Technology & Commercial Contracts

This century, significant advances in computer power and the associated ability to generate mind-boggling quantities of data have led to a huge rise in the use of artificial intelligence (AI) and automated decision-making (ADM) techniques. They now form an essential element of the technology industry.

If you’ve got a new project coming up and you want to assess the data protection risks involved in the use of data processing that involves AI or ADM (including profiling), we can help.

Our team of expert lawyers can quickly identify the issues at stake, including:

• Whether you have to complete a DPIA , and what it should cover.
• Staying compliant with the ICO’s guidance on AI and data protection, and also accountability.
• Ensuring that you understand the accountability and governance implications of AI and ADM.
• Determining what you need to do to ensure lawfulness, fairness and transparency in AI and ADM systems (e.g. by establishing legal basis and ensuring that appropriate privacy notices are in place).
• Ensuring that you assess security, data minimisation and accuracy in AI and ADM processes.
• Ensuring that individual rights are upheld in your AI and ADM systems.
• Considering how best to protect any vulnerable groups (including children).
• Considering the use of anonymised and pseudonymised data in line with regulatory guidance.

Of course, it is important to regularly review the use of AI and ADM processes as a project’s nature, scope, context, purpose or level of risk changes, or as technology advances. We can help with existing and ongoing project reviews and compliance updates, too.

Case Study

Do you want to outsource an aspect of your business, such as IT support, accounting or storage? You’ll want to ensure that the arrangement will meet the appropriate regulatory requirements and work effectively for both parties.

This is where we come in – with extensive experience of advising on myriad types of outsourcing arrangements.

You will also need to get your arrangements straight from a data protection perspective . We can help you to prepare the policies and procedures that support your data protection compliance when sharing personal data.

Case Study

Perhaps you’re a cloud services company looking to review how you implement your services in terms of your contract arrangements or your data-processing practices. Or maybe your business wants to explore using cloud services to fulfil some of its IT functions.

Our specialist technology lawyers have years of experience in this field. We can review or create contracts for you, including advising on GDPR-compliant data-processing practices that are specific to cloud services. We can also help you to carry out the necessary due diligence in line with best practice, including checklists and drafting or reviewing your policies and procedures where necessary.

Case Study

Having a set of terms and conditions may not be a legal requirement for businesses (unlike privacy notices ), but it is a great way to establish guidelines so that everyone – your business and your users, clients and other companies in your group – knows where they stand.

Our specialist commercial contracts lawyers can support you with setting up a practical, commercially focussed set of standard terms. These terms will be designed to suit your business, and aimed at addressing upfront the kinds of issues that might tie you up in legal wrangling later.

If you’re dealing with complex, high-value or high-risk arrangements and your standard terms aren’t going to cut it, we can help you to draft and negotiate bespoke commercial arrangements with customers and suppliers.

Case Study

If your business has a website or app, it’s a good idea to have a set of terms and conditions that:

• Protect your IP.
• Limit your liability in terms of the use of the website or app.
• Disclose legally required information.
• Define the relationship between the owner of the website or app and its users.
• Set out your acceptable use policy – or the “rules of the game”.

Whether your website or app is simply informational, sells products or offers subscriptions or other paid services, our technology lawyers can help you to devise a watertight set of terms and conditions that meet your business needs.

While you’re considering the legal side of your website or app, we can also help if you need a privacy notice drafted – a legal requirement under the GDPR – or associated documentation such as a cookie policy.

Case Study

Are you taking on a new supplier and keen to get a robust supply agreement in place? Or perhaps you’re conducting a review of the supply agreements that you have in place to ensure that they meet current regulatory requirements.

At Pritchetts, our team have extensive commercial experience and fully understand the balancing act involved in wanting to bring new suppliers on board smoothly and needing to manage risk. We can help to review or draft supply agreements and get that balance right.

Case Study

When setting up and operating a website, there are several legal and contractual issues to address, whether the website is a fully interactive e-commerce site or a simpler, brochure-style website.

Website design and development agreements

Where you are outsourcing website design and development to a third party, or you are a third-party web designer offering such services, you will need a contract to: 

• Ensure that the organisation gets the website that it needs and that there are fair obligations on both sides in relation to the design, functional and performance specifications.

