July 2024 Newsletter

A message from Jen Kitson, Managing Director and General Counsel (Private Sector)

The Summer is finally here! Before you all, hopefully, jet off for your summer holidays, I am delighted to share the next quarterly KC newsletter.

This time we cover topics like key considerations when looking to set up business in the USA, alternatives to court for debt-recovery, a business guide to the UK’s Online Safety Act and key areas for customers to focus on when negotiating SaaS agreements.

We hope you enjoy! As always, please contact us should you wish to find out more on any of the featured topics.

Jen

Key Considerations When Setting Up Business In The Usa

As a UK/EU business looking to enter the US market, there are some key considerations to successfully establishing your business in the US.
At Kennedy Cater we have worked with many clients who have set up businesses in the US, working with our carefully selected partners. If you require advice on this topic, please do not hesitate to contact us.

company type

Choosing the business entity that meets your needs and goals is critical. The type of business entity will affect the structure and operation of the business and also the owner’s obligations with respect to the debts and obligations of the entity. The types of entities which can be established include, Sole Proprietorship (unlimited liability), General Partnership (unlimited liability), LLC (limited liability company), LLP (Limited Liability Partnership) and LP (Limited Partnerships – partial liability). More often than not, the tax structuring will dictate the type of entity to be used. LLCs are most commonly used due to their limited liability structure and flexibility.

Taxation

Both local and international tax implications should be considered. The key local taxes include corporate tax on profits, which include federal corporate tax, potentially a state corporate tax and other taxes. For example, some states do not have a state corporate tax but will have a receipts tax, and some both. As such, the state chosen in which to establish, will impact upon how much tax is paid. Sales tax (VAT equivalent) will also apply at state level on all sales. In our experience, Delaware is one of the most popular states to incorporate within.

Commerical Contracts

Another common request we receive from our clients is support with state localisation of existing template commercial contracts, such as supply/services agreements, distribution agreement, NDA, etc. By localising contracts you are updating your template suite to include local legal provisions, and also by contracting via a US entity, it reduces or removes the risk for the UK parent company. Contracting with a local entity, under local laws, gives your US clients and vendors increased confidence to work with you.

Privacy

Depending on how, where and from whom personal data is being collected and processed, a number of US privacy law provisions should be considered and commercial contracts and applicable internal policies such as your privacy policy, should be updated. Also, if you are transferring personal data relating to UK/EEA data subjects to the US you will need to put in place measures to ensure such transfer is lawful. If the personal data being transferred is your client’s (where they are the data controller and you are the data processor) you will also need to check your contracts with those clients to understand whether consent is needed. Whilst GDPR is considered by many to be the worldwide “gold standard” a privacy review is highly recommended to identify areas of focus, to help ensure compliance with all applicable privacy laws.

Employment

As your business starts to grow you will need to consider employing staff locally such as a sales team. In the US, in addition to federal employment laws, it is the employment law of the state in which the employee resides that is applicable. Many states have (absent agreement to the contrary) an employment “at will” culture requiring a simple offer letter, but you should ensure basic protections such as ownership of IP and confidentiality are covered. If restrictive agreements such as non-compete or non-poaching are necessary to protect your legitimate business interests, then do seek advice depending on the state in which the employee resides. Generally speaking, these are enforceable but there are exceptions, for example in California post-termination non-competition/customer non-solicitation provisions are unlawful, entitling the employee to bring a private right of action not only for invalidation but also damages/costs.

Immigration Law

Immigration into the US can be a costly exercise and it is important to have a clear strategy around what staff you require to be based in the US. There are various Visa types available depending on how long the employee intends to stay within the US and also there may be eligibility for a green card for certain types of investor visas.

Trademarks

If you do not already have a registered US trademark for the branding you wish to use in the US, we would always recommend running initial trademark searches to ensure there are no conflicting marks. Failure to check upfront can lead to inadvertently infringing on another trademark which can be costly. As with the UK/EU, registration of your key marks is recommended to protect your brand and can often take anywhere between 12-18 months to complete.

