Publish Date: June 17, 2024
CUSTOMER RELATIONSHIP AGREEMENT FOR INDIRECT PURCHASES
THIS CUSTOMER RELATIONSHIP AGREEMENT FOR INDIRECT PURCHASES INCLUDING ALL APPLICABLE TERMS REFERENCED HEREIN AS BEING INCORPORATED INTO AND GOVERNED BY THE TERMS OF THIS DOCUMENT (“CRA” OR “AGREEMENT”) CONSTITUTES A LEGALLY
BINDING AGREEMENT BETWEEN (I) THE INDIVIDUAL OR ENTITY IDENTIFIED ON A TRANSACTION DOCUMENT FOR ORDERING SECUREWORKS PRODUCTS (AS DEFINED BELOW) AND THAT IS NOT THE RESELLER (AS DEFINED IN SECTION 1.1 BELOW) (ALSO REFERRED TO AS “YOU” OR “CUSTOMER”) AND (II) SECUREWORKS, DEFINED AS THE APPLICABLE ENTITY SET FORTH IN EXHIBIT A (“SECUREWORKS”) DEPENDING ON THE COUNTRY OF DOMICILE OF CUSTOMER. THE TERMS OF THIS AGREEMENT MAY VARY TO THE EXTENT PROVIDED IN EXHIBIT A. THE EFFECTIVE DATE OF THIS AGREEMENT IS THE DATE YOUR RESELLER (DEFINED BELOW) DELIVERS A TRANSACTION DOCUMENT TO SECUREWORKS FOR SECUREWORKS PRODUCTS (THE “EFFECTIVE DATE”). Please confirm the Effective Date with Your Reseller, as well as the term of any Transaction Document defined as Services Term herein below.
By purchasing, accessing or using Secureworks Products, You agree to be bound by this CRA and that You have read, understand and accept all of the terms and conditions of this Agreement. Please retain a copy of this Agreement for your records. Secureworks and Customer are collectively referred to herein as the “Parties” and each a “Party.”
1. Services; Products and Equipment.
1.1. Services. This Agreement applies to Customer’s purchase of any of the following Secureworks Services (as defined below) from a Secureworks authorized reseller, partner or distributor (the “Reseller”): (i) managed security services (“MSS Services”), (ii) security risk consulting services (“Consulting Services”) and/or (iii) cloud-enabled security services and associated professional service enhancements (“Cloud Services”). The MSS Services, Consulting Services, Cloud Services, and any applicable third-party products and services are collectively referred to hereafter as the Services (“Services”). For any Secureworks Products (as defined in Section 1.2 below) ordered by You from Your Reseller, the Reseller has placed an order, signed a quote or other purchase documentation with Secureworks (the “Transaction Document”), whether or not signed by Reseller, that identifies You as a customer and specifies the Secureworks Products ordered by You from Your Reseller, subject to the limitations in the immediate next sentence. Customer acknowledges and agrees that all Secureworks Services may not be available for purchase through a Reseller, and for such Services, Customer must order directly from Secureworks.
1.2. Products. As further described in the applicable Addenda for Services purchased through a Transaction Document, Secureworks will provide Customer with access to and use of software (in object code format only) (the “Software”), written directions and/or policies relating to the Services, which may be in paper or electronic format (the “Documentation”), and equipment or hardware (“Equipment”), and collectively, with the Services, Software, and Equipment (the “Products”), or a combination thereof, as necessary for Customer to receive the Services, provided that Equipment may be purchased by Customer pursuant to a Transaction Document (“Customer Purchased Equipment”).
1.3. Equipment. The provisions in this CRA related to Equipment shall apply only in the event Equipment is used in connection with the Products.
1.3.1. Any risk of loss or damage to the Equipment shall pass to Customer on delivery of such Equipment to Customer.
1.3.2. Title to the Customer Purchased Equipment, other than any Software or other Secureworks property (including IP (as defined in Section
5.1 below)) installed on the Customer Purchased Equipment, shall pass to Customer on payment. Secureworks shall retain title to the Equipment and any Software or other property installed on Equipment.
1.3.3. Secureworks agrees to transfer to Customer, all right, title, and interest in and to any Customer Purchased Equipment in accordance with Section 1.3.2 above, excluding any right, title or interest in and to the Software and any other Secureworks property (including IP) loaded onto such Customer Purchased Equipment.
1.3.4. Customer will, at Customer’s sole expense, keep and maintain the Equipment in clean and good working order and repair during the Services Term (as defined in Section 3.2 below).
1.3.5. Upon the earlier of the termination or expiration of the Transaction Document relating to the Equipment, Customer will (i) return Equipment to Secureworks in full working order and (ii) erase, destroy, and cease use of all Software located or installed on any Customer Purchased Equipment. If Customer does not return the Equipment in full working order within thirty (30) days following expiration or termination of the Transaction Document relating to the Equipment, then Customer will be responsible for the then-current replacement costs of such Equipment.
2. Service Fees and Affiliates.
2.1. Service Fees. Your payment obligations in respect of the Products are set forth in Your agreement with Your Reseller. Accordingly, no provision in any Addenda (as defined in Section 10.3 below) related to billing, invoicing, or automatic renewal shall apply to You. However, if Your Reseller fails to pay any outstanding invoice to Secureworks for any Products purchased by You through the Reseller, then Secureworks may suspend Your access to the Products until all outstanding fees are paid in full.
