Enterprise SaaS Agreement — Arkansas

ENTERPRISE SOFTWARE AS A SERVICE AGREEMENT

State of Arkansas

Agreement No.: [________________________________]

TABLE OF CONTENTS

1. Parties and Recitals
2. Definitions
3. Access Rights and License Grant
4. Service Levels and Availability
5. Implementation and Onboarding
6. Customer Obligations
7. Fees and Payment
8. Data Protection and Security
9. Intellectual Property and Feedback
10. Confidentiality
11. Representations and Warranties
12. Indemnification
13. Limitation of Liability
14. Term and Termination
15. Governing Law and Dispute Resolution
16. General Provisions
17. Signatures
18. Exhibit A — Order Form
19. Exhibit B — SLA Summary

1. PARTIES AND RECITALS

This Enterprise Software as a Service Agreement ("Agreement") is entered into as of [__/__/____] (the "Effective Date") by and between:

Provider:
Name: [________________________________]
Address: [________________________________]
State of Organization: [________________________________]
Contact: [________________________________]
Email: [________________________________]

Customer:
Name: [________________________________]
Address: [________________________________]
State of Organization: [________________________________]
Contact: [________________________________]
Email: [________________________________]

RECITALS

WHEREAS, Provider has developed and operates a proprietary cloud-based software platform described in the applicable Order Form (the "SaaS Services");

WHEREAS, Customer desires to subscribe to and access the SaaS Services for its internal business operations;

WHEREAS, the Parties intend this Agreement to comply with applicable Arkansas law, including without limitation the Arkansas Personal Information Protection Act (Ark. Code Ann. § 4-110-101 et seq.), the Arkansas Deceptive Trade Practices Act (Ark. Code Ann. § 4-88-101 et seq.), the Arkansas Trade Secrets Act (Ark. Code Ann. § 4-75-601 et seq.), and the Arkansas Uniform Electronic Transactions Act (Ark. Code Ann. § 25-32-101 et seq.);

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:

2. DEFINITIONS

2.1 "Affiliate" means any entity controlling, controlled by, or under common control with a Party (50%+ voting ownership).

2.2 "Authorized Users" means employees, contractors, and agents authorized to access the SaaS Services per the Order Form.

2.3 "Confidential Information" means all non-public information designated or reasonably understood as confidential.

2.4 "Customer Data" means all data submitted by or on behalf of Customer or Authorized Users, including Personal Information.

2.5 "Documentation" means Provider's then-current written materials describing the SaaS Services.

2.6 "Effective Date" means the date first written above.

2.7 "Fees" means all charges per the Order Form.

2.8 "Intellectual Property Rights" means all patent, copyright, trademark, trade secret (per Ark. Code Ann. § 4-75-601 and 18 U.S.C. § 1836), and other IP rights worldwide.

2.9 "Malicious Code" means viruses, worms, ransomware, or other harmful code.

2.10 "Order Form" means each ordering document referencing this Agreement.

2.11 "Personal Information" has the meaning set forth in Ark. Code Ann. § 4-110-101(7) and includes an individual's first name or first initial and last name in combination with data elements such as Social Security number, driver's license number, account number or credit/debit card number with required security code, medical information, or individual taxpayer identification number, when the data elements are not encrypted, redacted, or otherwise rendered unreadable.

2.12 "Professional Services" means implementation, configuration, training, or consulting services.

2.13 "SaaS Services" means the cloud-based application(s) in the Order Form.

2.14 "Security Breach" means unauthorized access of data in electronic form containing Personal Information per Ark. Code Ann. § 4-110-103.

2.15 "SLA" means the commitments in Exhibit B.

2.16 "Subscription Term" means the initial and renewal terms.

2.17 "Trade Secret" has the meaning set forth in Ark. Code Ann. § 4-75-601(4), meaning information that derives independent economic value from not being generally known and is the subject of reasonable efforts to maintain secrecy.