In general terms, high operating costs combined with a complex legal and regulatory framework, requires careful planning to ensure a successful entry into the US market.

Alternatives To Court For Debt Recovery

Debt collection is a critical aspect of financial management for businesses and individuals alike. When it comes to recovering outstanding debts, many companies choose to engage professional debt collection firms. In this article, we’ll explore the advantages and disadvantages of using such firms, along with the relevant professional regulations. We will also feature Kennedy Cater’s alternative model using the benefits of our own expertise and third-party contacts. The following attempts to conclude cost efficient ways of collecting debts without going to Court which can be slow and shockingly expensive with no guarantee of success.

Advantages of Using a Debt Collection Agency:

1. Expertise and Resources:

Debt collection agencies specialize in this field. They have the time, expertise, and resources required to efficiently pursue debtors.
Their experience allows them to navigate complex situations, legal requirements, and negotiation tactics effectively.

2. No Collection, No Fee:

Some agencies offer a “no collection, no fee” service. This means you only pay if they successfully recover the debt.
This feature however is fast reducing in the market and when still offered, the commission charged can be eye watering.

3. Time Savings:

Debt collection agencies work swiftly. They tend to have computerised systems in place that can save you valuable time compared to handling collections yourselves. Quick debt recovery positively impacts your cash flow

4. Preserving Customer Relationships:

A professional agency may maintain a polite and respectful approach when communicating with debtors.
By avoiding legal action, you may retain the customer’s goodwill and prevent damage to your business relationships.

5. Legal Assistance:

If a debtor remains uncooperative, the agency can escalate the matter by instructing solicitors on your behalf.
Legal expertise ensures compliance with relevant laws.

Disadvantages Of Using A Debt Collection Agency:

1. Costs:

Debt collection agencies charge a commission (typically 8% to 10%) based on the recovered amount. The commission is considerably higher if based on a “no win no fee” arrangement.
High fees may impact your overall financial recovery especially if attempts are unsuccessful.

2. Customer Relations:

If the agency fails to adopt the anticipated polite and professional approach and takes a heavy-handed approach, it could harm your customer relationships. It would be difficult to monitor this.
Losing a customer due to aggressive tactics may outweigh the benefits of debt recovery.

3. Agency Priorities:

Your business may not be the agency’s top priority. They handle multiple clients simultaneously. How far down the list are you?

4. Legally Trained Employees:

Some agencies may not employ legally trained staff and will therefore be subject to regulations.
It would be a good idea if you could verify that the agency adheres to legal requirements. This, in practice, would be difficult to establish.

Professional Regulations For Debt Collection Agencies:

1. Financial Conduct Authority (FCA):

Debt collection agencies in the UK are regulated by the FCA. The FCA sets rules and guidelines to ensure fair practices, transparency, and consumer protection.
Compliance with FCA regulations is crucial for ethical debt collection. As a customer of a debt collection agency, you should check that the firm is authorised.
However, no authorisation is required if you collect the debt yourselves or instruct a non-regulated party to simply try to collect the whole debt. Without authorisation, no negotiations with the debtor are permitted to arrange repayment schedules.

2. Consumer Credit Act 1974 where the debt relates to credit agreements.

Debt collection activities related to credit agreements fall under this legislation.
Agencies must adhere to the Act’s provisions, including treating debtors fairly and transparently.
Debt collection permission is required for credit agreements, consumer hire agreements, and regulated peer-to-peer loans. This means that in the terms and conditions of a business, there must be wording to permit the fees incurred in collecting debts to be added to the amounts claimed.
Utility debts and company debts (not credit agreements) are excluded. These can be collected without too much concern about the Consumer Credit Act 1974.

