IP, trademarks and IT contracts in due diligence in a company acquisition

At the start of the IP review stands a simple question: which protective rights exist, and who owns them? Captured are trademarks, patents, designs and copyrights, for instance in software and advertising material. For registered rights, the relevant registers provide information on the owner, the term and possible encumbrances. With trademarks and patents a look into the respective register is especially worthwhile, because the registered owner does not always coincide with the target company.

A frequent weak point is the chain of transfer. Trademarks often still stand in the name of the founder, software was developed by freelancers or agencies, and inventions originate from employees. In all these cases the right must have passed effectively to the company. With employee inventions the rights of claim and an appropriate remuneration must be clarified; with external developers an express transfer of rights in the contract is needed.

If this chain is missing, the buyer may acquire a company that does not hold the rights to its most important asset. How such findings fit into the overall review is shown in the post on the due diligence checklist.

Alongside the company own rights count the licences with which the company uses or grants rights. Inbound licences secure access to third-party technology or software; outbound licences bring revenue and bind the company towards its licensees. To be checked are the term, the scope, the transferability and any minimum licence fees.

With self-developed software, open-source compliance deserves particular attention. Anyone who uses free components under a copyleft licence may be forced to disclose their own source code or to pass on the software under the same conditions. A clean record of the components used together with their licence terms therefore belongs to every technical due diligence.

Domains, trade secrets and unregistered know-how must also be captured. Domains should be registered to the company; trade secrets protected by appropriate measures. We explore the concept of due diligence on our focus page on due diligence.

The ongoing operation today hangs on a range of IT and cloud contracts: hosting, software as a service, maintenance and support. These contracts must be checked for their materiality and for their continuation after the acquisition. A failure of a central cloud platform shortly after closing can hit the operation hard.

Change-of-control clauses deserve particular attention. They give the contractual partner a termination or consent right if control of the company changes. Such clauses appear in licence, IT and also financing contracts. Where consent is needed for completion, it belongs to the conditions to completion, as the post on the conditions to completion shows.

Whether these clauses apply at all depends on the structure of the acquisition. In a share deal the rights and contracts remain with the company, yet a change of owner at the level of the shares may trigger exactly the change-of-control clauses. In an asset deal the rights must be transferred individually, which for registered protective rights requires a re-registration in the register. The differences between the two structures are covered in the post on share deal and asset deal.

The findings of the IP and IT review flow into a dedicated section of the warranty catalogue. Common are warranties on the existence and ownership of the protective rights, on freedom from third-party rights, on the validity of the key licences and on compliance with the open-source obligations. Identified risks can be covered by a targeted indemnity, for example in an ongoing infringement dispute.

How far the buyer depends on these warranties also turns on the structure. In a share deal the rights remain with the company; the buyer takes them over indirectly with the shares. In an asset deal the individual rights are transferred; registered protective rights then require a re-registration in the trademark or patent register. These differences are illuminated in the post on share deal and asset deal.

A growing part of the IP and IT review also touches data protection. Where software and cloud process personal data, the GDPR applies. How these requirements fit into due diligence is covered in the post on data protection due diligence. An initial assessment of the overall risks is provided by our M&A transaction risk profile.