[{"id":"45447a38-80a5-4904-84eb-1c0f3e0d5893","order":10,"text":"DATA PROCESSING AGREEMENT","fontSize":"20","textAlign":"center","bold":true,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"40f76701-7cf7-455d-9e94-9582c2589988","order":20,"text":"SERVICE PROVIDER AND DATA PROCESSOR TERMS","fontSize":"14","textAlign":"center","bold":false,"underline":false,"marginBottom":"30","cflou":false,"active":true},{"id":"dd330079-00eb-4a6a-bce9-f98c1ba88a81","order":30,"text":"This Data Processing Agreement (this \"DPA\") is made and entered into as of [Effective date] (the \"Effective Date\") by and between:","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"12","cflou":false,"active":true},{"id":"9c234c40-7f69-44d0-b45f-9498ffe7f63e","order":40,"text":"[Legal name of the Business], [Entity type and state of organization], with its principal place of business at [Address of the Business] (the \"Business\", also referred to as the \"Controller\"); and","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d3a4a211-1534-4a8b-96ef-0b71575631bd","order":50,"text":"[Legal name of the Service Provider], [Entity type and state of organization], with its principal place of business at [Address of the Service Provider] (the \"Service Provider\", also referred to as the \"Processor\").","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e83b1d41-af6b-4063-b694-7a272f28deb2","order":60,"text":"The Business and the Service Provider are referred to individually as a \"Party\" and together as the \"Parties\".","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"20","cflou":false,"active":true},{"id":"28bf0b6d-333b-418d-a944-0ef603d850ef","order":70,"text":"RECITALS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"10"},{"id":"2b07242b-743b-4885-aea1-ea76b9f1a48b","order":80,"text":"The Parties have entered into [Title of the underlying agreement] dated [Date of the underlying agreement] (the \"Agreement\"), under which the Service Provider performs for the Business the services described in Annex 1 (the \"Services\").","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"39f9b98f-017f-44cb-9952-e7c136bf0de8","order":90,"text":"In performing the Services, the Service Provider Processes Personal Data on behalf of, and for the benefit of, the Business. The Parties enter into this DPA in order to satisfy the contractual requirements imposed on them by the Applicable Data Protection Laws and to record the safeguards that apply to that Processing.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"865d0897-6eb7-4123-aa81-11c32762f6f9","order":100,"text":"NOW, THEREFORE, in consideration of the mutual covenants contained in this DPA and in the Agreement, and for other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the Parties agree as follows:","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f77ed965-3ff4-4d57-a4a0-f9f460f9ea9e","order":110,"text":"1. DEFINITIONS AND INTERPRETATION","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S01"},{"id":"f111c923-0674-48ab-a467-47ff517c99ad","order":120,"text":"Capitalized terms used but not otherwise defined in this DPA have the meanings given to them in the Agreement. In this DPA, the following definitions apply.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a63f7971-90bf-42d4-aee3-27a3c9f099b0","order":130,"text":"\"Applicable Data Protection Laws\" means all laws, regulations and binding regulatory guidance relating to the Processing of Personal Data that apply to a Party in connection with the Services, including the CCPA, the other United States state privacy statutes referred to in this DPA and, where applicable, European Data Protection Law.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"28ac217b-976c-40c5-86bf-5e19a2a9e0df","order":140,"text":"\"Affiliate\" means any entity that directly or indirectly controls, is controlled by, or is under common control with a Party, where control means the ownership of more than fifty percent (50%) of the voting securities or the power to direct the management of the entity.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"277244ab-a9b3-4d06-81e6-66e0a18e84f3","order":150,"text":"\"CCPA\" means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020, together with its implementing regulations at 11 CCR § 7000 et seq., as amended from time to time.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"54d52a36-a3c9-40a5-a165-121afa99b8e8","order":160,"text":"\"Business\", \"Business Purpose\", \"Consumer\", \"Contractor\", \"Personal Information\", \"Sell\" and \"Sale\", \"Share\" and \"Sharing\", \"Sensitive Personal Information\", \"Service Provider\" and \"Third Party\" have the meanings given to them in the CCPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"1190c412-2ac2-4bdc-be25-5cda269cd0a7","order":170,"text":"\"Controller\", \"Data Subject\", \"Personal Data Breach\", \"Processing\" (and \"Process\" and \"Processed\" are construed accordingly), \"Processor\", \"Special Categories of Personal Data\" and \"Supervisory Authority\" have the meanings given to them in the GDPR.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"60eb0224-c4f8-4398-bda3-8268a399d009","order":180,"text":"\"European Data Protection Law\" means Regulation (EU) 2016/679 (the \"GDPR\"); Directive 2002/58/EC as implemented in each Member State; the GDPR as incorporated into the law of the United Kingdom by the European Union (Withdrawal) Act 2018 (the \"UK GDPR\") together with the Data Protection Act 2018; and the Swiss Federal Act on Data Protection (the \"FADP\"), in each case as amended, superseded or replaced from time to time.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"7ae46f97-c01a-4a4a-b372-3517aa1af7d0","order":190,"text":"\"Personal Data\" means Personal Information and any other information relating to an identified or identifiable natural person that the Service Provider Processes on behalf of the Business in connection with the Services.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"6a6871fa-3e10-4f51-95df-827cd9ddaaf8","order":200,"text":"\"Aggregated Data\" means information that relates to a group or category of Consumers or Data Subjects, from which individual identities have been removed and which is not linked, and is not reasonably linkable, to any individual or household.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"df80850f-7643-47a4-8f35-9622cd7cf3d7","order":210,"text":"\"De-identified Data\" means information that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual or household, and that is created, maintained and used in accordance with § 1798.140(m) of the CCPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"cf9b0284-6c0b-4e87-a86a-bdf7fb057df3","order":220,"text":"\"Prohibited Data\" means protected health information subject to the Health Insurance Portability and Accountability Act of 1996; payment card data subject to the Payment Card Industry Data Security Standard; nonpublic personal information subject to the Gramm-Leach-Bliley Act; education records subject to the Family Educational Rights and Privacy Act; personal information of children under the age of thirteen (13) subject to the Children's Online Privacy Protection Act; personal information of Consumers under the age of sixteen (16) collected without the opt-in required by § 1798.120(c) of the CCPA; and any information classified by a government authority.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"66fc279e-eb02-478f-9bcb-c8a0c34ebd1e","order":230,"text":"\"Security Incident\" means a Personal Data Breach or any other breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"8e5073c8-3d7d-4982-91b3-1575bd8d339f","order":240,"text":"\"Standard Contractual Clauses\" means the standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3a979b53-01f7-4708-b23c-8055c65ddc37","order":250,"text":"\"Sub-processor\" means any third party engaged by the Service Provider to Process Personal Data on behalf of the Business, including any Affiliate of the Service Provider and any Contractor within the meaning of the CCPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e504942c-4425-4898-90d6-eaf3b31e9325","order":260,"text":"In this DPA, headings are for convenience only and do not affect interpretation; \"including\" means \"including without limitation\"; a reference to a statute includes its implementing regulations and any successor or replacement provision; the singular includes the plural and vice versa; and a reference to writing includes email.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c862da6f-abf3-4a6b-a41e-0cbf20f70a06","order":270,"text":"Where a term is defined differently under the CCPA and under European Data Protection Law, the definition given by the law that governs the Processing in question shall prevail for that Processing.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b9a2eb21-3b06-407d-85d3-0fde82cdc15a","order":280,"text":"2. SCOPE, ROLES AND ORDER OF PRECEDENCE","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S02"},{"id":"cc32713d-25ce-4169-8496-0b16f6ce46ee","order":290,"text":"This DPA forms part of, and is subject to, the Agreement. It applies to all Processing of Personal Data carried out by the Service Provider, or by any Sub-processor, on behalf of the Business in connection with the Services.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a62b56f0-8ff1-4a25-9392-17afcef5dfd3","order":300,"text":"With respect to Personal Data governed by the CCPA, the Business is a Business, or acts on behalf of a Business, and the Service Provider is a Service Provider. With respect to Personal Data governed by European Data Protection Law, the Business is the Controller, or acts on behalf of the Controller, and the Service Provider is the Processor.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f80867cc-5893-43bd-a8b6-c4240031b0f2","order":310,"text":"The Service Provider does not act as a Third Party in respect of the Personal Data and shall not be treated as a Business, a Controller or a seller of Personal Information in its own right, except to the extent expressly permitted by this DPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f2d8c804-d76b-4bb3-a8fc-cb3906a4cd63","order":320,"text":"In the event of any conflict, the following order of precedence applies: first, the Standard Contractual Clauses where they apply to the Processing in question; second, this DPA; and third, the Agreement. Nothing in this DPA is intended to restrict or waive any right of a Data Subject or Consumer under Applicable Data Protection Laws, and any provision that purports to do so is void to that extent.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a8f19aa5-3795-4c96-a9b6-843a4d8cdbc5","order":330,"text":"The Business enters into this DPA on its own behalf and, to the extent required by Applicable Data Protection Laws, on behalf of each of its Affiliates that receives the Services under the Agreement. The Business warrants that it is authorized to do so.