Kennedy Cater Model

1. Letter Before Action: (“LBA”)

Following receipt of instructions from you and being satisfied that there is a collectable debt, we can draft a letter before action formally demanding repayment of the debt within a certain time frame.
This letter needs to be professionally drawn up as it requires certain formalities to be followed in respect of Court protocol.
Kennedy Cater will arrange for one of its partner law firms to issue the LBA to the debtor using their headed notepaper. The letter will require that all responses come back to you.
If the debt is paid, or a suitable repayment schedule agreed in writing, the aim of the LBA is achieved.
We charge a one-off fee for the drafting and service of the LBA to the debtor.

2. Next Steps:

If the debt remains outstanding after the date given to pay has passed, we will discuss with you the next steps of trying to retrieve these monies owed to you. If the debt is “crystallised,” i.e. it is finite amount from an unpaid account, then in most cases the logical next step would be to prepare and serve a Statutory Demand on the debtor.
A Statutory Demand is a formal requirement to pay a sum of money within 21 days. If the debt remains unpaid after that time, you can wind up a company debtor for debts over £750 or make an individual bankrupt if the debt exceeds £5000.
The statutory Demand can either be sent by the client directly or we can have one of our partner law firms send on its notepaper in the same fashion as it did the LBA.
Statutory Demands are often successful as they are the final sword of Damocles hanging over the debtor before it knows that the debt must be paid. If the debt is still unpaid, you can enforce as detailed above or consider suing in the Courts.

A Business Guide To The Uk’s Online Safety Act

The Online Safety Act (the OSA) provides a new extensive regulatory framework which has the general purpose of making the use of the internet services safer in the UK.

The Act imposes duties on service providers to mitigate and manage risk of harm with respect to illegal content and activity, and content which is harmful to children. It also confers new functions and powers on the regulator, Ofcom, to enforce the OSA framework

Who Is Affected?

If your business provides online services, like a website or app then the OSA may apply to you.

The law does not simply apply to UK companies but online service providers if UK users are a target market for the service, and if the service has a significant number of UK users which can include any user based in the UK who visits or interacts with your service.

Ofcom has provided that its analysis suggests that in excess of 100,000 online services could be affected by the new rules. approach os implementation pdf

The types of business which this applies to are:

User to User (U2U) Services, which enable users to interact with each other including generating or uploading or sharing content such as images, messages, comments, or video i.e. social media type online platforms.
Search Services, being a search engine service or functionality which enables users to search more than one website or database. (This could include a Generative AI model where the model enables the search of more than one database or website, e.g. via plugins to partners sources of data).

Note: the OSA also applies to online services who publish pornographic content, but for the purposes of this article we will not explore further this element of the OSA.

Exempted Services – Certain types of U2U services are exempt from the OSA as there are limits to the way in which users can communicate or limits to the type of content generated, where the only way users can communicate online is by email, SMS, MMS or one on one live aural communications, or where users can only interact with service provider generated content, such as comments, likes/dislikes, ratings/reviews of your content including using emojis or symbols. Examples are product reviews, ratings, etc. Other such exempted services are internal business services such as intranet, CMS or CRM systems, or where such services provided by a public or educational body. Other exemptions include UK public bodies or foreign governments bodies.

Duty Of Care - Assessment And Management Of Risks

While the majority of the rules have not yet come into being, it is expected that by late 2024 this will have changed.

Assuming you are affected by the new rules under the OSA, the following approach is recommended:

1) Carry out a risk assessment to:

a) identify and quantify:

users, and applicable risk to them from illegal content;
any associated harm from illegal content;
any risk of harm to children from harmful content (if children are likely to use your service); and

b) take proportionate and effective steps to manage and mitigate the risks and harms including removal of harmful content and prevention of children from accessing harmful, illegal or age inappropriate content.

2) Be cognisant of the rights of the individual with respect to, the protection of the freedom of expression, and the right to privacy.

3) Retain records for compliance purposes.

4) Review your terms of services and policies, and specifically document how users:

will be protected;
can report illegal and or harmful content; and
can complain, when an illegal post has been identified and removed.

Measures Proposed For U2u And Search Services

The measures to be implemented for U2U and search services, will depend on the size of the organisation, with large organisations being 7 million or more users per month, and small organisations being all other service providers which are not large.

