restriction is prohibited by law; rent, lease, sell, sublicense, distribute or make the Service available to a third party other than authorised users; use the Service to build a competing product; bypass usage limits or security controls; introduce malicious code; or use the Service unlawfully or in a manner that infringes rights or disrupts the Service.

The Customer must not use, or permit use of, the Service for any High Risk Activity. "High Risk Activity" means any situation where use or failure of the Service could reasonably be expected to lead to death, bodily injury or environmental damage, including autonomous vehicle technology, medical life-support technology, emergency-response services, nuclear-facility operation and air-traffic control.

The Customer must not, and must not permit any person to, submit Prohibited Data to the Service unless authorised by the Order Form or Key Terms. For this clause, "Prohibited Data" means: (a) patient, medical or other protected health information regulated by the Health Insurance Portability and Accountability Act; (b) credit, debit, bank-account or other financial-account numbers; (c) social security numbers, driver's-licence numbers or other unique and private government identification numbers; (d) special categories of data as defined in the GDPR; and (e) other similar categories of sensitive information under applicable data-protection law.

Service Levels and Support

The Provider will provide the Service in accordance with the Service Level and will provide support as stated there. If the Provider fails to meet an availability commitment, the Customer may claim the applicable Service Credits in accordance with the Service Credit regime. Service Credits are the Customer's sole monetary remedy for that failure, but do not limit any right to terminate for a material breach under the Term and Termination clause.

Customer Data

As between the parties, the Customer retains all right, title and interest in Customer Data. The Customer grants the Provider a non-exclusive, worldwide right during the Term to host, copy, transmit, display and otherwise process Customer Data only as necessary to provide, secure, support and improve the Service, to comply with law, and as documented in the Customer's instructions. The Customer represents that it has all rights, notices and lawful bases needed to provide Customer Data and permit that processing.

The Customer may choose to enable integrations with, or exchange Customer Data with, third-party platforms. The Customer's use of a third-party platform is governed by its agreement with the relevant provider, not this agreement, and the Provider is not responsible for third-party platforms or how their providers use Customer Data.

The Provider will maintain the Security Measures and reasonable administrative, technical and physical safeguards designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The Provider will maintain backups consistent with its standard disaster-recovery practices, but the Customer remains responsible for retaining independent copies of Customer Data where prudent for its business.

On notice to the Customer, the Provider may modify the Service Level or Security Measures to reflect new features or changing practices, but the modifications may not be retroactive or materially decrease the Provider's overall obligations during a subscription term.

The Provider will store Customer Data primarily in the Data Location. The Provider may process Customer Data in other locations only as permitted by the DPA and Transfer Mechanism, or as required by applicable law. The Provider will give reasonable prior notice of a material permanent change to the Data Location where legally permitted.

If the Provider receives a legally binding request from a governmental authority for Customer Data, it will, where legally permitted, promptly notify the Customer and reasonably cooperate with the Customer's efforts to seek protective treatment. The Provider will disclose only the minimum Customer Data legally required and will use reasonable efforts to obtain confidential treatment.

Data Protection

The parties will comply with applicable data-protection law. Where the Provider processes personal data on the Customer's behalf, the DPA is incorporated into this agreement and governs that processing. The Provider will ensure that each cross-border transfer of personal data is made under the Transfer Mechanism and any supplementary measures required by applicable law, including applicable requirements under UK, EU, UAE, DIFC, ADGM and United States state privacy laws.

The Provider may use subcontractors and permit them to exercise its rights and fulfil its obligations, but the Provider remains responsible for their compliance with this agreement and for its overall performance under this agreement. This does not limit any additional terms for subprocessors under the DPA.

Fees and Payment

The Customer will pay the Subscription Fee in the Currency in accordance with the Order Form and the Payment Period. Unless the Order Form states otherwise, fees are invoiced annually in advance and are non-cancellable and non-refundable, except as this agreement expressly states. The Provider may charge for use exceeding the Subscription Scope at the rates stated in the Order Form or, if none, its then-current list rates after notifying the Customer.

Fees exclude taxes, levies, duties and similar governmental charges, including VAT, GST and sales or use taxes, which the Customer will pay, excluding taxes based on the Provider's net income, payroll or property. If the Customer must withhold tax, it will promptly provide official evidence of the withholding and reasonably cooperate to obtain available treaty relief. The Customer will gross up a payment only where the Order Form expressly requires it.

Overdue undisputed amounts accrue Late Interest from the due date until payment, and the Customer will reimburse reasonable costs of collection. The Provider will not charge Late Interest on an amount the Customer disputes in good faith and promptly explains in writing.

Term and Termination

This agreement starts on the agreement date and continues until all Order Forms have expired or been terminated. Each subscription begins on the date stated in its Order Form, continues for the Initial Term and automatically renews for successive Renewal Terms unless either party gives Non-Renewal Notice. Fees for a Renewal Term are as stated in the Order Form or, if none, the Provider's then-current fees on at least 60 days' prior notice.

