NIST Privacy Framework : Our Essential Data Protection Guide

Close

SOFTWARE AS A SERVICE AGREEMENT

The following terms and conditions and schedules (“Terms and Conditions”) govern all orders signed by Customer (each an “Order”) for use of Spirion’s Services (as defined in the Definitions).  Each Order and these Terms and Conditions together constitute the Software as a Service (SaaS) Agreement (“Agreement”) between Spirion, LLC, a Delaware limited liability company with offices located at 200 Central Ave., Suite 1900, St. Petersburg, FL 33701 (“Spirion”) and the customer identified on the Order Form (“Customer”). The Effective Date of this Agreement is the date specified on the Order Form.

TERMS AND CONDITIONS

1. SERVICES.

1.1  Access and Use.  Subject to the terms and conditions of this Agreement, including, but not limited to, payment by Customer of the applicable fees set forth on the Order Form, Spirion grants to Customer a limited, non-exclusive, non-transferable (except as permitted under Section 13.4 of the Terms and Conditions) license to remotely access and use the Services that are located on the Spirion Server in accordance with the terms of this Agreement for the length of the Term solely for Customer’s internal business purposes. Use of the Services is limited to Authorized Users.  Use of the Services is limited to the number of users designated in the Order Form.  Customer will establish and maintain, at its own expense, all telecommunications equipment and access lines necessary to gain access to the Services.

1.2  Documentation License. Spirion hereby grants to Customer a non-exclusive, non-sublicensable, non-transferable (except as permitted under Section 13.4 of the Terms and Conditions) license to use the Documentation during the Term solely for Customer’s internal business purposes in connection with its use of the Services.

1.3 Third-Party VendorsSpirion acknowledges and agrees that Customer may use certain third-party vendors for purposes of performing some of Customer’s internal business processes (“Third-Party Vendors”).  Spirion authorizes Customer to allow its Third-Party Vendors (other than Spirion’s direct competitors) to access and use the Services subject to the terms and conditions of this Agreement solely for Customer’s internal business processing services, subject to the following conditions:  (i)  Customer agrees to be fully responsible and liable for all use of the Services by its Third-Party Vendors;  (ii) Customer will ensure compliance by its Third-Party Vendors of the terms and conditions of this Agreement, including without limitation, Section 4 of this Agreement (Confidential Information); (iii) Customer will formally notify Spirion of any such Third-Party Vendors and will ensure that each such Third-Party Vendor uses its own unique password as detailed in Section 2 below; and (iv) upon termination of its relationship with such Third-Party Vendors or of this Agreement, Customer will ensure that all access to the Services by such Third-Party Vendors ceases immediately.

1.3  Limitations.  Unless otherwise expressly authorized in this Agreement, Customer will not, and will ensure that its users will not: (i) modify, adapt, alter, translate, or create Derivative Works from the Documentation (other than providing Spirion with suggestions on improving the Services); (ii) sublicense, resell, re-distribute, lease, rent, loan, disclose or otherwise transfer the Services (or any part thereof), or any other associated products and services, to any third party; (iii) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source or object code of the Services (or any part thereof); (iv) use the Services (or any part thereof) to provide similar services to third parties, or permit third parties to use the Services (or any part thereof) (v) use the Services (or any part thereof)  to develop a product line that is similar to the Services or Services or to develop competitive analyses or benchmarking of Spirion’s products and services; (vi) otherwise use the Services or copy the Documentation except as expressly allowed under this Agreement; or (vii) alter, distort, or remove any confidential, proprietary, copyright, trademark, trade secret, or patent legends from any copy of the Services (or any part thereof).

1.4  Proprietary Rights.  As between the parties, and subject to the terms and conditions of this Agreement, Spirion and its third-party suppliers will retain ownership of all Intellectual Property Rights in the Services, and any and all Derivative Works made to the Services or any part thereof, (“Spirion Proprietary Technology”). Customer acquires no rights to Spirion Proprietary Technology except for the licensed interests granted under this Agreement or any SOW.   Customer acknowledges and agrees that Spirion may use, without restriction, all suggestions, improvements and ideas concerning any part of the Services or Intellectual Property Rights therein that may be communicated to Spirion by Customer.  Customer agrees to inform Spirion immediately of any infringement or other improper action with respect to Spirion’s Confidential Information, the Services or the Intellectual Property Rights therein that comes to Customer’s attention. Customer acknowledges and agrees that Spirion owns all Resultant Data, and may use it for product development purposes.

1.5  Rights Reserved.  Except as set forth in this Agreement, no right or implied license, or right of any kind, is granted to Customer or to any other person or entity with regard to the Services or any part thereof.  Nothing in this Agreement confers upon either party any right to use the other party’s trade names and trademarks, except for the permitted license use in accordance with this Agreement. All use of such marks by either party will inure to the benefit of the owner of such marks, the use of which will be subject to specifications controlled by the owner.

2.Customer Access.