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a7e68358-b778-48e0-b179-d006445ab939","order":340,"text":"3. OBLIGATIONS OF THE BUSINESS AND PROHIBITED DATA","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S03"},{"id":"d931c07e-9d5c-4868-85e4-e994011e8025","order":350,"text":"The Business is responsible for its own compliance with the Applicable Data Protection Laws. The Business warrants that it has collected the Personal Data lawfully, that it has given all notices and obtained all consents, authorizations and opt-ins required by those laws, and that it has a valid legal basis or lawful purpose for each Processing operation that it instructs.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"406dd0f4-3ee0-414b-80a1-48edabc51b58","order":360,"text":"The Business is responsible for the accuracy, quality, integrity and legality of the Personal Data that it submits to the Services and for the accuracy of the information stated in Annex 1, which it shall keep up to date.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"971bc92d-86e3-4ca6-b88f-eb3d5b395fb8","order":370,"text":"The Business shall issue only lawful instructions and shall not instruct the Service Provider to Process Personal Data in a manner that would cause either Party to infringe the Applicable Data Protection Laws.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a7a49df0-8df5-4b01-9f16-90c9ff90f7d8","order":380,"text":"The Business shall implement appropriate controls over the provisioning of user accounts, credentials and permissions within the Services, shall keep its authentication credentials confidential, and shall notify the Service Provider without undue delay of any known or suspected compromise of those credentials.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"41148724-008a-492b-9c10-0a3fd7a18068","order":390,"text":"The Business shall respond to requests from Consumers and Data Subjects and shall communicate to the Service Provider any instruction resulting from such a request in sufficient time to allow the Service Provider to act within the period prescribed by the Applicable Data Protection Laws.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"7b917b86-237a-4a9e-a5d3-1746d983caf0","order":400,"text":"The Business shall not submit Prohibited Data to the Services unless the Parties have executed a separate written addendum expressly permitting it, such as a business associate agreement under the Health Insurance Portability and Accountability Act of 1996. The Service Provider is not a business associate, a financial institution or a school official for the purposes of those laws, does not design the Services to receive Prohibited Data, and shall have no liability arising from Prohibited Data submitted in breach of this article.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"13fcfc81-f384-4893-9783-212cd8d4dfda","order":410,"text":"If either Party becomes aware that Prohibited Data has been submitted to the Services, it shall notify the other Party without undue delay, and the Parties shall cooperate in good faith to remove or otherwise secure that data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"79e82e1a-f24c-4263-85e3-8b25c14b76e6","order":420,"text":"4. PROCESSING INSTRUCTIONS AND PERMITTED PURPOSES","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S04"},{"id":"86ccce9d-456a-4750-afbb-516d80143a23","order":430,"text":"The Service Provider shall Process Personal Data only on and in accordance with the documented instructions of the Business, including with regard to any transfer of Personal Data to a third country or an international organization, unless required to Process otherwise by applicable law.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b6f2113f-03b1-420f-a973-7a56793ce630","order":440,"text":"The Agreement, this DPA including Annex 1, and the Business's ordinary use and configuration of the Services constitute the Business's complete and final documented instructions as at the Effective Date. Any additional or alternative instruction must be agreed by the Parties in writing and may be subject to reasonable additional charges.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c538b1fb-4ed6-4016-a2c9-03544ea83737","order":450,"text":"The Service Provider shall Process Personal Data only for the limited and specified Business Purposes set out in Annex 1 and for no other purpose. The Service Provider shall not retain, use or disclose Personal Data for any commercial purpose other than those Business Purposes, nor outside the direct business relationship between the Parties, unless expressly permitted by the CCPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b8b8346a-9569-43b9-a2ca-7ce92ba0e504","order":460,"text":"The Service Provider shall not Sell or Share Personal Data and shall not disclose Personal Data to any person other than a Sub-processor engaged in accordance with this DPA, except where compelled to do so by law and subject to the notification obligations set out in the article of this DPA entitled \"Confidentiality and Personnel\".","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e9a1e892-0ec5-4fed-8262-f749ec0dc7fd","order":470,"text":"The Service Provider shall not combine Personal Data received from, or on behalf of, the Business with Personal Information that it receives from or on behalf of any other person, or that it collects from its own interaction with a Consumer, except where expressly permitted by the CCPA and its implementing regulations.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e78bdf98-c718-46f2-bf81-bcdf12e6dbc6","order":480,"text":"The Service Provider certifies that it understands the restrictions set out in this article and in the article entitled \"California Consumer Privacy Act: Service Provider Terms\", and that it will comply with them.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b885493c-04b3-4532-a885-78cc60281e5f","order":490,"text":"The Service Provider shall inform the Business promptly if, in its opinion, an instruction of the Business infringes Applicable Data Protection Laws, and may suspend the affected Processing until the instruction is confirmed, amended or withdrawn.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"71f34e09-585b-4fdc-8898-66183f0ec6e3","order":500,"text":"Where the Service Provider is required by applicable law to Process Personal Data otherwise than in accordance with the Business's instructions, it shall inform the Business of that legal requirement before Processing, unless the law in question prohibits such information on important grounds of public interest.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"02165698-5fdf-411a-b1d5-043de50aa29d","order":510,"text":"The Personal Data includes Sensitive Personal Information and, where European Data Protection Law applies, Special Categories of Personal Data, as described in Annex 1. The Service Provider shall Process such data only for the purposes permitted by § 1798.121 of the CCPA and its implementing regulations, shall not use it to infer characteristics about a Consumer, and shall apply the enhanced safeguards described in Annex 2.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"52f00f84-f11c-4f97-9fa8-3640e0d4a39b","value":"included","type":"add","operator":"="}]},{"id":"59bba882-beea-48ae-8f54-163b5f7837b4","order":520,"text":"The Parties do not anticipate that Sensitive Personal Information or Special Categories of Personal Data will be Processed in connection with the Services. The Business shall not submit such data to the Services without the prior written consent of the Service Provider, and the Service Provider shall not be required to apply the enhanced safeguards applicable to such data until that consent is given.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"52f00f84-f11c-4f97-9fa8-3640e0d4a39b","value":"excluded","type":"add","operator":"="}]},{"id":"85cb0dac-1c56-4ffa-b659-b4eee8c66e55","order":530,"text":"5. CALIFORNIA CONSUMER PRIVACY ACT: SERVICE PROVIDER TERMS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S05"},{"id":"7160b17a-c4b4-40b7-a2c6-aee1b6da89a3","order":540,"text":"This article applies to Personal Information governed by the CCPA. It is intended to satisfy the contractual requirements of Cal. Civ. Code § 1798.100(d) and of 11 CCR § 7051, and shall be interpreted so as to give effect to those requirements.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"9d4c4c10-af6c-491a-a254-be3a8036bf91","order":550,"text":"The Business discloses Personal Information to the Service Provider solely for the limited and specified Business Purposes described in Annex 1. The Service Provider shall Process that Personal Information only in order to perform those Business Purposes on behalf of the Business, or as otherwise expressly permitted by the CCPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"4973ab8d-3416-4143-9b8d-afb3c071595c","order":560,"text":"The Service Provider shall comply with all obligations applicable to it as a Service Provider under the CCPA and shall provide the same level of privacy protection to Personal Information as the CCPA requires of the Business.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"23dcbbed-e4ea-42bc-9ed2-bdb8d285fc46","order":570,"text":"The Business has the right to take reasonable and appropriate steps to ensure that the Service Provider Processes Personal Information in a manner consistent with the Business's obligations under the CCPA, and to stop and remediate any unauthorized Processing of Personal Information. Such steps may include ongoing manual reviews, automated scans, regular assessments, audits, and other technical and operational testing at least once every twelve (12) months.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a8331214-8d8b-49db-a1b6-0d5d405e519b","order":580,"text":"The Service Provider shall notify the Business promptly, and in any event within five (5) business days, if it determines that it can no longer meet its obligations under the CCPA. Following that notice, the Business may take the steps described in the preceding paragraph and may suspend or terminate the affected Services.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"28773feb-25b1-4016-ac8f-cb6b1e1ba914","order":590,"text":"The Service Provider shall cooperate with the Business in responding to any request from a Consumer to know, delete, correct, opt out of the Sale or Sharing of Personal Information, limit the use of Sensitive Personal Information, or exercise any other right conferred by the CCPA, and shall implement any resulting instruction of the Business, and cause each Sub-processor to do so, without undue delay.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"4b04ae5d-cec3-4c4e-89f0-b5e45fdfa80d","order":600,"text":"To the extent that the Service Provider acts as a Contractor rather than as a Service Provider within the meaning of the CCPA, it certifies that it understands the restrictions set out in § 1798.140(j)(1) of the CCPA and that it will comply with them, and every provision of this DPA expressed to apply to the Service Provider applies to it in that capacity.