The Provider may suspend access to the Service if the Customer's use presents a material security risk, violates law or the use restrictions, threatens the Service or other customers, or if undisputed amounts remain overdue after the Suspension Cure Period. The Provider will give prior notice where reasonably practicable, limit suspension to what is reasonably necessary, and restore access promptly after the cause is cured.

Either party may terminate this agreement or an affected Order Form by written notice if the other party materially breaches it and fails to cure the breach within the Termination Cure Period, or if the other party becomes insolvent, enters liquidation or administration, ceases substantial business operations, or is unable to pay debts as they fall due, in each case to the extent permitted by law. The Customer may terminate an affected Order Form if the Provider materially and repeatedly fails the Service Level and the failure materially deprives the Customer of the Service.

On expiry or termination, the Customer's access rights end and the Customer will pay all amounts accrued and due. On the Customer's written request made during the Data Return Period, the Provider will make Customer Data available in a commonly used machine-readable format. After that period, the Provider will delete Customer Data from active systems, except for data retained in backups until overwritten in the ordinary course, data required by law, or data retained in de-identified form; retained data remains protected under this agreement and the DPA.

After expiry or termination of this agreement, within 60 days of request, each party will delete the other party's Confidential Information in its possession or control. A recipient may retain Confidential Information in accordance with its standard backup or record-retention policies or as required by applicable law, subject to the Confidentiality clause and the DPA.

Intellectual Property

Except for the express rights granted in this agreement, each party retains all rights in its pre-existing and independently developed materials. The Provider and its licensors retain all rights in the Service, documentation, usage data and Provider materials. The Customer retains all rights in Customer Data. The Provider may use aggregated and de-identified usage data to operate, secure, analyse and improve the Service, provided it does not identify the Customer or any individual.

If the Customer provides suggestions, ideas or feedback about the Service, the Provider may use them without restriction or compensation, provided it does not publicly identify the Customer as the source without consent.

Confidentiality

Each party may use the other party's Confidential Information only to perform or exercise rights under this agreement and may disclose it only to its affiliates, employees, advisers and subcontractors who need to know it and are bound by confidentiality obligations no less protective than these. Each party will protect Confidential Information using reasonable care and no less than the care it uses for its own similar information. Confidential Information does not include information the receiving party can demonstrate was lawfully known without restriction, becomes public without breach, is independently developed without use of it, or is lawfully received from a third party without restriction. A party may disclose Confidential Information if law requires, after giving legally permitted notice and reasonable cooperation.

A breach of the Confidentiality clause may cause substantial harm for which monetary damages are an insufficient remedy. On a breach, the disclosing party may seek appropriate equitable relief, including an injunction, in addition to other remedies.

A receiving party may disclose the disclosing party's Confidential Information to the extent required by applicable law if, unless applicable law prohibits it, the receiving party gives the disclosing party reasonable advance notice of the required disclosure and reasonably cooperates, at the disclosing party's expense, with the disclosing party's efforts to obtain confidential treatment for the Confidential Information.

Warranties and Disclaimers

Each party represents that it has authority to enter into this agreement. The Provider warrants that it will provide the Service with reasonable skill and care and substantially in accordance with the documentation. The Customer's exclusive remedy for breach of that warranty is re-performance or, if the Provider cannot re-perform within a reasonable time, termination of the affected subscription and a pro rata refund of prepaid unused Subscription Fees. Except as expressly stated, the Service is provided "as is" and the Provider disclaims all implied warranties, including merchantability, satisfactory quality, fitness for a particular purpose, non-infringement and uninterrupted or error-free operation, to the maximum extent permitted by law.

If the Provider gives the Customer access to a beta feature or version of the Service identified as beta or similar, or that is not generally available (a "Beta Service"), the Beta Service is provided "as is" and the Provider's warranties do not apply to it. The Customer acknowledges that Beta Services are experimental and may be modified or removed at the Provider's discretion with or without notice.

Indemnities

The Provider will defend the Customer against a third-party claim that the Service, when used as permitted, infringes that third party's intellectual-property right, and will pay damages, costs and settlements finally awarded or agreed by the Provider. This does not apply to claims arising from Customer Data, Customer materials, use contrary to this agreement or documentation, combinations not supplied by the Provider, or use of a superseded version where the Provider provided a non-infringing replacement. If such a claim is likely, the Provider may procure continued use, modify or replace the Service, or terminate the affected subscription and refund prepaid unused fees. The Customer must promptly notify the Provider, give it sole control of the defence and settlement, and provide reasonable cooperation; the Provider may not settle in a manner admitting Customer liability or imposing obligations on the Customer without consent.