2.1  Customer’s Obligations.  Spirion will provide Customer with Access Credentials.  Customer will ensure that each user is given their own individual user ID and password, which may not be shared with another individual for any reason.  Customer is entirely responsible for maintaining the confidentiality of such passwords and of its accounts.  Customer is responsible for all access to and use of the Services through Customer’s Access Credentials.

2.2  Unauthorized Access.  Spirion is not responsible for any unauthorized access and/or use by any third party who independently gains access to Customer Data, provided that such access is not caused or contributed to by Spirion.  Customer will notify Spirion promptly of any unauthorized use of any user accounts or of any other breach of security occurring as a result of any activities of any of Customer’s users or of any vulnerabilities that Customer believes are contained in or caused by the Services such that Spirion may take or recommend appropriate remedial measures.  Spirion will have no liability for any loss or damage arising from Customer’s failure to comply with the provisions of Section 2.1 and 2.2.

3. FEES AND PAYMENT TERMS.

3.1  Payments.  Customer will pay to Spirion all fees due to Spirion under this Agreement in U.S. dollars (collectively “Fees”). Unless otherwise set forth in this Agreement, all Fees will be due within thirty (30) days after the date of the invoice for same.  All Fees payable under this Agreement are fully earned, non-cancelable and the sums paid are non-refundable.  If any amounts are withheld by Customer in good faith, Customer will, within fifteen (15) days from receipt of invoice (“Dispute Period”), provide Spirion a reasonably detailed written explanation of the nature of the dispute, which explanation will set forth the dollar amounts withheld and the reasons for withholding such amounts.  If Customer does not dispute the applicable invoice during the Dispute Period, any such dispute will be deemed waived.  For clarity, Customer remains obligated to pay Spirion for all portions of the applicable invoice that are not under reasonable and good faith dispute.

3.2  Excess Usage. If, during any thirty (30) day period, Customer uses in excess of the processing agents or storage listed in the Order Form, Spirion shall notify Customer that its use is exceeding the such amount(s). After such notice, Spirion has the right to cap and limit the usage or charge for such overage for the remainder of the Term.

3.3  Overdue Accounts.  A late fee may be charged by Spirion on all undisputed Fees and Expenses not paid to Spirion by Customer within thirty (30) days after receipt of the invoice for same at the lesser of the maximum amount chargeable by law or one and one-half percent (1.5%) per month commencing with the date payment was due.  Customer will be liable for all costs of collection of such undisputed, overdue amounts including, without limitation, all court costs and attorneys’ fees incurred by Spirion.  Fees due from Customer under this Agreement may not be withheld or offset by Customer against other amounts for any reason.

3.4  Taxes.  The Fees and other charges do not include any applicable sales, use, and other taxes (including value added tax) and all applicable export and import fees, customs duties and similar charges, and Customer will also be responsible for the payment of all such taxes (other than taxes based on Spirion’s income), fees, duties, and charges, and any related penalties and interest, which will be above and beyond, and in addition to, the Fees, arising from the payment of the Fees and from the delivery of the Services to Customer, whether such taxes are assessed before or retroactively following the issue of any invoice by Spirion.  If Customer is required by law to deduct or withhold any tax or other amount from any sum payable to Spirion, then the sum payable by Customer will be increased to the extent necessary to ensure that after such tax or other amount has been deducted, withheld or paid, Spirion receives on the due date and retains (free from any liability in respect of any such deduction, withholding or payment) a net sum equal to what it would have received and so retained had no such deduction, withholding or payment been required or made.

4. CONFIDENTIAL.

4.1  Disclosure of Confidential Information.  Neither party may use or disclose any Confidential Information of the other party, except on a need-to-know basis for purposes of performing its obligations under this Agreement.  This Agreement and its terms are Confidential Information.  Disclosure of Confidential Information to employees of the parties hereto will be limited to those who have a need to know such information in connection with carrying out the obligations of the applicable party pursuant to this Agreement.  Customer acknowledges that all parts of the Services are the Confidential Information of Spirion and/or Spirion’s licensors, and Customer agrees to treat such information as Confidential Information in accordance with the terms of this Agreement.   A “party” (as used in this Section 4) will be deemed to include each party’s respective subsidiaries, affiliates and sister companies or any other organization in which such party has an ownership stake or over which such party can exert control, and each such party will cause its parties observe the confidentiality requirements of this Agreement with respect to the information disclosed by the other party under this Agreement.  The receiving party will only allow its independent contractors to receive the Confidential Information if such contractors execute nondisclosure agreements with, or are otherwise contractually bound to, Confidential Information restrictions no less protective than those of this Agreement; provided that the receiving party will not under any circumstances provide access to such Confidential Information to competitors of Spirion.

4.2  Legally Required Disclosures.  If a receiving party is presented with legal process under which it could be legally compelled to disclose any Confidential Information of the disclosing party (whether by oral question, deposition, interrogatory, request for documents, subpoena, civil investigative demand or similar process or by rule, regulation or other applicable law), such receiving party will promptly notify the disclosing party of the same before any disclosure is made so that the disclosing party may, at its discretion, seek a protective order or other appropriate remedy or may waive compliance with the confidentiality terms of this Agreement.  If such protective order or other remedy is not obtained, or if the disclosing party waives compliance with the provisions hereof, then only that portion of the Confidential Information that it is legally required to be disclosed (as advised by a written opinion of counsel) may be disclosed.

