Enterprise SaaS Agreement — Arkansas

ENTERPRISE SOFTWARE AS A SERVICE AGREEMENT

State of Arkansas

Agreement No.: [________________________________]

TABLE OF CONTENTS

1. Parties and Recitals
2. Definitions
3. Access Rights and License Grant
4. Service Levels and Availability
5. Implementation and Onboarding
6. Customer Obligations
7. Fees and Payment
8. Data Protection and Security
9. Intellectual Property and Feedback
10. Confidentiality
11. Representations and Warranties
12. Indemnification
13. Limitation of Liability
14. Term and Termination
15. Governing Law and Dispute Resolution
16. General Provisions
17. Signatures
18. Exhibit A — Order Form
19. Exhibit B — SLA Summary

1. PARTIES AND RECITALS

This Enterprise Software as a Service Agreement ("Agreement") is entered into as of [__/__/____] (the "Effective Date") by and between:

Provider:
Name: [________________________________]
Address: [________________________________]
State of Organization: [________________________________]
Contact: [________________________________]
Email: [________________________________]

Customer:
Name: [________________________________]
Address: [________________________________]
State of Organization: [________________________________]
Contact: [________________________________]
Email: [________________________________]

RECITALS

WHEREAS, Provider has developed and operates a proprietary cloud-based software platform described in the applicable Order Form (the "SaaS Services");

WHEREAS, Customer desires to subscribe to and access the SaaS Services for its internal business operations;

WHEREAS, the Parties intend this Agreement to comply with applicable Arkansas law, including without limitation the Arkansas Personal Information Protection Act (Ark. Code Ann. § 4-110-101 et seq.), the Arkansas Deceptive Trade Practices Act (Ark. Code Ann. § 4-88-101 et seq.), the Arkansas Trade Secrets Act (Ark. Code Ann. § 4-75-601 et seq.), and the Arkansas Uniform Electronic Transactions Act (Ark. Code Ann. § 25-32-101 et seq.);

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:

2. DEFINITIONS

2.1 "Affiliate" means any entity controlling, controlled by, or under common control with a Party (50%+ voting ownership).

2.2 "Authorized Users" means employees, contractors, and agents authorized to access the SaaS Services per the Order Form.

2.3 "Confidential Information" means all non-public information designated or reasonably understood as confidential.

2.4 "Customer Data" means all data submitted by or on behalf of Customer or Authorized Users, including Personal Information.

2.5 "Documentation" means Provider's then-current written materials describing the SaaS Services.

2.6 "Effective Date" means the date first written above.

2.7 "Fees" means all charges per the Order Form.

2.8 "Intellectual Property Rights" means all patent, copyright, trademark, trade secret (per Ark. Code Ann. § 4-75-601 and 18 U.S.C. § 1836), and other IP rights worldwide.

2.9 "Malicious Code" means viruses, worms, ransomware, or other harmful code.

2.10 "Order Form" means each ordering document referencing this Agreement.

2.11 "Personal Information" has the meaning set forth in Ark. Code Ann. § 4-110-101(7) and includes an individual's first name or first initial and last name in combination with data elements such as Social Security number, driver's license number, account number or credit/debit card number with required security code, medical information, or individual taxpayer identification number, when the data elements are not encrypted, redacted, or otherwise rendered unreadable.

2.12 "Professional Services" means implementation, configuration, training, or consulting services.

2.13 "SaaS Services" means the cloud-based application(s) in the Order Form.

2.14 "Security Breach" means unauthorized access of data in electronic form containing Personal Information per Ark. Code Ann. § 4-110-103.

2.15 "SLA" means the commitments in Exhibit B.

2.16 "Subscription Term" means the initial and renewal terms.

2.17 "Trade Secret" has the meaning set forth in Ark. Code Ann. § 4-75-601(4), meaning information that derives independent economic value from not being generally known and is the subject of reasonable efforts to maintain secrecy.

2.18 "Updates" means bug fixes, patches, and minor enhancements at no additional charge.