Each organisation type (large or small) will have their own requirement to implement measures depending on the risk profile of the organisation, being, low risk, specific risk or multi risk. (see link for detail - Consultation at a glance ourproposals pdf

For example, for a small service provider (for both U2U and Search Services) with a multi-risk profile, at a minimum they will be required to do the following:

Appoint a named person accountable to the most senior governance body in the organisation;
Have written statements of responsibility for senior staff members who make decisions related to the management of online risks;
Track and report illegal content;
Implement a code of conduct for all staff;
Train staff;
Engage content management / search deprioritisation systems;
Implement internal content / search moderation policies; and
Update terms of service.

Although, small service providers (both U2U and Search Services) with a low or specific risk profile will have much less onerous requirements.

Other Measures – in addition there are other measures which may apply to you.

New Offences

The OSA also introduces a range of new offences including, information offences and communications offences. The offences can be broken down into three distinct groups:

Offences which related to Ofcom’s enforcement powers, which came into effect on 10 January 2024;
Communications offences, which came into force on 31 January 2024; and
Offences which relate to a new requirement to report Child Sexual Exploitation and Abuse (CSEA), which are not yet in force.

By way of example; the Ofcom enforcement offences include four new criminal offences:- failure to comply with an information request from Ofcom, failure by the senior manager to take all reasonable steps to prevent an offence from occurring; offences with respect to inspection and audit by Ofcom; and offences for failing to cooperate with Ofcom.

Penalties include a maximum penalty for conviction on indictment being imprisonment for a term not exceeding 2 years or a fine or both, with lesser penalties on summary conviction, though there are a number of proscribed defences which can be invoked, depending on the offence

In addition, the regulator has the authority to impose fines of up to £18 million or 10% of the organisation’s annual turnover, whichever is greater.

If you require advice on this topic, please contact us and we can support you with interpretation and implementation of the changes in law arising from the OSA.

A Customer’s Guide To Key Contractual Negotiation Points When Purchasing Software-as-a-service

Many of the big SaaS providers will resist any changes to their standard T&C’s. As with most supplier’s you need to consider the bargaining power of the vendor, the value of the service you are purchasing and your ability to “shop elsewhere” if adequate terms cannot be reached – but with the exception of some of the largest players, most SaaS providers will negotiate for the “right deal”.

Here is a quick summary of the key areas to review and consider from the customer perspective when purchasing SaaS:

1) Performance:

What if the service doesn’t work in the way it should?

a. You would not be unreasonable to demand:

an ongoing warranty that the service will comply with the vendors service description/standard documentation. Expect the vendor to require the ability to update that documentation from time to time, but do ensure they can’t do so if that update materially decreases the features/functionality of the service;
an ongoing warranty that the service will comply with documented Service Level Agreements (SLAs) – SLAs usually relate to the availability of the service and how quickly support tickets will be dealt with;
if you are also purchasing professional services, for example implementation services, a warranty that the services will be performed with reasonable skill and care by appropriately experienced individuals and materially in accordance with the agreed scope (usually set out in an order or statement or work). Usually this is a warranty limited in time to a certain number of days from performance or completion (for example 90 days) but do make sure that gives you time to run end-to-end testing.

b. What is the consequence of breach of warranty?

Failure of the service to comply with documentation should give the vendor the obligation to repair the service so that it does conform, or replace the service with a comparable service, failing which sometimes termination and refund remedies are made available.
Failure of SLAs usually give rise to service credits;
Failure of professional services warranties usually give rise to obligation of re-performance so to conform, failing which refund remedies are made available.
Where refund remedies are given, be careful to check if the refund only relates to the part of the service which failed or the whole service. If the former (which is not unusual) consider if it is possible to benefit from only certain portions of the service in isolation or whether you need to consider total termination and refund in that situation.
Whilst not unusual, be very wary of remedies which are stated to be “sole and exclusive”. A prime example is the offering of service credits. A 5% service credit for failure to meet the availability SLA may sound good in practice, but if it is sole and exclusive remedy then it is likely to prevent you from bringing additional damages claim up to the agreed cap. At a minimum you may want to explore an agreed failure which is considered so bad that you are entitled to seek additional remedies.

