Due diligence for tech M&A in Peru

Due diligence

What are the typical areas of due diligence undertaken in your jurisdiction with respect to technology and intellectual property assets in technology M&A transactions? How is due diligence different for mergers or share acquisitions as compared to carveouts or asset purchases?

In Peru, due diligence related to technology M&A gives great importance to IP rights, their validity and enforceability, and the adequate performance of technology assets for the stated and agreed acquisition purpose.

Regarding IP rights, the review of labour agreements is prioritised to ensure all work performed by employees to develop the technology accrues directly to the benefit of the employer. If third parties have been hired for specific developments, it is important to review such third-party agreements to be certain that the target company has full ownership of the development. Additionally, it is also relevant to confirm that the holder of the IP rights to the assets has not or is not currently infringing any third-party rights.

When dealing with technology M&A transactions, importance is also given to the technical review of the IP assets. See question 10.

The main difference between mergers or share acquisitions, as compared to carveouts or asset purchases in the context of a traditional due diligence, is the scope of the analysis, and the matters to be reviewed in each of them are the key differentiators.

In this sense, mergers or share acquisitions involve acquiring a company and, consequently, it will be required to examine, at least, matters concerning corporate, tax, labour, regulation, intellectual property, real estate, the environment, litigation, personal data and insurance. (Other types of due diligence must be also required, such as financials, accounting, human resources, technical and operational due diligence to get the whole picture of the business and its operations.) Regarding legal due diligence of carveouts or asset purchases, it must be specifically focused on reviewing the asset to be acquired; therefore, legal due diligence should include property rights, intellectual property, taxes, regulatory and administrative matters, as well as insurance and litigation aspects related to the asset. Technical, commercial and operational due diligence processes become important in an asset acquisition.

Technology M&A due diligences are different based on the fact that technology companies are different from traditional companies. Technology companies are dependent from other technology providers, third parties and technology elements that give support to the company and the necessary tools to carry out its business. This means that technology companies exist and operate in an economic environment characterised by seamless integration and sometimes complex and crucial relationships.

Thus, there are some critical issues to focus on when performing a diligence over a technology company or IP assets. For instance, it is crucial to have a clear and detailed picture of cybersecurity matters, data privacy regulations and procedures, third-party IP rights and any other matter related to information and know-how of the target.

Technology and IP assets involve sensitive and critical information that must be carefully protected, and the know-how and complex relationships must be assessed and duly determined in the due diligence to assure the business will continue operating.

Consequently, we recommend verifying if the seller is following security protocols, compliance procedures and setting critical operational rules (ie, information safety guidelines, rules regarding coding procedures as well as access to use of third-party codes or services, rules for backup of data, employee training plans, set of certain data access policies (ie, passwords), constant supervision of users of the information, among others) applicable to workers and service providers, and confidentiality agreements, among others.

Based on the above and according to our experience, we estimate that legal due diligence for mergers or share acquisitions usually take around four to six weeks, and legal due diligence for carveouts or asset purchases usually take about three to five weeks from the date that we receive complete information we request. However, it will depend on the complexity and the amount of information in each case.

What types of public searches are customarily performed when conducting technology M&A due diligence? What other types of publicly available information can be collected or reviewed in the conduct of technology M&A due diligence?

In Peru, it is customary to carry out the following public searches when conducting technology M&A due diligences:

• a search at Indecopi to verify IP asset registration status, amendments and other acts that could affect them (eg, a transfer, pledge, lien, registry cancellation) as well as to confirm identity of title holders of such intellectual property. We always suggest conducting searches before the following administrative authorities:
• patents, utility models and industrial designs before the Directorate of Inventions and New Technologies; and
• copyrights (ie, software) before the Directorate of Copyrights. This search is merely referential, since registering copyrights is not mandatory;
• a search at the Registry of Movable Assets and Contracts to verify if the specific IP asset or technology has any lien, if it has been licensed or if there is any specific agreement by seller with third parties over such asset (recently enacted Legislative Decree No. 1400, Law of the Security Interests, changes the above-mentioned registry for a new system of publicly available information called the Information System of Movable Assets (SIGM);
• if technology M&A involves a company acquisition, it must be highlighted that the completion of such transaction will necessarily require the buyer to obtain more information and, consequently, carry out additional searches. For instance, it will be necessary to conduct public searches at the Peruvian public registries to confirm property rights, company’s information, contracts, Indecopi (trademarks), the judicial courts to look for litigation procedures, credit reporting agencies for obtaining the company’s credit history, among other things.

What types of intellectual property are registrable, what types of intellectual property are not, and what due diligence is typically undertaken with respect to each?