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e69cc888-6174-4067-a6be-9b1688116b2c","order":610,"text":"Neither Party shall be liable for a violation of the CCPA by the other Party, provided that the Party seeking to rely on this paragraph did not, at the time of the disclosure of the Personal Information, have reason to believe that the other Party intended to commit such a violation.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"334d17bf-0fc9-4e57-a41a-5cabc00e9933","order":620,"text":"The Services involve automated decision-making technology that is used, or is capable of being used, to make or substantially to facilitate a significant decision concerning a Consumer. The Service Provider shall provide the Business with all facts necessary to enable the Business to conduct and document a risk assessment, and shall cooperate with the Business's pre-use notice, opt-out, appeal and access obligations under the CCPA regulations governing automated decision-making technology, including by implementing any opt-out communicated by the Business without undue delay.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"ac1e0f76-b1e1-4def-86a9-dbf9941fa0be","value":"admt_yes","type":"add","operator":"="}]},{"id":"ed922400-623b-44dd-ac00-6d8d70dd6264","order":630,"text":"The Services do not involve the use of automated decision-making technology to make, or substantially to facilitate, a significant decision concerning a Consumer. The Service Provider shall not introduce such technology into the Services without the prior written consent of the Business and the execution of any amendment to this DPA that the Business reasonably requires.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"ac1e0f76-b1e1-4def-86a9-dbf9941fa0be","value":"admt_no","type":"add","operator":"="}]},{"id":"7f3f4c0a-3da0-470e-aa76-734dd9f96909","order":640,"text":"6. DE-IDENTIFIED DATA, AGGREGATED DATA AND SERVICE IMPROVEMENT","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S06"},{"id":"13427fd0-a4e7-473c-afc5-ff1d4cee797e","order":650,"text":"The Service Provider may create De-identified Data and Aggregated Data from Personal Data. Information that has been de-identified or aggregated in accordance with this article is not Personal Data for the purposes of this DPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3e816c0a-6c1a-4577-97d2-adf16c22ae08","order":660,"text":"Where the Service Provider creates or uses De-identified Data, it shall take reasonable measures to ensure that the information cannot be associated with a Consumer, a Data Subject or a household; shall publicly commit to maintain and use the information in de-identified form and not to attempt to reidentify it, save as the CCPA permits in order to test whether the de-identification is effective; and shall contractually obligate any recipient of the information to comply with the same requirements.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"ad755b57-8c38-43ad-9f9a-149369a8b5f0","order":670,"text":"The Service Provider may use De-identified Data and Aggregated Data for its internal business purposes, including operating, securing, benchmarking, troubleshooting and improving the Services, provided that it shall not disclose that data in any manner that identifies the Business, a Consumer or a Data Subject, and shall not Sell it.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d5b185dd-e68c-4158-a5a1-3ff52e0611c6","order":680,"text":"The Service Provider shall not use Personal Data, De-identified Data or Aggregated Data to develop, train, fine-tune, evaluate or improve any machine learning or artificial intelligence model, whether its own or that of a third party, without the prior written consent of the Business.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"e2a4849a-b335-48d0-a345-217cc3ba807f","value":"prohibited","type":"add","operator":"="}]},{"id":"5a518867-c210-4330-a7b8-d500acac20a7","order":690,"text":"The Service Provider shall not use Personal Data to develop, train, fine-tune, evaluate or improve any machine learning or artificial intelligence model. The Service Provider may use De-identified Data and Aggregated Data for those purposes, provided that the resulting model neither memorises nor reproduces nor otherwise exposes Personal Data, that no output is attributable to the Business or to any individual, and that the Business may withdraw this permission on thirty (30) days' written notice.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"e2a4849a-b335-48d0-a345-217cc3ba807f","value":"deidentified","type":"add","operator":"="}]},{"id":"d9f8a308-d8c7-4731-bcf0-58be2730f629","order":700,"text":"Nothing in this article authorizes the Service Provider to retain, use or disclose Personal Data in identifiable form outside the direct business relationship between the Parties, or otherwise than as permitted by the article of this DPA entitled \"Processing Instructions and Permitted Purposes\".","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"4b8064fe-df55-4a59-aa9b-77f5b898ed38","order":710,"text":"7. OTHER UNITED STATES STATE PRIVACY LAWS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S07","displayConditions":[{"field":"63700165-324c-467c-996f-771c4c85f65e","value":"included","type":"add","operator":"="}]},{"id":"96338a17-8ed5-480f-9700-ac4880b1e795","order":720,"text":"This article applies where the Business is subject to a comprehensive state privacy statute other than the CCPA, including the Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.), the Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.), the Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.), the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, and any comparable statute of another state.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"63700165-324c-467c-996f-771c4c85f65e","value":"included","type":"add","operator":"="}]},{"id":"0f46d00f-cbc6-4a7b-9647-06c190925168","order":730,"text":"With respect to Personal Data governed by those statutes, the Business is the controller and the Service Provider is the processor. The Service Provider shall Process Personal Data only on the documented instructions of the Business and only for the duration, nature and purposes, and in respect of the types of Personal Data and categories of data subjects, described in Annex 1.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"63700165-324c-467c-996f-771c4c85f65e","value":"included","type":"add","operator":"="}]},{"id":"1454b989-0485-4d70-be77-5f7c85bfb84c","order":740,"text":"The Service Provider shall ensure that each person Processing Personal Data is subject to a duty of confidentiality; shall, at the direction of the Business, delete or return all Personal Data at the end of the provision of the Services; shall make available to the Business all information in its possession that is reasonably necessary to demonstrate compliance with its obligations; and shall engage each Sub-processor under a written contract imposing obligations equivalent to those set out in this DPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"63700165-324c-467c-996f-771c4c85f65e","value":"included","type":"add","operator":"="}]},{"id":"52dd3e35-c6fb-4bb7-bc2e-62f33d096b09","order":750,"text":"The Service Provider shall allow and cooperate with reasonable assessments by the Business or, at the Business's election, shall arrange for a qualified and independent assessor to assess the Service Provider's policies and technical and organizational measures using an appropriate and accepted control standard or framework and assessment procedure, and shall provide a report of that assessment to the Business on request.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"63700165-324c-467c-996f-771c4c85f65e","value":"included","type":"add","operator":"="}]},{"id":"26774fe7-281d-4bfd-a866-3827d2bcab71","order":760,"text":"The Service Provider shall assist the Business in meeting its obligations in relation to the security of Processing, the notification of breaches of security, responses to consumer rights requests, and the conduct and documentation of data protection assessments, in each case taking into account the nature of the Processing and the information available to the Service Provider.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"63700165-324c-467c-996f-771c4c85f65e","value":"included","type":"add","operator":"="}]},{"id":"1ac63360-27b6-4de6-b209-21feadba2b25","order":770,"text":"8. PROCESSOR OBLIGATIONS UNDER EUROPEAN DATA PROTECTION LAW","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S08","displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"55ebf042-a0cc-4f85-8e9e-77a363e537e4","order":780,"text":"This article applies to Personal Data subject to European Data Protection Law and is intended to satisfy Article 28 of the GDPR and the corresponding provisions of the UK GDPR and of the FADP.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"afd70af3-cccf-4d18-b1c8-eb1e109cca5d","order":790,"text":"The Service Provider shall Process Personal Data only on documented instructions from the Controller; ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; take all measures required by Article 32 of the GDPR; respect the conditions for engaging another Processor set out in the article of this DPA entitled \"Sub-processors\"; and, taking into account the nature of the Processing, assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilllment of the Controller's obligation to respond to requests for exercising the rights of Data Subjects.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"3e3713f3-0da7-44e6-8692-19cc0d9a7d99","order":800,"text":"The Service Provider shall assist the Controller in ensuring compliance with the obligations set out in Articles 32 to 36 of the GDPR, taking into account the nature of the Processing and the information available to the Service Provider.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"f6826ff8-01fb-423e-8bd4-766b8eebd6a1","order":810,"text":"At the choice of the Controller, the Service Provider shall delete or return all Personal Data after the end of the provision of the Services, and shall delete existing copies unless European Data Protection Law requires storage of the Personal Data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"6de97f03-b0d4-4188-a132-f69dcb5bb018","order":820,"text":"The Service Provider shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and shall allow for and contribute to audits, including inspections, conducted by the Controller or by another auditor mandated by the Controller, in accordance with the article of this DPA entitled \"Audits and Demonstration of Compliance\".","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"c94ce14a-d7d0-4702-8d6a-505a91e0f630","order":830,"text":"The Service Provider shall maintain a record of all categories of Processing activities carried out on behalf of the Controller in accordance with Article 30(2) of the GDPR and shall make that record available to the Controller and, on request, to the competent Supervisory Authority.