2.2. Affiliates. As used herein, the term “Affiliate”, with respect to a Party means any entity that, directly or indirectly, through one or more intermediaries, controls, is controlled by or is under common control with such Party. Where the Customer’s domicile is in Australia, the term Affiliate means a Party or its related bodies corporate as defined under Section 50 of the Corporations Act 2001 (as amended or substituted from time to time). “Customer” shall include Customer’s Affiliate(s): (i) receiving the benefit of the Services through Customer’s purchase of the Services, or (ii) whose data is included, accessed or received by Secureworks in connection with the performance of the Services for Customer. With respect to Customer’s Affiliate(s), Customer hereby represents and warrants that: (A) Customer has obtained the necessary consent from each Customer Affiliate for Secureworks to access such Customer Affiliate’s networks and data in connection with providing the Services, and (B) each Customer Affiliate agrees to, and is hereby legally bound by, the terms of this CRA. The Parties acknowledge and agree that Customer Affiliate(s) are not intended to be third-party beneficiaries to this CRA and shall have no direct claim against Secureworks hereunder. Customer shall be fully liable for any breach of the terms of this CRA by its Affiliate(s) receiving or having access to the Services hereunder. For the purposes of either Party’s Affiliate(s) performing, receiving or purchasing Services hereunder, references to Secureworks and Customer herein shall be deemed references to such Party’s respective Affiliate(s).
3. Term.
3.1. Term of CRA. The term of this CRA shall commence on the Effective Date and shall continue until the earlier of (i) the expiration or earlier termination of all Services Term(s), as specified in Section 3.2 or (ii) termination of the CRA pursuant to Section 4 below (“Term”).
3.2. Services Term. The term of the Transaction Document(s) will commence on the date specified on the applicable Transaction Document and continue for the period identified therein (“Services Term”) unless terminated earlier in accordance with the provisions hereof. In the event that the Services Term on any applicable Transaction Document expires and Services continue to be provided by Secureworks and received and used by Customer, the terms and conditions of this CRA and any applicable Addendum (as defined in Section 10.3) shall apply until the Services have been terminated.
4. Termination.
4.1. Termination for Material Breach. Either Party may terminate this CRA or an active Transaction Document in the event that the other Party materially defaults in performing any obligation under this CRA or the applicable Transaction Document and such default continues un-remedied for a period of thirty (30) days following written notice of default.
4.2. Termination for Bankruptcy, Insolvency, or Similar Events. This CRA will terminate, effective upon delivery of written notice by either Party to the other Party upon the following: (a) the institution of insolvency, receivership or bankruptcy proceedings or any other proceedings for the settlement of debts of the other Party; (b) the making of an assignment for the benefit of creditors by the other Party; (c) the dissolution of the other Party; or (d) the assignment to Secureworks by Your Reseller of its right to receive any remaining scheduled payment for the Products due to the occurrence of any of (a)-(c) above or other similar events.
4.3. Effects of Termination. Termination or expiration of a Transaction Document shall not be construed to constitute termination of any other active Transaction Documents related to Your other orders with Your Reseller of Secureworks Products. In the event that this CRA is terminated, any active Transaction Document(s) shall also terminate.
4.4. Irrespective of the provisions of the DPA, in case of termination of Services as per Sections 4.6 or 5.3 in the DPA (as defined in Section 6.3 below), Customer shall remain liable to pay to Secureworks through the Reseller any unpaid Services fees as set forth in the relevant Transaction Document accrued as of, and attributable to the period prior to, such termination together with any applicable fees associated with Third Party Products (as defined in Section 10.1 below). Customer agrees to pay any delay penalties invoiced by Secureworks to Reseller for any delays of Reseller to pay to Secureworks such fees due in accordance with this Section 4.4, irrespectively if the delays are caused by Customer or Reseller.
5. Proprietary Rights.
5.1. Customer’s Proprietary Rights. Customer represents and warrants that it has the necessary rights, power and authority to transmit Customer Data (as defined below) to Secureworks under this CRA and that Customer has and shall continue to fulfill all obligations as required to permit Secureworks to carry out the terms hereof, including with respect to all applicable laws, regulations and other constraints applicable to Customer Data. As between Customer and Secureworks, Customer will own all right, title and interest in and to (i) any data provided by Customer and/or its Affiliate(s) to Secureworks and/or any such data accessed or used by Secureworks or transmitted by Customer and/or its Affiliate(s) to Secureworks or Equipment in connection with Secureworks’ provision of the Services, including, but not limited to, any such data included in any written or printed summaries, analyses or reports generated in connection with the Services (collectively, the “Customer Data”), (ii) all intellectual property, including patents, copyrights, trademarks, trade secrets and other proprietary information (“IP”) of Customer that may be made available to Secureworks in the course of providing Services under this CRA, and (iii) all confidential or proprietary information of Customer or Customer Affiliates, including, but not limited to, Customer Data, Customer Reports (as defined in Section 5.3), and other Customer files, documentation and related materials, in each case under this clause (iii) obtained by Secureworks in connection with this CRA. Customer grants to Secureworks a limited, non-exclusive license to use the Customer Data to perform the Services. Customer grants to Secureworks a limited, non-exclusive, worldwide, irrevocable license to use and otherwise process Security Event Data during and after the term hereof to develop, enhance and/or improve the products and services it offers and provides to You and other customers. “Security Event Data” means information collected during Secureworks’ provision of Services related to security events and may include alerts, event data, network data, executable code, IP addresses, user IDs, device ID, commands and prompts, and other types of metadata. Secureworks shall, at all times, use and maintain the Security Event Data in accordance with its confidentiality obligations and data processing obligations set forth in this Agreement and the DPA.
