This agreement protects confidential information a company shares with a vendor, agency, or other third party during an engagement — including situations where the vendor's team receives access to the company's systems, premises, or client materials.

1. Parties and engagement

This agreement is between Company name (the "Company") and Vendor name (the "Vendor"). It takes effect on Effective date and covers information exchanged for the following engagement (the "Engagement"): Engagement description.

2. Confidential information

1. "Confidential information" means non-public information the Company or its clients share with the Vendor, or that the Vendor observes through access to the Company's systems, premises, or personnel — in any form.
2. It includes, without limitation: business and financial information, pricing, product plans, technical materials, source code, credentials, customer and employee data, personal data, and the terms of the Engagement.
3. Information is covered whether or not marked confidential, if a reasonable business would treat it as non-public.
4. It excludes information that is or becomes public without the Vendor's fault, was lawfully known to the Vendor without restriction, was lawfully received from a third party without restriction, or was developed independently without using the Company's information.

3. Vendor obligations

1. Use confidential information only to perform the Engagement, and for no other purpose — including no use for other customers, benchmarking, or product development.
2. Protect it with at least reasonable care and in line with any written security requirements the Company provides.
3. Not disclose it to anyone except vendor personnel covered by section 4, or as the Company approves in writing.
4. Notify the Company promptly of any actual or suspected unauthorized access, use, or disclosure, and cooperate to contain and remediate it.

4. Vendor personnel and flow-down

1. The Vendor will share confidential information only with its employees and subcontractors who need it for the Engagement and who are bound by written confidentiality obligations at least as protective as this agreement.
2. The Vendor remains fully responsible for its personnel's and subcontractors' compliance, as if their acts were the Vendor's own.
3. On request, the Vendor will identify which personnel have access and confirm their obligations in writing.

5. System and premises access

1. Access credentials issued to vendor personnel are individual, must not be shared, and may be revoked by the Company at any time.
2. The Vendor will access only the systems, environments, and data needed for the Engagement, follow the Company's security policies communicated in writing, and not copy data out of Company systems except as the Engagement requires.
3. The Vendor will promptly tell the Company when any of its personnel no longer need access, so it can be removed.

6. Compelled disclosure

If the Vendor is legally required to disclose confidential information, it will disclose only what is required and, where lawful, give the Company prompt written notice first so the Company can seek protective treatment.

7. Term, return, and deletion

1. This agreement runs for the duration of the Engagement, and the confidentiality obligations continue for Confidentiality period after the Engagement ends. Trade secrets remain protected for as long as they qualify as such; personal data remains protected for as long as the law protects it.
2. When the Engagement ends, or earlier on request, the Vendor will return or securely delete all confidential information and copies, including from subcontractor systems, and confirm in writing. Copies retained by law or routine backup remain subject to this agreement.

8. No license, no publicity

1. No rights or licenses to intellectual property are granted by this agreement.
2. The Vendor will not use the Company's name, logo, or the existence of the Engagement in marketing, case studies, or client lists without the Company's prior written consent.

9. Remedies and general terms

1. Unauthorized use or disclosure may cause harm that money alone cannot adequately remedy; the Company may seek injunctive or other equitable relief in addition to other remedies.
2. This agreement supplements any services agreement for the Engagement; on confidentiality, the stricter term controls.
3. Neither party may assign this agreement without the other's written consent; amendments must be written and signed; an unenforceable provision does not affect the rest.

Signatures

For the Vendor: ✍ Vendor signature Date: Vendor signature date

For the Company: ✍ Company signature Date: Company signature date