2) Privacy and Security

What data will the vendor host on your behalf – how sensitive is it? Is it a type of data that is subject to specific legal protections (such as personal data or payment card information etc.) Is it just your internal data or do they host data belonging to your clients (or other 3rd parties)?
Have you asked where the servers are located, from which countries your data will be accessible from and what 3rd parties have access to your data? Is this all identified in the contract?
Are the security measures the service must adhere to acceptable and are they incorporated into the contract?
What frequency should your data be backed up by the vendor and what disaster recovery plans do they have in place? Do they offer SLAs for how long to recover the service and your data in the event of an outage?
If the SaaS vendor is processing personal data of yours (or your customers) then you will need to consider terms applicable to data protection (usually a separate data processing agreement).

3) Limitation of Liability

Exclusions: Often SaaS providers will exclude their liability for certain heads of loss entirely. This is common for example: loss of goodwill, loss of profits/revenue/business, indirect losses etc. These should be considered in light of the types of loss that you anticipate suffering in event of their breach. The key one to focus on specifically for SaaS however is loss of, or corruption to, data – if the SaaS provider is hosting your data and their platform is the only source of that data then loss/corruption of data is going to be a significant issue for you. It is sensible to try to remove this exclusion, or at a minimum ensure that it only applies where they have provided all agreed backup and disaster recovery services and in all cases you should try to exclude loss of personal data.
Cap: It is common for caps to be introduced which are a multiple of the fees (usually 100% across a period such as 12 months). As with any contract this should be considered in light of the losses you anticipate and the value of the deal. It may be this is commercially acceptable in general, but do consider if you want to carve out from that cap (or agree a separate higher cap) for areas such as breach of security, privacy obligations, 3rd party intellectual property infringement (which is usually subject to an uncapped indemnity) and/or breach of confidentiality.

4) Term and Suspension/Termination

A SaaS provider will usually expect you to sign up for a minimum term (often with auto-renewal) and will likely resist any ability to terminate for convenience within that time.
If the SaaS is going to be critical to your business, you will want to limit the vendor’s ability to terminate or suspend the service. Note it is common for SaaS providers to require suspension rights in the event of security issues or where your usage may disrupt the service or other customer’s use of the service. You can try limiting to “material” security issues or disruption, and to seek comfort that any suspension is only to be for the minimum extent and duration necessary to resolve with appropriate notification obligations.
If the vendor is your sole source of your data, then it will be imperative to ensure on termination that you can get access to, or a copy of, your data (in an acceptable format). Typically, this should be a right to request the same within a certain number of days following termination.

5) Fees and Payment

Are the fees based on minimum scope or is it a true “pay as you go” model? If minimum scope this is often paid for annually, quarterly or monthly in advance. If on a pay as you go model this may be monthly in arrears.
If you are committing to a minimum scope, particularly over multiple years – do you need flexibility to decrease usage during the minimum term?
Often SaaS vendors will require the right to suspend or terminate for late payment. Particularly, if the SaaS is business critical, this should only apply to failure to pay undisputed fees and suspension/termination should only occur following a documented escalation process.
When do you start paying for the SaaS? This is often immediately but if there is a period of implementation, it may be worth discussing whether fees should be waived (or at least discounted) until “go-live” when you expect to actually start receiving a benefit from the service.

6) Intellectual Property Ownership:

It is a given that the SaaS provider will retain IP in its service and that the customer should own the IP in its data/materials hosted by the service, but what about the outputs of the service? This should be considered on a case-by-case basis with particular care if the SaaS utilises any artificial intelligence which “learns” from the customer’s data.

We have extensive SaaS experience here at KC. Whether you are a SaaS provider or customer, let us know if we can help review any SaaS contracts or templates on your behalf.