5.2. Secureworks’ Proprietary Rights. As between Customer and Secureworks, Secureworks will own all right, title, and interest in and to the Products.
This CRA does not transfer or convey to Customer or any third Party, any right, title or interest in or to the Products or any associated IP rights, but only a limited right of use as granted in and revocable in accordance with this CRA. Secureworks agrees to transfer to Customer, all right, title and interest in and to any Customer Purchased Equipment, excluding any right, title, or interest in and to the Software and any other Secureworks IP loaded onto such Customer Purchased Equipment. In addition, Customer agrees that Secureworks is the owner of all right, title and interest in all IP in any work, including, but not limited to, all inventions, methods, processes, flow charts, algorithms, documentation, adversary information, report templates, know-how, inventions, models, and computer programs including any source code or object code, (and any enhancements and modifications made thereto) contained within the Services and/or Products and any suggestions, enhancement requests, recommendations, or feedback provided by Customer regarding the Services or Products (collectively, the “Secureworks Materials”), and Customer hereby assigns to Secureworks all right, title and interest in and to any copyrights that Customer may have in and to such Secureworks Material; provided, however, that such Secureworks Material shall not include Customer’s Confidential Information (as defined in Section 6), Customer Data, Customer Reports (as defined in Section 5.3) or other information belonging, referencing, identifying or pertaining to Customer or Customer Affiliates. During the term of the Services, Secureworks grants to Customer a limited, non-exclusive license to use such Secureworks Materials solely for Customer to receive and use the Services for Customer’s or its Affiliate’s internal security purposes only. Any license to the Secureworks Products, Services or Secureworks Materials expires or terminates upon the expiration or termination of any individual Transaction Document and/or this CRA.
5.3. Customer Reports; No Reliance by Third Parties. Secureworks hereby grants to Customer a perpetual, irrevocable license to any written summaries, reports, analyses, and findings or other documentation prepared uniquely and exclusively for Customer in connection with the Services and as specified in a Transaction Document and any reports generated by Customer through the Cloud Services (the “Customer Reports”), subject to Secureworks’ ownership in any Secureworks Materials. To the extent any Secureworks Materials are embedded in any Customer Reports, Secureworks grants to Customer a perpetual, irrevocable right for Customer to use the Secureworks Materials embedded in the Customer Reports in accordance with the terms of this CRA. Secureworks disclaims all liability for any damages whatsoever to any unaffiliated third party arising from or related to its reliance on any Customer Report or any contents thereof.
6. Confidentiality and Data Privacy.
6.1. Confidentiality. In the performance of its obligations under this CRA, Customer and Secureworks may have access to or be exposed to information of the other Party not generally known to the public, including, but not limited to software, product plans, marketing and sales information, customer lists, “know-how,” or trade secrets which may be designated as being confidential or which, under the circumstances surrounding disclosure, ought to be treated as confidential (collectively, “Confidential Information”). Confidential Information may not be shared with third parties unless such disclosure is to agents and subcontractors on a “need-to-know” basis in connection with a Party’s performance of its obligations under this CRA, and only if such personnel have agreed to treat such Confidential Information under terms at least as restrictive as those herein. The receiving Party will be responsible for any breach of this Section 6 by its employees, representatives, and agents and any third party to whom it discloses Confidential Information. Each Party agrees to take precautions to maintain the confidentiality of Confidential Information by using at least the same degree of care as such Party employs with respect to its own Confidential Information of a like-kind nature, but in no case less than a commercially reasonable standard of care. The foregoing shall not include information, which, (A) was known by one Party prior to its receipt from the other or is or becomes public knowledge without the fault of the recipient, (B) is received by the recipient from a source other than a Party to this CRA, (C) is independently developed by a Party without causing a breach of the terms hereunder, or (D) a Party is required to disclose in response to an order by a court or governmental agency, provided that advance notice of the disclosure is provided to other Party.
6.2. Security Procedures. Secureworks shall maintain reasonable and appropriate safeguards designed to (a) reasonably protect Customer Data in Secureworks’ possession from unauthorized use, alteration, access or disclosure (a “Security Breach”); (b) detect and prevent against a Security Breach; and (c) ensure that Secureworks’ employees and agents are trained to maintain the confidentiality and security of Customer Data in Secureworks’ possession. Secureworks shall promptly notify Customer upon becoming aware of a confirmed Security Breach of Customer Data or Customer Confidential Information in Secureworks’ possession or control.
6.3. Additional Addenda. If Secureworks is exposed to or has access to Protected Health Information (“PHI”) in the performance of the Services, and such exposure or access is not incidental, the Business Associate Addendum set forth at https://www.secureworks.com/baa-us (“BAA”) shall be incorporated herein by reference to provide Customer with the written assurances required by the Privacy Rule and the Security Rule established pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). This CRA also incorporates the Data Protection Addendum set forth at https://www.secureworks.com/dpa (“DPA”) when applicable Privacy Laws (as defined in the DPA) apply to Customer’s use of the Services to process Personal Data (as defined in the DPA). Each Party expressly agrees that the DPA shall apply and govern all activities concerning the processing of Personal Data for the purposes of this CRA.