• Set out clear costs, payment mechanisms, timescales and acceptance testing.

• Clarify ownership of what is developed and the underlying software, etc.

• Ensure that – when designing the site content or its performance – the site will comply with access requirements set out in disability discrimination legislation; requirements for GDPR-compliant consent; and other requirements under data protection, electronic privacy, e-commerce and distance-selling legislation.

• Ensure compliance with the use of cookies and adtech .

• Specify clear termination rights.

• Set out obligations and liability in relation to policing content, e.g. chat room facilities, etc.

• Set out rights and obligations in relation to ongoing site support and maintenance.

• Clarify the position in relation to website content.

Website content agreements

During the initial stages of designing and developing a website, or as a separate project to add more content later, you will need to consider: 

• What types of content are needed for the site, e.g. photographs, video, text, etc.

• Ensure that third-party intellectual property and other rights are established and that appropriate licences are sought for content that the website owner doesn’t own, including any software used on the site.

Website hosting agreements

Following the initial design and development of a website, you will need a contract that ensures that the site is hosted and maintained appropriately. The contract should:

• Ensure that the website continues to be hosted on an appropriate server for that site and should deal with any associated risks.

• Set out the agreed scope of services, response times, uptime requirements, acceptance and penetration testing requirements, liability for website content and personal data processed.

• Set out the fees, payment mechanisms and termination rights.

• Refer to the website’s terms and conditions , privacy policy , cookie policy, acceptable use policies and linking licences.

Case Study

Software is business-critical to most organisations. Developing or using software often requires specialist legal advice and consultancy on issues such as:

• Ensuring that appropriate software licences are in place, either for the standalone software product or in relation to bundling with other software or equipment. For example, these licences may need to be established between:

  • The third-party software vendors and the relevant users and end users.

  • Parties in the software supply chain, e.g. distributors such as software resellers, value-added resellers ( VARs ) or original equipment manufacturers ( OEMs ).

• Ensuring that appropriate software development agreements are in place with third parties who are developing bespoke software, and that appropriate rights and licences are in place if your own employees are creating such software.

Case Study

Non-disclosure agreements (also known as confidentiality agreements)

Non-disclosure/confidentiality agreements are fairly inexpensive to draft. You would usually deploy them to enable you to share confidential information with a third party (e.g. a customer, supplier, potential investor or stakeholder) while having some protections in place when you do so.

Although free templates are available online, these will rarely be fit for purpose and are unlikely to protect your specific idea or requirements. Not having adequate legal protection in place could have an adverse impact on your business, e.g. rendering you unable to register a patent or finding that someone else has got to market first with your idea.

We can advise you and ensure that you are seeking the best protection possible to:

• Ensure that the third party with whom you share information only uses it for the agreed purposes.

• Ensure that you have the right to sue for damages where the agreement is not complied with.

Research and development agreements

Organisations may try to obtain new ideas or technology from third parties such as other organisations, universities or individuals. They may do so via collaborative research, commissioning a third-party researcher, trialling third-party software or accepting unsolicited ideas from third parties.

We can use our years of experience to assist with drafting legal agreements and providing practical guidance on these kinds of arrangements.

Case Study

 

E-commerce

The rapid growth of technology means that for many organisations, their website or app is not only a shop window for their goods and services, but also where they trade. There is a raft of issues to consider when doing so – from compliance with data protection and e-privacy legislation , through to ensuring that robust commercial arrangements and protections are in place to minimise your commercial risk:

• Perhaps you’re looking to review your current e-commerce terms and conditions of trading, or you’ve started a new line of business and would like to create some?
  
  Our specialist commercial contracts lawyers can support you with setting up a practical, commercially focussed set of standard terms. These terms will be designed to suit your business, and aimed at addressing upfront the kinds of issues that might tie you up in legal wrangling later.
  
  This will help to ensure that both parties are clear about issues such as when the contract is formed, whether there are rights of cancellation, what the various obligations are and how to deal with things like returns and complaints.

• We can also assist with ensuring that your other app or website compliance documents – such as your app or website terms and conditions , privacy notices and cookie policy – are up to date.

