API License and Data Sharing Agreement
THIS API LICENSE AND DATA SHARING AGREEMENT ("AGREEMENT") IS BETWEEN TEKION CORP, A CORPORATION DULY ORGANIZED AND EXISTING UNDER THE LAWS OF THE STATE OF DELAWARE, HAVING ITS PRINCIPAL PLACE OF BUSINESS AT 5934 GIBRALTAR DRIVE, PLEASANTON, CA 94588 ("WE", "OUR" OR "US") AND YOU ("YOU") AND SETS FORTH THE TERMS AND CONDITIONS GOVERNING THE USE OF OUR APIS TO ALLOW YOUR APPLICATION TO INTEROPERATE WITH OUR PRODUCTS. IT IS EFFECTIVE AS OF THE DATE ACCEPTED BY YOU ("EFFECTIVE DATE").
BY ACCEPTING THIS AGREEMENT, YOU AGREE TO THE TERMS OF THIS AGREEMENT IN A LEGALLY BINDING MANNER. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY AND YOUR AFFILIATES TO THESE TERMS AND CONDITIONS, IN WHICH CASE THE TERMS "YOU" OR "YOUR" SHALL REFER TO SUCH ENTITY AND YOUR AFFILIATES. IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT AGREE WITH THESE TERMS AND CONDITIONS, YOU MUST NOT ACCEPT THIS AGREEMENT AND MAY NOT USE OUR API.
NOTE: YOU MAY NOT ACCESS OUR API FOR PURPOSES OF BENCHMARKING.
- DEFINITIONS
- "API" means an application programming interface and includes all accompanying or related documentation, specifications, source code, object code, software development kit, executable applications or other materials made available by Us, including any APIs through which Data may be made available to You.
- "Application" means software authored by You in Object Code or Source Code form that accesses or otherwise interoperates with the Products via the APIs.
- "Authorized Users" means an individual authorized by You to use the APIs or Data such as Your directors, officers, employees, subcontractors or agents.
- "CCPA" means the California Consumer Privacy Act of 2018 (Cal Civ Code Div. 3, Pt. 4, Title 1.81.5) and the California Privacy Rights Act of 2020, each as amended and any regulations promulgated under the foregoing.
- "Change of Control" means (i) the sale of all or substantially all of Your assets, (ii) any merger, consolidation, or acquisition of You by or into another corporation, entity, or person, or (iii) any change in Your ownership of more than fifty percent (50%) of Your voting capital stock.
- "Data" means the data, including Personal Information, that We make available to You through Our APIs or any other mechanisms, including but not limited to FTP file transfers.
- "Data Protection Laws" means all Laws, in applicable jurisdictions worldwide, that relate to (i) the confidentiality, Processing, privacy, security, protection, transfer or trans-border data flow of Personal Information, or (ii) electronic data privacy; whether such Laws are in place as of the effective date of the Agreement or come into effect during the term. Without limiting the foregoing, Data Protection Laws includes, as applicable, California Consumer Privacy Act, California Privacy Rights Act, Virginia Consumer Data Protection Act, Colorado Privacy Act, and any rules or regulations promulgated under the foregoing.
- "Intellectual Property Rights" means any and all of the following in any jurisdiction throughout the world: (a) trademarks and service marks, including all applications and registrations, and the goodwill connected with the use of and symbolized by the foregoing, (b) copyrights, including all applications and registrations related to the foregoing, (c) trade secrets and confidential know-how, (d) patents and patent applications, (e) websites and internet domain name registrations, and (f) any other intellectual property and related proprietary rights, interests and protections (including all rights to sue and recover and retain damages, costs and attorneys' fees for past, present, and future infringement, and any other rights relating to any of the foregoing).
- "Law" means (a) any applicable law (including the common law), statute, bylaw, rule, regulation, order, ordinance, treaty, decree, judgment, and (b) any official directive, protocol, code, guideline, notice, approval, order, policy, or other requirement of any applicable government agency or body having the force of law.
- "Malicious Code" means viruses, worms, time bombs, Trojan horses, ransomware, spyware, adware, scareware, and any other malicious codes, files, scripts, agents or programs intended to do harm.