2.19 "Usage Data" means aggregated, de-identified data.

2.20 "AUP" means Provider's then-current acceptable use policy.

3. ACCESS RIGHTS AND LICENSE GRANT

3.1 Grant. Subject to compliance and payment, Provider grants Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the SaaS Services for internal business operations.

3.2 License Type.

☐ Per-User License — [____] named users
☐ Per-Seat License — [____] concurrent users
☐ Enterprise-Wide License — unlimited
☐ Usage-Based License — metered by [________________________________]
☐ Tiered License — per Order Form

3.3 Usage Restrictions. Customer shall not:

(a) Copy, modify, or create derivative works;

(b) Reverse engineer except as permitted by applicable Arkansas law;

(c) Sublicense, lease, rent, sell, or transfer;

(d) Remove proprietary notices;

(e) Use for competitive benchmarking without consent;

(f) Use in violation of applicable law, including the Arkansas Deceptive Trade Practices Act (Ark. Code Ann. § 4-88-101 et seq.);

(g) Transmit Malicious Code or unlawful content;

(h) Interfere with or burden the SaaS Services; or

(i) Exceed authorized scope.

3.4 Reservation of Rights. All rights not expressly granted are reserved.

4. SERVICE LEVELS AND AVAILABILITY

4.1 Uptime Commitment. [____]% monthly availability per Exhibit B.

4.2 Service Credits.

4.3 Credit Request. Written request within thirty (30) days of the affected month.

4.4 Exclusions. Scheduled maintenance, force majeure, Customer systems, Customer breach, third-party services, emergency security work.

4.5 Measurement. (Total Minutes - Downtime) / Total Minutes x 100.

4.6 Chronic Failure. Three consecutive months below [____]% triggers termination right with pro-rata refund.

5. IMPLEMENTATION AND ONBOARDING

5.1 Implementation plan within [____] business days.

5.2 Configuration per Order Form.

5.3 Data migration if included.

5.4 [____] hours of training.

5.5 [____] business days for acceptance testing; cure within [____] business days.

6. CUSTOMER OBLIGATIONS

6.1 Accurate information, credential security, breach notification, administrator designation.

6.2 Compliance with Arkansas and federal laws.

6.3 Reasonable cooperation.

6.4 Responsible for own systems.

6.5 Responsible for Customer Data legality.

7. FEES AND PAYMENT

7.1 Fees. Per the Order Form.

7.2 Invoicing.

☐ Annually in advance
☐ Quarterly in advance
☐ Monthly in advance
☐ Monthly in arrears (usage-based)

7.3 Payment Terms. Due within [____] days.

7.4 Late Payments. Overdue amounts shall bear interest at the lesser of: (a) one percent (1.0%) per month (12% per annum); or (b) the maximum rate permitted under Arkansas law. Under the Arkansas Constitution, Article 19, Section 13, as amended by Amendment 89, the maximum lawful rate of interest on any contract is seventeen percent (17%) per annum for consumer loans and credit sales. The maximum rate cannot exceed five percent (5%) per annum above the Federal Reserve Discount Rate at the time of the contract. Persons paying usurious interest may recover twice the amount of interest paid under Ark. Const. Art. 19, § 13.

7.5 Arkansas Sales Tax. All Fees exclude applicable Arkansas state and local sales taxes. SaaS services may be subject to Arkansas sales tax under Ark. Code Ann. § 26-52-301 et seq. Customer shall pay all applicable taxes (excluding Provider's income tax).

