- Swiss SaaS scale-ups handling a steady volume of customer and supplier contracts without in-house legal
- Mid-cap industrial companies digitalizing: IoT, connected products and ICT-services agreements
- ICT and SaaS providers to financial institutions that face DORA ICT third-party terms in their contracts
ICT commercial contracts
GAWEL Legal acts as outsourced commercial contracting counsel for SaaS, cloud, IoT and ICT-services businesses, on a retainer. The volume-based retainer, with a fair-use cap, covers inbound and outbound master service agreements under the OR, data-processing agreements under the DSG and GDPR, non-disclosure agreements, statements of work and subscriptions; cyber and digital-resilience compliance is a separate service.
- Customer terms
- MSAs and SaaS subscriptions
- Supplier terms
- ICT services and statements of work
- Data and confidentiality
- DPAs and NDAs
A volume retainer with an agreed fair-use cap
Who this is for
Scope
- Master service agreements and SaaS subscriptions:review and negotiation of inbound and outbound terms covering scope, service levels, liability caps, indemnities and termination, drawing on the freedom of contract that Art. 19 OR gives commercial parties over the content of their agreements
- Data-processing agreements:processor and controller terms aligned with the processor provision in Art. 9 DSG and, for EU-facing data flows, the processor terms required under Art. 28 GDPR
- Non-disclosure agreements and statements of work:mutual and one-way NDAs, plus SOWs that define deliverables, acceptance and change control against the parent master service agreement
- Customer and supplier contracts:both the contracts a provider issues and the third-party terms it is asked to sign, including DORA ICT third-party clauses pushed down by financial-sector customers
- Playbooks and fallback positions:an agreed set of standard positions and fallbacks so routine negotiations follow the same positions across the contract base
- Volume retainer with a fair-use cap:a predictable monthly fee against an agreed contract throughput, with matters beyond the cap scoped separately
How the work proceeds
- Intake The initial review covers the client's existing contracts, recurring counterparties and the standard terms used by each side.
- Agreed terms Standard positions and fallbacks form the playbook, and the fair-use cap sets the monthly volume.
- Contract review Contracts are reviewed and negotiated under the agreed scope and playbook.
- Escalation Any matter beyond the cap or outside the playbook is flagged before work proceeds, so cost stays predictable.
- Review The playbook and throughput are reviewed periodically as the contract base and counterparties change.
Fees
Monthly retainer
A volume-based retainer with a fair-use cap; beyond-scope advice is billed by time.
Questions
- What does a contracting retainer cover, and how does the fair-use cap work?
- The retainer covers review and negotiation of the recurring commercial contracts of an ICT business: master service agreements, SaaS subscriptions, data-processing agreements, non-disclosure agreements and statements of work, both inbound and outbound. A volume-based fee is set against an agreed monthly throughput; the fair-use cap defines the contract volume and complexity included before additional matters are scoped separately. The cap keeps the monthly cost predictable, and GAWEL Legal flags any high-volume month or unusually complex negotiation that falls outside it before work on it proceeds.
- Does a data-processing agreement require both Swiss and EU terms?
- Often, yes. Where a SaaS or cloud provider acts as a processor, Swiss law governs the engagement through the processor provision in Art. 9 DSG, which permits processing to be assigned to a processor by contract under defined conditions and limits sub-processing to cases with prior controller approval. Where the controller is subject to the GDPR, for example because it is established in the EU or offers its services to people in the EU (Art. 3 GDPR), the data-processing agreement must also carry the processor terms required under Art. 28 GDPR. A workable DPA usually addresses both regimes in one instrument, and GAWEL Legal drafts and negotiates the clause set accordingly.
- Does this service include NIS2, DORA or Cyber Resilience Act compliance?
- No. Those are handled under a separate service. Cyber and digital-resilience compliance (NIS2, DORA and the EU Cyber Resilience Act) is its own engagement, covering applicability scoping, governance and incident-reporting frameworks and product-cybersecurity obligations. The contracting retainer handles the commercial contracts: where a financial customer pushes DORA ICT third-party terms into a provider's master service agreement, the retainer reviews and negotiates those contractual terms, while the wider resilience-compliance work is covered by the Cyber and digital resilience service.
- Which law governs these contracts, and is party choice respected?
- Most engagements run on Swiss contract law under the OR, where a contract forms on the parties' mutual assent (Art. 1 OR) and the parties may set the content of their agreement freely within the limits of the law (Art. 19 OR), which gives commercial parties wide latitude over allocation of risk, liability caps, service levels and termination. Swiss private international law gives effect to the parties' choice of law (Art. 116 IPRG); where a counterparty insists on a foreign governing law, GAWEL Legal advises on the practical consequences and negotiates the terms accordingly.
Discuss your matter
Briefly describe the matter and the legal advice you need.