- "Person" includes any corporation, company, limited liability company, partnership, government agency or body, joint venture, fund, trust, association, syndicate, organization, or other entity or group of persons, whether incorporated or not, and any individual.
- "Personal Information" means any information relating to an identified or identifiable individual where such information is contained within Personal Information and is protected similarly as personal data, personal information or personally identifiable information under applicable Data Protection Laws.
- "Products" mean any of Our services or products, including but not limited to Our Automotive Retail Cloud (ARC) platform and Our Digital Retailing Platform.
- "Uses" means the use cases for the Data set forth in Schedule 1 of this Agreement
- LICENSE
- License Grant: Subject to the terms and conditions of this Agreement, We grant You a limited, non-exclusive, non-transferable, and revocable license during the Term to: (a) access the APIs only as necessary to develop, test, and support an integration of the Application with the Products; and (b) use Data solely for the Uses stated in Schedule 1. Any access, use or distribution of the APIs or the Data other than as expressly permitted by this Section 2.1 is strictly prohibited.
- License Restrictions. You agree and acknowledge that the licenses granted in Section 2.1 are explicitly conditioned on Your adherence to the following restrictions and compliance with Your responsibilities as set forth herein. You must not: (a) make the APIs or Data available to, or use the APIs or Data for the benefit of, anyone other than You, (b) modify, copy or create derivative works (e.g., a superset or subset of the APIs or Data) based on the APIs or Data; (c) disassemble, reverse engineer, or decompile the APIs or Data or part thereof; (d) attempt to or actually re-identify any previously aggregated, deidentified, or anonymized data; (e) collect, store, or use Data without obtaining proper consent of the relevant Person; (f) combine Data with data gathered from other sources for any purposes unrelated to the Uses; (g) attempt to gain unauthorized access to any of Our systems, platforms or networks, (h) use or access the APIs, Products or Data in order to monitor the availability, performance, or functionality of any of the API or a Product, for any similar benchmarking purposes or for purposes of building a competitive product or service; (i) take any action that may impose an unreasonable or disproportionately large load on the Our systems, knowingly interfere with or disrupt the integrity or performance of Our systems or the data contained therein, or circumvent or attempt to circumvent any technical or other limitations imposed by Us to limit use of the Our APIs or Data; (j) perform any penetration or vulnerability testing with respect to Our systems; (k) hide or mask the identity of systems or devices accessing the APIs; (l) unless otherwise set forth in this Agreement, sell, distribute, rent, lease, sublicense, display, modify, time share, outsource or otherwise provide the APIs or Data to any third party or use it in a service bureau or outsourcing environment, (m) use the APIs or Data in violation of this Agreement; or (n) use the APIs to send or store infringing, obscene, threatening, libelous, defamatory, or otherwise unlawful or tortious material, including material that violates third-party proprietary or other rights. We reserve the right, but have no obligation, to investigate any violation of this provision or misuse of the APIs or Data. Any use of the APIs or Data by You or Your users that: (i) is in breach of this Agreement or our policies, or (ii) in Our judgment, threatens the security, integrity or availability of the APIs or Data (including but not limited to an unusual number or frequency of API requests), may result in temporary or permanent revocation of your license, with or without notice to You.
- Ownership: Subject to the limited licenses expressly provided in this Agreement, We and Our licensors retain all Intellectual Property Rights in and to the APIs, Data, the Products and anything developed by Us. Nothing in this Agreement transfers or assigns to Us any of Your Intellectual Property Rights in Your Applications or other technology, and nothing in this Agreement transfers or assigns to You any of Our Intellectual Property Rights in the APIs, Data, the Products or anything developed by Us.
- Feedback: You grant Us a royalty-free, fully paid, worldwide, transferable, sub-licensable, irrevocable and perpetual license to implement, use, modify, commercially exploit, or incorporate into any of the Products any suggestions, enhancement requests, recommendations or other feedback that We receive from You.