4.3  Exclusions to Confidential Information.  For purposes of this Agreement, “Confidential Information” will not include information or material which (a) enters the public domain (other than as a result of a breach of this Agreement); (b) was in the receiving party’s possession prior to its receipt from the disclosing party; (c) is independently developed by the receiving party without the use of Confidential Information; or (d) is obtained by the receiving party from a third party under no obligation of confidentiality to the disclosing party.  Section 5 (Customer Data and Security) of this Agreement and any business associate agreement Customer requires Spirion to execute will govern all use and protection of Customer Data.

4.4  Duration and Injunctive Relief.  The confidentiality obligations set forth in this Section 4 will continue indefinitely following termination or expiration of this Agreement for as long as the Confidential Information remains a trade secret under applicable law and will continue for three (3) years following termination or expiration of this Agreement with respect to Confidential Information that does not rise to the level of a trade secret.  The receiving party acknowledges that disclosure of any Confidential Information or a trade secret by it or its employees will give rise to irreparable injury to the disclosing party or the owner of such information and that such injury will not adequately be compensated for by damages.  Accordingly, the disclosing party will be entitled to seek equitable relief, including injunctive relief and specific performance against the breach or threatened breach of the undertakings in this Section 4, in addition to any other legal remedies which may be available.

5. CUSTOMER DATA AND SECURITY.

5.1  Customer Data Generally.  Customer is the sole and exclusive owner of all Customer Data and all Intellectual Property Rights in the Customer Data.  Customer Data may include Personally identifiable information (“PII”).  In the event Customer provides Spirion with PII, the terms of the Data Protection Addendum set forth in Schedule D will apply in addition to this Section 5.  Customer assumes full responsibility to safeguard against unauthorized access and provide appropriate protection of its Customer Data prior to and during the transmission or transfer of its Customer Data to Spirion.

5.2  Spirion Information Security Protocols.  Spirion will employ security measures in accordance with Schedule D.

5.3  Customer Information Security Protocols.

Customer has and will retain sole responsibility for: (a) all Customer Data, including permissions to collect, store, process, and transfer Personal Data to Spirion; (b) all information, instructions, and materials provided by or on behalf of Customer or any Authorized User in connection with the Services; (c) Customer Systems; (d) the security and use of Customer’s and its Authorized Users’ Access Credentials; and (e) all access to and use of the Services and Spirion Materials directly or indirectly by or through the Customer Systems or its or its Authorized Users’ Access Credentials, with or without Customer’s knowledge or consent, including all results obtained from, and all conclusions, decisions, and actions based on, such access or use.

Customer shall employ all physical, administrative, and technical controls, screening, and security procedures and other safeguards necessary to: (a) securely administer the distribution and use of all Access Credentials and protect against any unauthorized access to or use of the Services; and (b) control the content and use of Customer Data, including the uploading or other provision of Customer Data for Processing by the Services.

5.3  Data Backup. The Services do not replace the need for Customer to maintain regular data backups or redundant data archives. SPIRION HAS NO OBLIGATION OR LIABILITY FOR ANY LOSS, ALTERATION, DESTRUCTION, DAMAGE, CORRUPTION, OR RECOVERY OF CUSTOMER DATA.

6. PROFESSIONAL SERVICES.

6.1  Professional Services Generally.  Spirion will provide Customer any of the following Professional Services:  implementation, training, support and maintenance in excess of that provided under Schedule C, and transitional services, subject to a Statement of Work (“SOW”) (Schedule E).

6.2  Statements of Work.  Each SOW shall be incorporated into and subject to this Agreement.

6.3  Work Product.  Any work product of the Professional Services shall remain the property of Spirion, and shall be licensed to Customer for its use exclusively in connection with the Services and for no other purpose.

7. Customer Support Services and SLAs.

7.1  Customer Support Services.  Spirion will provide the Customer Support Services set forth in Schedule C.  Spirion may update this Schedule from time to time upon notice to Customer provided that such update does not result in a degradation of the level of Customer Support Services.  Customer’s continued use of the Services following notice of such changes will constitute Customer’s acceptance of the same.  In the event that any such changes do result in a degradation of the level of Customer Support Services, then Customer may terminate this Agreement upon notice to Spirion.

7.2  SLAs.  Spirion will provide the Services in accordance with the service levels set forth in Schedule C.

8. WARRANTY AND DISCLAIMER.

8.1      General Warranty.  Each party represents and warrants that it is not subject to any agreement that would prevent it from complying with this Agreement. Spirion represents and warrants that it will comply with all applicable laws and regulations relating to its performance of the Services under this Agreement.