• If you have queries about social media compliance or adtech , we can help with that, too.

 

Our specialist technology lawyers have years of experience in this field. We can review or create appropriate contracts for you and advise on GDPR-compliant data-processing practices.

Software-as-a-service

SaaS agreements differ from software licence agreements because the software is available via the Internet, so users don’t have to host, install and run the software from their own premises.

So, how can we help?

• We can assist you with ensuring that robust arrangements are in place between the SaaS provider and the SaaS customer, clearly identifying the terms under which SaaS software may be used.

• SaaS contracts are service contracts, rather than just a software licence. They are usually set up on standard terms to help with distribution to a wider set of customers. Perhaps you are a SaaS provider trying to create a robust set of terms and exclude or limit liability for data loss, corruption or service failure. We can help.

• Maybe you’re a customer who’s trying to understand your risk when buying SaaS products from a larger supplier who is unlikely to negotiate. Or perhaps the SaaS provider is a smaller organisation and there may be some wriggle room on negotiating terms to better manage your risk? We can help.

• If data-processing agreements form part of the terms, our team of specialist data protection lawyers can help to ensure that these are GDPR-compliant and that you understand the associated risks. We can also help if you’re mandated to carry out a data protection impact assessment (DPIA).

• SaaS providers are likely to host their service and store all of their customers’ data in the cloud in other countries, or use sub-contractors based in other countries. We can assist with reviewing your international transfer arrangements.

Case Study

Do you have a simple need to assess your organisation’s compliance when it hosts corporate social media accounts on platforms such as Twitter, LinkedIn, Facebook and Instagram? If so, we can help you to audit your interaction with those sites and update your privacy notices , cookie policy, website terms and conditions and acceptable use policies.

Alternatively, you may have entered the complicated new world of adtech and other online advertising channels such as aggregators, in which case you may need to consider or mitigate your risks as you do so.

The Information Commissioner’s Office (ICO) has investigated and reported on data protection issues around real-time bidding (RTB), programmatic advertising and on the adtech industry generally.

Its commissioned research into online advertising found that, of 2,300 participants, 63% said they found it acceptable that ads funded free content. However, when researchers explained how RTB works, this fell to 36%.

The adtech industry is facing increasing scrutiny by European authorities. In 2019, the French data protection regulator fined Google €50 million (£45 million) for breaching EU online privacy rules. This related to Google’s lack of transparency and clarity about its handling of personal data and inadequate consent for personalised ads.

Ignoring compliance carries a genuine threat of huge management costs backed by large fines, criminal offences and serious adverse PR:

• We can help if your organisation is involved in processing personal data in the adtech ecosystem and needs assistance to ensure that the correct compliance measures or contracts are in place.
   
• In the ICO’s view, a data protection impact assessment ( DPIA ) is mandatory where personal data is processed for RTB, given the high risk to individuals. We can help you to put the right DPIA processes in place and we can also liaise with the regulator if required.
   
• The ICO is concerned that:
  1. Privacy policies and information provided to users cannot ensure transparency and fair processing of data where adtech is involved.
  2. Ad profiles created about individuals can be detailed and shared repeatedly among hundreds of organisations for any one bid request, all without the individual’s knowledge.

  We can help to draft compliant privacy notices or associated documents including cookie policies, DPIAs and supplier due diligence checklists.

• The ICO has also highlighted:

  1. The inconsistent application of measures to secure data in transit and at rest. The ICO is concerned that individuals have no guarantees about the security of their personal data within the adtech ecosystem.
  2. The likelihood of changes to data protection law concerning international transfers of personal data, and similar inconsistencies about applying data minimisation and retention controls.

  
  We can help you to audit and assess your compliance generally, or specifically by conducting DPIAs . Such processes can often reveal training requirements , a need to assess and document appropriate lawful bases relied upon within the RTB ecosystem, and a need to draft new policies and procedures , or simply tighten up existing ones.

• Perhaps your data protection compliance queries concerning adtech or social media are more specific, relating to direct marketing , outsourcing to data processors , handling individual rights requests , ensuring the compliant use of surveillance and new technologies and more?
  