- ACCESS AND SECURITY
- Authentication. In order to use and access the APIs, You and each Authorized User must obtain API credentials from Us (a "Token"). You and each Authorized User must not share Your Token with any third party, must keep Tokens and all login information secure, and must use the Tokens as Your sole means of accessing the API.
- Access. You will integrate Your Applications with Us only through documented APIs built and made expressly available by Us. You will properly implement the APIs in accordance with Our policies, including without limitation, any applicable user interface guidelines. All access to our APIs and Data is provided solely for use by Your employees (and consultants who are bound by terms which are at least as protective of Intellectual Property Rights and Confidential Information as set forth in this Agreement) and only to the extent necessary to perform Your obligations under this Agreement and to develop, and test the integration or interaction between Our Products and Your Applications.
- Security. You will not permit any Person that is not an Authorized User to access or use the APIs or Data and shall implement and maintain security systems and procedures reasonably designed to prevent unauthorized access, use, or misuse by any person of the APIs or Data. You are responsible for all activities by Authorized Users and for Your Authorized Users' compliance with this Agreement and applicable Laws. Without limiting the generality of the foregoing, You shall: (a) inform each Authorized User of Your obligations under this Agreement with respect to access and use of the APIs and/or Data and take all necessary steps to ensure that all Authorized Users comply with such obligations; (b) ensure that Your hardware, software, devices, and any other equipment through which the APIs or Data may be accessed are secure and able to prevent any unauthorized access, use, or misuse of the APIs or Data, including, as appropriate, the pseudonymization and encryption of the Data; (c) take any other measures reasonably necessary to prevent any use or disclosure of the APIs or Data other than as allowed under this Agreement, which measures shall be at least equal to those that You use to protect Your own confidential or proprietary information of a similar kind and character, but shall in no event be less than reasonable care; and (iv) promptly notify Us, and in no case later than twenty-four (24) hours, of discovering any actual or potential breach, compromise or vulnerability in Your security procedures related to the APIs or Data.
- Data Privacy. The DPA attached as Schedule 2 applies to the extent that any Data that You receive from Us under this Agreement contains Personal Information.
- REPRESENTATIONS, WARRANTIES AND COVENANTS
- Mutual Representations. Each party represents that (a) it is duly organized and validly existing under the laws of the state or country of its incorporation or formation, (b) it has validly entered into this Agreement and that it has the power and authority to do so, (c) the Agreement is a valid obligation binding upon both Parties and enforceable in accordance with its terms, and (d) to the best of each party’s respective knowledge, the execution, delivery, and performance of the Agreement by each party does not materially conflict with any agreement that party has with a third party.
- Your Warranties. You represent, warrant and covenant that: (a) You will comply with the terms of this Agreement (including without limitation, the provisions of Section 2) and all applicable Laws, and maintain all licenses, permits, consents and other permissions necessary to use the APIs and Data; (b) Your Applications do not and will not violate, misappropriate or infringe upon the Intellectual Property Rights of any third party; (c) Your Applications do not, and will not, contain or introduce any Malicious Code into the Products, APIs, any Data or other data stored or transmitted using the APIs; (d) to the extent that You or Your Applications store, process or transmit Data, You will not, without appropriate prior user consent or except to the extent required by applicable law: (i) modify any Data in a manner that adversely affects its integrity; (ii) disclose Data to any third party; or (iii) use Data for any purpose other than the Uses.