8.2      Professional Services Warranty.  Spirion warrants that the Professional Services will be performed in a professional and workmanlike manner consistent with generally accepted industry practices.  For any breach of this services warranty, Customer’s exclusive remedy and Spirion’s entire liability will be the re-performance of any such deficient Spirion Professional Services.  In order to claim a breach of this Professional Services warranty, Customer must identify in a written notice to Spirion any deficiencies in such Professional Services within ninety (90) days of the completion of such deficient Professional Services in order to receive the above warranty remedies.

8.3      Customer Warranty.  Customer represents and warrants that Customer is authorized to provide Spirion with the Customer Data, and that Spirion is authorized to use such Customer Data solely for the purpose of providing the Services.  Customer also represents and warrants that it will (a) maintain and update an industry standard anti-virus program within its own computer systems and (b) to use commercially reasonable efforts require its employees to check attachments to e-mail messages that its employees receive before saving such attachments to Customer’s hard drives or servers.

8.4      Disclaimer.  OTHER THAN AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER SPIRION, ITS AFFILIATES, LICENSORS OR SUPPLIERS, NOR THEIR OFFICERS, DIRECTORS, EMPLOYEES, SHAREHOLDERS, AGENTS OR REPRESENTATIVES MAKES ANY EXPRESS OR IMPLIED WARRANTIES, CONDITIONS, OR REPRESENTA­TIONS TO CUSTOMER, OR ANY OTHER PERSON OR ENTITY WITH RESPECT TO THE SOFTWARE, SYSTEM AND SPIRION SERVICES PROVIDED HEREUNDER OR OTHERWISE REGARDING THIS AGREEMENT, WHETHER ORAL OR WRITTEN, EXPRESS, IMPLIED OR STATUTORY, INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTY OR CONDITION OF MERCHANTABILITY, THE IMPLIED WARRANTY AGAINST INFRINGEMENT, AND THE IMPLIED WARRANTY OR CONDITION OF FITNESS FOR A PARTICULAR PURPOSE.  SPIRION DOES NOT WARRANT THAT THE OPERATION OF THE SOFTWARE, SYSTEM OR SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE.  THE SERVICES USE SEARCH ALGORITHMS TO IDENTIFY SENSITIVE DATA WITHIN THE CUSTOMER DATA, BUT ARE NOT GUARANTEED TO FIND EVERY OCCURRENCE OF SENSITIVE DATA. CUSTOMER ACKNOWLEDGES THAT USING THE SERVICES, EVEN AS DIRECTED, DOES NOT GUARANTEE COMPLIANCE WITH ANY PARTICULAR LAW, REGULATION, STANDARD, OR BEST PRACTICE, EACH OF WHICH SPIRION EXPRESSLY DISCLAIMS TO THE FULLEST EXTENT OF THE LAW.  SPIRION SHALL NOT BE LIABLE UNDER ANY THEORY FOR CUSTOMER’S VIOLATION OR BREACH OF ANY LAW, REGULATION OR STANDARD, EVEN IF SUCH VIOLATION OR BREACH INVOLVED CUSTOMER’S USE OF THE SPIRION SERVICES.

9. INDEMNIFICATION.

9.1      Spirion Indemnity.  Spirion will indemnify, defend, and hold Customer, its individual directors, officers, employees and agents, harmless from and against any claims, actions or proceedings, arising out of any third-party claim that the Services or Customer’s permitted use thereof infringes or violates any third party’s valid U.S. patent, copyright or trade secret (“IP Claim”).  If in Spirion’s reasonable judgment any such IP Claims, or threat of an IP Claim, materially interferes with Customer’s use of the Services,  Spirion will consult with Customer, and Spirion will have the option, in Spirion’s sole discretion, to (a) substitute functionally equivalent non-infringing services or documentation, (b) modify the Services to make it non‑infringing, or (c) obtain for Customer at Spirion’s expense the right to continue using the infringing Services; or, if the foregoing is not feasible in Spirion’s sole discretion, Spirion will (d) require Customer to cease using the Services, refund a pro-rata portion of the Fees (as defined in the Order Form at Schedule B) for the Services for such period of time in which Customer was unable to use the Services.  Spirion will have no indemnity obligation for claims of infringement resulting or alleged to result from (i) any combination, operation, or use of any software with any programs or equipment not supplied by Spirion or not specified in this Agreement for such purpose if in Spirion’s reasonable judgment such infringement would have been avoided by the combination, operation, or use of such software with items supplied by Spirion or specified in this Agreement for such purpose; (ii) inclusion of Customer Data; (iii) any modification of the Services by a party other than Spirion if such infringement would have been avoided in the absence of such modifications;  or (iv) the use of the Services in a manner other than for its intended purposes or contrary to the Specifications.   This Section 9.1 states Spirion’s entire liability and Customer’s sole and exclusive remedy for infringement claims and actions.

