# PART 1 — REVISED CLAUSES (FINAL FORM) --- ## Section 7. Indemnification. **7.1 Vendor IP Indemnity.** Vendor shall defend, indemnify, and hold harmless Customer and its affiliates, and their respective officers, directors, employees, and agents, from and against any third-party claim, demand, suit, or proceeding alleging that the Services, the Vendor materials used to deliver them, or Customer's use of the Services in accordance with this Agreement infringes, misappropriates, or otherwise violates any patent, copyright, trademark, trade secret, or other intellectual property or proprietary right, and shall pay all damages, losses, liabilities, fines, costs, and expenses (including reasonable attorneys' fees) finally awarded against Customer or agreed by Vendor in settlement of such claim. **7.2 Limited Exclusion.** Vendor's obligations under Section 7.1 do not apply to the extent a claim arises solely from (a) modification of the Services by or for Customer without Vendor's authorization, or (b) combination of the Services with materials or systems not provided, specified, or recommended by Vendor, in either case where the claim would not have arisen but for such modification or combination. **7.3 Remedial Measures.** If the Services become, or in Vendor's reasonable judgment are likely to become, the subject of a claim under Section 7.1, Vendor shall, at its expense and at Customer's option among such of the following as Vendor can provide, procure the necessary rights for Customer to continue using the Services, or replace or modify the Services so that they are non-infringing and materially equivalent in functionality and performance. Only if neither remedy is commercially available may Vendor terminate the affected Services, in which case Vendor shall refund all prepaid, unused fees. Termination under this Section 7.3 does not limit Vendor's obligations under Section 7.1. **7.4 Customer Indemnity.** Customer shall defend, indemnify, and hold harmless Vendor from and against any third-party claim alleging that Customer Data, as furnished by Customer and used by Vendor in accordance with this Agreement, infringes or misappropriates the intellectual property rights of that third party, and shall pay all damages finally awarded against Vendor or agreed by Customer in settlement of such claim. Customer has no obligation with respect to any claim for which Vendor is obligated to indemnify Customer under Section 7.1, or arising from Vendor's use of Customer Data or Usage Data other than as permitted by Section 9. **7.5 Procedure.** The indemnified party shall give the indemnifying party prompt written notice of the claim (provided that failure to give prompt notice relieves the indemnifying party only to the extent it is materially prejudiced thereby), shall provide reasonable cooperation at the indemnifying party's expense, and shall permit the indemnifying party to control the defense and settlement. The indemnifying party shall not enter into any settlement that imposes any liability, payment, admission of fault, or non-monetary obligation on the indemnified party, or that fails to release the indemnified party unconditionally, without the indemnified party's prior written consent. The indemnified party may participate in the defense with counsel of its own choosing at its own expense. --- ## Section 8. Limitation of Liability. **8.1 General Cap.** Subject to Sections 8.2 and 8.3, and except for Customer's obligation to pay fees due under this Agreement, each party's total aggregate liability arising out of or relating to this Agreement, regardless of the theory of liability, shall not exceed the total fees paid or payable by Customer under this Agreement in the twelve (12) months preceding the first event giving rise to the claim (or, if fewer than twelve months have elapsed as of that event, the fees paid or payable annualized over a twelve-month period). **8.2 Enhanced Cap for Confidentiality and Data Security.** Claims arising out of or relating to (a) either party's breach of its confidentiality obligations under this Agreement, or (b) Vendor's breach of its obligations to safeguard, secure, or restrict access to or use of Customer Data or Usage Data under this Agreement (including any security incident, unauthorized access, or unauthorized disclosure) (together, the "**Data Security Obligations**"), are excluded from the cap in Section 8.1 and are instead subject to a separate aggregate cap equal to two (2) times the amount determined under Section 8.1 (i.e., twenty-four (24) months of fees). The cap in this Section 8.2 is separate from, and not reduced by, amounts payable under Section 8.1. **8.3 Matters Not Subject to Any Cap.** The limitations in Sections 8.1 and 8.2 do not apply to, and no cap limits, either party's indemnification obligations under Section 7. **8.4 Excluded Damages.** Except as provided in Section 8.5, neither party shall be liable for indirect, incidental, consequential, special, or punitive damages, or for loss of data, in each case however caused and regardless of the theory of liability. **8.5 Exceptions to Section 8.4.** Section 8.4 does not apply to, and shall not be construed to limit recovery for, (a) either party's indemnification obligations under Section 7, (b) breach of confidentiality obligations, or (c) Vendor's breach of the Data Security Obligations. For the avoidance of doubt, in the case of a claim described in clause (b) or (c), the reasonable costs of forensic investigation, regulatory response, required notifications to individuals and regulators, credit monitoring, and restoration or reconstruction of Customer Data are recoverable as direct damages, subject to the cap in Section 8.2. --- ## Section 9. Intellectual Property; Data; Term. **9.1 Vendor Materials.** Vendor owns and retains all right, title, and interest in and to the Services and all software, models, technology, and documentation used to provide them, excluding Customer Data, Derived Data, and Usage Data. **9.2 Customer Data and Derived Data.** As between the parties, Customer owns and retains all right, title, and interest in and to (a) all data, content, records, and materials that Customer or its users submit to or that are generated for Customer through the Services ("**Customer Data**"), and (b) all outputs, reports, compilations, aggregations, de-identified or anonymized versions, modifications, and other materials derived from Customer Data, whether created by Customer, by Vendor, or by or through the Services ("**Derived Data**"). Vendor hereby assigns to Customer all right, title, and interest it may acquire in Derived Data. No provision of this Agreement operates as an assignment or transfer of Customer Data or Derived Data to Vendor. **9.3 Limited License to Vendor.