- Disclaimer of Warranties. YOU ACKNOWLEDGE THAT THE APIS AND DATA, INCLUDING ALL SERVER AND NETWORK COMPONENTS, ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT ANY WARRANTIES OF ANY KIND. TO THE FULLEST EXTENT PERMITTED BY LAW, WE EXPRESSLY DISCLAIM ANY AND ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. YOU ACKNOWLEDGE THAT WE DO NOT WARRANT THAT THE APIS OR DATA WILL BE UNINTERRUPTED, TIMELY, SECURE, ERROR-FREE OR FREE FROM VIRUSES OR OTHER MALICIOUS CODE. FURTHER, WE MAKE NO REPRESENTATIONS OR WARRANTIES REGARDING THE INTEGRITY OF DATA THAT YOU TRANSMIT, TRANSFER, STORE, OBTAIN OR RECEIVE THROUGH USE OF THE APIS. WE ARE NOT OBLIGATED TO MAINTAIN OR SUPPORT THE APIS, OR TO PROVIDE YOU WITH UPDATES, FIXES, OR SERVICES RELATED THERETO. YOU ASSUME ALL RISK ARISING FROM USE OF THE APIS AND DATA, INCLUDING, WITHOUT LIMITATION, COMPLIANCE WITH ALL APPLICABLE LAWS AND REGULATIONS (INCLUDING DATA PROTECTION LAWS AND LAWS RELATED TO ADVERTISING, ELECTRONIC COMMUNICATIONS AND SOLICITATIONS, TELEMARKETING, "DO NOT CALL" AND "DO NOT CONTACT" COMPLIANCE, CALL RECORDING AND CONSUMER PROTECTION).
- INDEMNITIES AND LIMITATION OF LIABILITY
- Your Indemnity. You will indemnify and hold Us harmless against any claim brought by a third party against Us arising from or related to any breach of an obligation, representation, warranty, covenant or other provision of this Agreement by You or any matter which You are responsible for pursuant to this Agreement.
- Limitation of Liability. NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT, TO THE MAXIMUM EXTENT PERMITTED BY LAW: (A) OUR AGGREGATE LIABILITY TO YOU OR ANY THIRD PARTY ARISING OUT THIS AGREEMENT SHALL IN NO EVENT EXCEED ONE HUNDRED U.S. DOLLARS ($100.00). ANY CLAIM ARISING OUT OF OR RELATING TO THIS AGREEMENT MUST BE BROUGHT WITHIN ONE (1) YEAR OF THE FIRST EVENT OR OCCURRENCE GIVING RISE TO THE CLAIM; AND (B) In no event will WE have any liability to YOU or to any third party for any lost profits or revenues, or for any indirect, special, incidental, consequential, or punitive damages however caused, whether in contract, tort or under any other theory of liability, and whether or not YOU or the third party has been advised of the possibility of such damages.
- TERM AND TERMINATION
- Term. This Agreement shall commence on the Effective Date and will remain in effect until terminated pursuant to this Section 6 (the "Term"). Either party may terminate this Agreement at any time, for any reason, or for no reason including, but not limited to, if You violate any provision of this Agreement or undergo a Change of Control. Any termination of this Agreement shall also terminate the licenses granted to You hereunder.
- Effect of Termination. Upon termination of this Agreement for any reason, You shall cease using, and either return to Us, or destroy and remove from all computers, systems, hard drives, networks, and other storage media, all copies of any materials licensed pursuant to this Agreement and any Confidential Information in Your possession, and shall certify to Us that such actions have occurred. Sections 2.3, 2.4, 4, 5, 6.2, 8, 10, and 11 will survive any termination of this Agreement.
- AUDIT
- Records and Access. You shall maintain complete and accurate records relating to Your use of the APIs, the receipt and usage of Data, and any other related information as We may request from time to time. We are entitled, in Our sole discretion, to conduct (or arrange for an agent to conduct) an onsite audit or review of Your facilities and systems to monitor Your compliance with the terms of this Agreement and You will fully cooperate with Us and comply with all reasonable requests from Us pursuant to this provision. Any onsite audit or review pursuant to this Agreement shall be conducted during normal business hours.
- CONFIDENTIALITY
- Confidential Information. As used herein, Confidential Information means any business or technical information that is disclosed to You in connection with this Agreement, including, but not limited to, the APIs, the Data, the Products and any information relating to Our plans, business opportunities, or research and development. Confidential Information excludes any information that: (a) is or becomes generally known to the public other than as a result of Your breach of this Agreement; (b) is rightfully known to You at the time of disclosure without restrictions on use or disclosure; (c) is independently developed by You, without access to or use of any Confidential Information; or (d) is rightfully obtained by You from a third party who has the right to disclose it and who discloses it without restrictions on use or disclosure.
