Snapshot 232786
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING ADDENDUM This Data Processing Addendum (“DPA”), including its Exhibits, forms part of the Master Services Agreement (“Agreement”) entered into between the Customer specified in the Order Form (“Customer”) and iBASEt, INC. (“Provider”), for the protection of Personal Information and/or Sensitive Personal Information (defined herein) that is processed, collected, or received by Provider or made available to Provider by Customer in its provision of Services. In the event of a conflict between this DPA and the Agreement, this DPA will control. In all other respects the Agreement remains in effect as written. 1- Definitions “Business Purpose” means the Services described in the Agreement or any other purpose identified in Exhibit A. “Collects” means buying, renting, gathering, obtaining, receiving, or accessing any Personal Information pertaining to a Consumer by any means, including actively or passively, or by observing the Consumer’s behavior. “Contractor” means a person or entity to whom the Controller makes available a Consumer’s Personal Information for a Business Purpose as defined under the CCPA. “Controller” means any person or entity that, alone or jointly with others, determines the purposes and means of Processing Consumers’ Personal Information, and satisfies any threshold requirements as set forth under the applicable Privacy Laws, including that defined as a “Business” under the CCPA. “Consumer” means a natural person acting only in an individual capacity, and as further defined under applicable Privacy Laws. For GDPR-regulated Processing, “Consumer” shall mean a “Data Subject” as defined under GDPR. “GDPR” means the General Data Protection Regulation (EU) 2016/679), the U.K. General Data Protection Regulation (“UK GDPR”) (collectively, “GDPR”). “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked directly or indirectly, with a particular individual or household, including, but not limited to, the data elements listed in Section 1798.140(v)(1)(A)-(L) of the CCPA, or, if different to the above, any information defined as such in the Privacy Laws, which may also be called “Personal Data” under the GDPR and other Privacy Laws. “Privacy Laws” means all privacy laws and regulations applicable to the Processing and protection of Personal Information including, but not limited to, the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020, including any amendments and finalized regulations (collectively, “CCPA”), and the GDPR. “Process” or “Processing” means any operation or set of operations that are performed on Personal Information or on sets of Personal Information, whether or not by automated means, including the collection, use, sale, storage, disclosure, analysis, deletion, or modification of Personal Information, including the actions of a Controller directing a Processor to Process Personal Information, and operations defined as “Processing” under the GDPR. “Processor” means any person or entity that Processes Personal Information on behalf of a Controller for a Business Purpose pursuant to a written contract, including that defined as a “Service Provider” under the CCPA. “Sell” or “Sale” means the exchange of a Consumer’s Personal Information for monetary or other valuable consideration by a Controller to a Third Party, including selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, and as further defined under applicable Privacy Laws. “Sensitive Personal Information” or “Sensitive Data” shall have the meaning ascribed under applicable Privacy Laws. For GDPR-regulated Processing, this term includes “Special Categories of Personal Data” as defined in the GDPR. “Services” means the services provided by Provider under the Agreement. “Share” has the meaning ascribed under the CCPA. For Processing subject to the GDPR, this definition does not limit or modify the obligations applicable to any disclosure of Personal Information or to any Processing that constitutes profiling or targeted advertising under the GDPR. “Subcontractor” means a person or entity appointed by or on behalf of Provider to Process Personal Information on behalf of Customer in connection with the Agreement, including that defined as a “Sub-processor” under the GDPR. “Third Party” means a person, public authority, agency or body, other than the Consumer, Controller, Processor, or Contractor, or as otherwise defined in any applicable Privacy Laws. For GDPR-regulated Processing, this term shall have the meaning of “Third Party” under Article 4(10) of the GDPR. 2- Scope and Personal Information Subject to Processing 2.1. Customer is a Controller of Personal Information and Provider is a Processor Processing Customer Personal Information for the Business Purposes. To the extent Provider qualifies as a Contractor under the CCPA, Provider certifies that it understands and will comply with the restrictions in Section 3.2. Nothing herein is intended to, or will, impose on Customer and Provider any obligations beyond what is required under applicable Privacy Laws. 2.2. The categories of Personal Information and types of Data Subjects the Provider may Process to fulfill the Business Purposes under the Agreement are reflected in Exhibit A. For Processing subject to the GDPR, the Personal Information categories described in Exhibit A are non-exhaustive and shall include any “Personal Data” and “Special Categories of Personal Data” as defined under