Preparation of a set of agreements and powers of attorney for the launch of B2B SaaS with the processing of personal data (RF/EAEU)

Initial situation: a company launches a B2B SaaS for HR automation and video interviews. Clients are legal entities from the Russian Federation and partly from the EAEU. The product processes personal data of candidates and employees, has integrations with APIs of third-party services (mail, instant messengers, cloud storage), and also connects contractors for data support and tagging. Currently, one contract template is used, which does not cover liability, SLA, rights to results, cross-border data transfer and work through representatives. It is required to collect a legally related package of documents and bring it to a unified logic.

Subject area and environment: contractual basis for IT services and software licensing, processing of personal data according to 152-FZ, distribution of operator-processor roles, trade secrets, NDA, acts and electronic document management. Documents must be suitable for use in EDI (Kontur.Diadoc or SBIS) and for signing with a simple electronic signature in the SaaS account (one-time code).

What needs to be done in stages:
1) Audit of source materials - current contract, price list, description of tariffs, PD processing policy, integration scheme, standard SLA, list of subcontractors - identify gaps and risks, create a map of documents and a matrix of roles/responsibilities.
2) Prepare and agree on the structure of the package - which documents are required, which are optional according to sales scenarios - a direct agreement, through a partner, through a representative by proxy.
3) Develop documents in Russian with uniform definitions and cross-references:
- Framework agreement for the provision of services/providing access to SaaS with applications: tariffs, SLA, support procedure, payment procedure, EDI/PEP procedure.
- An order to process personal data for a client (if the client is an operator and the service is a processor) and an alternative option, if the service is an operator for individual data (describe the delimitation of data sets).
- Agreement with a subcontractor-processor of personal data (data processing + confidentiality) for technical support/tagging contractors.
- NDA (two-way) in the logic of the IT project.
- Power of attorney from a legal entity for an employee/representative for signing contracts in EDF and for performing actions in your personal account, plus a short form for one-time actions.
- A template for a notification letter about the involvement of subprocessors and changes to the list, suitable for distribution to clients.
4) Prepare a table of variable conditions - which items vary by customer segments (enterprise vs SMB), by data storage location, by SLA periods and liability limits.
5) Carry out 2 iterations of edits based on the customer’s comments and prepare the final version for implementation.

The concrete result: a set of final documents in DOCX with a uniform style and table of contents, plus a PDF for distribution, and a separate file with a matrix of scenarios and condition variables. Documents must be ready for filling out details and signing without additional processing.

Restrictions:
- Basic jurisdiction - Russian Federation, with reservations for clients from the EAEU without an in-depth analysis of the law of each country, but with neutral wording for cross-border transfers.
- Do not use exotic structures that are difficult for clients’ corporate lawyers to agree on, but cover key risks - liability, limits, confidentiality, rights to results, procedure for deleting/returning data.
- Avoid conflicts between the contract, SLA and instructions for processing personal data.

Measurable acceptance criteria:
- Transfer of at least 6 documents from the list above in the final version, all in DOCX format, without empty placeholders except for details and variable commercial conditions.
- A single glossary of terms - at least 20 key definitions - identical in all documents.
- The matrix of roles for personal data - what data is whose, who is the operator/processor, purposes and storage periods - is drawn up in a separate application and agreed with the contract.
- The table of variable conditions contains at least 15 parameters and links to specific document paragraphs.
- After 2 rounds of customer edits, no more than 10 point comments remain without the need to change the package architecture.

Tools and approach: working in Word with edit mode and versions, using checklists for 152-FZ and the practice of IT contracts, carefully linking applications and links, preparing documents for EDI and SEP in your personal account.