6.4. Data. Customer authorizes Secureworks to, and Customer represents and warrants that it has obtained and shall continue to have all consents, permissions and authorizations required and necessary under the applicable Privacy Laws (as defined in the DPA) for Secureworks to, and nothing contained in such laws and regulations shall limit in any way, Secureworks’ ability to, collect, use, store, transfer and otherwise process the personal data Secureworks obtains from Customer as a result of providing the Services for the purpose of complying with Secureworks’ rights and obligations under this CRA and for any additional purposes described pursuant to this CRA. It is Customer’s responsibility to maintain backups and data redundancies. The Customer agrees that Secureworks may invoice to the Reseller any charges incurred by Secureworks for assistance to Customer with data subjects’ rights or with data protection impact assessments or for any audit and inspection requested by Customer in order to audit and/or inspect Secureworks’ compliance with the DPA.
6.5. Duration. This Section 6 shall survive for three (3) years following any termination or expiration of this CRA; provided that with respect to any Confidential Information remaining in the receiving Party’s possession following any termination or expiration of this CRA, the obligations under this Section 6 shall survive for as long as such Confidential Information remains in such Party’s possession. The confidentiality obligations as to “trade secrets” under applicable law will continue until such information ceases to constitute a “trade secret”.
7. Secureworks Warranties; Breach Recovery Limitations.
7.1. Secureworks Warranty. Secureworks warrants that:
7.1.1. its personnel are adequately trained and competent to perform the Services,
7.1.2. the Consulting Services and any professional services provided in connection with the Cloud Services shall be performed in a professional manner and in accordance with the applicable Transaction Document,
7.1.3. in providing the Products, it will not knowingly introduce any virus, disabling or malicious software, code, or component that may lock, disable, or erase any Customer Data or software, and
7.1.4. the Cloud Services shall conform in all material respects to the Documentation available at https://docs.ctpx.secureworks.com, as updated from time to time.
7.2. Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS SECTION 7.2, SECUREWORKS (INCLUDING ITS AFFILIATES, SUBCONTRACTORS AND AGENTS) AND EACH OF THEIR RESPECTIVE EMPLOYEES, DIRECTORS AND OFFICERS (COLLECTIVELY, THE “SECUREWORKS PARTY(IES)”) MAKES NO EXPRESS OR IMPLIED WARRANTIES WITH RESPECT TO ANY OF THE PRODUCTS, SERVICES OR CUSTOMER
REPORTS, INCLUDING BUT NOT LIMITED TO, ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR SUITABILITY. CUSTOMER UNDERSTANDS THAT SECUREWORKS’ SERVICES DO NOT CONSTITUTE ANY GUARANTEE OR ASSURANCE THAT THE SECURITY OF CUSTOMER’S SYSTEMS, NETWORKS AND ASSETS CANNOT BE BREACHED OR ARE NOT AT RISK.
7.3. Breach Recovery Limitations.
7.3.1. NEITHER THE SECUREWORKS PARTIES NOR CUSTOMER WILL BE LIABLE FOR ANY INCIDENTAL, INDIRECT, PUNITIVE, SPECIAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN CONNECTION WITH THIS CRA. THE SECUREWORKS PARTIES SHALL NOT BE LIABLE FOR ANY DAMAGES RELATING TO ANY PART OF CUSTOMER’S NETWORK, OR ANY
ENVIRONMENT, SOFTWARE, HARDWARE OR OPERATIONAL TECHNOLOGY, WHERE CUSTOMER HAS NOT DEPLOYED AN
ENDPOINT AGENT OR OTHERWISE PROVIDED RELEVANT DATA TO SECUREWORKS PURSUANT TO A TRANSACTION DOCUMENT.
7.3.2. NEITHER THE SECUREWORKS PARTIES NOR CUSTOMER SHALL HAVE ANY LIABILITY FOR THE FOLLOWING: (A) LOSS OF
REVENUE, INCOME, PROFIT, OR SAVINGS, (B) LOST OR CORRUPTED DATA, (C) LOSS OF BUSINESS OPPORTUNITY, OR (D) BUSINESS INTERRUPTION OR DOWNTIME.
7.3.3. EXCEPT FOR EACH PARTY’S LIABILITY UNDER SECTION 7.3.4 AND EACH PARTY’S INDEMNIFICATION OBLIGATIONS UNDER SECTION 8, THE SECUREWORKS’ PARTIES’ AND CUSTOMER’S RESPECTIVE AGGREGATE LIABILITY (WHETHER IN
CONTRACT, TORT OR OTHERWISE) FOR ALL CLAIMS OF LIABILITY ARISING OUT OF OR IN CONNECTION WITH THIS CRA
SHALL NOT EXCEED THE AMOUNTS PAID OR PAYABLE BY RESELLER FOR THE PRODUCT(S) GIVING RISE TO SUCH CLAIM DURING THE PRIOR TWELVE (12) MONTH PERIOD (THE “GENERAL CAP”).