The Customer will defend the Provider against a third-party claim arising from Customer Data, Customer materials, or the Customer's or its authorised users' use of the Service in breach of this agreement or applicable law, and will pay damages, costs and settlements finally awarded or agreed by the Customer. The Provider must promptly notify the Customer, give it sole control of the defence and settlement, and provide reasonable cooperation; the Customer may not settle in a manner admitting Provider liability or imposing obligations on the Provider without consent.

Limitation of Liability

Subject to the Liability Carve-outs clause, each party's total aggregate liability arising out of or relating to this agreement will not exceed the Liability Cap. The Liability Cap applies separately to each party and includes all claims in contract, tort (including negligence), misrepresentation, restitution, statute or otherwise.

Nothing in this agreement excludes or limits liability that cannot lawfully be excluded or limited, including liability for fraud or fraudulent misrepresentation, death or personal injury caused by negligence, or deliberate misconduct. Neither party is liable for lost profits, revenues, business, goodwill, anticipated savings, or indirect, consequential, special, exemplary or punitive loss, even if advised of its possibility. The exclusions of loss do not apply to either party's indemnity payment obligations, the Customer's payment obligations, or either party's breach of confidentiality or data-protection obligations, but those liabilities remain subject to the Liability Cap unless law requires otherwise.

Insurance

During the Term, the Provider will maintain commercially reasonable insurance, including cyber liability and technology errors and omissions cover, with limits of at least the Insurance Amount, and will provide evidence of cover on reasonable written request.

Compliance

Each party will comply with applicable export-control, import-control and economic-sanctions laws. The Customer will not permit access to or use of the Service in a prohibited country or by a prohibited person, and will not provide Customer Data whose processing would cause the Provider to breach those laws. The Provider may suspend affected access where reasonably necessary to comply with this clause.

To the extent applicable, the Service is "commercial computer software" or a "commercial item" for purposes of FAR 12.212 and DFARS 227.7202. Use, reproduction, release, modification, disclosure or transfer of the Service is governed solely by this agreement, and all other use is prohibited.

Each party will comply with applicable anti-bribery and anti-corruption laws, including the UK Bribery Act 2010 and the US Foreign Corrupt Practices Act where applicable. Neither party will offer, promise, give, request or accept an improper advantage in connection with this agreement.

Publicity

Neither party may issue a press release or use the other party's name, logo or trade marks in publicity without the other party's prior written consent, except that the Provider may list the Customer's name and logo in a customer list if the Customer has given prior written approval.

General

Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, excluding payment obligations, provided it promptly notifies the other party, uses reasonable efforts to mitigate the effect, and resumes performance as soon as practicable. If the event continues for more than 60 days and materially prevents performance, either party may terminate the affected Order Form on written notice.

Governing Law and Disputes

This agreement and any non-contractual obligations arising out of or relating to it are governed by the Governing Law, without regard to conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

The courts of the Court Location have exclusive jurisdiction to settle any dispute arising out of or relating to this agreement, including any non-contractual dispute or claim. Nothing prevents either party from seeking urgent interim, injunctive or protective relief in any court of competent jurisdiction.

General

This agreement is made in the Contract Language. Any translation is for convenience only and, to the extent of inconsistency, the Contract Language version prevails.

A notice under this agreement must be in writing and delivered by personal delivery, reputable international courier, or email to the applicable address below, or to a replacement address notified under this clause: for the Customer, [TO BE CONFIRMED — Customer notice address and email]; for the Provider, [TO BE CONFIRMED — Provider notice address and email]. A notice is deemed received on delivery if personally delivered, on recorded delivery if sent by courier, or when sent by email unless the sender receives an automated failure notice. Notices concerning termination, legal claims or changes to these addresses must also be sent by courier or personal delivery.

This agreement, the Order Forms and the DPA are the entire agreement between the parties about their subject matter and supersede prior discussions and agreements about it. Each party acknowledges that it has not relied on a statement not set out in those documents, except that nothing limits liability for fraud or fraudulent misrepresentation. A waiver or amendment is effective only if in writing and signed by authorised representatives of both parties. If any provision is unenforceable, it will be modified to the minimum extent necessary and the remainder will continue in force. Neither party may assign this agreement without the other's prior written consent, except to an affiliate or in connection with a merger, reorganisation, sale of substantially all assets or change of control, provided the assignee is not a competitor of the other party and agrees in writing to be bound by this agreement. No person other than the parties and their permitted successors and assigns has rights to enforce this agreement, except where applicable law provides otherwise.

The parties are independent contractors, not agents, partners or joint venturers. Neither party is authorised to bind the other to any liability or obligation.

This agreement may be executed in counterparts, each of which is an original and all of which together form one instrument. Delivery of a signed counterpart by electronic signature, electronic transmission or other legally valid electronic means is effective as delivery of an original signed counterpart.