7.6 Fee Increases. [____] days' notice; not to exceed [____]% per year.

7.7 Disputed Invoices. Written dispute with detail within [____] days.

7.8 Suspension. After [____] days' notice of non-payment.

8. DATA PROTECTION AND SECURITY

8.1 Arkansas Personal Information Protection Act (PIPA). Provider shall comply with the Arkansas Personal Information Protection Act (Ark. Code Ann. § 4-110-101 et seq.), including:

(a) Reasonable Security Measures. Provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the Personal Information to protect it from unauthorized access, destruction, use, modification, or disclosure, as required by Ark. Code Ann. § 4-110-104(b);

(b) Breach Notification to Customer. Provider shall notify Customer without unreasonable delay and in no event later than [____] hours after discovering a Security Breach affecting Customer Data containing Personal Information of Arkansas residents;

(c) Notification to Individuals. Disclosure to affected Arkansas residents shall be made in the most expedient time and manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system, as required by Ark. Code Ann. § 4-110-105(a);

(d) Notification to Arkansas Attorney General. If the Security Breach affects more than one thousand (1,000) individuals, Provider shall cooperate with Customer in providing notice to the Arkansas Attorney General at the same time as disclosure to affected individuals, or within forty-five (45) days after determining a reasonable likelihood of harm, whichever occurs first, per Ark. Code Ann. § 4-110-105(d);

(e) Content of Notification. Written notification shall include: (i) a description of the incident in general terms; (ii) the type of Personal Information compromised; (iii) telephone number or website for additional information; (iv) toll-free numbers for consumer reporting agencies; and (v) advice to review account statements, as per Ark. Code Ann. § 4-110-105(c);

(f) Form of Notification. Written notice to the last known mailing address, or substitute notice if the cost would exceed $250,000, affected class exceeds 500,000 persons, or the entity does not have sufficient contact information, per Ark. Code Ann. § 4-110-105(b); and

(g) Third-Party Data. If Provider maintains computerized data that includes Personal Information that Provider does not own, Provider shall notify the owner or licensee of the information of any Security Breach immediately per Ark. Code Ann. § 4-110-105(e).

8.2 Security Measures. Provider shall maintain:

(a) Encryption in transit (TLS 1.2+) and at rest (AES-256);

(b) Role-based access with multi-factor authentication;

(c) Vulnerability assessments and penetration testing;

(d) Incident response procedures; and

(e) Employee background checks and training.

8.3 Security Certifications.

☐ SOC 2 Type II
☐ ISO 27001
☐ HITRUST CSF
☐ Other: [________________________________]

8.4 Data Ownership. Customer retains all rights in Customer Data.

8.5 Data Use. Provider shall process Customer Data solely for the SaaS Services. Provider shall not sell, share, or use Customer Data for purposes other than those expressly permitted.

8.6 Data Return and Deletion. Within [____] days of termination, return or delete; certify upon request.

8.7 Subprocessors. Prior written notice; equivalent data protection obligations on subprocessors.

9. INTELLECTUAL PROPERTY AND FEEDBACK

9.1 Provider retains all IP in the SaaS Services.

9.2 Customer retains all IP in Customer Data.

9.3 Provider may use Usage Data for operations and improvements.

9.4 Customer grants Provider a royalty-free license for Feedback.

10. CONFIDENTIALITY

10.1 Obligations. Use solely for Agreement purposes; reasonable care; need-to-know; no third-party disclosure without consent.

10.2 Exclusions. Public; previously known; third-party sourced; independently developed.

10.3 Compelled Disclosure. Permitted with prompt notice and cooperation on protective orders, to the extent permitted by Arkansas law.

10.4 Trade Secrets. Trade secret obligations survive indefinitely under the Arkansas Trade Secrets Act (Ark. Code Ann. § 4-75-601 et seq.), which defines a trade secret as information that derives independent economic value from not being generally known and not being readily ascertainable by proper means, and is the subject of reasonable efforts to maintain secrecy (Ark. Code Ann. § 4-75-601(4)). Federal protections under the Defend Trade Secrets Act (18 U.S.C. § 1836 et seq.) also apply. Other confidentiality obligations survive [____] years post-termination.

10.5 Misappropriation Remedies. Under the Arkansas Trade Secrets Act, a court may award: (a) injunctive relief (Ark. Code Ann. § 4-75-602); (b) actual damages and unjust enrichment (Ark. Code Ann. § 4-75-603); and (c) exemplary damages up to twice actual damages for willful and malicious misappropriation (Ark. Code Ann. § 4-75-603(b)).