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"ca721e5c-4ed3-45e2-a682-7903f2cca91f","order":840,"text":"Where the Service Provider is subject to European Data Protection Law and has no establishment in the European Economic Area or in the United Kingdom, it shall designate a representative in accordance with Article 27 of the GDPR and shall notify the Controller of that designation.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"99bb9c9e-63e4-455d-848a-e1ddbc769a23","order":850,"text":"The competent Supervisory Authority for the Processing is [Competent supervisory authority]. The data protection contact of the Service Provider is [Data protection contact].","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"a0f5b29f-90bb-4574-b7dd-c9e62dc1f5d7","order":860,"text":"9. CONFIDENTIALITY AND PERSONNEL","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S09"},{"id":"5242a6c2-439d-4cd4-9a83-6b4091197cfb","order":870,"text":"The Service Provider shall treat Personal Data as the confidential information of the Business and shall not disclose it except as expressly permitted by this DPA or required by law.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"735ce44a-b290-40a6-b04e-6484a1540035","order":880,"text":"The Service Provider shall ensure that access to Personal Data is limited to those of its personnel who require access in order to perform the Services, and that each such person is bound by a written obligation of confidentiality that survives the end of their engagement.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"71c9931a-96b1-4112-abf3-771a6a19e338","order":890,"text":"The Service Provider shall provide appropriate and regular training on data protection and information security to all personnel with access to Personal Data, and shall maintain and enforce a disciplinary process for breaches of its data protection and security policies.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"cd0a5151-fb62-4d64-a396-08b8c7a23026","order":900,"text":"The Service Provider shall carry out background screening of personnel with access to Personal Data to the extent permitted by applicable law, and shall revoke access promptly upon a change of role or the termination of an engagement.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"6e6f2114-0a5a-44dc-a4e2-f321c34d69f7","order":910,"text":"If the Service Provider receives a subpoena, warrant, court order or other demand from a law enforcement authority or other public authority for the disclosure of Personal Data, it shall, unless legally prohibited from doing so, notify the Business without undue delay, give the Business a reasonable opportunity to seek protective relief, disclose only the minimum amount of Personal Data legally required, and challenge any demand that is manifestly unlawful.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a9ad2a3f-611f-4afe-8b82-7d255f91ce2f","order":920,"text":"10. INFORMATION SECURITY","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S10"},{"id":"1c3911ce-2c99-42e4-ab0e-a53dd992ed61","order":930,"text":"Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing, and the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Service Provider shall implement and maintain the technical and organizational measures described in Annex 2.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d7b9774e-3c5c-4543-b801-561a9e307b0b","order":940,"text":"The Service Provider maintains, and shall maintain throughout the term of this DPA, an information security program aligned to the SOC 2 Trust Services Criteria, and shall make available to the Business on request its most recent audit report, certification or attestation relating to that program.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"6f5ca54e-71fd-4c0f-9405-755e4ff3925c","order":950,"text":"Those measures shall include, at a minimum, the pseudonymization and encryption of Personal Data where appropriate; the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services; the ability to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident; and a process for regularly testing, assessing and evaluating the effectiveness of those measures.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"480986f5-68cc-4d4d-81c3-358823852421","order":960,"text":"The Service Provider shall not materially decrease the overall security of the Services during the term of this DPA. Where the Service Provider updates its technical and organizational measures, the updated measures shall afford a level of protection no less protective than that described in Annex 2.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"8d7b8549-5ef8-4a8e-b8e3-fe1a94abf42d","order":970,"text":"The Service Provider shall maintain written information security policies, review them at least annually, and designate an individual accountable for information security who shall act as the point of contact for the Business on security matters.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"280d0d1b-5c67-4ce1-89a9-12e224992713","order":980,"text":"11. SUB-PROCESSORS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S11"},{"id":"cc58a9cb-85e0-4431-a3a6-3570c9a69b4c","order":990,"text":"The Service Provider shall not engage any Sub-processor to Process Personal Data except in accordance with this article.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e6937ba3-0b19-437b-a9ec-80f35a03ccf1","order":1000,"text":"The Business grants the Service Provider general written authorization to engage the Sub-processors listed in Annex 3. The Service Provider shall give the Business at least [Notice period] days' prior written notice of the intended addition or replacement of any Sub-processor. The Business may object on reasonable data protection grounds within that period, in which case the Parties shall discuss the objection in good faith; if no resolution is reached, the Business may terminate the affected Services without penalty and shall receive a pro rata refund of any fees prepaid in respect of the terminated Services.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"6165d27c-fecd-4f53-9460-68ed98b2a3f2","value":"general","type":"add","operator":"="}]},{"id":"9dd8a8fe-16ff-4a29-8040-2a170d03557a","order":1010,"text":"The Service Provider shall not engage any Sub-processor other than those listed in Annex 3 without the prior specific written authorization of the Business. A request for authorization shall identify the proposed Sub-processor, the Processing to be sub-contracted, the locations in which Processing will take place and the safeguards that will apply. Annex 3 shall be updated to record each authorization granted.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"6165d27c-fecd-4f53-9460-68ed98b2a3f2","value":"specific","type":"add","operator":"="}]},{"id":"cb48a828-c95b-4668-b727-071df434319a","order":1020,"text":"The Service Provider shall impose on each Sub-processor, by way of a written contract, data protection obligations that are no less protective than those set out in this DPA, including the obligations relating to security, confidentiality, assistance, breach notification, international transfers, audit and the return or deletion of Personal Data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"0209b649-4bfc-450a-a602-f6f0d979fde4","order":1030,"text":"The Service Provider remains fully liable to the Business for the acts and omissions of each Sub-processor as if they were its own acts and omissions.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"9187b4cf-69c4-4b64-b3b4-e0919144d14e","order":1040,"text":"The Service Provider shall make available to the Business, on request, a current list of Sub-processors stating their names, the locations in which they Process Personal Data and the Processing activities entrusted to them.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b89b6862-b419-4c4a-85de-b337700fd6d1","order":1050,"text":"12. ASSISTANCE WITH INDIVIDUAL RIGHTS REQUESTS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S12"},{"id":"99bcf56f-51ac-424f-908d-371216841456","order":1060,"text":"Taking into account the nature of the Processing, the Service Provider shall provide reasonable assistance to the Business, by appropriate technical and organizational measures and insofar as this is possible, to enable the Business to respond to requests from Consumers and Data Subjects seeking to exercise their rights under Applicable Data Protection Laws, including rights of access, correction, deletion, portability, objection, restriction of Processing, opt-out of the Sale or Sharing of Personal Information, and limitation of the use of Sensitive Personal Information.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"597eb136-f192-4f88-849a-c66bbacdcaf1","order":1070,"text":"If the Service Provider receives such a request directly from a Consumer or Data Subject, it shall not respond to the request other than to acknowledge receipt and to direct the individual to the Business, and shall forward the request to the Business without undue delay and in any event within five (5) business days.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c9d176c4-817d-44da-8144-022e9753c3f2","order":1080,"text":"The Service Provider shall implement, and shall cause each Sub-processor to implement, any deletion, correction, restriction or opt-out instruction communicated by the Business without undue delay and in any event within the period required by Applicable Data Protection Laws.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"080b51b0-e9b0-4473-9265-eae39ee85fb4","order":1090,"text":"Where the Service Provider makes functionality available within the Services enabling the Business to retrieve, correct, restrict, export or delete Personal Data itself, the Business's use of that functionality shall be deemed to satisfy the Service Provider's assistance obligation in respect of the corresponding right.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"443da225-2a35-4dfa-8bcc-91e690dea662","order":1100,"text":"13. SECURITY INCIDENTS AND BREACH NOTIFICATION","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S13"},{"id":"64dc581f-1209-4cea-912a-a73bebb994f4","order":1110,"text":"The Service Provider shall notify the Business of any Security Incident affecting Personal Data without undue delay and in any event within [Number] hours after becoming aware of it. Notice shall be given to the addresses set out in the article of this DPA entitled \"Notices\".","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"32716045-977b-4a95-80fd-5564cf8929b0","order":1120,"text":"The notification shall describe, to the extent known at the time and shall be supplemented as further information becomes available, the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address the incident and to mitigate its adverse effects, and the name and contact details of a point of contact from whom further information may be obtained.