9.2      Customer Indemnity. Customer will indemnify, defend, and hold Spirion, its individual directors, officers, employees, representatives, and agents, harmless from and against any claims, actions or proceedings, arising out of any third-party claim: (a) resulting from Customer’s improper  use of the Services; or (b) that the Customer Data or Customer’s transmission to Spirion or Spirion’s hosting or Processing thereof infringes or violates the rights of such third party or violates applicable law.

9.3      General.  The defense and indemnification obligations set forth in this Section 9 are conditioned upon (i) the indemnified party providing the indemnifying party timely notice of any claim or cause of action upon which the indemnified party intends to base a claim of indemnification hereunder, (ii) the indemnified party providing reasonable assistance and cooperation to enable the indemnifying party to defend the action or claim hereunder; and (iii) allowing the indemnifying party to control the defense and all related settlement negotiations; provided that the indemnifying party may not settle any claim that results in the indemnified party’s liability and the indemnifying party will be required to consult with the indemnified party during any settlement discussions.

LIMITATION OF LIABILITY.

10.1   Limitation of Remedy.  Except as prohibited by law, in no event will either party, its affiliates, or its contractors, licensors or suppliers or any of their officers, directors, employees, shareholders, agents or representatives be liable to the other party, or any other person or entity for any special, incidental, consequential, indirect, exemplary, or punitive damages or liabilities for any cause whatsoever arising out of or relating to this agreement, including all statements of work, order forms, or amendments thereto, whether in contract or tort or by way of indemnity or otherwise, including a breach thereof or including damages or liabilities for lost profit, lost revenue, loss of use, loss of goodwill, loss of reputation, loss of data, regulatory fines, costs of recreating lost data, the cost of any substitute equipment, software program, or data, regardless of whether the possibility of such damages or liabilities have been communicated to such party and regardless of whether such party has or gains knowledge of the existence of such damages or liabilities.

10.2   Maximum Liability.  Except (i) for the recovery of sums due under this Agreement, (ii) as prohibited by law or (iii) for claims arising under sections 1.1 – 1.3(a), 4, 9.1 and 9.2, in no event will either party’s liability for any damages to the other, any of its affiliates, or to any third party regardless of the form of action, whether based on contract, tort, negligence, strict liability, products liability or otherwise, ever exceed the actual fees received by spirion under this agreement for the portion of the  SPIRION Services giving rise to such claim during the preceding twelve (12) month period.

11. TERM AND TERMINATION.

11.1   Term and Renewals. The initial term of this Agreement will be as set forth in the Order Form (the “Initial Term”), unless earlier terminated in accordance with this Section 11.  The Initial Term will automatically renew for successive one year periods commencing on the anniversary of the Effective Date of the Initial Term (each a “Renewal Term”; the Initial Term and all Renewal Terms are collectively referred to as the “Term”), unless either party notifies the other on or before ninety (90) days prior to the end of the then-current Term.  The Fees for renewal of the Services may be increased by five (5) percent year-over-year at the time of renewal.

11.2   Termination for Breach.  In the event that either party materially defaults in the performance of any of its duties or obligations under this Agreement and does not substantially cure such default, or commence a cure, within thirty (30) days after being given written notice specifying the default, the non-defaulting party may, by giving written notice thereof to the defaulting party, terminate this Agreement.  Spirion may, by written notice to Customer, terminate Customer’s right to use the Services without liability to Customer, if Customer fails to pay the applicable Fees for the Services as set forth in the Order Form Schedule B within thirty (30) days after Spirion gives Customer notice of such nonpayment.  Any such suspension or termination of access to the Services does not relieve Customer from paying any past due amounts and any amounts due Spirion through the expiration date of this Agreement.

11.3   Effect of Termination.  Within thirty (30) days (or earlier upon Spirion’s reasonable written request) after the effective date of a termination of this Agreement for any reason, Customer will (i) pay Spirion for all Services performed by Spirion up to the effective date of such termination and all other amounts owed by Customer to Spirion under this Agreement including, but not limited to, all Fees owed by Customer as of the effective date of termination according to the payment schedule set forth in the Order Form, regardless of the date of termination; and (ii) destroy or return to Spirion all Spirion property, including, but not limited to all Spirion Content, Documentation and  Confidential Information.  Upon the destruction or return of such materials, Customer will provide Spirion with a signed written statement certifying that it has destroyed or returned all Spirion property to Spirion.  Upon termination of this Agreement for any reason, all rights and licenses granted by Spirion hereunder to Customer will immediately cease.

11.4   Return of Customer Data.  For up to thirty (30) days after the Term of this Agreement, Customer can request in writing and Spirion will make available electronic files containing all of the then-available Customer Data.  After thirty (30) days, all Customer Data in the System will be purged from the System.

11.5 Survival.  Termination of this Agreement will not affect survival of the provisions regarding either party’s treatment of Confidential Information, provisions relating to the payments of amounts due that have accrued prior to termination, indemnity provisions, provisions limiting or disclaiming the party’s liability, or the provisions on termination, which provisions will survive such termination.