10.6 Return. Return or destroy upon termination.

11. REPRESENTATIONS AND WARRANTIES

11.1 Mutual. Duly organized; authority; no conflict; compliance with Arkansas and federal laws.

11.2 Provider. Material conformance; professional performance; no Malicious Code; no material decrease; no known infringement.

11.3 Customer. Right to provide data; no infringement; compliance.

11.4 Remedies. Cure or terminate for pro-rata refund.

11.5 Disclaimer. TO THE EXTENT PERMITTED BY ARKANSAS LAW, EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION 11, PROVIDER MAKES NO WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, AND SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. PROVIDER DOES NOT WARRANT THAT THE SAAS SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE.

12. INDEMNIFICATION

12.1 Provider indemnifies against third-party IP claims from authorized use.

12.2 Exclusions: modifications, combinations, misuse, Customer Data, non-current versions.

12.3 Remediation: procure rights, modify, or terminate and refund.

12.4 Customer indemnifies for Customer Data, AUP breaches, unauthorized use.

12.5 Prompt notice, defense control, cooperation, no settlement without consent.

13. LIMITATION OF LIABILITY

13.1 Cap. EACH PARTY'S TOTAL AGGREGATE LIABILITY SHALL NOT EXCEED THE FEES PAID OR PAYABLE DURING THE [____]-MONTH PERIOD PRECEDING THE CLAIM, EXCEPT PER SECTION 13.3.

13.2 Exclusion. NEITHER PARTY SHALL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, REGARDLESS OF THEORY, EXCEPT PER SECTION 13.3.

13.3 Carve-Outs. (a) Indemnification; (b) confidentiality breaches; (c) data protection (Section 8); (d) usage restriction breaches; (e) willful misconduct or gross negligence; (f) Fee obligations; (g) violations of Arkansas law where limitation is prohibited.

13.4 Arkansas Statutory Claims. Nothing limits liability for violations of the Arkansas Deceptive Trade Practices Act (Ark. Code Ann. § 4-88-101 et seq.) to the extent such limitation is prohibited by Arkansas law. Under the Act, the Arkansas Attorney General may seek injunctive relief and civil penalties (Ark. Code Ann. § 4-88-113).

13.5 Basis of Bargain. These limitations reflect the allocation of risk and form an essential basis of the bargain.

14. TERM AND TERMINATION

14.1 Initial Term. Effective Date through the Subscription Term.

14.2 Renewal. Auto-renews for [____] periods unless [____] days' non-renewal notice.

14.3 Termination for Cause. Material breach uncured in [____] days; insolvency.

14.4 Termination for Convenience. [____] days' notice; Fees due through current term.

14.5 Effect. Licenses end; cease use; return Confidential Information; data export for [____] days; pay accrued Fees.

14.6 Survival. Sections 2, 7 (accrued), 8.6, 9, 10, 11.5, 12, 13, 14.5, 14.6, 15, 16.

15. GOVERNING LAW AND DISPUTE RESOLUTION

15.1 Governing Law. This Agreement is governed by the laws of the State of Arkansas, without regard to conflict-of-laws principles.

15.2 Escalation. Good-faith executive negotiation within [____] days.

15.3 Forum Selection.

☐ Litigation. Exclusive jurisdiction in state and federal courts in [________________________________] County, Arkansas (Circuit Court of [________________________________] County or the United States District Court for the [____] District of Arkansas). Parties consent to jurisdiction and waive venue objections.

☐ Arbitration. Binding arbitration under AAA Commercial Arbitration Rules in [________________________________], Arkansas, by [____] arbitrator(s). The Federal Arbitration Act (9 U.S.C. § 1 et seq.) and the Arkansas Uniform Arbitration Act (Ark. Code Ann. § 16-108-201 et seq.) govern.

☐ Mediation then Arbitration. Mediation first; arbitration if unresolved within [____] days.

15.4 Jury Trial Waiver. TO THE FULLEST EXTENT PERMITTED BY ARKANSAS LAW, EACH PARTY HEREBY IRREVOCABLY WAIVES ANY RIGHT TO A TRIAL BY JURY IN ANY ACTION OR PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT.