7.3.4. EACH PARTY’S AGGREGATE LIABILITY (WHETHER IN CONTRACT, TORT OR OTHERWISE) FOR ALL CLAIMS OF LIABILITY ARISING OUT OF OR IN CONNECTION WITH SECTION 6 (CONFIDENTIALITY) AND/OR THE DPA SHALL NOT EXCEED TWO HUNDRED PERCENT (200%) OF THE AMOUNTS PAID OR PAYABLE BY RESELLER FOR THE PRODUCT(S) GIVING RISE TO SUCH CLAIM DURING THE PRIOR TWELVE (12) MONTH PERIOD (THE “ENHANCED CAP”). THE ENHANCED CAP IS NOT IN
ADDITION TO THE GENERAL CAP BUT REFLECTS THE ENHANCED AGGREGATE CAP FOR ALL CLAIMS UNDER THIS CRA IF SUCH CLAIMS ARE FOR BREACHES OF SECTION 6 (CONFIDENTIALITY) OR THE DPA.
7.3.5. The foregoing limitations, exclusions and disclaimers shall apply, regardless of whether the claim for such damages is based in contract, warranty, strict liability, negligence, and tort or otherwise. Insofar as applicable law prohibits any limitation herein, the Parties agree that such limitation will be automatically modified, but only to the extent so as to make the limitation permitted to the fullest extent possible under such law. The Parties agree that the limitations on liabilities set forth herein will apply notwithstanding the failure of essential purpose of any limited remedy and even if a Party has been advised of the possibility of such liabilities.
7.3.6. The Parties acknowledge and agree that Secureworks Products are deployed to mitigate the risk of criminal cyber activity by alerting to potential suspicious activities within Customer’s network or information technology systems, where certain Secureworks technology is deployed. As such, Secureworks shall not be liable for any such breach of its confidentiality obligations under Section 6 of this Agreement or data security obligations under the DPA, in each case resulting from a hack or intrusion by a third party into Customer’s network or information technology systems. This Section does not prohibit Customer from pursuing or recovering damages arising out of a breach of Secureworks’ other obligations under the Agreement.
8. Indemnification. “Indemnified Parties” shall mean, in the case of Secureworks, Secureworks, its Affiliates and subcontractors, and each of their respective directors, officers, employees, contractors and agents and in the case of Customer, Customer, its Affiliates, and each of their respective directors, officers, employees, contractors and agents.
8.1. Secureworks Indemnity. Secureworks shall defend, indemnify and hold harmless the Customer Indemnified Parties from any damages, costs and liabilities, expenses (including reasonable and actual attorney’s fees) (“Damages”) actually incurred or finally adjudicated as to any third-party claim or action alleging that the Products, Services or any Customer Reports prepared or produced by Secureworks and delivered pursuant to this CRA infringe or misappropriate any third party’s IP rights enforceable in the country(ies) in which the Products, Services or any Customer Reports are performed or prepared for Customer by Secureworks (“Indemnified Claims”). If an Indemnified Claim under this Section 8.1 occurs, or if Secureworks determines that an Indemnified Claim is likely to occur, Secureworks shall, at its option: (A) obtain a right for Customer to continue using such Products, Services or Customer Reports; (B) modify such Products, Services or Customer Reports to make them non-infringing; or (C) replace such Products, Services or Customer Reports with a non-infringing equivalent. If (A), (B) or (C) above are not reasonably available, either Party may, at its option, terminate this CRA and/or the relevant Transaction Document and Secureworks will refund to Reseller any pre-paid fees on a pro-rata basis for the allegedly infringing Products, Services or Customer Reports that have not been performed or provided. Notwithstanding the foregoing, Secureworks shall have no obligation under this Section 8.1 for any claim resulting or arising from: (A) modifications made to the Products, Services or Customer Reports that were not performed or provided by or on behalf of Secureworks; or (B) the combination, operation or use by Customer or anyone acting on Customer’s behalf, of the Products, Services or Customer Reports in connection with a third-party product or service (the combination of which causes the infringement).
8.2. Customer Indemnity. Customer shall defend, indemnify and hold harmless the Secureworks Indemnified Parties from any Damages actually incurred or finally adjudicated as to (i) misappropriation of Secureworks’ IP or violation of the use restrictions as to Secureworks’ IP, (ii) any third party claim, action or allegation that the Customer Data infringes any IP rights enforceable in the country(ies) where the Customer Data is accessed, provided to or received by Secureworks or was improperly provided to Secureworks in violation of any person’s rights, Customer’s privacy policies or applicable laws (or regulations promulgated thereunder), and (iii) any claim, action or allegation by Customer Affiliates arising from or relating to the Services.
8.3. Mutual General Indemnity. Each Party agrees to defend, indemnify and hold harmless the other Party from any third-party claim or action (i) for personal bodily injuries, including death, or tangible property damage resulting from the indemnifying Party’s gross negligence or willful misconduct, and (ii) relating to the indemnifying Party’s violation or alleged violation of export laws.
8.4. Indemnification Procedures. The Indemnified Party will (i) promptly notify the indemnifying Party in writing of any claim, suit or proceeding for which indemnity is claimed, provided that failure to so notify will not remove the indemnifying Party’s obligation except to the extent it is prejudiced thereby, and (ii) allow the indemnifying Party to solely control the defense of any claim, suit or proceeding and all negotiations for settlement. In no event may either Party enter into any third-Party agreement which would in any manner whatsoever affect the rights of the other Party or bind the other Party in any manner to such third party, without the prior written consent of the other Party. This Section 8 states each Party’s exclusive remedies for any third-party claim or action, and nothing in this CRA or elsewhere will obligate either Party to provide any greater indemnity to the other.
