Skip to content

SaaS terms for the EU and the US

For software sold as a service to business customers: master subscription terms, a data processing agreement and, where needed, a privacy notice for the people whose data you handle yourself.

Example request

We are a German GmbH selling a cloud platform for predictive maintenance to manufacturers in Germany, France,
Italy, Ohio, Texas and California, never to consumers. Customers sign an annual subscription online. The
platform holds sensor data from their machines and login accounts of their staff. Support runs through a US
ticketing vendor. Please draft our master subscription terms and a data processing agreement.

What the skill does

  • Business track only. A customer acting for its trade is not a consumer, so the consumer information duties, the right of withdrawal and the German order and cancellation buttons stay out. German standard terms control still applies between businesses through § 307 BGB; §§ 308 and 309 BGB apply to consumer contracts only.
  • Data Act. Machine sensor data can be product data or related service data of a connected product. The skill checks the Data Act's definitions, its exemptions for micro and small enterprises and custom-built products (as open points when the facts are missing) and the Article 13 test for unfair terms imposed on another business.
  • GDPR Article 28. The data processing agreement follows the Article 28(3) list. Roles are decided per category of data: staff logins processed for the customer make you a processor; the contact details you use for your own dealings with the customer make you a controller.
  • Sub-processors. The standard contractual clauses under Article 28(7) offer prior specific authorisation or general authorisation with notice and a right to object. The skill sets out both options and asks which one you want.
  • Transfers. A US vendor that sees support tickets is a transfer under GDPR Chapter V; the skill names the transfer tools and leaves the vendor's own safeguard status as an open point.
  • US states. Each state is read from its own consumer definition. Several state privacy laws exclude people acting in a business or employment context; the CCPA does not, so a California service-provider module goes into the data processing agreement, with the customer's own threshold left open.
  • Other EU countries. France and Italy are handled at the level of the EU regulations, with the national rules listed as open points.

Documents

Master subscription terms, data processing agreement with annexes, annotations, open points and an implementation register (sub-processor list, notice periods, transfer records, security measures).

See the full B2B SaaS example. Related: privacy notice under GDPR and CCPA.