2.18 "Updates" means bug fixes, patches, and minor enhancements at no additional charge.

2.19 "Usage Data" means aggregated, de-identified data.

2.20 "AUP" means Provider's then-current acceptable use policy.

3. ACCESS RIGHTS AND LICENSE GRANT

3.1 Grant. Subject to compliance and payment, Provider grants Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the SaaS Services for internal business operations.

3.2 License Type.

☐ Per-User License — [____] named users
☐ Per-Seat License — [____] concurrent users
☐ Enterprise-Wide License — unlimited
☐ Usage-Based License — metered by [________________________________]
☐ Tiered License — per Order Form

3.3 Usage Restrictions. Customer shall not:

(a) Copy, modify, or create derivative works;

(b) Reverse engineer except as permitted by applicable Arkansas law;

(c) Sublicense, lease, rent, sell, or transfer;

(d) Remove proprietary notices;

(e) Use for competitive benchmarking without consent;

(f) Use in violation of applicable law, including the Arkansas Deceptive Trade Practices Act (Ark. Code Ann. § 4-88-101 et seq.);

(g) Transmit Malicious Code or unlawful content;

(h) Interfere with or burden the SaaS Services; or

(i) Exceed authorized scope.

3.4 Reservation of Rights. All rights not expressly granted are reserved.

4. SERVICE LEVELS AND AVAILABILITY

4.1 Uptime Commitment. [____]% monthly availability per Exhibit B.

4.2 Service Credits.

4.3 Credit Request. Written request within thirty (30) days of the affected month.

4.4 Exclusions. Scheduled maintenance, force majeure, Customer systems, Customer breach, third-party services, emergency security work.

4.5 Measurement. (Total Minutes - Downtime) / Total Minutes x 100.

4.6 Chronic Failure. Three consecutive months below [____]% triggers termination right with pro-rata refund.

5. IMPLEMENTATION AND ONBOARDING

5.1 Implementation plan within [____] business days.

5.2 Configuration per Order Form.

5.3 Data migration if included.

5.4 [____] hours of training.

5.5 [____] business days for acceptance testing; cure within [____] business days.

6. CUSTOMER OBLIGATIONS

6.1 Accurate information, credential security, breach notification, administrator designation.

6.2 Compliance with Arkansas and federal laws.

6.3 Reasonable cooperation.

6.4 Responsible for own systems.

6.5 Responsible for Customer Data legality.

7. FEES AND PAYMENT

7.1 Fees. Per the Order Form.

7.2 Invoicing.

☐ Annually in advance
☐ Quarterly in advance
☐ Monthly in advance
☐ Monthly in arrears (usage-based)

7.3 Payment Terms. Due within [____] days.

7.4 Late Payments. Overdue amounts shall bear interest at the lesser of: (a) one percent (1.0%) per month (12% per annum); or (b) the maximum lawful rate. For a loan or contract governed by Arkansas Constitution Amendment 89, Section 3, the maximum is seventeen percent (17%) per annum; Section 6(b) makes an over-limit contract void as to principal and interest. Arkansas counsel must confirm the transaction's classification and selected rate.

7.5 Arkansas Sales Tax. All Fees exclude applicable Arkansas state and local sales taxes. SaaS services may be subject to Arkansas sales tax under Ark. Code Ann. § 26-52-301 et seq. Customer shall pay all applicable taxes (excluding Provider's income tax).

