Vendor Clauses

The vendor undertakes to protect the confidential information received or obtained during the contractual relationship, not to disclose it to third parties without prior written authorization, and to return or destroy it at the end of the contract.

- **Ownership of work:** Every development, work, source code, design, methodology or material created by the vendor specifically for the organization in performance of the contract will be the exclusive property of the organization, including economic copyrights, with no need for an additional act of assignment.
- **Assignment and waiver:** The vendor assigns to the organization, and causes its staff and subcontractors to assign, all economic rights over the deliverables, and waives, to the extent permitted by law, the exercise of moral rights that would affect the organization's use of those deliverables.
- **Pre-existing intellectual property:** Components, libraries, methodologies or tools owned by the vendor prior to the contract ("pre-existing IP") remain its property; the vendor grants the organization a non-exclusive, perpetual license to use the pre-existing IP incorporated into the deliverables, to the extent necessary for the organization to use, operate and maintain those deliverables.
- **Third-party and open-source components:** The vendor must declare every third-party or open-source component included in the deliverables, ensuring its licensing is compatible with the use intended by the organization.
- **Non-infringement:** The vendor guarantees that the deliverables don't infringe third-party intellectual property rights and assumes the defense and indemnification against claims on that basis.
- **Use of trademarks:** Neither party may use the other's trademarks, trade names or logos without prior written authorization.

The vendor will process the personal data it has access to in accordance with applicable regulations and the organization's instructions, solely for the purposes of the contract, and will delete or return it upon its termination.

The vendor will implement security controls proportional to the access granted, report security incidents affecting the organization within 48 hours of detection, and allow reasonable security audits.

The vendor declares that its resources come from lawful activities, that it complies with the applicable anti-money laundering and counter-terrorist financing regulations (AML/CFT), and that neither it nor its representatives have engaged in corruption or bribery in connection with the contract.

The vendor may not subcontract essential obligations of the contract without prior written authorization, and is liable for any authorized subcontractor's compliance with these obligations and the clauses in this document.

The vendor will maintain the agreed service levels and have reasonable continuity measures to minimize the impact of disruptions in its operations on the organization.

The organization may request evidence of compliance with these clauses and, for Critical or High vendors, carry out audits or inspections with reasonable prior notice.

The vendor is liable for direct damages caused to the organization by breach of its obligations, including those arising from intellectual property, data protection and information security.

When the contract ends, for any reason, the vendor will return or destroy the organization's information and assets in its possession, revoke granted access and certify that return or destruction.

Any dispute arising from the contract will be resolved under the governing law agreed between the parties, after first exhausting direct settlement options.