  Alternatively, you might be looking to untangle some data-processing and data-sharing arrangements between customers and adtech providers or aggregators. It’s certainly not always clear who is the processor or the controller, or whether everyone is a joint controller. We can help.
   
• We can also help on the commercial side, putting adtech vendor arrangements in place to protect your organisation.
   
• If you think your current processes need to be updated or reviewed to ensure compliance with data protection legislation, we can help draft new policies and procedures that reflect how you do business.
   
• If something’s gone wrong and you’ve had a security breach , we can advise you on how best to handle it.
   
• Given the regulatory spotlight on this area (the ICO is undertaking targeted information-gathering activities, engaging with stakeholders and cooperating with other data protection authorities), you may need assistance liaising with them and other regulators on data protection issues.
  
  Perhaps you’d like help to get their view on a tricky question where guidance is ambiguous, or where your DPIA has not completely reduced the data protection risks to your business. Alternatively, maybe the ICO has approached you more formally concerning information requests or complaints that it has received, and you’re unsure about next steps. We can help.

Case Study

From microenterprises to global multinationals and charities, organisations want to connect with potential and existing prospects and shout about their products or services. But who will you contact? How did you get their details? Have they consented to receiving your marketing material? If you can’t show that you have consent, are you sending it under another lawful basis?

If you’re using adtech , AI or machine learning – or other new technologies to reach your customers, or monetise your data – you’ll need to consider which data protection risks are key, and how to mitigate those risks.

We are experts in the field of data protection and direct marketing. We can help you to design marketing strategies and carry out advertising copy clearance to ensure that they comply with both the GDPR and e-privacy legislation such as PECR. We can also advise you on how best to utilise your customer databases without tripping over the hurdles of the complex legislation that governs these activities.

Alternatively, you may simply want a leg up to ensure that your staff know how to create marketing campaigns that comply with data protection law . We can design and deliver marketing-focused data protection training to a brief that we agree together.

Case Study

Are you someone who is being sponsored ? Or perhaps you are an organisation, event owner or venue being sponsored ? If so, it would be sensible not to rely on informal arrangements, but instead to put in place a sponsorship agreement setting out the legal relationship between the sponsor and those seeking to enforce the sponsorship obligation.

A formal arrangement is in the interests of each party.

Benefits to the sponsorship rights holder

A formal agreement:

• Clarifies the sponsor’s obligations to pay or provide a benefit in kind, etc. and ensures that the contract is easier to enforce.

• Establishes a clear schedule for payment dates and specifies the VAT position in relation to sponsorship fees.

• Ensures that the sponsor provides relevant material samples, branding rules, etc. to enable the rights holder to exploit its rights under the agreement.

• Establishes that the sponsor is contracting with the correct party, i.e. the owner (or exclusive licensee) of the rights. In conjunction with this, the licence to use trademarks can be set out.

• Ensures that appropriate sponsorship is granted, e.g. sponsorship of a stadium or venue; event, title or secondary sponsorship; official supplier status; and product placement broadcast sponsorship.

• Ensures that the sponsor acts fairly and doesn’t prejudice the sponsored person, event, sport, etc.

• Establishes clear rights to terminate.

Benefits to the sponsor

A formal agreement:

• Ensures that the individual or entity being sponsored has clear obligations and that the sponsor’s benefits are clearly defined. This makes the arrangement easier to enforce and terminate, and – where it is not complied with – helps to ensure that reimbursement is forthcoming.

• Makes it easier to terminate the contract if the actions of the other party could damage the sponsor’s brand or reputation.

• Protects the sponsor’s trademarks where they are licensed to the other party, and ensures that the sponsorship rights holder can grant the benefits that it has offered.

• Agrees the official status or direct association title, as well as advertising, branding, filming, corporate hospitality, award presentation rights, etc.

• Ensures appropriate territory sponsorship worldwide.

• Establishes the duty of a third party to consult with the sponsor, e.g. third-party contracts, sponsors, etc.

Our team of highly skilled solicitors have experience of both drafting and helping to manage sponsorship contracts. We’ve seen situations where things have gone wrong on either side, and where formalised agreements have been imperative to manage that risk. We can help to review or draft your sponsorship agreements and get that balance right.

Case Study