## Revised Clauses

**Section 7. Intellectual Property Indemnity.** Vendor shall defend, indemnify, and hold harmless Customer from and against any third-party claim alleging that the Services infringe or misappropriate any patent, copyright, trademark, trade secret, or other intellectual property right, and shall pay all damages, settlements, interest, and reasonable attorneys’ fees finally awarded or paid in settlement with Customer’s approval. This Section 7 does not apply to the extent a claim arises solely from (a) Customer’s modification of the Services, or (b) Customer’s combination of the Services with materials, data, or systems not provided or required by Vendor.

**Section 8. Limitation of Liability.**

8.1 **Ordinary Cap.** Except for Customer’s payment obligations and except as set forth in Sections 8.2 and 8.3, each party’s total aggregate liability arising out of or relating to this Agreement, regardless of theory, shall not exceed the fees paid or payable by Customer in the twelve (12) months preceding the event giving rise to the claim; provided that, if fewer than twelve (12) months of fees have become payable, the cap is the annualized fees in effect at the time of the claim.

8.2 **Exclusions from Ordinary Cap.** The cap in Section 8.1 does not apply to: (a) Vendor’s indemnification obligations under Section 7; (b) Vendor’s breach of its confidentiality obligations under Section 9.4; or (c) Vendor’s breach of its data-security obligations under Section 9.4.

8.3 **Data-Breach and Confidentiality Supercap.** A “data breach” means (a) unauthorized access to, or acquisition, use, disclosure, modification, or destruction of, Customer Data, Usage Data, Customer Derivatives, or Feedback, or (b) Vendor’s breach of its data-security obligations under Section 9.4. Notwithstanding Section 8.2, each party’s total aggregate liability arising out of or relating to a data breach or Vendor’s breach of its confidentiality obligations under Section 9.4 shall not exceed two (2) times the amount that would be the cap under Section 8.1.

8.4 **Consequential Damages.** In no event shall either party be liable for indirect, incidental, consequential, special, or punitive damages, including loss of data; provided that this exclusion does not apply to (a) Vendor’s indemnification obligations under Section 7 or (b) liability subject to Section 8.3.

**Section 9. Intellectual Property; Data.**

9.1 **Ownership.** Vendor owns all right, title, and interest in and to the Services. Customer owns all right, title, and interest in and to Customer Data, Usage Data, Feedback, and all derivatives, outputs, analytics, models, and other materials derived from any of the foregoing (collectively, **Customer Derivatives**). Customer does not assign to Vendor any Customer Data, Usage Data, Feedback, or Customer Derivatives. Vendor acquires no ownership interest in Customer Data, Usage Data, Feedback, or Customer Derivatives except as expressly set forth in this Section 9. For this Section 9, “Customer Data” means data provided by or on behalf of Customer, including data entered into or processed by the Services; “Usage Data” means data collected by Vendor regarding Customer’s use of the Services; and “Feedback” means suggestions, ideas, or other input provided by Customer regarding the Services.

9.2 **Limited Licenses.** Customer grants Vendor a non-exclusive, non-transferable license to use Customer Data, Usage Data, Customer Derivatives, and Feedback solely as necessary to provide the Services to Customer. All licenses granted by Customer are non-exclusive, no exclusivity of any kind is granted or implied, and no license is granted by implication or estoppel.

9.3 **Data Use Restrictions.** Vendor may collect and use Usage Data solely as necessary to provide the Services to Customer. Vendor shall not use or disclose Customer Data, Usage Data, or Customer Derivatives except as expressly permitted in Section 9.2 or as required by law. Vendor shall not use Customer Data, Usage Data, or Customer Derivatives, in whole or in part, to train, develop, test, or improve any model, algorithm, service, or product, or to provide services to any other customer, except with Customer’s prior written opt-in specifically authorizing the particular use.

9.4 **Confidentiality; Data Security.** Vendor shall keep Customer Data, Usage Data, Customer Derivatives, and Feedback confidential and shall not disclose them except to personnel or contractors who need to know and are bound by confidentiality obligations at least as protective as this Section 9.4, or as required by law with prior notice to Customer where lawful. Vendor shall implement and maintain commercially reasonable administrative, technical, and physical safeguards to protect Customer Data, Usage Data, Customer Derivatives, and Feedback from unauthorized access, use, disclosure, alteration, or destruction, and shall notify Customer promptly after discovering any such unauthorized access (a “Security Incident”).

9.5 **Renewal.** This Agreement does not automatically renew. Any renewal or extension must be set forth in a written agreement signed by both parties.

---

## Rationale Memos

**Section 7**  
Section 7 replaces the one-way customer indemnity with a vendor IP indemnity required by the mandate. Vendor must defend, indemnify, and hold harmless Bellhaven for third-party claims that the Services infringe IP rights and pay resulting amounts. I kept the vendor’s ownership of the Services but did not retain any customer indemnity because the mandate does not require it. The only exclusion is the permitted fallback for claims arising solely from Bellhaven’s modifications or combinations with non-vendor materials, because that limits the indemnity to Vendor’s own IP. I expect Vendor to counter hardest on the uncapped nature of the IP indemnity under Section 8 and on removing Customer’s broad indemnity, which previously covered all Customer use.

**Section 8**  
Section 8 replaces the three-month cap with a twelve-month fee cap, as required. It creates a separate supercap equal to twice that cap for data-breach and confidentiality claims, and also applies it to Vendor’s data-security obligations so those excluded claims have a defined higher ceiling. Indemnification, confidentiality breaches, and Vendor data-security obligations are excluded from the ordinary cap. I retained the payment-obligation carve-out and the mutual consequential-damages exclusion, but carved out the mandated categories so the supercap can operate. I did not use the $4 million fixed fallback because the twice-fee formula satisfies the mandate and scales with the deal. I expect Vendor to counter hardest on the uncapped IP indemnity, which is excluded from both the ordinary cap and the consequential-damages waiver.

**Section 9**  
Section 9 keeps Vendor ownership of the Services but restores Bellhaven ownership of Customer Data, Usage Data, Feedback, and all derivatives, and deletes the vendor draft’s assignment. It grants only non-exclusive, non-transferable licenses limited to what is necessary to provide the Services, satisfying the no-broadening mandate and the no-exclusivity rule. It expressly prohibits Vendor from using Bellhaven data, including usage data, to train models or improve services for other customers without prior written opt-in. It adds confidentiality and data-security duties needed to support the Section 8 exclusions and replaces the three-year auto-renewal with no automatic renewal. I expect Vendor to counter hardest on the data-use prohibition, because it eliminates the draft’s broad right to use and improve services with Customer data.