13. DISPUTES.

If at any time a dispute arises out of or in connection with this Agreement or any part thereof (e.g., a SOW), then Spirion and Customer will have their respective Project Managers meet in good faith with a view to resolving the dispute within a period of fifteen (15) Business Days from the day the dispute first arises.  Should the parties not be able to resolve the dispute within the fifteen (15) Business Days, then both parties will refer the matter to their own appropriate level of senior executive management respectively for resolution. If the relevant senior executive management of Spirion and Customer are unable to resolve the dispute within a further ten (10) Business Day period, then the parties will attempt to settle the dispute through discussions between each parties’ respective Chief Executive Officer.  In the absence of an amicable resolution within fifteen (15) Business Days from the meeting of the respective Chief Executive Officers in accordance with the conditions set forth in this Section 12, the dispute may then be submitted to the appropriate courts having jurisdiction over the matter as governed by Section 13.6.  Nothing in this Agreement will prevent either party from taking such action as it deems appropriate (including any application to a relevant court) for injunctive or other emergency or interim relief in relation to its Intellectual Property Rights or Confidential Information.

13. GENERAL.

13.1   Marketing.  Customer agrees to permit Spirion’s reasonable reference to Customer’s status as a user of the Services, including captioned quotations in product literature or advertisements, websites, articles, press releases, marketing literature, presentations and the like and occasional use as a reference for potential new users.

13.2   Force Majeure.  Neither Spirion nor Customer will be liable to the other for any delay or failure to perform (other than a failure to pay monies due under this Agreement) arising out of causes beyond its reasonable control including, but not limited to, riots, epidemics, severe weather, acts of the other party, fire, flood, terrorism, war, acts of the enemy, embargoes or work stoppages, labor disputes or strikes.  Spirion and Customer will notify each other promptly upon learning of any event that may result in any delay or failure to perform.  If the force majeure event occurs and continues to prevent substantial performance for more than thirty (30) days, the other party has the right to terminate this Agreement.

13.3   Entire Agreement.  This Agreement constitutes the sole and entire agreement of the parties with respect to the subject matter of this Agreement and supersedes all prior and contemporaneous understandings, agreements, representations, and warranties, both written and oral, with respect to such subject matter. In the event of any inconsistency between the statements made in the body of this Agreement, the related exhibits, schedules, attachments, and appendices (other than an exception expressly set forth as such therein) and any other documents incorporated herein by reference, the following order of precedence governs: (1) Terms and Conditions, excluding its schedules; (2) the Order;  (3) the Schedules, (4) any PSA, and (5) any SOW.

13.4   Assignment.  Except as otherwise set forth in this Agreement, this Agreement and all rights and obligations may not be assigned (by operation of law or otherwise) in whole or in part by Customer, and any such attempted assignment will be void and of no effect; provided, however, that either party hereto will have the right to assign this Agreement to another entity in connection with a reorganization, merger, consolidation, acquisition or other restructuring involving all or substantially all of the voting securities and/or assets of the assigning party upon written notice to the non-assigning party.   This Agreement will be binding upon and inure to the benefit of the parties, their legal representatives, permitted transferees, successors, and assigns as permitted by this Agreement.  There are no third-party beneficiaries of this Agreement and, in particular but without limiting the generality of the foregoing, no target or actual customers, or potential or actual employees of Customer or any Customer affiliate will have any legal rights or entitlements of any kind hereunder under any circumstances.

13.5   Waiver and Invalidity.  No delay or failure in exercising any right hereunder and no partial or single exercise thereof will be deemed to constitute a waiver of such right or any other rights hereunder.  If any provision hereof is declared invalid by a court of competent jurisdiction, such provision will be ineffective only to the extent of such invalidity, so that the remainder of that provision and all remaining provisions of this Agreement will be valid and enforceable to the fullest extent permitted by applicable law.

13.6   Choice of Law. This Agreement will be exclusively construed, governed and enforced in all respects in accordance with the internal laws (excluding all conflict of law rules) of the State of Florida and any applicable federal laws of the United States of America, as from time to time amended and in effect. Each party agrees that any claim or cause of action whether in law or equity, arising under or relating to this Agreement may be brought in a court of appropriate jurisdiction in the State of Florida. The parties agree that the United Nations Convention on Contracts for the International Sale of Goods will not apply in any respect to this Agreement or the parties hereto.  The parties hereby agree that their respective rights and obligations hereunder will be solely and exclusively as set forth herein and that UCITA, whether enacted in whole or in part by any state or applicable jurisdiction, regardless of how codified, will not apply to this Agreement and is hereby disclaimed.

13.7   Counterparts.  This Agreement and any SOW may be executed in any number of counterparts, each of which will be deemed an original but all of which together will be deemed for all purposes to constitute one and the same instrument. Signatures transmitted and received via email will be treated as original signatures for all purposes of this Agreement.

13.8       Government Entities. The Software and Documentation may be deemed to be “commercial computer software” and “commercial computer software documentation,” respectively, pursuant to DFAR Section 227.72 et. seq. and FAR Section 12.212, as applicable. Any use, modification, reproduction, release, performance, display or disclosure of the Software and accompanying Documentation by the United States Government shall be governed solely by the terms of this Agreement and shall be prohibited except to the extent expressly permitted by the terms of this Agreement.