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"7f9032a3-6120-459d-afa5-778c89d3c497","order":1130,"text":"The Service Provider shall promptly take all reasonable steps to contain, investigate and remediate the Security Incident, shall preserve all relevant evidence and logs, and shall provide the Business with all cooperation and information reasonably required to enable the Business to meet its own notification obligations to regulators, Consumers and Data Subjects.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"2d1a8747-0c96-463f-a8ef-f7d0cc312b29","order":1140,"text":"Within thirty (30) days after the closure of a Security Incident, the Service Provider shall provide the Business with a written report stating the root cause of the incident, the remediation carried out and the measures adopted to prevent a recurrence.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"6e5243f9-1e61-416e-ad91-0bb964822b00","order":1150,"text":"The Service Provider shall not make any public statement, regulatory notification or notification to affected individuals concerning a Security Incident that identifies the Business without the Business's prior written consent, unless and to the extent required by applicable law.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"1d55dcf5-bf98-4bf8-80ae-b508028f2857","order":1160,"text":"The Service Provider shall bear its own costs of investigating and remediating a Security Incident and shall reimburse the reasonable costs incurred by the Business in providing notifications and credit monitoring where the Security Incident results from a breach by the Service Provider or any Sub-processor of this DPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e840441b-1df7-4ad1-acd7-9398c06f3c30","order":1170,"text":"14. DATA PROTECTION ASSESSMENTS AND REGULATOR ENGAGEMENT","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S14"},{"id":"8b49e064-27f5-42a4-b80b-dea959ba5b47","order":1180,"text":"The Service Provider shall provide the Business with all information in its possession that is reasonably necessary to enable the Business to carry out and document any data protection impact assessment, risk assessment or cybersecurity audit required of the Business by Applicable Data Protection Laws in respect of the Services.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e8a9b656-ca97-413a-ac34-081b40fbf8e8","order":1190,"text":"Where required by European Data Protection Law, the Service Provider shall assist the Business with any prior consultation of a Supervisory Authority.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"988709a7-f918-49b6-9bf3-ac7d11efe0ce","order":1200,"text":"The Service Provider shall notify the Business without undue delay of any complaint, inquiry, investigation, audit or enforcement action by a Supervisory Authority, the California Privacy Protection Agency, the Attorney General of any state or any other regulator that relates to the Processing of Personal Data under the Agreement, and shall not respond substantively without first consulting the Business, unless legally required to do so.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e150ad56-1d07-4100-9687-7b1bee24b333","order":1210,"text":"Each Party shall cooperate with the other, at the reasonable request and cost of the requesting Party, in responding to any such regulatory matter and in the defense of any claim brought by a Consumer or Data Subject.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"09dfdd02-eadc-4732-99bd-640f6de351ef","order":1220,"text":"15. AUDITS AND DEMONSTRATION OF COMPLIANCE","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S15"},{"id":"d159ff85-dbae-443a-a216-d39ea764632f","order":1230,"text":"The Service Provider shall make available to the Business all information reasonably necessary to demonstrate compliance with this DPA and with Applicable Data Protection Laws.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e8bf9c63-8c19-42cd-8838-71666beda0be","order":1240,"text":"The Business may, on at least [Number] days' prior written notice, audit the Service Provider's compliance with this DPA, including by conducting an inspection of the premises and systems used to Process Personal Data. Audits shall take place during normal business hours, shall not unreasonably interfere with the Service Provider's operations, and shall be limited to once in any twelve (12) month period, except where an audit is required by a regulator or follows a Security Incident, in which case no such limit applies.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"48672614-28c9-4eea-b3f3-371079d114f5","order":1250,"text":"The Business may appoint an independent third-party auditor to conduct an audit on its behalf, provided that the auditor is not a competitor of the Service Provider and executes a reasonable confidentiality undertaking in favor of the Service Provider.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"dec7c1c3-c3e0-43b3-9ab7-0ad43392b4a0","order":1260,"text":"The Service Provider may satisfy an audit request by providing a current third-party audit report, certification or attestation covering the Services, provided that it addresses the scope of the Business's request and was issued within the preceding twelve (12) months.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"482bad00-8b72-4e3e-a16d-febc428604e7","order":1270,"text":"Each Party shall bear its own costs of an audit, save that the Business shall reimburse the Service Provider's reasonable costs where the audit reveals no material non-compliance, and the Service Provider shall bear the costs of remediation and of any re-audit where material non-compliance is identified.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"1766d78c-840a-4f76-8606-1ab6cf2563ed","order":1280,"text":"16. DATA LOCATIONS AND RESIDENCY","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S16"},{"id":"6e753a47-824f-4d0c-b078-7b8315c24c95","order":1290,"text":"The Service Provider shall Process Personal Data, and shall permit each Sub-processor to Process Personal Data, only in [Permitted countries of processing].","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"fbb950ef-29a4-42fe-aa7a-bda7cdc7a5cc","order":1300,"text":"Remote access to Personal Data from a country other than a permitted country constitutes a transfer for the purposes of this DPA and is subject to the same safeguards, including where the access is made for support, maintenance or administration purposes.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"63bc3cc3-3b11-4bb8-b2ae-59043636c665","order":1310,"text":"The Service Provider shall give the Business prior written notice of any intended change to the countries in which Personal Data is Processed. The Business may object on reasonable data protection grounds, in which case the Parties shall follow the procedure set out in the article of this DPA entitled \"Sub-processors\".","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"34900266-c8cb-4a8e-90cf-fe5095128309","order":1320,"text":"The Service Provider shall maintain an accurate record of the locations in which Personal Data is Processed, including by each Sub-processor, and shall make that record available to the Business on request.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"52f29523-80d2-4215-9c7a-6a447b459813","order":1330,"text":"17. INTERNATIONAL DATA TRANSFERS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S17","displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"5f1d0c95-78b7-4a51-9f33-1be6a3917bcd","order":1340,"text":"This article applies to transfers of Personal Data subject to European Data Protection Law from the European Economic Area to the United States or to any other country in respect of which no adequacy decision applies.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"2daed23c-00ff-4989-9a2c-9706f87ea85c","order":1350,"text":"The Service Provider is certified under, and shall maintain its certification to, the EU-U.S. Data Privacy Framework and, as applicable, its UK Extension and the Swiss-U.S. Data Privacy Framework administered by the U.S. Department of Commerce, and shall Process Personal Data in accordance with the Data Privacy Framework Principles. If that certification lapses, or if the relevant adequacy decision is suspended, annulled or repealed, the Standard Contractual Clauses shall apply automatically to the affected transfers without further action by the Parties.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"058d1f68-5089-40f6-89b7-6c137b98b452","value":"dpf","type":"add","operator":"="},{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"us_only","type":"remove","operator":"="}]},{"id":"a64f9a24-bd25-4062-9f9f-636bfeaa4441","order":1360,"text":"The Parties rely on the Standard Contractual Clauses for transfers of Personal Data subject to European Data Protection Law. The Service Provider does not rely on any adequacy decision in respect of such transfers.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"058d1f68-5089-40f6-89b7-6c137b98b452","value":"scc","type":"add","operator":"="},{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"us_only","type":"remove","operator":"="}]},{"id":"35877d6e-21c7-4ceb-8b01-118f424e1333","order":1370,"text":"The Standard Contractual Clauses are incorporated into this DPA by reference and are deemed executed by the Parties, with Module Two (controller to processor) applying. For their purposes: the Business is the data exporter and the Service Provider is the data importer; the optional docking clause at Clause 7 applies; the optional redress provision at Clause 11(a) does not apply; the governing law and the forum are those of the Member State in which the competent Supervisory Authority identified in Annex 1 is established; and Annexes 1, 2 and 3 to this DPA populate Annexes I, II and III to the Standard Contractual Clauses respectively.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"69feefc5-4e31-4da3-b556-2a98053d1e94","order":1380,"text":"Clause 9 of the Standard Contractual Clauses applies with Option 2, general written authorization, and the time period for prior notice of Sub-processor changes is the period specified in the article of this DPA entitled \"Sub-processors\".","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"6165d27c-fecd-4f53-9460-68ed98b2a3f2","value":"general","type":"add","operator":"="},{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"us_only","type":"remove","operator":"="}]},{"id":"dcf29473-c2c6-40a7-a388-05dac073ffbf","order":1390,"text":"Clause 9 of the Standard Contractual Clauses applies with Option 1, specific prior authorization, and the Service Provider shall not engage a Sub-processor without the prior specific written authorization of the data exporter.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"6165d27c-fecd-4f53-9460-68ed98b2a3f2","value":"specific","type":"add","operator":"="},{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"us_only","type":"remove","operator":"="}]},{"id":"7972c9a0-e9f0-46fc-9982-a1baad9b1012","order":1400,"text":"For transfers of Personal Data subject to the UK GDPR, the Standard Contractual Clauses are supplemented by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018 (the \"UK Addendum\"), which is incorporated by reference. Table 1 is completed by the details of the Parties set out in this DPA and in Annex 1; Tables 2 and 3 by the Standard Contractual Clauses and by Annexes 1, 2 and 3; and, in Table 4, neither Party may end the UK Addendum when the approved addendum changes.