PreVend

For vendors processing personal data, a Data Processing Agreement (DPA) or Addendum is required. The DPA should address GDPR/CCPA compliance, subprocessors, data subject rights, and security measures. Complete absence of DPA or privacy terms is unacceptable for any vendor handling customer or employee data. Also check for references to SOC 2, ISO 27001, or other compliance certifications.

Customer should not be required to use Vendor as its exclusive or sole source provider for any category of services or products. Exclusivity clauses prevent Customer from using competing or complementary solutions, eliminate negotiating leverage, and create vendor lock-in. Look for language like "exclusive provider," "sole source," "shall not use competing products," or "primary vendor for all [category] needs." These may appear in Scope of Services, Restrictions, or commercial terms sections.

Customer should not be restricted from hiring Vendor's employees or contractors, or from using competing products or building competitive solutions. One-sided non-solicit (Customer cannot hire from Vendor, but Vendor can hire from Customer) or non-compete clauses (Customer cannot use competitive products) are unacceptable. These clauses are often buried in "Restrictions" or "Miscellaneous" sections. Mutual non-solicit for executive-level hires during the term may be acceptable.

Vendor may use Customer's name, logo, and trademarks for marketing purposes (e.g., customer lists, case studies, website) only if Customer can opt out upon written notice. Automatic permission without opt-out rights is unacceptable. Look for language like "Customer grants Vendor a license to use Customer's marks" or "Vendor may list Customer as a reference." Acceptable: opt-in (requires consent) or opt-out (Customer can revoke via email). Unacceptable: no opt-out mechanism or requiring "reasonable" grounds to object.

There shouldn't be anything in the contract that is materially unusual in a B2B vendor SaaS agreement.

Price increases should be capped (e.g., CPI, 5-10% annually)

Vendor must not have unrestricted rights to use Customer content for purposes beyond providing the service.

• That includes using aggregated and anonymized Customer content to improve the vendor's products and services.
• Using "usage data" or "system data" is OK and fine for product improvement and development purposes.
• We are only worried about the vendor using customer content directly or aggregating and anonymizing customer content to improve the product or train AI models.

Vendor's total liability must not be capped below 12 months of fees paid. Caps based on shorter periods (e.g., "fees paid in the prior month") or nominal amounts (e.g., "$100") are unacceptable. Look for language like "shall not exceed," "limited to," or "liability capped at."

Vendor must commit to deleting all personal data upon the customer's request after the agreement terminates or expires.

• "Commercially reasonable efforts" or indefinite retention for "legal purposes" without clear limitations is unacceptable.

Vendor must commit to specific implementing, at least, commercially reasonably technical and organizational security measures for protecting personal data. Detailed security obligations and references to certifications are great, but not required.