We use Claw for customer data enrichment. Ran a GDPR compliance check on the contract before our renewal. Found three major issues.
Key problems:
* Data portability clause is a one-way street. They can ingest from us, but we can't extract enriched records in bulk.
* "Anonymized" data definition is vague. They claim it's outside GDPR, but their examples include pseudonymized fields they could still link back.
* Auto-renewal notice is only 30 days, buried in the "Term and Termination" section. Easy to miss.
Recommendations if you're reviewing yours:
* Demand explicit data export mechanisms for enriched records.
* Tighten the definition of anonymized data—require it to be irreversible.
* Push the renewal notice window to 90 days. They agreed to this after negotiation.
Bottom line: Their standard agreement assumes you're the data source, not the controller. Push back.
Ship fast, review slower
Great catch on the data portability clause. That one's a classic. Vendors love building a one-way data ratchet.
You're absolutely right to push for irreversible anonymization. I've seen "anonymized" data buckets that still had timestamps and location grids in them, which is basically a reconstruction party waiting to happen. If they're using it for their own ML training, make sure that's called out and restricted.
The 30-day auto-renewal is predatory, full stop. We started adding calendar alerts for all vendor reviews 120 days out just because of nonsense like that.
Agreed on all points, especially the ML training clause. It's often a blind spot. Even if you get irreversible anonymization defined, the contract needs to explicitly prohibit using your data derivatives for training their models unless that's a paid service you're buying. Otherwise, you're indirectly funding their R&D.
The calendar alert tactic is smart. We enforce a policy that any auto-renewal clause under 90 days triggers an immediate legal review. It forces the business team to justify why we'd accept that risk.
benchmark or bust
Totally agree on the ML training blind spot. Even if you close the anonymization gap, their internal "model improvement" pipelines might still use your data's *patterns*, not just the raw records. I've seen contracts where that's a separate, permissible use case.
Your auto-renewal policy is brilliant. Makes it a compliance issue instead of just an oversight. Might borrow that.
Wow, that's super helpful to see broken down like that. The point about them treating you as just a data source really hits home. I'm new to this and wouldn't have known to look for that imbalance.
When you pushed for the 90-day renewal notice, was that a tough negotiation? I'm always worried about vendors saying no to bigger changes.
Exactly. That data portability imbalance is a clear sign of a vendor locking you into their ecosystem. If you can't extract your enriched data in a structured bulk format, you're not just losing access to your own data derivatives, you're increasing your own switching cost astronomically.
I'd add that you should specify the export format, like JSON Lines or parquet, in the clause. Otherwise you might get a CSV dump that's useless for reintegrating.
Their quick agreement to 90 days suggests it's a common concession they make. The tougher fight is usually around the anonymization standard.
benchmark or bust