- Duty of Confidentiality. You will maintain all Confidential Information in strict confidence and will not disclose Confidential Information to any third party except as permitted by this Agreement. You may use Confidential Information only to the extent necessary to exercise Your rights or perform Your obligations under this Agreement. You agree that to protect Confidential Information from unauthorized use, access, or disclosure in the same manner that You would use to protect Your own confidential and proprietary information of a similar nature and in any event with no less than a reasonable degree of care.
- Equitable Relief. You acknowledge that the unauthorized use or disclosure of the APIs or Data may cause Us to incur irreparable harm and significant damages, the degree of which may be difficult to ascertain. Accordingly, You agree that in addition to any other rights or remedies that We may have under this Agreement, in law or otherwise, We will have the right to seek immediate equitable relief to enjoin any unauthorized use or disclosure of the APIs or Data without the necessity of proving any actual damages sustained by Us and without the requirement of bond or security. Moreover, any such award of relief to Us shall include recovery of all actual and reasonable costs associated with enforcement of this Agreement including, without limitation, attorney’s fees.
- GOVERNING LAW; AMENDMENTS AND ASSIGNMENTS
- Governing Law and Jurisdiction. This Agreement will be construed, interpreted, and applied in accordance with the internal laws of the State of California without regard to its conflicts of laws rules or the United Nations Convention on the International Sale of Goods.
- Venue; Waiver of Jury Trial; Fees. The state and federal courts located in San Francisco County, California will have exclusive jurisdiction to adjudicate any dispute arising out of or relating to the Agreement or its formation, interpretation or enforcement. Each party hereby consents and submits to the exclusive jurisdiction of such courts. Each party also hereby waives any right to jury trial in connection with any action or litigation in any way arising out of or related to the Agreement. In any action or proceeding to enforce rights under the Agreement, the prevailing party will be entitled to recover its reasonable costs and attorney’s fees.
- Amendments. This Agreement may not be waived, altered, amended, or modified except by written instrument signed by the duly authorized representatives of both parties hereto.
- Assignments. You may assign this Agreement in its entirety, whether by operation of law or otherwise, with Our prior written consent. A Change of Control will be considered an assignment for the purpose of this provision. Any attempt to assign Your rights or obligations under this Agreement in breach of this section will be void and of no effect. We may assign this Agreement in its entirety whether by operation of law or otherwise without Your prior written consent. Subject to the aforesaid, the terms and conditions of this Agreement shall inure to the benefit of and be binding upon the respective successors and assigns of the parties.
- MISCELLANEOUS
- No Waiver. Each party’s obligations hereunder are in addition to, and not exclusive of, any and all of its other obligations and duties to the other party, whether express, implied, in fact or in law. Any failure by either party to enforce the other party’s strict performance of any provision of this Agreement will not constitute a waiver of its right to subsequently enforce such provision or any other provision of this Agreement.
- Notices. Notices shall be sent to the addresses set forth in this Agreement or such other address as either party may specify in writing.
- Entire Agreement and Severability. This Agreement is the complete and exclusive statement regarding the subject matter of this Agreement and supersedes all prior agreements, understandings and communications, oral or written, between the parties regarding the subject matter of this Agreement. If one or more provisions of this Agreement are held to be unenforceable under applicable law, the parties agree to renegotiate such provision in good faith. In the event that the parties cannot reach a mutually agreeable and enforceable replacement for such provision, then (a) such provision shall be excluded from this Agreement, (b) the balance of the Agreement shall be interpreted as if such provision were so excluded and (c) the balance of the Agreement shall be enforceable in accordance with its terms.
- Relationship of Parties; Third Party Beneficiaries. The parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the parties. There are no third-party beneficiaries under this Agreement.
- Publicity. You grant Us the right to use Your company name and logo as a reference for marketing or promotional purposes on Our website and in other public or private communications with Our existing or potential customers subject to Your standard trademark usage guidelines as provided to Us from time-to-time.
SCHEDULE 1
DATA AND APPLICATION USES
- Uses: Please provide a description of why You are requesting the Data and how You will use it (e.g., creating appointments, creating deals, retrieving customers, etc.):
Refer to Your responses to the Tekion onboarding questionnaire, which are incorporated here by reference.