7.6 Fee Increases. [____] days' notice; not to exceed [____]% per year.

7.7 Disputed Invoices. Written dispute with detail within [____] days.

7.8 Suspension. After [____] days' notice of non-payment.

8. DATA PROTECTION AND SECURITY

8.1 Arkansas Personal Information Protection Act Role Map. The Data Processing Addendum shall identify, for each covered data category, whether each Party acquires, owns, licenses, or merely maintains the data. The Parties shall perform the role assigned by Ark. Code Ann. § 4-110-105:

(a) A Party that acquires, owns, or licenses covered information shall control required Arkansas-resident notice and provide it in the most expedient time and manner possible and without unreasonable delay, subject to the statute's law-enforcement and system-integrity provisions;

(b) A Party that merely maintains covered computerized data it does not own shall notify the owner or licensee immediately following discovery of a qualifying breach under § 4-110-105(b)(1), with any shorter contractual outside deadline stated in the DPA;

(c) The Party responsible under § 4-110-105(b)(2) shall notify the Arkansas Attorney General when more than one thousand (1,000) individuals are affected, at the time affected individuals are notified or within forty-five (45) days after the required harm determination, whichever occurs first;

(d) A Party making a written breach determination shall retain it and its supporting documentation for five (5) years and respond to a qualifying Attorney General request as § 4-110-105(g) requires; and

(e) Each Party shall cooperate in investigating the incident, identifying affected persons, preparing notices, mitigating harm, and performing the duties allocated to its statutory and contractual role.

8.2 Security Measures. Provider shall maintain:

(a) Encryption in transit (TLS 1.2+) and at rest (AES-256);

(b) Role-based access with multi-factor authentication;

(c) Vulnerability assessments and penetration testing;

(d) Incident response procedures; and

(e) Employee background checks and training.

8.3 Security Certifications.

☐ SOC 2 Type II
☐ ISO 27001
☐ HITRUST CSF
☐ Other: [________________________________]

8.4 Data Ownership. Customer retains all rights in Customer Data.

8.5 Data Use. Provider shall process Customer Data solely for the SaaS Services. Provider shall not sell, share, or use Customer Data for purposes other than those expressly permitted.

8.6 Data Return and Deletion. Within [____] days of termination, return or delete; certify upon request.

8.7 Subprocessors. Prior written notice; equivalent data protection obligations on subprocessors.

9. INTELLECTUAL PROPERTY AND FEEDBACK

9.1 Provider retains all IP in the SaaS Services.

9.2 Customer retains all IP in Customer Data.

9.3 Provider may use Usage Data for operations and improvements.

9.4 Customer grants Provider a royalty-free license for Feedback.

10. CONFIDENTIALITY

10.1 Obligations. Use solely for Agreement purposes; reasonable care; need-to-know; no third-party disclosure without consent.

10.2 Exclusions. Public; previously known; third-party sourced; independently developed.

10.3 Compelled Disclosure. Permitted with prompt notice and cooperation on protective orders, to the extent permitted by Arkansas law.

10.4 Trade Secrets. Trade secret obligations survive indefinitely under the Arkansas Trade Secrets Act (Ark. Code Ann. § 4-75-601 et seq.), which defines a trade secret as information that derives independent economic value from not being generally known and not being readily ascertainable by proper means, and is the subject of reasonable efforts to maintain secrecy (Ark. Code Ann. § 4-75-601(4)). Federal protections under the Defend Trade Secrets Act (18 U.S.C. § 1836 et seq.) also apply. Other confidentiality obligations survive [____] years post-termination.

10.5 Misappropriation Remedies. Under the Arkansas Trade Secrets Act, a court may award: (a) injunctive relief (Ark. Code Ann. § 4-75-602); (b) actual damages and unjust enrichment (Ark. Code Ann. § 4-75-603); and (c) exemplary damages up to twice actual damages for willful and malicious misappropriation (Ark. Code Ann. § 4-75-603(b)).

10.6 Return. Return or destroy upon termination.

11. REPRESENTATIONS AND WARRANTIES

11.1 Mutual. Duly organized; authority; no conflict; compliance with Arkansas and federal laws.

11.2 Provider. Material conformance; professional performance; no Malicious Code; no material decrease; no known infringement.