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"e1968855-0d92-4b41-bdf9-b97bbe3b35e9","value":"the European Economic Area and the United Kingdom","type":"add","operator":"="},{"field":"e1968855-0d92-4b41-bdf9-b97bbe3b35e9","value":"the European Economic Area, the United Kingdom and Switzerland","type":"add","operator":"="},{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"us_only","type":"remove","operator":"="}]},{"id":"60a681f2-bcb0-458f-8610-9e83dd680ff2","order":1410,"text":"For transfers of Personal Data subject to the FADP, the Standard Contractual Clauses apply with the amendments recognized by the Swiss Federal Data Protection and Information Commissioner, including that references to the GDPR are to be understood as references to the FADP, that the term \"Member State\" shall not be interpreted so as to prevent data subjects in Switzerland from enforcing their rights in their place of habitual residence, and that the competent supervisory authority is the Federal Data Protection and Information Commissioner.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"e1968855-0d92-4b41-bdf9-b97bbe3b35e9","value":"the European Economic Area, the United Kingdom and Switzerland","type":"add","operator":"="},{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"us_only","type":"remove","operator":"="}]},{"id":"9989b8cd-eae2-48ea-a5e5-6ce3484a5442","order":1420,"text":"Before transferring Personal Data, and periodically thereafter, the Service Provider shall assess whether the laws and practices of the destination country prevent it from fulfillling its obligations, shall document that assessment, and shall make it available to the Business on request. The Service Provider shall notify the Business without undue delay if it becomes unable to comply, in which case the Business may suspend the transfer or terminate the affected Services.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"b117661c-a742-45a7-997c-5cf0097367cd","order":1430,"text":"The Service Provider shall implement supplementary technical, organizational and contractual measures where necessary to ensure a level of protection of Personal Data essentially equivalent to that guaranteed within the European Economic Area, and shall challenge any request for disclosure received from a public authority that is unlawful under applicable law.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"c5d58a56-dc1a-45b6-adb7-12cab83f3fb0","order":1440,"text":"18. RETURN AND DELETION OF PERSONAL DATA","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S18"},{"id":"fe1024b5-98d5-498c-8663-dd8cc563fca0","order":1450,"text":"Following the expiry or termination of the Agreement, or earlier upon the written instruction of the Business, the Service Provider shall cease all Processing of Personal Data other than storage pending its return or deletion.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e5b7be2f-4d8e-41ff-98aa-29c511fc92ee","order":1460,"text":"At the choice of the Business, the Service Provider shall either return all Personal Data to the Business in a commonly used, machine-readable format and thereafter delete all existing copies, or delete all Personal Data. The Business shall notify the Service Provider of its choice within [Number] days after the expiry or termination of the Agreement; failing such notice, the Service Provider shall delete the Personal Data.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"30f7b2bb-f2a3-4204-add0-57e6d7d0cb01","value":"return_delete","type":"add","operator":"="}]},{"id":"6b394a16-27d2-4302-8182-e1ee31f23da9","order":1470,"text":"The Service Provider shall delete all Personal Data, and all existing copies of it, within [Number] days after the expiry or termination of the Agreement and shall not be obliged to return it. The Business is responsible for exporting, before that period expires, any Personal Data that it wishes to retain.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"30f7b2bb-f2a3-4204-add0-57e6d7d0cb01","value":"delete_only","type":"add","operator":"="}]},{"id":"b124b5f6-f4a9-4cc0-8152-a9813268cce6","order":1480,"text":"The retention period stated in Annex 1 governs the Processing during the term of the Agreement. On the expiry or termination of the Agreement, the period stated in this article governs the return or deletion of the Personal Data and prevails over any longer retention period stated in Annex 1.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b52456c8-8690-4160-b7a6-2c5bf2168154","order":1490,"text":"The Service Provider may retain Personal Data to the extent, and for so long as, required by applicable law, provided that it maintains the confidentiality of that Personal Data, does not Process it for any purpose other than the purpose for which retention is required, and deletes it as soon as the retention requirement ceases to apply.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3ee99803-81d3-4cd5-9a44-1299a5d90ad0","order":1500,"text":"Personal Data contained in routine back-ups shall be deleted in accordance with the Service Provider's documented back-up rotation schedule and shall be protected against any further Processing in the meantime.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"571e7fb5-555f-4091-844e-ffa00eeb61ec","order":1510,"text":"The Service Provider shall procure that each Sub-processor complies with equivalent obligations and shall certify to the Business in writing, on request, that all Personal Data has been returned or deleted in accordance with this article.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"4dd1b3ae-211d-4db4-a98d-7f29645c7648","order":1520,"text":"19. TERM, SUSPENSION AND TERMINATION","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S19"},{"id":"4108a36b-e025-454f-bf8b-e991fa3ead10","order":1530,"text":"This DPA takes effect on the Effective Date and continues until the later of the expiry or termination of the Agreement and the date on which the Service Provider ceases to Process Personal Data on behalf of the Business.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"0fc8b13e-e96a-4379-8e73-3fb291a4a68f","order":1540,"text":"The Business may instruct the Service Provider to suspend the Processing of Personal Data, in whole or in part, where it reasonably believes that the Processing infringes Applicable Data Protection Laws or that a Security Incident has occurred, and the Service Provider shall comply with that instruction without undue delay.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"04bcbf7d-6b00-4b09-9b05-9bdc12779bea","order":1550,"text":"The Business may terminate the Agreement, or the affected part of the Services, with immediate effect and without penalty where the Service Provider is in material breach of this DPA and has failed to cure that breach within thirty (30) days of written notice, or where the breach is incapable of cure.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"cf642e21-8d74-4983-a266-aa5a944c2c40","order":1560,"text":"Those provisions of this DPA that by their nature should survive termination, including those relating to confidentiality, return and deletion, audit, liability, indemnification and governing law, survive the termination or expiry of this DPA and of the Agreement.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d3efa058-5f92-4475-bbef-eb022b2b9518","order":1570,"text":"20. REPRESENTATIONS AND WARRANTIES","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S20"},{"id":"a17d363f-f82c-4eae-ae6d-cebb8b8ca546","order":1580,"text":"Each Party represents and warrants that it has full power and authority to enter into this DPA and that the execution and performance of this DPA do not conflict with any other obligation binding upon it.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"a520ff2b-283e-4869-a9da-3d5a37c1a10c","order":1590,"text":"The Service Provider represents and warrants that it will comply with the Applicable Data Protection Laws applicable to it; that it has implemented the technical and organizational measures described in Annex 2; that it has engaged no Sub-processor other than those disclosed in Annex 3; and that no claim, investigation or enforcement action is pending or, to its knowledge, threatened against it that would materially impair its ability to perform this DPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c28b50bc-e7d8-4dcc-bc65-e6dc29f8014a","order":1600,"text":"The Service Provider represents and warrants that no member of its personnel with access to Personal Data is subject to any obligation, whether under a foreign law or otherwise, that would prevent compliance with this DPA, and that it has disclosed to the Business every legal requirement to which it is subject that would prevent such compliance.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"1bcb2ca9-87c8-42fb-8363-b538bee4813d","order":1610,"text":"The representations and warranties set out in this article are given on the Effective Date and are deemed repeated on each day on which Personal Data is Processed under the Agreement.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d4fa6c5e-48e4-48c6-b2bf-7d6e752ab2ec","order":1620,"text":"21. LIABILITY, INDEMNIFICATION AND INSURANCE","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S21"},{"id":"d792687d-db6c-48cf-a140-1e0658820cd8","order":1630,"text":"Each Party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Agreement, and any liability under this DPA counts towards, and does not increase, the aggregate liability caps set out in the Agreement.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"527c95c6-0f4d-48c6-96cd-a53e9837387f","value":"agreement_cap","type":"add","operator":"="}]},{"id":"7882aee8-be99-4d1e-a9c5-2e58fcbffad9","order":1640,"text":"Notwithstanding any limitation of liability in the Agreement, each Party's aggregate liability arising out of or in connection with this DPA and the Applicable Data Protection Laws shall not exceed [Liability cap]. That cap is separate from, and additional to, the aggregate liability caps set out in the Agreement.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"527c95c6-0f4d-48c6-96cd-a53e9837387f","value":"separate_cap","type":"add","operator":"="}]},{"id":"b7e6508a-4a4e-49c9-9b77-a9881f6d7109","order":1650,"text":"Notwithstanding the preceding paragraph, no exclusion or limitation of liability applies to a Party's indemnification obligations under this DPA, to a breach of the confidentiality obligations set out in this DPA, to the Selling or Sharing of Personal Data in breach of this DPA, or to fraud, gross negligence or willful misconduct.