Data Processing Addendum

Capitalized terms have the meanings set forth below, and elsewhere in this Addendum. All capitalized terms not defined herein have the meaning set out in the Agreement.

• “Applicable Data Privacy Laws” means those applicable federal, state and local laws, rules and regulations related to the security and privacy of Personal Data, including but not limited to: (a) the data security breach notification laws and data security laws of the various states of the United States and other privacy, security, labor, and consumer protection laws, as they may be adopted, implemented, or amended from time to time; and (b) the California Consumer Privacy Act of 2018 and its implementing regulations as modified by the California Privacy Rights Act of 2020 (“CCPA”).
• “Incident” means (a) a data security breach as defined by Applicable Data Privacy Laws; or (b) an unauthorized access, use, loss, theft, exfiltration, damage or acquisition of Personal Data as a result of Provider’s breach of this DPA.
• “Personal Data” means any Customer Data that identifies, describes, is capable of being associated with, or could reasonably be linked, with a particular User.
• “Personnel” means employees, affiliates, contractors, subprocessors, and/or agents that Provider uses or engages to perform the Services.
• “Process or Processing” means the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, destruction, or any other use of Personal Data.

2.1. Ownership of Personal Data. Customer represents and warrants it has all necessary authority (including any legally required consent from individuals) to transfer such information to Provider to and to authorize Provider to Process such information as permitted under this DPA and the Agreement, and as otherwise required by Applicable Data Privacy Laws. All Personal Data is and remains the sole and exclusive property of Customer, as between the parties. Provider may not, in any event, retain any Personal Data for any purpose except as otherwise required by appliable laws.

2.2. Use of Personal Data. Provider will only Process Personal Data on the written instructions of Customer as set forth in this DPA, unless otherwise permitted by Applicable Data Privacy Laws. The Parties agree that Provider’s Processing of Personal Data as required for provision of Services in accordance with the Agreement constitutes compliance with the written instructions of Customer as required by this Section. Written instructions may also include additional written instructions provided by or on behalf of Customer to Service Provider from time-to-time, including in emails and order forms, if and to the extent such instructions are required by Applicable Data Privacy Laws.

2.3. Restrictions of Personal Data. Provider and its Personnel will not Process Personal Data for any purpose other than for the specific purposes necessary of performing the Services for the duration of the Agreement unless required by law. Provider will not (and will take commercially reasonable efforts to ensure its Personnel do not) sell, share, rent, disclose, release, transfer, make available, or otherwise communicate Personal Data to any third party for any commercial purpose other than the business purpose set forth in the Agreement for monetary or other consideration of any kind. Provider will not combine Personal Data with any other data that Provider has or retains for the benefit of Provider or any other third party. “Sell”, “share”, “sale”, “business purpose”, and “commercial purpose” have the definitions set forth in Applicable Data Privacy Laws. In the event Customer becomes aware of an unauthorized use of Personal Data, it may take reasonable and appropriate steps to remediate such unauthorized use upon reasonable advance written notice to Provider. In the event such remediation prevents performance of the Services by Provider, Provider will not have any liability for such nonperformance under the Agreement.

2.4. Deidentified and Aggregated Data. Provider and its Personnel may create deidentified and/or aggregated data derived from Personal Data, provided that such deidentified and anonymized data does not identify Customer or any individual and cannot reasonably be used to infer information about, or otherwise be linked to, Customer or any individual. Upon the creation of such deidentified and/or aggregated data, such data shall no longer be Personal Data and will be owned by Provider.

2.5. Transfer of Personal Data. In the event that Provider engages any third party Personnel (i.e. subcontractors) to assist in the Processing of Personal Data for the purpose of providing the Services, Service Provider will provide Customer notice of the engagement. In the event Service Provider changes subcontractors or needs to use any additional subcontractors, Provider will provide notice to Customer. If Customer objects to such Personnel, it will notify Provider and the parties will work in good faith to resolve Customer’s concerns. Service Provider will enter into a written agreement with any subcontractors it engages for the Processing of Personal Data that imposes on the subcontractors a materially equivalent level of protection for Personal Data and confidentiality as is imposed under this DPA on Service Provider.

3.1. Compliance with Applicable Data Privacy Laws. Provider understands its obligations under Applicable Data Privacy Laws and agrees to comply with all Applicable Data Privacy Laws in performing the Services under the Agreement, including providing same level of protection to the Personal Data as required by Applicable Data Privacy Laws. Provider will notify Customer if it believes it can no longer meet its obligations under Applicable Data Privacy Laws.

3.2. Data Subject Requests. Taking into account the nature of the Processing and Services provided by Provider, and the Personal Data available to Provider, Provider will assist Customer, as reasonably requested by Customer in writing, with addressing requests from any individual to exercise data subject rights under Applicable Data Privacy Laws. Such assistance will be at Customer’s expense unless prohibited by Applicable Data Privacy Laws. Service Provider will only be required to assist with Data Subject requests when (a) Customer cannot resolve a data subject request without the help of Provider, and (b) such data subject has a right under Applicable Data Privacy Laws to exercise the requested rights. If any requests to exercise rights from data subjects are received directly by Provider, Provider will direct such individual to Customer.

3.3. Information. Given the nature of the processing of Personal Data and the Services performed in the Agreement, Provider will, as requested by Customer, promptly provide all information, perform all acts and otherwise cooperate with Customer as reasonably requested by Customer to assist Customer in complying with Customer's obligations under Applicable Data Privacy Laws, which may be at an additional cost to the extent permitted by Applicable Data Privacy Laws.

4.1. Security Program. Provider warrants it maintains commercially reasonable technical, organizational and physical measures, safeguards and policies, which are reasonably designed to help maintain the confidentiality, integrity, availability and security of Personal Data, taking into account the nature of the Processing and Personal Data available to the Provider.

4.2. Audit. Provider will promptly respond to all of Customer’s written requests for information about its data security and privacy practices, which may be at an additional cost to Customer depending on the level of effort required. In the event such responses indicate a material breach or noncompliance by Provider, Provider and its third-party Personnel will permit Customer to perform a data security audit as Customer may reasonably request, no more than once per calendar year, to verify that Provider is complying with the requirements under this Addendum and Applicable Data Privacy Laws, provided Provider reserves the right to arrange instead for a qualified and independent assessor to conduct an assessment of Provider’s safeguards and policies for compliance with this DPA and Appliable Data Privacy Laws using an appropriate and accepted control standard or framework and assessment procedure. In any event, to the extent permitted by Applicable Data Privacy Laws, any such audit will be at Customer’s cost and may not unreasonably interfere with Provider’s operations. No audit may include the confidential information of Provider or any of Provider’s other customers. In the event any such audit reveals a noncompliance with Applicable Data Privacy Laws that generates liability for Customer under Applicable Data Privacy Laws, Customer may take reasonable and appropriate steps to ensure compliance upon reasonable advance written notice to Provider.

In the event that Provider or any of its Personnel become aware of or suspect an Incident, Provider agrees to notify Customer and will reasonably assist Customer in complying with its requirements as requested in writing by Customer, taking into account the nature of the Processing and the Personal Data available to Provider.

At the termination or expiration of the Agreement, howsoever caused, Provider will delete or return all Personal Data in its possession or control, except as otherwise permitted by Applicable Data Privacy Laws to retain. Provider will not be liable to Customer for any deletion of Personal Data in accordance with this Section.

The terms of this DPA are expressly incorporated into the Agreement and made a part thereof as of the effective date of the Agreement.