13.9       Sanctions; Export Controls. Spirion’s obligations under this Agreement are subject to the condition that the fulfillment of such obligations are not prohibited by applicable Economic Sanctions Laws or US export control laws.  Customer represents and warrants that neither Customer, any Customer Affiliate or any Customer Personnel is (A) included on a Sanctions List or otherwise a target of any Economic Sanctions Laws, (B) directly or indirectly owned or controlled by any Person included on a Sanctions List or otherwise a target of any Economic Sanctions Laws, (C) located, organized or resident in a country or territory that is, or whose government is, the target of any Economic Sanctions Laws, (D) on the Denied Persons List, the Entity List or any similar list maintained by the US Department of Commerce that implements restrictions or prohibitions arising out of US foreign trade and customs requirements, embargoes or sanctions, or (E) to Customer’s knowledge, the subject of any investigation by a US governmental entity for violation of Economic Sanctions Laws or US export control laws.  If the preceding sentence becomes untrue in whole or in part for any reason during the Term, Customer agrees to notify Spirion promptly and will provide detailed related information to Spirion.

Customer agrees not to act in any manner that would reasonably be expected to result in a violation by Spirion of any Economic Sanctions Law (including using its relationship with Spirion or the Software to facilitate any activities of or business with any Person that is, at the time of such facilitation, on any Sanctions List).

The Software may be, or may become, subject to US export control laws, including the US Export Control Reform Act and its associated regulations. Customer will not directly or indirectly (whether separately or as part of a system), export, re-export, or release the Software or any technical information relating to the Software to, or make the Software or such technical information accessible from, any country, jurisdiction or Person to which export, re-export, or release is prohibited by applicable laws (including US export control laws) or which would require Spirion to be in violation of such laws in the absence of a license. Customer will at its sole expense comply with all applicable Laws and complete all required undertakings (including obtaining any necessary export license or other governmental approval) prior to exporting, re-exporting, releasing, or otherwise making the Software or technical information relating to the Software available outside the US, and will provide a copy of such licenses or approvals to Spirion upon request.

Customer will fully cooperate with Spirion to confirm or achieve compliance with any Economic Sanctions Laws or US export control laws, and will provide to Spirion promptly upon request any documents that are reasonably related to such compliance (including end-user certificates and affidavits).

13.10 Notices.  Any and all notices permitted or required to be given hereunder will be deemed duly effectively given: (a) when received, if delivered by hand, with signed confirmation of receipt; (b) when received, if sent by a nationally recognized overnight courier, signature required; (c) when sent, if by email, (with confirmation of transmission), if sent during the addressee’s normal business hours, and on the next Business Day, if sent after the addressee’s normal business hours; and (d) on the third day after the date mailed by certified or registered mail, return receipt requested, postage prepaid. Each such notice must be sent to the respective party at the addresses indicated on the signature page.  Notice to Spirion must include a copy to:  legal@spirion.com.