11.3 Customer. Right to provide data; no infringement; compliance.

11.4 Remedies. Cure or terminate for pro-rata refund.

11.5 Disclaimer. TO THE EXTENT PERMITTED BY ARKANSAS LAW, EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION 11, PROVIDER MAKES NO WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, AND SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. PROVIDER DOES NOT WARRANT THAT THE SAAS SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE.

12. INDEMNIFICATION

12.1 Provider indemnifies against third-party IP claims from authorized use.

12.2 Exclusions: modifications, combinations, misuse, Customer Data, non-current versions.

12.3 Remediation: procure rights, modify, or terminate and refund.

12.4 Customer indemnifies for Customer Data, AUP breaches, unauthorized use.

12.5 Prompt notice, defense control, cooperation, no settlement without consent.

13. LIMITATION OF LIABILITY

13.1 Cap. EACH PARTY'S TOTAL AGGREGATE LIABILITY SHALL NOT EXCEED THE FEES PAID OR PAYABLE DURING THE [____]-MONTH PERIOD PRECEDING THE CLAIM, EXCEPT PER SECTION 13.3.

13.2 Exclusion. NEITHER PARTY SHALL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, REGARDLESS OF THEORY, EXCEPT PER SECTION 13.3.

13.3 Carve-Outs. (a) Indemnification; (b) confidentiality breaches; (c) data protection (Section 8); (d) usage restriction breaches; (e) willful misconduct or gross negligence; (f) Fee obligations; (g) violations of Arkansas law where limitation is prohibited.

13.4 Arkansas Statutory Claims. Nothing limits liability for violations of the Arkansas Deceptive Trade Practices Act (Ark. Code Ann. § 4-88-101 et seq.) to the extent such limitation is prohibited by Arkansas law. Under the Act, the Arkansas Attorney General may seek injunctive relief and civil penalties (Ark. Code Ann. § 4-88-113).

13.5 Basis of Bargain. These limitations reflect the allocation of risk and form an essential basis of the bargain.

14. TERM AND TERMINATION

14.1 Initial Term. Effective Date through the Subscription Term.

14.2 Renewal. Auto-renews for [____] periods unless [____] days' non-renewal notice.

14.3 Termination for Cause. Material breach uncured in [____] days; insolvency.

14.4 Termination for Convenience. [____] days' notice; Fees due through current term.

14.5 Effect. Licenses end; cease use; return Confidential Information; data export for [____] days; pay accrued Fees.

14.6 Survival. Sections 2, 7 (accrued), 8.6, 9, 10, 11.5, 12, 13, 14.5, 14.6, 15, 16.

15. GOVERNING LAW AND DISPUTE RESOLUTION

15.1 Governing Law. This Agreement is governed by the laws of the State of Arkansas, without regard to conflict-of-laws principles.

15.2 Escalation. Good-faith executive negotiation within [____] days.

15.3 Forum Selection.

☐ Litigation. Exclusive jurisdiction in state and federal courts in [________________________________] County, Arkansas (Circuit Court of [________________________________] County or the United States District Court for the [____] District of Arkansas). Parties consent to jurisdiction and waive venue objections.

☐ Arbitration. Binding arbitration under AAA Commercial Arbitration Rules in [________________________________], Arkansas, by [____] arbitrator(s). The Federal Arbitration Act (9 U.S.C. § 1 et seq.) and the Arkansas Uniform Arbitration Act (Ark. Code Ann. § 16-108-201 et seq.) govern.

☐ Mediation then Arbitration. Mediation first; arbitration if unresolved within [____] days.

15.4 No Predispute Jury Waiver. This Agreement does not waive either Party's right to a jury trial. In Tilley v. Malvern National Bank, 2017 Ark. 343, the Arkansas Supreme Court held predispute contractual jury waivers unenforceable under Ark. Const. art. 2, § 7. Ark. Code Ann. § 16-30-104 creates an exception only for a written provision in a contract to borrow or lend money; this SaaS agreement is not drafted as such a contract. If the Parties select arbitration, counsel should use a complete arbitration clause rather than add a jury-waiver clause.