the GDPR. To the extent any of the information described in Exhibit A constitutes “Special Categories of Personal Data”, the Provider shall process such data only in accordance with requirements and restrictions set out in the GDPR. 3- Provider’s Obligations 3.1. Customer is disclosing Personal Information to Provider only for the limited and specified Business Purposes set forth in the Agreement. Provider shall not retain, use, or disclose Personal Information it obtains pursuant to the Agreement with Customer for any purpose other than the Business Purposes specified in the Agreement, or as otherwise permitted by applicable Privacy Laws, in accordance with Customer’s instructions. For Processing subject to the GDPR, Provider shall process Personal Information only on the documented instructions of Customer including with regard to transfers of Personal Information to third countries. 3.2. Provider shall not: 3.2.1. Sell or Share Personal Information it Collects pursuant to the Agreement. 3.2.2. Retain, use, or disclose Personal Information it Collected pursuant to the Agreement outside of the direct business relationship between Provider and Customer, or for any purpose, commercial or otherwise, other than for the Business Purposes, unless expressly permitted by applicable Privacy Laws. 3.2.3. Combine the Personal Information Provider receives from, or on behalf of, Customer with Personal Information Provider receives from, or on behalf of, another source or Collects from its own interaction with the Consumer, provided that Provider may combine Personal Information for any Business Purpose or as otherwise permitted by applicable Privacy Laws. For Processing subject to the GDPR, Provider shall not combine Personal Information except as expressly instructed by Customer. 3.3. Provider shall comply with all applicable Privacy Laws, including – with respect to the Personal Information Collected pursuant to the Agreement – providing the same level of privacy protection as required of Customer under the Privacy Laws. This same level of privacy protection shall include: (i) cooperating with Customer in responding to and complying with Consumer requests made pursuant to the Privacy Laws; (ii) implementing reasonable security procedures and practices appropriate to the nature of the Personal Information to protect the Personal Information from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with the Privacy Laws; and (iii) assisting Customer in completing its cybersecurity audit, risk assessment, and automated-decisionmaking technology obligations (as applicable), required under the CCPA. 3.4. Provider will make available all information necessary to demonstrate Provider’s compliance with its obligations under applicable Privacy Laws and notify Customer within a reasonable time if Provider determines it can no longer meet its obligations under applicable Privacy Laws. 3.5. Provider shall allow for and contribute to, reasonable audits, assessments and inspections by Customer or its designated assessor as permitted under applicable Privacy Laws. Customer must provide at least 60 days’ advance written notice to Provider of any audit request under this provision, which is limited to once annually during the Term (as defined in the Agreement). The audit must be conducted during Processor’s business hours or as otherwise agreed to by the parties, and, if requested by Provider, Customer’s designated assessor must execute a confidentiality agreement in advance. Customer will treat the audit report as Provider’s Confidential Information (as defined in the Agreement), and any audit report may not be used by Customer for any purpose other than for Customer to meet its obligations under applicable Privacy Laws. Provider shall provide a report of the audit to Customer upon request, which will be treated as Provider’s Confidential Information (as defined in the Agreement). 3.6. For Processing subject to the GDPR, Provider shall: 3.6.1. Assist Customer in ensuring compliance with obligations under Articles 32 to 36 of the GDPR, including assistance with security, breach notifications, data protection impact assessments, and prior consultations with supervisory authorities; 3.6.2. Notify Customer promptly if, in its opinion, an instruction infringes the GDPR or other applicable data protection law; 3.6.3. Implement technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of Processing, and the risks and rights and freedoms of Data Subjects. Provider will obtain Customer’s approval before making changes to any security measures; and 3.6.4. Process Personal Information only on documented instructions from Customer, including with respect to any transfer of Personal Information to a third country or international organization, unless otherwise required by applicable law. In such case, Provider shall inform Customer of that legal requirement before Processing, unless the law prohibits such notice. 4- Customer’s Rights and Obligations 4.1. Customer shall have the right to take reasonable and appropriate steps to ensure Provider uses the Personal Information it Collected pursuant to the Agreement with Customer in a manner consistent with Customer’s obligations under the Privacy Laws. For Processing subject to the GDPR this includes Customer’s obligations as a Controller to ensure that Processing is carried out in compliance with applicable data protection requirements. 