SaaS agreement and terms

With SaaS, customers do not receive the software — they access a service you operate. The focus therefore shifts from licensing to availability, support, data and account termination, alongside processing customers' personal data within your infrastructure. A conventional licence agreement does not address these issues.

We advise against it — common-law templates contain concepts that do not work under our law and omit duties under European and Slovak or Czech rules, particularly concerning consumers and personal data. We write terms that fit your product and the law under which you operate.

Usually, yes. If you process personal data on a customer's behalf — for example, its users' data — you are a processor, and the relationship must be governed by an agreement or another legal act with prescribed content: the subject matter and duration of processing, its nature and purpose, the scope of data, categories of data subjects, and the controller's rights and duties (§ 34(3) of Act No. 18/2018 Z. z.). The Act also requires a form — paper or electronic (§ 34(7)). A section in the terms generally does not cover these requirements, so we prepare a DPA as a standard part of the suite.

Yes. As a processor, you must not engage another processor without the customer's prior specific or general written authorisation. If relying on general authorisation, you must inform the customer in advance of engaging another processor (§ 34(2) of Act No. 18/2018 Z. z.). The further processor must also be subject to the same duties, and you remain liable to the customer for its failure (§ 34(5)). In practice, we address this through a subcontractor list and notification arrangements for changes.

When you start making your own decisions about the customer's data. A processor that breaches the law by determining the purposes and means of processing is considered a controller for that processing (§ 34(8) of Act No. 18/2018 Z. z.), with all associated duties. This typically becomes a risk when customer data is used for your own analytics or model training; we therefore expressly address these rules in the terms.

Measurable availability with a clear calculation method, exclusion of planned maintenance, incident categories with response times, and credits as the primary remedy for outages. Promise only what the infrastructure can actually support — an SLA is a commitment, not marketing.

Consumer rules are stricter — information duties, withdrawal rights, restrictions on limitations of liability and scrutiny of unfair terms. We structure the terms so the B2C section complies and the B2B section does not unnecessarily carry consumer restrictions.

It depends on scope — from reviewing existing terms to a complete suite with SLA and DPA. We confirm the fee in advance, and the agreed fee stands.