SCHEDULE 2
DATA AND APPLICATION USES
This Data Processing Agreement ("DPA") reflects the parties’ agreement with respect to the Processing of Personal Information by You.
This DPA is supplemental to, and forms an integral part of, the Agreement, and is effective upon its incorporation into the Agreement. In case of any conflict or inconsistency with the terms of the Agreement, this DPA will take precedence over the terms of the Agreement to the extent of such conflict or inconsistency.
The term of this DPA will follow the term of the Agreement. Terms not otherwise defined in this DPA will have the meaning as set forth in the Agreement.
- DEFINITIONS
- "Approved Country" means a country, such as the countries within the European Economic Area, that has a data localization requirement requiring that Personal Information must either remain within that country’s territory or satisfy certain requirements before the Personal Information can be transferred to a third country.
- "California Personal Information" means Personal Information that is subject to the protection of the CCPA.
- "Consumer", "Business", "Sell" and "Service Provider" will have the meanings given to them in the CCPA.
- "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Information.
- "Data Subject" means the individual to whom Personal Information relates.
- "Measures" means technical and organizational measures to protect against unauthorized or unlawful processing of Personal Information and against accidental loss or destruction of, or damage to, Personal Information with those measures being appropriate to the harm that might result from the unauthorized or unlawful processing or accidental loss, destruction or damage of the Personal Information in question and taking account of the nature of the Personal Information to be protected, as well as having regard to the state of technological development and the cost of implementing them.
- "Personal Information Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information transmitted, stored or otherwise Processed by You and/or Your Sub-Processors in connection with this Agreement. "Personal Information Breach" will not include unsuccessful attempts or activities that do not compromise the security of Personal Information, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
- "Processing" means any operation or set of operations which is performed on Personal Information, encompassing the collection, retention, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Information. The terms "Process", "Processes" and "Processed" will be construed accordingly.
- "Processor" means a natural or legal person, public authority, agency or other body which Processes Personal Information on behalf of the Controller.
- "Sub-Processor" means any Processor engaged by You or Your affiliates to assist in fulfilling Your obligations with respect to the Agreement. Sub-Processors may include third parties or Your affiliates but will exclude any of Our employees or consultants.
- YOUR OBLIGATIONS
- Compliance with Laws. You will be responsible for complying with all requirements that apply to You under applicable Data Protection Laws with respect to Your Processing of Personal Information. Further, You will only Process Personal Data for the purposes described in this DPA or as otherwise agreed by the parties, except where and to the extent otherwise required by applicable Law.
- Inability to Comply with Agreement. If You become aware that You cannot Process Personal Information in accordance with the Agreement and this DPA, You will (i) promptly notify Us to the extent permitted by the Law; and (ii) where necessary, cease all Processing (other than merely storing and maintaining the security of the affected Personal Information). In such instance, We may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information.
- Security. You will implement and maintain appropriate technical and organizational measures to protect Personal Information from Personal Information Breaches. This includes the following Measures:
- To prevent unauthorized use or publication of Data, You shall at a minimum use the same degree of care (but never less than a reasonable degree of care), as You use to protect Your own information.
- You will implement appropriate Measures (which may include but are not limited to (i) anonymizing and/or encrypting Data; (ii) ensuring confidentiality, integrity, availability and resilience of Your systems and services; (iii) ensuring that availability of and access to Personal Information can be restored in a timely manner after an incident) to:
- protect Data against: (i) accidental or unlawful damage, destruction or loss; (ii) unauthorized disclosure or access (e.g., where processing involves the transmission of Contract Data over a network); (iii) alteration; and (iv) all other unlawful forms of Processing;
- prevent unauthorized persons from having access to the data processing equipment used to process the Data;
- ensure that any persons You authorize to have access to the Data respects and maintains the confidentiality and security of the Data;
- keep all Data belonging to Us separate from any Data, including Personal Information, that You process on behalf of Your other customers (other than such Personal Information required in connection with this Agreement); and
- will ensure that those Measures are sufficient to comply with all Data Protection Laws.