Schedule A

DEFINITIONS

  1. “Access Credentials” means the username, password, active directory authentication, or other security code, method, technology, or device used, alone or in combination, to verify an individual’s identity and authorization to access and use the Services.
  2. Authorized Users” means Customer’s employees, consultants, contractors, and agents (a) who are authorized by Customer to access and use the Services under the rights granted to Customer pursuant to this Agreement; and (b) for whom access to the Services has been purchased hereunder.
  3. “Business Day” collectively means Monday through Friday of each week, other than days on which banks in New York, New York, U.S.A, are closed for banking and any other date designated by Spirion as a company holiday (taking into account that different holidays may be recognized on different days each year).
  4. “Confidential Information” means any information or material in tangible or intangible form that: (i) is confidential and proprietary to the disclosing party, possesses an element of value to the disclosing party, is not generally known to the disclosing party’s competitors, and would damage the disclosing party if disclosed; or (ii) the disclosing party obtains from any third party and which the disclosing party treats as proprietary whether or not such information or material is owned by the disclosing party.
  5. “Customer Affiliate” means any entity controlling, controlled by, or under common control with Customer, where the root word “control” means (i) owning forty percent or more of an entity’s voting securities, partnership interests, membership interests or the like, (ii) having the right to appoint forty percent or more of an entity’s Board of Directors or similar governing body or (iii) having the right to forty percent or more of the profits of an entity or forty percent or more of the assets of an entity upon dissolution.
  6. “Customer Data” means information, data, and other content, in any form or medium, that is received, directly or indirectly from Customer or an Authorized User by or through the Services, or that incorporates or is derived from the Processing of such data by the Services, namely, the data delivered in Reports. For the avoidance of doubt, Customer Data does not include Resultant Data or any other information reflecting the access or use of the Services by or on behalf of Customer or any Authorized User.
  7. Customer Personnel” means, with regard to any Customer Affiliate, the officers, directors, agents, representatives, contractors and employees of that entity, collectively and individually.
  8. Customer Systems” means the Customer’s information technology infrastructure, including computers, software, hardware, databases, electronic systems (including database management systems), and networks, whether operated directly by Customer or through the use of third-party services.
  9. “Deliverables” means those Services detailed in a Statement of Work.
  10. “Derivative Works” means any suggestions, contributions, enhancements, improvements, modifications or changes to the referenced materials.
  11. “Documentation” means the user documentation and any other operating, training, and reference manuals relating to the use of the Services, as supplied by Spirion to Customer, as well as any Derivative Works thereto.
  12. “Economic Sanctions Law” means any statute, law, ordinance, regulation, rule, code, governmental order, executive order, guidance or other requirement or rule of law that imposes economic sanctions and trade embargoes and is administered by OFAC or any successor US governmental entity and, if Licensee is a business organized outside of the United States, such laws in the country of organization of Licensee.
  13. “Intellectual Property Rights” means all rights in and to any of the following, however constituted: trade secrets, patents, copyrights, trademarks, service marks, URLs, trade dress, brand features, know-how, moral rights, contract rights, code (executable, source and other) and similar rights of any type under the laws of any applicable governmental authority, or international treaty, including, without limitation, all applications and registrations relating to any of the foregoing.
  14. “Order Form” means the initial order form set forth in Schedule A as well as subsequent order forms, which will serve as the mechanism by which Customer may purchase additional Services following the Effective Date that incorporates the terms and conditions of this Agreement.
  15. Permitted Use” means any use of the Services by an Authorized User for the purpose of discovering, classifying, and monitoring, certain Sensitive Data located on servers and devices within Customer Systems.
  16. “Person” means any individual, corporation, limited liability company, partnership, association or other entity.
  17. “Personal Data” means (i) that subset of Customer Data that relates to or can be attributed to an identified or identifiable natural person and/or (ii) information concerning an identified or identifiable natural person that is protected by applicable laws.
  18. “Process” means to take any action or perform any operation or set of operations that the SaaS Services are capable of taking or performing on any data, information, or other content, including but not limited to receive, store, organize, evaluate, analyze, sort, anonymize, process, retrieve, transmit, or otherwise use. “Processing” and “Processed” have correlative meanings.
  19. “Professional Services” means the services provided by Spirion for Customer pursuant to a Statement of Work (Schedule E).
  20. Reporting” means the part of the reports regarding the processing of the Customer Data by the Services (“Reports”).
  21. “Resultant Data” means data and information related to Customer’s use of the Services that is used by Spirion in an aggregate and anonymized manner, including to compile statistical and performance information related to the provision and operation of the Services.
  22. “Sanctions List” means the “Specially Designated Nationals and Blocked Persons List”, the “Consolidated Sanctions List” and any other list that is not included in the forgoing lists that identifies targets of Economic Sanctions Laws and is maintained by OFAC or any successor US governmental entity.
  23. Sensitive Data” means the categories of data, including but not limited to Personal Data, to be identified by the Services, as selected by Customer, such as Social Security number or credit card number.
  24. “Services” means the software-as-a-service offering(s) listed in the Order Form for the Spirion Sensitive Data suite of products and services.
  25. “Specifications” means the specifications set forth in the Documentation.
  26. “Spirion Materials” means the Services, Specifications, Documentation, and Spirion Systems and any and all other information, data, documents, materials, works, and other content, devices, methods, processes, hardware, software, and other technologies and inventions, including the Spirion user interface, any deliverables, technical or functional descriptions, requirements, plans, or reports (including the look and feel of Reports), that are provided by or used by Spirion in connection with the Services or otherwise comprise or relate to the Services or Spirion Systems. For the avoidance of doubt, Spirion Materials include Resultant Data and any information, data, or other content derived from Spirion’s monitoring of Customer’s access to or use of the Services, but do not include Customer Data.
  27. “Spirion Server” means the Microsoft Azure cloud servers that Spirion uses to provide the Service.
  28. “Spirion Services” means the collective reference to all services Spirion performs for Customer under this Agreement and includes without limitation, any Professional Services provided under an SOW.
  29. Spirion Systems” means the information technology infrastructure used by or on behalf of Spirion in performing the Services, including all computers, software, hardware, databases, electronic systems (including database management systems), and networks, whether operated directly by Spirion or through the use of third-party services.
  30. “Term” has the meaning set forth in Section 13.1 of this Agreement.
  31. Third-Party Materials” means materials and information, in any form or medium, including any open source or other software, documents, data, content, specifications, products, equipment, or components of the Services that are not proprietary to Spirion.

The following Schedules will be provided to Customer when applicable:

Schedule B: Initial Order Form (to be provided separately)

Schedule C: Customer Support Services and SLAs

Schedule D: Data Privacy and Security Policy

Schedule E: Professional Services SOW (to be provided separately)

The following Addendums will be provided to Customer when applicable:

Data Processing Addendum

Business Associate Addendum

V2021.02.10