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"fb4fd771-088e-4bd2-9780-12b16c1a3178","order":1660,"text":"The Service Provider shall indemnify, defend and hold harmless the Business and its Affiliates against all claims, fines, penalties, losses, costs and expenses, including reasonable attorneys' fees, arising out of the Service Provider's breach of this DPA, its violation of Applicable Data Protection Laws, or any Security Incident caused by the Service Provider or by any Sub-processor.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e6307811-94b7-42a7-b765-f68ec980b1ba","order":1670,"text":"The Business shall indemnify, defend and hold harmless the Service Provider against all claims, fines, penalties, losses, costs and expenses arising out of the Business's instructions, where the Service Provider has complied with those instructions and has given any notice required of it under this DPA, and against all claims, fines, penalties, losses, costs and expenses arising out of Prohibited Data submitted to the Services in breach of the article of this DPA entitled \"Obligations of the Business and Prohibited Data\".","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"6928ff12-acb3-4924-b588-c705e7ae320d","order":1680,"text":"Nothing in this DPA limits or excludes the liability of either Party where such limitation or exclusion is prohibited by Applicable Data Protection Laws, including any liability owed directly to a Data Subject or Consumer.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"44055d20-9755-4b43-a067-a45a81564bae","order":1690,"text":"The Service Provider shall maintain, throughout the term of this DPA and for two (2) years thereafter, cyber liability and technology errors and omissions insurance with a reputable insurer in an amount that is reasonable and customary for the Services, and shall provide a certificate of insurance on request.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c6625403-e928-4e69-9345-f166c7d541b5","order":1700,"text":"22. NOTICES","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S22"},{"id":"2a89f619-f5af-4a81-a2bc-9af92db0bcee","order":1710,"text":"Notices under this DPA shall be in writing and shall be given to the Business at [Email of the Business], marked for the attention of [Attention], and to the Service Provider at [Email of the Service Provider], marked for the attention of [Privacy contact of the Service Provider].","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"5eb3465a-30f2-40e6-ba1e-90f30b25290b","order":1720,"text":"Notice of a Security Incident shall additionally be sent to the Business at [Security notice email of the Business].","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d33f11d2-a572-4291-b20f-bc8dc578ad35","order":1730,"text":"A notice given by email is deemed received on the next business day at the place of receipt, save that a notification of a Security Incident is deemed given at the time it is sent. Each Party shall keep its notice details current and shall notify the other Party of any change without undue delay.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f715aeac-a788-49fe-89be-d92572d70f53","order":1740,"text":"Notices and communications required under the Standard Contractual Clauses shall be given to the same addresses.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"8e94959f-c2aa-42cc-94cd-8cc7a4166961","order":1750,"text":"23. GENERAL PROVISIONS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S23"},{"id":"46f94cbe-84e2-4639-9fe2-274104233e12","order":1760,"text":"This DPA, together with its Annexes and the Agreement, constitutes the entire understanding between the Parties relating to the Processing of Personal Data and supersedes all prior agreements, understandings and representations on that subject.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d1c976cf-5452-46e0-9104-8232763824c7","order":1770,"text":"No amendment to this DPA is effective unless made in writing and signed by both Parties, save that the Parties shall negotiate in good faith any amendment reasonably required to give effect to a change in Applicable Data Protection Laws.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3f5fc746-d017-4e8b-b231-52bcb286d701","order":1780,"text":"The Standard Contractual Clauses may not be amended except as permitted by their own terms, and nothing in this DPA shall be construed as contradicting or limiting the safeguards they provide.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"2450c258-0ed4-4858-b1d2-c4989a8abe3b","order":1790,"text":"If any provision of this DPA is held to be invalid, illegal or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect, and the Parties shall replace the severed provision with a valid provision that most closely reflects their original intention.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f1221dbc-83ad-4d5b-b5cd-165dd0124977","order":1800,"text":"No failure or delay by a Party in exercising any right under this DPA operates as a waiver of that right, and no single or partial exercise of a right precludes any further exercise of it or of any other right.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"51e21f9d-77cd-4613-8653-0e6cb5470a80","order":1810,"text":"Neither Party may assign or transfer this DPA without the prior written consent of the other Party, except to a successor in connection with a merger, reorganization or sale of substantially all of its assets, provided that the successor assumes all of the obligations set out in this DPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"331b169e-82d3-44a3-b6f4-3f8f35df3bc3","order":1820,"text":"Nothing in this DPA creates a partnership, joint venture, agency or employment relationship between the Parties. Except for the Affiliates of the Business and for those Data Subjects and Consumers on whom rights are expressly conferred by Applicable Data Protection Laws or, where they apply, by the Standard Contractual Clauses, no third party has any right to enforce this DPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"d4a36c5a-a2ad-44dd-9dea-7f2f356cad57","order":1830,"text":"Any force majeure provision of the Agreement applies to this DPA, save that an event of force majeure shall not excuse a failure to protect the confidentiality, integrity or availability of Personal Data, to notify a Security Incident, or to return or delete Personal Data when required to do so.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"6b1a88b0-85c3-4f31-afcd-0270b889d283","order":1840,"text":"This DPA is drawn up in the English language, which prevails over any translation. Each Party shall do all such acts and execute all such further documents as may reasonably be required to give full effect to this DPA.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"f423df4c-0cd3-4ab8-80d9-6630386f3426","order":1850,"text":"This DPA may be executed in counterparts, including by electronic signature, each of which is an original and all of which together constitute one and the same instrument.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"2c5a317c-6d86-40cc-8090-732aa71d1cb0","order":1860,"text":"24. GOVERNING LAW, JURISDICTION AND DISPUTE RESOLUTION","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"26","sectionNum":"S24"},{"id":"b4b01421-8862-4211-929d-38840f5bb52d","order":1870,"text":"This DPA is governed by the laws of the State of California, without regard to its conflict of laws principles and excluding the United Nations Convention on Contracts for the International Sale of Goods.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"3e4e4047-aeff-4ab9-873d-b747673032e7","order":1880,"text":"Before commencing any proceedings, the Parties shall attempt in good faith to resolve any dispute arising out of or in connection with this DPA through negotiation between senior representatives for a period of thirty (30) days from written notice of the dispute. This requirement does not prevent either Party from seeking urgent interim or injunctive relief.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"64179ebb-aca7-421e-b9d1-b79352e3ff91","order":1890,"text":"The Parties submit to the exclusive jurisdiction of the state and federal courts located in [City and state] in respect of any dispute arising out of or in connection with this DPA, and each Party irrevocably waives any objection to venue in those courts.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"453b869e-d69b-4b79-a7ae-1175139eb810","value":"courts","type":"add","operator":"="}]},{"id":"ec314670-5dfc-47ea-b7bd-f0c2947a04b4","order":1900,"text":"Any dispute arising out of or in connection with this DPA shall be finally resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator, seated in [City and state]. Judgment on the award may be entered in any court of competent jurisdiction, and either Party may seek injunctive or other equitable relief from a court of competent jurisdiction at any time.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"453b869e-d69b-4b79-a7ae-1175139eb810","value":"arbitration","type":"add","operator":"="}]},{"id":"13766f09-f854-4a55-b022-430077c07e06","order":1910,"text":"This article does not apply to, and shall not override, the governing law and forum provisions of the Standard Contractual Clauses, which prevail in respect of any dispute governed by them.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"142e4dd3-cc9e-4c76-834d-b63f8e13f195","order":1920,"text":"ANNEX 1 — DESCRIPTION OF THE PROCESSING","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"30"},{"id":"ee4c0a7e-3e9c-4c23-b039-bd4e05fe3ddd","order":1930,"text":"Business, acting as Controller and, where the Standard Contractual Clauses apply, as data exporter: [Legal name of the Business], [Address of the Business]. Contact: [Attention], [Email of the Business].","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"6e71b4ea-1fc0-4696-828e-0e0293f58887","order":1940,"text":"Service Provider, acting as Processor and, where the Standard Contractual Clauses apply, as data importer: [Legal name of the Service Provider], [Address of the Service Provider]. Contact: [Privacy contact of the Service Provider], [Email of the Service Provider].","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"030edb32-4958-4821-882b-c16378db29a0","order":1950,"text":"Description of the Services: [Description of the Services]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"01c18bd7-34c5-4566-a5d0-51a9d6159483","order":1960,"text":"Nature and purpose of the Processing, being the Business Purposes for which Personal Data is disclosed: [Nature and purpose of the Processing]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"bb0a0ea6-5069-409a-a34a-ee637f294630","order":1970,"text":"Categories of data subjects: [Categories of data subjects]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"571756d7-f51c-4f7b-b87e-24f5ab3ca8ef","order":1980,"text":"Categories of Personal Data: [Categories of Personal Data]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"8f0bd8ae-8a83-4d14-bba9-a5019d35d665","order":1990,"text":"Sensitive Personal Information and Special Categories of Personal Data: [Categories of sensitive personal information]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"52f00f84-f11c-4f97-9fa8-3640e0d4a39b","value":"included","type":"add","operator":"="}]},{"id":"f3aaaddb-06d2-4197-bcbf-87cbc93dd8ce","order":2000,"text":"Sensitive Personal Information and Special Categories of Personal Data: none is Processed under the Agreement.