9. Export. Secureworks and Customer acknowledges that Products and Customer Purchased Equipment provided under this CRA may incorporate encryption functionality and are subject to the customs and export control and economic sanctions laws and regulations of the United States and other countries to which the Products and Customer Purchased Equipment are delivered. Each Party agrees to comply with all applicable customs and export control and economic sanctions laws and regulations of the United States and other countries to which the Products and Customer Purchased Equipment are delivered to such Party in the course of performance of its obligations.
9.1. Secureworks Responsibilities. Secureworks is responsible for ensuring that the initial delivery of Products and any Customer Purchased Equipment to Customer is in compliance with U.S. export and economic sanctions regulations, including by applying for and obtaining any required U.S. export licenses. Secureworks’ acceptance of any order for Products and any Customer Purchased Equipment is contingent upon the issuance of any license required by the U.S. Government. Secureworks will not be liable for delays or failure to deliver Products or any Customer Purchased Equipment resulting from the inability to obtain such license.
9.2. Customer Responsibilities. Customer agrees to comply with, and to cause and require its Affiliates to comply with, all applicable U.S. export and economic sanctions regulations governing the retransfer and use of the Products and any Customer Purchased Equipment purchased from Secureworks, and neither Customer nor its Affiliates will transfer or re-export the Products without written permission from Secureworks. Customer further agrees that it and its Affiliates are solely responsible for compliance with the applicable laws, rules and regulations governing the importation and use of the Products and any Customer Purchased Equipment in the countries to which Products or any Customer Purchased Equipment will be delivered, including, but not limited to, by making any required customs entry or declaration, paying all duties, taxes and fees owed as a result of the importation, receipt or use of Products and any Customer Purchased Equipment by Customer, and obtaining all necessary licenses, permits or other authorizations, including those required under regulations governing the importation and use of encryption products.
9.3. Cooperation. Customer agrees to cooperate, and to cause and require its Affiliates to cooperate, in providing the information necessary for Secureworks to apply for any required U.S. export licenses. Secureworks agrees to cooperate with Customer and Customer Affiliates by providing the information necessary for Customer or Customer Affiliates to apply for any required licenses, permits or other authorizations in connection with the importation and use of the Products and Customer Purchased Equipment. Notwithstanding any terms in any Transaction Document, under no circumstances shall Secureworks be required to provide any source code, or proprietary information in connection with the pursuit of any license, permit or other authorization to Customer, Customer Affiliates, or any government authority.
9.4. Additional Warranties. Each Party warrants that neither it, nor any of its Affiliates nor any of its employees, officers or directors, any agent, or other person acting on its behalf (i) has been or is designated on the Specially Designated Nationals and Blocked Persons List maintained by the Office of Foreign Assets Control of the United States Department of the Treasury (“OFAC”), or, to the extent applicable, any similar list of sanctioned persons issued by the United Nations Security Council, the European Union, His Majesty’s Treasury of The United Kingdom or any other relevant governmental authority administering sanctions, including the U.S. Department of State, (ii) is a national or citizen of, organized under the laws of, or resident or operating in any country or territory which is itself the subject of country-wide or territory-wide sanctions, including, but not limited to, as of the date of this CRA, Iran, Cuba, Syria, North Korea and the Crimea, Donetsk and Luhansk regions of Ukraine, (iii) is a person owned or controlled by any persons described in clauses (i) and/or (ii) of this sentence, or (iv) is a person identified on the United States Department of Commerce, Bureau of Industry and Security’s “Denied Persons List” or “Entity List.” Each Party agrees that it will promptly notify the other Party in writing if the notifying Party becomes aware of any changes to this warranty or if to the notifying Party’s knowledge any change is threatened. In such event, the notified Party shall have the ability to terminate this CRA without affording the notifying Party an opportunity to cure. In addition, Customer acknowledges that the Products are not designed to process, store, or be used in connection with Excluded Data. Customer is solely responsible for reviewing data that will be provided to or accessed by Secureworks to ensure that it does not contain Excluded Data. “Excluded Data” means: (i) data that is classified, used on the U.S. Munitions list (including software and technical data); or both; (ii) articles, services, and related technical data designated as defense articles and defense services; (iii) ITAR (International Traffic in Arms Regulations) released data; and (iv) personally identifiable information that is subject to heightened security requirements as a result of Customer’s internal policies or practices, industry-specific standards or by law.
9.5. Access to Information. Secureworks shall have the right to terminate the provision of Products to Customer under this Agreement with immediate effect in regard to any specific country or jurisdiction upon written notice to Customer in the event that the specific country or jurisdiction demands access to any Secureworks proprietary or confidential data, information, software or other material, including, without limitation, information relating to Customer or other Secureworks customers, Secureworks IP, technology, code, cryptographic keys or access to encrypted material, trade secrets or security process secrets. Secureworks and Customer shall negotiate toward an agreement on reduction of future payments due to reduction in these Services. This Agreement and other Services shall continue in jurisdictions unaffected by Secureworks exercise of this right. This Section 9.5 shall not apply to jurisdictions where Secureworks Corp., Secureworks, Inc., or its subsidiaries are incorporated.
10. Additional Terms.
10.1. Third Party Product Purchases. If Customer purchases any third-party products or services (“Third Party Products”) through Secureworks as specified in a Transaction Document, then Customer will comply with any flow down terms and conditions applicable to Third Party Products including, but not limited to, any third-party end-user license agreement incorporated into, referenced in or attached to a Transaction Document or a Service Description (as defined in Section 10.11 below).