4.2. Customer shall have the right, upon notice (including notice under Section 3.4) to take reasonable and appropriate steps to stop and remediate Provider’s unauthorized use of Personal Information. 4.3. Provider will enable Customer to comply with Consumer requests made pursuant to the Privacy Laws or Customer shall notify Provider of any request made pursuant to the Privacy Laws that Provider must comply with and provide the information necessary for Provider to comply with the request. 4.4. For Processing subject to the GDPR, references in this DPA to Consumer Requests shall be interpreted to include Data Subject requests under applicable Privacy Laws, including access, rectification, erasure, restriction, objection, portability, and requests relating to automated decision-making. Provider shall assist Customer, to the extent reasonably necessary and appropriate, in responding to such requests and shall respond directly to any Data Subject unless expressly instructed by Customer. 4.5. Customer is responsible for its compliance obligations as a Controller under applicable Privacy Laws. 5- Subcontractors 5.1. Provider may engage a Subcontractor only after providing Customer with an opportunity to object where Provider is required to do so under applicable Privacy Laws. If Provider engages any Subcontractor to assist in Processing Personal Information, that engagement shall be pursuant to a written contract binding the Subcontractor to comply with Provider’s obligations under this DPA and the Privacy Laws. 5.2. Where the Processing of Personal Information is subject to the GDPR, the requirements set forth in Section 5.1 shall not apply, and the following rules set forth in this Section 5.2 shall exclusively govern the engagement of any Sub-processor involved in such Processing. Provider shall not engage any Sub-processor to assist in Processing Personal Information without Customer’s prior specific or general written authorization. Where Customer has provided general written authorization, Provider shall inform Customer of any intended changes concerning the addition or replacement of Sub-processors, thereby giving Customer the opportunity to object. Provider shall ensure that any Sub-processor engaged to assist in Processing Personal Information is bound by a written contract imposing data protection obligations no less protective than those imposed on Provider under this DPA, including obligations relating to confidentiality, security, assistance to Customer in meeting its compliance obligations, deletion or return of Personal Information, and audit and inspection rights. 6- Confidentiality and Security 6.1. Provider shall ensure that each person Processing Personal Information is subject to a duty of confidentiality with respect to the Personal Information. 6.2. Provider shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Subcontractor who may have access to the Personal Information, ensuring in each case that access is strictly limited to those individuals who need to know and access relevant Personal Information, as strictly necessary for the purposes of this DPA and the Agreement, and to comply with Privacy Laws in the context of that individual’s duties to the Subcontractor, ensuring that all such individuals are subject to professional or statutory obligations of confidentiality. 6.3. Provider will notify Customer without undue delay after becoming aware of a personal data breach affecting Personal Information Processed on behalf of Customer (“Personal Data Breach”). Such notification shall include the information reasonably required for Customer to meet its obligations in respect of the Personal Data Breach, to the extent available to Provider. 7- International Transfers 7.1. Where the Processing involves the transfer of Personal Information from the European Economic Area, Switzerland, or the United Kingdom to a country that does not provide an adequate level of protection, the parties shall ensure that such transfer is made in compliance with applicable Privacy Laws. Provider shall not engage in any onward international transfers without Customer’s prior authorization and without ensuring an appropriate transfer mechanism is in place. 8- Term and Termination 8.1. Provider’s Processing of Personal Information as contemplated under this DPA will continue until the expiration or termination of the Agreement. 8.2. Upon expiration or termination of the Agreement, Provider shall delete or return all Customer Personal Information at Customer’s option, unless retention of Personal Information is required by law. 9- Notice 9.1. Customer will send all notices and communications under this DPA to Customer in writing to 26812 Vista Terrace, Lake Forest, CA 92630. 10- Indemnification 10.1. Any indemnification obligations by Provider under the Agreement are expressly excluded from this DPA. EXHIBIT A PERSONAL INFORMATION PROCESSING DETAILS Business Purposes Business Purposes as set forth the Agreement and any accompanying Statement of Work or Order Forms. To provide the Services and technical support to Customer. Storage and other processing necessary to provide and maintain the Services provided to Customer. Personal Information Categories Category Examples Identifiers Real Name Contact Information Postal or mailing address, email address, phone number For Processing subject to the GDPR, the categories described above are non-exhaustive. Data Subject Types Categories of data subjects may include Company’s customers or clients and employees.