As mentioned in question 3, under Peruvian law, the following IP rights are registerable, among others: trademarks, patents, utility models and industrial designs. The registration of these IP rights is mandatory and it is a requisite for its legal protection and exclusivity under Peruvian law.

The registration of copyrights (ie, software) and trade names is not mandatory. Holders of such intellectual property do have certain rights even if they do not register their work (eg, right to use, exploit, among others).

Legal due diligence of registrable assets usually involves the review of the following information:

• certificate of IP rights issued by Indecopi, labour or services agreements if the holder of the IP rights is a company;
• expiration terms;
• proof of use;
• payment of legal annual fees, if applicable; and
• registration of liens or security over IP rights at Indecopi.

Regarding non-registrable IP assets, legal due diligence usually includes the review of all the executed agreements and legal matters described in question 4.

In addition to the legal diligence of registrable and non-registrable IP assets, acquirers also request completion of market investigations or researches (quality and quantity) to confirm competition, advantages, improvement opportunities, etc.

Can liens or security interests be granted on intellectual property or technology assets, and if so, how do acquirers conduct due diligence on them?

Yes. Liens and security interests over intellectual property can be granted under Peruvian law.

Liens are granted by a judiciary order upon claimant’s request (article 608 of the Civil Procedures Code). This order can be obtained as a precautionary measure provided that there are enough grounds to support such claim. Once the lien is obtained, the court orders its registration in the Registry of Movable Assets and Contracts and the corresponding registry of Indecopi. Registration at the Registry of Movable Assets and Contracts will vary (see question 5).

Security interest agreements have to be executed by the parties in writing to be valid (article 17 of the Law of Guaranty over Movable Assets, Law No. 28677, and article 6.2 of the new Law of Security Interests, Legislative Decree No. 1400, which will be enforceable once the Peruvian government implements the SIGM). It is not mandatory to register such security interests at the Registry of Movable Assets and Contracts (or to register security interest at SIGM once it is implemented). However, we strongly recommend registering them to ensure priority and enforceability against any third party.

As we said before, acquirers could carry out searches of IP rights at Indecopi as well as in the Registry of Movable Assets and Contracts (or SIGM, as the case may be).

What due diligence is typically undertaken with respect to employee-created and contractor-created intellectual property and technology?

According to Peruvian law, intellectual property developed under labour or services agreements is the property of the employer unless the parties agree otherwise. Thus, due diligence review will usually focus on verifying that there is no specific agreement against the previously described rule.

Additionally, given the relevance of the IP assets, it is important to verify if the employees or contractors have executed non-disclosure and non-compete agreements with the target.

Are there any requirements to enable the transfer or assignment of licensed intellectual property and technology? Are exclusive and non-exclusive licences treated differently?

No, there are no specific requirements by law for a transfer or assignment of intellectual property and technology, and there is no regulatory difference between exclusive and non-exclusive licences regarding transfer or assignment. Usually, contracts providing a licence to use certain intellectual property include a limitation to sub-license such intellectual property unless a previous written approval is granted by licensor. There is no specific regulation setting forth any additional requirement for the transfer or assignment of such licensed intellectual property.

Assignment is granted by licensor based on a contract that is registerable at Indecopi and the Registry of Movable Assets and Contracts. It is not mandatory to register such rights or its transfer. However, we recommend our clients to register the licences given that registration ensures enforceability against third parties in the case of patents, utility models and industrial designs.

However, in the case of copyrights (ie, software), the registry at Indecopi only gives the holder proof of priority and informs third parties about the registered right (Copyrights Law, Legislative Decree No. 822, article 171 Andean Community Decision No. 351, article 53).

What types of software due diligence is typically undertaken in your jurisdiction? Do targets customarily provide code scans for third-party or open source code?

When dealing with technology M&A transactions, we have seen a major relevance of the technical review of the IP assets. In this regard, usually the technical review includes, but is not limited to, having access to the source code and being able to run different tests, which may include stressing different areas of the code or platform to verify its capacity and growing potential.

What are the additional areas of due diligence undertaken or unique legal considerations in your jurisdiction with respect to special or emerging technologies?

There is no specific regulation on these matters or any M&A experience regarding these technologies that we are aware of. With regard to big data, it is important to consider that Peru has adopted specific privacy legislation such as Law No. 29733, Law for Personal Data Protection and its Regulations (Supreme Decree No. 003-2013-JUS). These pieces of legislation establish a National Register of Personal Data Protection and recognise guiding principles for the processing of personal data and regulate cross-border data flows.

As to natural language processing and speech recognition, there are an increasing number of Peruvian companies (banks, software companies integrating this service to their platforms) that are licensing these technologies and we have provided legal assistance to certain companies interested in such technologies. Similarly, we have been working closely to companies developing internet of things products and connected devices. See question 4.