15.5 Injunctive Relief. Either Party may seek injunctive relief to prevent irreparable harm without posting a bond, to the extent permitted by Arkansas law.

16. GENERAL PROVISIONS

16.1 Force Majeure. No liability for causes beyond reasonable control, including natural disasters (tornadoes, floods, ice storms), pandemics, government acts, war, or cyberattacks. Termination right if continues [____] days.

16.2 Assignment. No assignment without consent except to Affiliates or in M&A.

16.3 Notices. Written, by hand, courier, certified mail, or confirmed email.

16.4 Severability. Invalid provisions modified; remaining provisions continue.

16.5 Entire Agreement. This Agreement, Order Forms, Exhibits, DPA, AUP constitute the entire agreement.

16.6 Amendments. Written, signed by both Parties.

16.7 Waiver. Written only; no waiver of subsequent breaches.

16.8 Counterparts. Electronic signatures are valid under the Arkansas Uniform Electronic Transactions Act (Ark. Code Ann. § 25-32-101 et seq.), which provides that a record or signature may not be denied legal effect solely because it is in electronic form (Ark. Code Ann. § 25-32-107). The E-SIGN Act (15 U.S.C. § 7001 et seq.) also applies.

16.9 Independent Contractors. No partnership, agency, or employment.

16.10 No Third-Party Beneficiaries. No third-party rights.

16.11 Order of Precedence. (1) DPA; (2) this Agreement; (3) Order Form; (4) SLA; (5) AUP.

16.12 Export Compliance. EAR, ITAR, OFAC compliance.

16.13 Anti-Corruption. FCPA and applicable anti-corruption law compliance.

16.14 Arkansas Deceptive Trade Practices Compliance. Activities under this Agreement shall comply with the Arkansas Deceptive Trade Practices Act (Ark. Code Ann. § 4-88-101 et seq.). The Act prohibits deception, fraud, and unconscionable conduct in business, trade, and commerce, and all representations made by Provider concerning the SaaS Services shall be truthful and not misleading.

16.15 Interest Savings Clause. The Parties do not intend to contract for interest above the rate permitted by Arkansas Constitution Amendment 89. Counsel shall revise any charge that could be treated as interest before execution; this clause does not replace the remedy stated in Amendment 89, Section 6(b), for an over-limit contract governed by Section 3.

17. SIGNATURES

☐ Provider has reviewed and agrees to all terms and conditions
☐ Customer has reviewed and agrees to all terms and conditions
☐ Legal counsel review completed

PROVIDER:

Signature: [________________________________]
Printed Name: [________________________________]
Title: [________________________________]
Date: [__/__/____]

CUSTOMER:

Signature: [________________________________]
Printed Name: [________________________________]
Title: [________________________________]
Date: [__/__/____]

EXHIBIT A — ORDER FORM

Order Form No.: [________________________________]
Agreement Reference: Enterprise SaaS Agreement dated [__/__/____]

Special Terms:
[________________________________]

Provider: _________________________ Date: [__/__/____]
Customer: _________________________ Date: [__/__/____]

EXHIBIT B — SLA SUMMARY

1. Uptime Commitment: [____]% monthly availability

2. Maintenance Windows:

• Day(s): [________________________________]
• Time: [________________________________] (Central Time)
• Notice: [____] hours

3. Service Credits:

4. Max Monthly Credit: [____]%

5. Support Response Times:

6. Support Channels:

☐ Email: [________________________________]
☐ Phone: [________________________________]
☐ Portal: [________________________________]

7. Support Hours:

☐ 24/7/365
☐ Business Hours: [________________________________] (Central Time)

This template is provided for informational purposes only and does not constitute legal advice. Consult an attorney licensed in Arkansas before executing this agreement. Arkansas has unique constitutional usury limitations that must be carefully evaluated.