** Customer grants Vendor a non-exclusive, non-transferable, revocable, worldwide license to host, copy, store, transmit, process, and display Customer Data and Derived Data solely to the extent necessary to provide, maintain, support, and secure the Services for Customer's benefit and as directed by Customer, and for no other purpose. Vendor may sublicense these rights only to subcontractors and hosting providers engaged in delivering the Services to Customer and bound by written obligations no less protective than those in this Agreement. No other license, right, or interest in Customer Data, Derived Data, Usage Data, or any Customer trademarks or materials is granted to Vendor, by implication, estoppel, or otherwise. **9.4 Usage Data.** "**Usage Data**" means data and metadata generated in connection with Customer's or its users' access to or use of the Services, including configuration, telemetry, log, performance, and interaction data. Vendor may use Usage Data solely to provide, support, secure, monitor, troubleshoot, and invoice for the Services provided to Customer. **9.5 Prohibited Uses; Opt-In.** Vendor shall not, and shall not permit any affiliate, subcontractor, or third party to, use, reproduce, disclose, or sell Customer Data, Derived Data, or Usage Data to (a) train, develop, tune, test, validate, or improve any machine-learning, artificial-intelligence, or other model or algorithm; (b) develop, improve, benchmark, or market any product or service for or on behalf of any other customer or prospective customer; or (c) create any dataset, insight, index, or product made available to any third party. This restriction applies whether such data is identified, pseudonymized, aggregated, anonymized, or de-identified, and applies notwithstanding any other provision of this Agreement. Vendor may engage in a use otherwise prohibited by this Section 9.5 only pursuant to Customer's prior, express, written opt-in identifying the specific data, purpose, and duration, executed by an authorized signatory of Customer. Any such opt-in is revocable by Customer prospectively on written notice, is not a condition of receiving the Services, and confers no license beyond its express terms. Silence, continued use of the Services, click-through, or acceptance of updated online terms does not constitute an opt-in. **9.6 Feedback.** Customer may, but is not obligated to, provide suggestions, comments, or ideas regarding the Services ("**Feedback**"). Customer grants Vendor a non-exclusive, worldwide, royalty-free, perpetual, irrevocable license to use and incorporate Feedback into the Services. Customer does not assign, and retains all right, title, and interest in, Feedback. Feedback excludes Customer Data, Derived Data, Usage Data, and Customer's Confidential Information, and no Feedback license permits any use prohibited by Section 9.5. **9.7 Non-Exclusivity.** This Agreement is non-exclusive. Nothing in this Agreement restricts Customer from developing, procuring, evaluating, or using any products or services from any third party or internally, whether or not competitive with the Services, and Customer makes no exclusivity, preferred-provider, minimum-purchase, or first-look commitment of any kind. **9.8 Renewal.** Following the initial term, this Agreement renews automatically for successive periods of one (1) year each, unless either party gives written notice of non-renewal at least thirty (30) days before the end of the then-current term. No renewal term shall exceed one (1) year, and no renewal shall change the fees or other terms except by written agreement of both parties. --- # PART 2 — RATIONALE MEMO ## Section 7 (146 words) The draft's one-way customer indemnity is replaced with a full vendor IP defense-and-indemnity obligation covering third-party infringement and misappropriation claims (mandate item 1), including defense costs and settlement amounts. Section 7.2 uses the authorized fallback — exclusion only where a claim arises *solely* from Customer's own modifications or combinations — which I judged necessary to make the indemnity closable; "solely" plus "but for" keeps it narrow. Section 7.3 preserves Customer's continuity of service and bars Vendor from using termination as a substitute for indemnifying. The residual Customer indemnity is narrowed to third-party IP claims about Customer Data as furnished, and expressly does not cover Vendor's unpermitted data uses under Section 9. **Hardest vendor pushback:** Section 7.3 — Vendor will want unilateral discretion to terminate and refund as its exclusive remedy, capping its IP exposure. Hold the line that termination does not extinguish Section 7.1. ## Section 8 (149 words) The three-month cap becomes twelve months of fees, with annualization so an early-term incident is not effectively uncapped-downward (mandate item 2). Section 8.2 creates a separate, non-cumulative-with-8.1 supercap at twice that figure (24 months) for confidentiality breaches and Vendor's data-security obligations, and expressly excludes those claims from the ordinary cap (mandate items 2 and 3). Indemnification obligations are uncapped (mandate item 3). The mutual excluded-damages waiver and the Customer-payment carve-out are retained as drafted; Section 8.5 carves indemnity, confidentiality, and data-security claims out of that waiver, and confirms breach-response costs are direct damages so the retained "loss of data" exclusion cannot hollow out the supercap. The $4 million fixed-dollar fallback was not needed and is held in reserve if annual fees make 24 months inadequate. **Hardest vendor pushback:** uncapped indemnity in Section 8.3 — Vendor will demand the IP indemnity sit inside the supercap. ## Section 9 (150 words) Vendor's ownership of the Services is preserved, but the assignment of Derived Data is reversed: Customer owns Customer Data and everything derived from it (mandate item 5). Vendor's rights are recast as a narrow, revocable license limited to what is necessary to deliver the Services to Customer, with an express no-implied-license backstop (must-not-concede item 3). Section 9.5 prohibits training, cross-customer improvement, benchmarking, and third-party datasets, including aggregated and de-identified data, absent a specific, signed, revocable opt-in (mandate item 4), closing the draft's "aggregated or de-identified where practicable" loophole. Feedback moves from assignment to a license only (mandate item 5). Section 9.7 forecloses exclusivity; Section 9.8 replaces three-year auto-renewal and 180-day notice with one-year renewals and 30-day notice (must-not-concede items 1 and 2). **Hardest vendor pushback:** Section 9.5's inclusion of aggregated and de-identified data — Vendor will argue de-identified data is outside Customer's ownership and essential to product development.