10.2. Independent Contractor Relationship; Assignment; Subcontracting; No Third-Party Beneficiaries. The Parties are independent contractors.
Neither Party will have any rights, power, or authority to act or create an obligation, express or implied, on behalf of another Party except as specified in this CRA. Secureworks has the right to assign, subcontract or delegate in whole or in part this CRA, any rights, duties, obligations or liabilities under this CRA, by operation of law or otherwise. Secureworks shall remain responsible for the acts and omissions of any subcontractor to the same extent it is liable for its own actions under this CRA. Customer may not assign this CRA without the permission of Secureworks, which such permission shall not be unreasonably withheld or delayed; except that Customer may assign this CRA without the consent of Secureworks to a successor in connection with a merger, sale of all or substantially all of such Customer’s stock or assets. The Parties do not intend, nor will any Section hereof be interpreted, to create for any third-party beneficiary rights with respect to either of the Parties.
10.3. Entire Agreement; Amendments; Severability; Section Headings; Customer Marks. This CRA, the Transaction Document(s), the applicable Addenda, including (a) the DPA; (b) the BAA; (c) one or more Addenda set forth on the Products Terms Page (each of (a) – (c), an “Addendum” and (a) – (c) collectively, the “Addenda”) and (d) any Service Descriptions that are applicable as to a Transaction Document, are the complete agreement regarding transactions under this CRA and the subject matter and supersede all prior oral and written understandings, agreements, communications, and terms and conditions between the Parties including, without limitation, any terms contained within a purchase order issued by Customer in connection with the Services, and any separate security or privacy agreements executed by the Parties. No amendment to or modification of this CRA, in whole or in part, will be valid or binding unless it is in writing and executed by authorized representatives of both Parties.
Notwithstanding the foregoing, Secureworks may update the Service Descriptions from time to time as reasonably necessary; provided that, such updates may not materially diminish any functionality of the Service or service levels set forth therein and are being affected with respect to all similarly situated Secureworks customers. If any provision of this CRA is void or unenforceable, the remainder of this CRA will remain in full force and effect. Section headings are for reference only and shall not affect the meaning or interpretation of this CRA. Customer hereby grants Secureworks permission to display Customer’s trademarks or logo (“Customer Marks”) solely for the purpose of identifying Customer as a Secureworks’ customer in its marketing, promotional, and public relations materials. Secureworks shall not use the Customer Marks in any manner that suggests an endorsement or sponsorship by Customer of Secureworks’ products or services. All use of Customer Marks by Secureworks shall be in accordance with Customer’s trademark usage guidelines, as may be provided by Customer to Secureworks from time to time. The Parties have requested that this Agreement and all correspondence and all documentation relating thereto be drawn-up in the English language. Preceding sentence translated to French and applicable to Canadian customers only: Les parties aux présentes ont exigé que la présente entente, de même que toute la correspondance et la documentation relative à cette entente, soient rédigées en langue anglaise.
10.4. Force Majeure. Except for Customer’s payment obligations, neither Party shall be liable to the other Party for any failure to perform any of its obligations under this CRA or Transaction Document during any period in which such performance is delayed or prevented by circumstances beyond its reasonable control including, but not limited to: fire; flood; war; embargo; strike; riot; hurricane; earthquake; pandemic, epidemic or other public health crisis, including any government-imposed quarantines, restrictions or measures responding to the outbreak of infectious disease; utility or telecommunication failures; or acts of state or governmental action prohibiting or impeding performance of a Party’s contractual obligations, including widespread nation state or government-backed cyber activity (a “Force Majeure Event”), and the excused Party’s time to perform shall be extended on a day-for-day basis by the length of the delay resulting from the Force Majeure Event. However, the delayed Party must promptly provide the other Party with written notice of the Force Majeure Event. If the Force Majeure Event lasts longer than thirty (30) days, then the other Party may immediately terminate the applicable Transaction Document by giving written notice to the delayed Party.
10.5. Notices. Notices under this CRA must be in writing and sent by postage prepaid first-class mail or receipted courier service as follows: For Secureworks: SecureWorks, Inc., 1 Concourse Pkwy, NE #500, Atlanta, GA 30328, Attn: Legal with a copy to [email protected]; For Customer: the address provided by Reseller to Secureworks in the Transaction Document. Such notices will be effective upon receipt.
10.6. Governing Law. THE PARTIES AGREE THAT THIS CRA, ANY TRANSACTION DOCUMENT HEREUNDER, OR ANY CLAIM, DISPUTE OR
CONTROVERSY (WHETHER IN CONTRACT, TORT, OR OTHERWISE, WHETHER PREEXISTING, PRESENT OR FUTURE, AND INCLUDING
STATUTORY, COMMON LAW, AND EQUITABLE CLAIMS) BETWEEN CUSTOMER AND SECUREWORKS ARISING FROM OR RELATING TO
THIS CRA, THE SERVICES, ITS INTERPRETATION, OR THE BREACH, TERMINATION OR VALIDITY THEREOF, THE RELATIONSHIPS
WHICH RESULT FROM THIS CRA OR ANY RELATED PURCHASE SHALL BE GOVERNED BY THE LAWS OF THE JURISDICTION SET FORTH ON EXHIBIT A, WITHOUT REGARD TO ITS CHOICE OF LAW AND/OR CONFLICT OF LAWS PRINCIPLES. THE PARTIES IRREVOCABLY
SUBMIT AND CONSENT TO THE EXCLUSIVE JURISDICTION OF THE CORRESPONDING COURTS SET FORTH ON EXHIBIT A, AND
HEREBY AGREE THAT SUCH COURTS SHALL BE THE EXCLUSIVE PROPER FORUM FOR THE DETERMINATION OF ANY DISPUTE ARISING IN CONNECTION WITH THIS AGREEMENT. THE PARTIES EXPRESSLY AGREE THIS AGREEMENT SHALL NOT BE GOVERNED BY THE U.N. CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS.