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"52f00f84-f11c-4f97-9fa8-3640e0d4a39b","value":"excluded","type":"add","operator":"="}]},{"id":"862df7ab-f7e6-4b2d-8aa3-62d37d65fe4f","order":2010,"text":"Frequency of the Processing and of any transfer: the Personal Data is Processed and, where applicable, transferred on a continuous basis.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"b4564ebf-88ef-4b6e-8105-4a1610b0efc6","order":2020,"text":"Countries in which Personal Data is Processed: [Permitted countries of processing]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"c3798fdc-3f1c-4574-a19b-4aa673504012","order":2030,"text":"Transfers to Sub-processors: the subject matter, nature and duration of the Processing carried out by each Sub-processor are as stated in Annex 3.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"21e04395-381b-44c5-9e3f-e16f25f2dfac","order":2040,"text":"Duration of the Processing: [Duration of the Processing]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"7d8ae5d8-61cd-466c-8e08-fda95a83e324","order":2050,"text":"Retention period: [Retention period]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"e035fd29-855e-46c7-a475-15d219e357fc","order":2060,"text":"Competent supervisory authority, being Annex I.C to the Standard Contractual Clauses: [Competent supervisory authority]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"00095f74-e070-4fc1-a25f-525d2e925884","order":2070,"text":"ANNEX 2 — TECHNICAL AND ORGANIZATIONAL MEASURES","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"30"},{"id":"5daa54a9-2819-48a2-9d65-20f522b73f2e","order":2080,"text":"The Service Provider implements and maintains at least the following technical and organizational measures, aligned to the SOC 2 Trust Services Criteria.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"82f1c81c-3296-464d-a7cc-79a4e3b56af1","order":2090,"text":"— Access control: role-based access, least-privilege provisioning, unique user identifiers, multi-factor authentication for administrative and remote access, and review of access rights at least quarterly.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"c6a19f33-5715-455a-a97f-580df0d4062f","order":2100,"text":"— Encryption: encryption of Personal Data in transit using current industry-standard protocols and at rest using strong cryptographic algorithms, together with documented key management and rotation.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"7e0bb0f3-42b1-41bd-b7c8-356e43f4565c","order":2110,"text":"— Pseudonymization and minimization: pseudonymization of Personal Data where compatible with the Services, and limitation of Processing to the Personal Data necessary for the Business Purposes.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"2fdd595e-7c57-4fad-bd33-c11e90a1136b","order":2120,"text":"— Network and infrastructure security: firewalls, network segmentation, intrusion detection, endpoint protection, and hardening of systems in accordance with documented baselines.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"f66027ce-05e6-4ed5-b2a5-9752ad320c9d","order":2130,"text":"— Vulnerability and patch management: regular vulnerability scanning, penetration testing by an independent third party at least annually, and remediation within risk-based timeframes.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"a805d59e-4b9c-4912-9f52-c6fbc61fe5c2","order":2140,"text":"— Logging and monitoring: centralised, tamper-resistant logging of access to and Processing of Personal Data, retained for a period appropriate to the risk, with alerting on anomalous activity.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"60becc49-0402-45d2-b420-f4aae7d64f10","order":2150,"text":"— Physical security: controlled access to data centers and offices, visitor management, and environmental and power controls.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"789a210a-dcdd-4f50-a675-f6d9ef315f53","order":2160,"text":"— Business continuity and resilience: documented back-up, disaster recovery and business continuity plans, tested at least annually, with defined recovery point and recovery time objectives.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"bb4a122b-8519-49f1-8b7d-7ab6ad792767","order":2170,"text":"— Incident response: a documented incident response plan with defined roles, escalation paths, forensic capability and notification procedures, tested at least annually.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"3dba3968-58c2-49a9-b14a-04a3586f98ac","order":2180,"text":"— Secure development: secure coding standards, peer code review, segregation of production and non-production environments, and a prohibition on the use of production Personal Data in test environments without pseudonymization.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"4bbb1961-26d5-4c57-a02b-43772944f345","order":2190,"text":"— Personnel: background screening where lawful, written confidentiality undertakings, mandatory security and privacy training on hire and at least annually thereafter, and prompt revocation of access on termination of engagement.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"54133289-b2c9-41bb-84b6-dc634349d4ae","order":2200,"text":"— Sub-processor management: due diligence on Sub-processors, contractual flow-down of these measures, and periodic review of their performance and security posture.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"b1928b8f-6bde-464d-9a94-9b5eafc1190b","order":2210,"text":"— Secure disposal: secure erasure or destruction of media and documents containing Personal Data in accordance with recognized standards.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"b4c0af61-b585-4453-9f3f-093d17788cd3","order":2220,"text":"— Governance: a designated individual accountable for information security, documented policies reviewed at least annually, and an internal audit or assessment program.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"5b0c47fb-fa71-41d1-a66e-e712f8056791","order":2230,"text":"— Data minimization and quality: measures ensuring that only the Personal Data necessary for each purpose is collected and Processed, and that inaccurate Personal Data is corrected or erased without undue delay.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"9ce4e052-cdb7-4946-9a62-880c9d3d7667","order":2240,"text":"— Limited retention: documented retention schedules and automated deletion routines aligned with the retention period stated in Annex 1.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"4abcb752-05c6-4c2d-9f54-db959646d019","order":2250,"text":"— Portability and erasure: technical means enabling the export of Personal Data in a structured, commonly used and machine-readable format and its secure erasure on the instruction of the Business.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"eeeae77c-77f6-4698-bef4-b22fa20461f3","order":2260,"text":"— Transfer safeguards: measures applied to Personal Data transferred to another country, including encryption in transit, restriction of remote administrative access, and documented assessments of the destination country.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"f98f359a-68c2-42b0-8df2-ce068b223f33","order":2270,"text":"— Accountability: documented allocation of responsibilities, records of Processing activities, and periodic management review of the privacy and information security program.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"95842e4a-5889-4d1d-b3e3-7edc9dce275e","order":2280,"text":"ANNEX 3 — APPROVED SUB-PROCESSORS","fontSize":"16","textAlign":"left","bold":true,"underline":false,"marginBottom":"12","cflou":false,"active":true,"marginTop":"30"},{"id":"2807c48a-6f29-4f56-85d8-731fd68ff176","order":2290,"text":"The Business authorizes the engagement of the following Sub-processors, each of which shall Process Personal Data only for the purposes and in the locations stated:","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"6b8bd6dc-c146-4a89-bf52-ab5931f856e6","order":2300,"text":"[List of approved Sub-processors]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true},{"id":"94072409-f8f3-4a05-a1c6-ba3a0be2846f","order":2310,"text":"Where the Standard Contractual Clauses apply, this Annex constitutes Annex III to those Clauses.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true,"displayConditions":[{"field":"71025a18-18c0-4d28-a34a-d1174e8c0b12","value":"eu_in","type":"add","operator":"="}]},{"id":"ffd8bc0f-4a8c-4aa7-b4dc-e3f0d38b191f","order":2320,"text":"IN WITNESS WHEREOF, the Parties have caused this Data Processing Agreement to be executed by their duly authorized representatives as of the Effective Date.","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"14","cflou":false,"active":true,"marginTop":"30"},{"id":"06dcdf7c-a254-4661-94dc-2fccba8a60da","order":2330,"text":"Executed at [City and state], on [Date of signature].","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"26","cflou":false,"active":true},{"id":"55eaeb19-1efb-4703-a73f-9dfd6bd1157d","order":2340,"text":"THE BUSINESS","fontSize":"14","textAlign":"left","bold":true,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"80089015-b5af-4863-bdd1-29b98c0556c6","order":2350,"text":"[Legal name of the Business]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"4","cflou":false,"active":true},{"id":"22222c49-7482-4501-843b-aae22923833b","order":2360,"text":"By: [Name of the signatory]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"4","cflou":false,"active":true},{"id":"a7ba3fc7-6748-4086-a705-67ff66e24289","order":2370,"text":"Title: [Title of the signatory]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"4","cflou":false,"active":true},{"id":"297d211a-4854-4bda-a480-ad6095ca5d17","order":2380,"text":"Signature: ______________________________","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"26","cflou":false,"active":true},{"id":"4bdbb8ed-a347-4823-b686-c05f359fd196","order":2390,"text":"THE SERVICE PROVIDER","fontSize":"14","textAlign":"left","bold":true,"underline":false,"marginBottom":"6","cflou":false,"active":true},{"id":"f56babe7-bf92-46aa-beb1-15de73db2f45","order":2400,"text":"[Legal name of the Service Provider]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"4","cflou":false,"active":true},{"id":"f8fab4f7-157e-4582-ba4a-5839f306efda","order":2410,"text":"By: [Name of the signatory]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"4","cflou":false,"active":true},{"id":"96318ddb-f7df-4d94-a322-77be0f46ed3a","order":2420,"text":"Title: [Title of the signatory]","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"4","cflou":false,"active":true},{"id":"7e02f0f2-b3e7-4b72-8171-bea9e732f25e","order":2430,"text":"Signature: ______________________________","fontSize":"14","textAlign":"left","bold":false,"underline":false,"marginBottom":"10","cflou":false,"active":true}]