Businesses evaluate software on features and price, sign standard terms without reading them, and discover the important provisions three years later when they want to leave or when something goes wrong. The features are the easy part; they are visible in a demo. The contract is where the risk sits.
Who owns your data
Good agreements state plainly that you retain ownership of the data you put into the system, and that the provider has a licence to use it only to deliver the service.
Watch for terms granting the provider broader rights — to use your data for product improvement, to create aggregated or derived datasets, or to use it for training machine learning models. Some of that may be acceptable; all of it should be a conscious decision rather than a discovery.
Where the data includes personal information about your customers or staff, you remain accountable under the Privacy Act 2020 regardless of what the provider does. The agreement should support your obligations, not undermine them.
Getting your data out
This is the provision that determines whether you are a customer or a hostage.
Establish before signing:
- What format you can export in. “You can export your data” means little if the export is a PDF report rather than structured data.
- What is included. Master records usually are. Transaction history, attachments, notes, audit trails and configuration often are not, and they are frequently the parts you need.
- Whether export is self-service or requires the provider to run it, and at what cost.
- How long after termination you can still retrieve data, and when it is deleted.
- Whether access can be suspended for a payment dispute, which would prevent you extracting your own records at exactly the wrong moment.
Test the export during your trial. Actually download it and open it. Providers are not always accurate about what their export contains.
Uptime, support and what a service credit is worth
Service level commitments should specify an availability target, how it is measured, what is excluded (scheduled maintenance usually is), and what remedy applies.
Be realistic about remedies. A service credit of a few percent of monthly fees does not compensate for a day of lost trading. The credit is a signal of how seriously the provider takes availability, not genuine compensation. For genuinely critical systems, the more important questions are the provider’s track record and whether you have a workable manual fallback.
Check support hours against your operating hours. A provider offering business-hours support in a northern hemisphere timezone is offering you overnight support.
Price changes and lock-in
Most SaaS agreements allow price increases on notice. Look for a cap, a notice period long enough to respond, and a right to terminate without penalty if you do not accept an increase.
Watch for auto-renewal terms with narrow cancellation windows — the pattern where you must give notice between 90 and 60 days before renewal or you are committed for another year. Diarise those dates when you sign, not when you want to leave.
Multi-year discounts are real savings and real lock-in. For a mature product in a stable business, that is a reasonable trade. For a young product or a changing business, it usually is not.
Liability, security and where the provider actually is
Liability caps in SaaS agreements are typically low — often fees paid in the preceding twelve months — with consequential loss excluded. That is standard and largely non-negotiable for small customers, so factor it into how much you depend on the system.
For anything holding personal or financial data, ask about security posture: independent certification, encryption, breach notification commitments, and where data is hosted. A provider that cannot answer clearly is telling you something.
Also establish which entity you are actually contracting with and under which country’s law. A dispute governed by foreign law with foreign jurisdiction is effectively unenforceable for a small New Zealand business.
Practical process
- Shortlist on features, then read the terms of the shortlist before deciding.
- Run a real trial with real data and test the export.
- Ask for references from businesses of similar size in New Zealand.
- Record renewal and cancellation dates in a central place at signing.
- Keep a register of every system, what data it holds, who has access and when it renews. Most businesses cannot produce this, which is itself the problem.
business.govt.nz publishes practical guidance on choosing business software and on contracts, and the Office of the Privacy Commissioner publishes material on privacy obligations when using third-party providers.
General information only, not legal advice. Have significant software contracts reviewed.