10.7. Compliance with Laws. Each Party agrees to comply with all laws and regulations applicable to such Party in the course of performance of its obligations under this CRA.
10.8. Legal Proceedings. If Secureworks is requested by Customer, or required by government regulation, regulatory agency, subpoena, or other legal process to produce Customer Reports, Documentation, or Secureworks personnel for testimony or interview with respect to the Services, Customer will (i) promptly notify Secureworks, unless otherwise prohibited by such order or process, (ii) use commercially reasonable efforts to reduce the burdens associated with the response, and (iii) reimburse Secureworks for (a) its employees’ time spent as to such response at the hourly rate reflected in the applicable Transaction Document, (b) its reasonable and actual attorneys’ fees as to such response, and (c) its reasonable and actual travel expenses incurred as to such response. Customer will reimburse Secureworks’ and its counsel’s expenses and professional time incurred in responding to such a request. Nothing in this Section 10.8 shall apply to any legal actions or proceedings between Customer and Secureworks as to the Services.
10.9. U.S., Canadian and Other Government End Users. The Products are provided as “commercial items,” “commercial computer software,” “commercial computer software documentation,” and “technical data,” as defined in the Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS) and are provided with the same rights and restrictions generally applicable to the Products.
Secureworks does not warrant that the Products are provided in accordance with the provisions of the Federal Acquisition Regulation (FAR), the Defense Federal Acquisition Regulation Supplement (DFARS), Canadian Aviation Regulations (CARs), including SOR 96-433, or any other similar U.S. or foreign laws, rules or regulations. If You are using the Products on behalf of the U.S., Canadian or other government and these terms fail to meet the U.S., Canadian or other government’s needs or are inconsistent in any respect with U.S., Canadian or other governmental law, You must immediately discontinue your use of the Products. For clarity, the Products have not received Federal Risk and Authorization Management Program (FedRAMP) authorization.
10.10.Order of Precedence. In the event of a conflict among any of the foregoing documents, the order of priority shall be in descending order as follows:
(1) the DPA; (2) the BAA; (3) a Transaction Document (but only as to that specific Transaction Document); (4) the other Addenda; and (5) this CRA.
10.11.Survival. The provisions of this CRA that by their nature survive expiration or termination of this CRA as applicable, will survive expiration or termination of this CRA including, but not limited to; Section 5 (Proprietary Rights); Section 6 (Confidentiality and Data Privacy); Section 7 (Warranties; Breach Recovery Limitations); Section 8 (Indemnification); Section 9 (Export) and this Section 10 (Additional Terms).
10.12.Additional Terms and Service Descriptions. This Agreement is a master agreement that covers all Secureworks Products but provisions regarding specific Products apply only to the extent You have purchased, accessed or used such Products through the Reseller. Additional terms governing the receipt of such specific Products and the applicable service description and associated service level agreements (if any) for each of the Products (each a “Service Description”) can be found at https://www.secureworks.com/legal/product-terms, as updated from time to time and incorporated herein by reference (the “Product Terms Page”). Provisions related to the Services Term(s) and payment terms within the Product Terms shall not apply to Your consumption of Services but instead shall be subject to Your agreement with Your Reseller. [REMAINDER OF PAGE INTENTIONALLY LEFT BLANK; EXHIBIT FOLLOWS]
Exhibit A
Customer Country of Domicile “Secureworks” Governing Law and Jurisdiction Australia
SecureWorks Australia Pty. Ltd.,
with registered office at Unit 3, 14
Aquatic Drive, Frenchs Forest,
NSW 2086, Australia
The laws of the State of New South Wales,
Australia; New South Wales, Australia Court
Canada
Secureworks Software Canada
ULC
Suite 2600, Three Bentall Centre,
595 Burrard Street, P.O. Box
49314, Vancouver, BC V7X 1L3
The laws of the Province of Ontario and the
federal laws of Canada applicable therein
United States of America
Any other country except Australia, Canada, Japan and
EMEA countries
SecureWorks, Inc., with registered
office at 1 Concourse Pkwy, NE
#500, Atlanta, GA 30328
The laws of the state of Georgia; state and
federal courts located in DeKalb County,
Georgia, USA.
Europe, the Middle East and Africa (“EMEA”)
SecureWorks Europe Limited, with
registered office at Dell House,
Cain Road, Bracknell, Berkshire
RG12 1LF, UK
The laws of England and Wales; English
courts
Customer Signature:
___________________________________
Daniel Calleros, Interim City Administrator
___________________________________
Date
Attest:
___________________________
Yonnie Parker, Deputy City Clerk
Approved as to Form:
____________________________
Zaynah Moussa, City Attorney
SecureWorks, Inc. Signature:
___________________________________
Signature
___________________________________
Name
___________________________________
Title
___________________________________
Date
2nd Authorized Signature:
___________________________________
Signature
___________________________________
Name
___________________________________
Title
___________________________________
Date