15.5 Injunctive Relief. Either Party may seek injunctive relief to prevent irreparable harm without posting a bond, to the extent permitted by Arkansas law.

16. GENERAL PROVISIONS

16.1 Force Majeure. No liability for causes beyond reasonable control, including natural disasters (tornadoes, floods, ice storms), pandemics, government acts, war, or cyberattacks. Termination right if continues [____] days.

16.2 Assignment. No assignment without consent except to Affiliates or in M&A.

16.3 Notices. Written, by hand, courier, certified mail, or confirmed email.

16.4 Severability. Invalid provisions modified; remaining provisions continue.

16.5 Entire Agreement. This Agreement, Order Forms, Exhibits, DPA, AUP constitute the entire agreement.

16.6 Amendments. Written, signed by both Parties.

16.7 Waiver. Written only; no waiver of subsequent breaches.

16.8 Counterparts. Electronic signatures are valid under the Arkansas Uniform Electronic Transactions Act (Ark. Code Ann. § 25-32-101 et seq.), which provides that a record or signature may not be denied legal effect solely because it is in electronic form (Ark. Code Ann. § 25-32-107). The E-SIGN Act (15 U.S.C. § 7001 et seq.) also applies.

16.9 Independent Contractors. No partnership, agency, or employment.

16.10 No Third-Party Beneficiaries. No third-party rights.

16.11 Order of Precedence. (1) DPA; (2) this Agreement; (3) Order Form; (4) SLA; (5) AUP.

16.12 Export Compliance. EAR, ITAR, OFAC compliance.

16.13 Anti-Corruption. FCPA and applicable anti-corruption law compliance.

16.14 Arkansas Deceptive Trade Practices Compliance. Activities under this Agreement shall comply with the Arkansas Deceptive Trade Practices Act (Ark. Code Ann. § 4-88-101 et seq.). The Act prohibits deception, fraud, and unconscionable conduct in business, trade, and commerce, and all representations made by Provider concerning the SaaS Services shall be truthful and not misleading.

16.15 Usury Savings Clause. Notwithstanding anything in this Agreement to the contrary, in no event shall the total interest or charges paid by either Party exceed the maximum rate or amount permitted under Arkansas law, including the Arkansas Constitution, Article 19, Section 13, as amended by Amendment 89. If any payment or charge exceeds the maximum permitted, the excess shall be applied first to the unpaid principal and then refunded.

17. SIGNATURES

☐ Provider has reviewed and agrees to all terms and conditions
☐ Customer has reviewed and agrees to all terms and conditions
☐ Legal counsel review completed

PROVIDER:

Signature: [________________________________]
Printed Name: [________________________________]
Title: [________________________________]
Date: [__/__/____]

CUSTOMER:

Signature: [________________________________]
Printed Name: [________________________________]
Title: [________________________________]
Date: [__/__/____]

EXHIBIT A — ORDER FORM

Order Form No.: [________________________________]
Agreement Reference: Enterprise SaaS Agreement dated [__/__/____]

Special Terms:
[________________________________]

Provider: _________________________ Date: [__/__/____]
Customer: _________________________ Date: [__/__/____]

EXHIBIT B — SLA SUMMARY

1. Uptime Commitment: [____]% monthly availability

2. Maintenance Windows:

• Day(s): [________________________________]
• Time: [________________________________] (Central Time)
• Notice: [____] hours

3. Service Credits:

4. Max Monthly Credit: [____]%

5. Support Response Times:

6. Support Channels:

☐ Email: [________________________________]
☐ Phone: [________________________________]
☐ Portal: [________________________________]

7. Support Hours:

☐ 24/7/365
☐ Business Hours: [________________________________] (Central Time)

This template is provided for informational purposes only and does not constitute legal advice. Consult an attorney licensed in Arkansas before executing this agreement. Arkansas has unique constitutional usury limitations that must be carefully evaluated.