I need to revise Sections 7, 8, and 9 along with a rationale memo, keeping each to 150 words or less. The critical issue is mutual indemnity — the mandate requires the vendor to defend against third-party IP claims, which is non-negotiable. For the customer indemnity, I should narrow it from the vendor's overly broad draft to cover only third-party claims arising from Customer Data that infringes or violates laws. I need to stay within the mandate's scope while tightening the customer's obligations, making sure the indemnity remains reciprocal but more balanced.

On liability caps, the structure is: ordinary cap at 12 months of fees minimum, with a supercap of at least 24 months for data-breach and confidentiality claims. Indemnification obligations sit outside the ordinary cap entirely (uncapped), while confidentiality and data-security breaches are carved out of the ordinary cap and instead subject to the supercap. I'll draft the supercap as 24 months of fees, with a fallback option to express it as a fixed dollar amount of at least $4 million if needed.

For the IP indemnity combination carve-out—excluding claims arising solely from Bellhaven's combinations or modifications—that's a standard market concession vendors expect. I'll include it narrowly as written, since it's customary and helps close deals without real cost.

On data handling: Bellhaven owns all customer data and derivatives; the vendor gets no right to train models or improve services for other customers without prior written consent. For feedback, I'm granting only a non-exclusive, perpetual, royalty-free license—no assignment. The vendor's license to use customer data is strictly limited to providing the services as directed, nothing broader.

For renewal, I'm locking in successive one-year terms with 30 or 60 days' notice—no automatic renewal beyond one year, and I'm pushing back hard on longer notice periods like 180 days.

On exclusivity, I need to add an express statement that the agreement is non-exclusive and the customer can obtain similar services elsewhere, which guards against any implied exclusivity. For aggregated or de-identified data, the vendor cannot use it for training or service improvement without opt-in, though they can use usage data for security, billing, and service delivery.

I should reference the agreement's existing confidentiality and data security obligations generically rather than inventing section numbers — just point to "the Agreement's confidentiality provisions" and define the vendor's data security obligations narrowly as safeguarding customer data. On damages exclusions, I need to keep them mutual but carve out that the exclusion doesn't apply to indemnification obligations.

Now drafting Section 7 on vendor IP indemnity — the vendor defends and indemnifies the customer against third-party claims that the services infringe intellectual property rights, covering damages and legal fees. The exclusion applies only when the claim arises solely from customer's modifications or use outside the agreement's scope.

Customer indemnity is narrower, covering only claims that customer data itself infringes third-party IP or violates law. The procedure requires prompt notice and gives the indemnifying party sole control of defense, with no settlements allowed without consent. If an injunction is issued, the vendor must either secure rights, replace the services, or terminate with a pro rata refund.

Now looking at the liability caps: the general cap is the greater of fees paid or owed in the preceding 12 months, excluding payment obligations themselves. There's a higher cap of 24 months' fees for breaches of confidentiality or data security obligations, including security incidents. Indemnification obligations under Section 7 remain uncapped, which aligns with the mandate.

For the damages exclusion, I'm carving out indemnification, confidentiality breaches, and data security breaches—those aren't subject to the ordinary exclusion. I'll note that direct damages from data breaches, including notification costs and forensic investigation, are recoverable even though they might technically fall under the data-security cap. The definition of "fees paid or payable" looks back 12 months from the first triggering event.

Moving to Section 9 on IP and data ownership: Vendor retains ownership of the Services themselves, while Customer owns all Customer Data plus any derivatives, modifications, or de-identified versions created from it. Vendor gets a limited, non-exclusive, non-transferable license to use Customer Data only for providing and securing the Services—no sublicensing except through bound subprocessors.

Vendor is prohibited from using Customer Data or Usage Data to train AI models, develop competing services, or benchmark/market anything without explicit prior written opt-in from Customer, though they can use Usage Data for billing and service delivery. Customer grants Vendor a perpetual, royalty-free license to use any Feedback provided, as long as it doesn't contain Customer Data or Confidential Information. The agreement runs on successive one-year terms with 30 days' notice required for non-renewal.