- Confidentiality. You will ensure that any personnel whom You authorize to Process Personal Information on Your behalf is subject to appropriate confidentiality obligations (whether a contractual or statutory duty) with respect to that Personal Information.
- Personal Information Breaches. You will notify Us without undue delay (and in no case later than twenty-four (24) hours) after You become aware of any Personal Information Breach and will provide timely information relating to the Personal Information Breach as You becomes known or reasonably requested by Us. At Our request, You will promptly provide Us with assistance as necessary to enable Us to notify relevant Personal Information Breaches to competent authorities and/or affected Data Subjects, if We are required to do so under Data Protection Laws.
- Deletion or Return of Personal Information. You will delete or return all Data, including Personal Information (including copies thereof) Processed pursuant to this DPA, on termination or expiration of the Agreement in accordance with the procedures and timeframes set out in the Agreement, save that this requirement shall not apply to the extent You are required by applicable Law to retain some or all of the Data, or to Data You have archived on back-up systems, which data You will securely isolate and protect from any further Processing and will delete at the earliest possible time (and no later than in accordance with Your deletion practices).
- Sub-Processors. You will notify Us prior to engaging any Sub-Processors to Process Personal Information unless We have provided prior written approval of such Sub-Processors. Where You engage Sub-Processors, You will impose data protection terms on the Sub-Processors that provide at least the same level of protection for Personal Information as those in this DPA to the extent applicable to the nature of the services provided by such Sub-Processors. You will remain responsible for each Sub-Processor’s compliance with the obligations of this DPA and for any acts or omissions of such Sub-Processor that cause You to breach any of Your obligations under this DPA.
- DATA SUBJECT REQUESTS
- You will notify Us within one (1) business day if You receive a request from a Data Subject regarding any Data Subject rights provided by applicable Data Protection Laws, including but not limited to, requests to access the Data Subject’s Personal Information.
- You shall provide Us with full cooperation and assistance in relation to any request made by a Data Subject which falls within section 3(a) of this DPA.
- You will not disclose any Data to any Data Subject or to a third party other than at Our request, as provided for in the Agreement or as required by applicable Data Protection Laws.
- DATA TRANSFERS
- Where You transfer Personal Information outside an Approved Country, You will ensure that such transfers comply with applicable Data Protection Laws.
- AUDIT
- At least once every twelve (12) months, We are entitled, with prior reasonable notice to You, to inspect or appoint representatives to inspect all facilities, equipment, documents and electronic data relating to the Processing of Personal Information by You or any Sub-Processors during normal business hours. Such audit is limited to ensuring Your compliance with this DPA and any information that We obtain during the audit is subject to the confidentiality provisions of this Agreement.
- We shall use reasonable endeavors to ensure that any disruption caused to You by exercise of Our rights under section of this DPA shall be minimized as far as reasonably practicable.
- Throughout the term of the Agreement and for a period of not less than seven (7) years thereafter, You will maintain complete and accurate records and information to demonstrate Your compliance with this DPA.
- The requirement to give notice will not apply if We reasonably believe that You are in material breach of any of Your obligations under the DPA.
- INDEMNITY
- You shall, at all times during and after the termination or expiry of this DPA, indemnify Us, keep Us indemnified and hold Us harmless from and against all losses, damages, costs or expenses and other liabilities (including without limitation legal fees) incurred by, awarded against or agreed to be paid by Us for which We may become liable due to any failure by You or Your employees or agents to comply with any of their obligations under the DPA.
- INTENTIONALLY LEFT BLANK
- ADDITIONAL PROVISIONS FOR CALIFORNIA PERSONAL INFORMATION
- Scope of Section 8. This section of the DPA will apply only with respect to California Personal Information.
- Roles of the Parties. When processing California Personal Information, the parties acknowledge and agree that both parties are Service Providers for the purposes of the CCPA.
- Responsibilities. You agree that You will Process Personal Information as a Service Provider strictly for the Uses provided in the Agreement or as otherwise permitted by the CCPA, and will not Sell, collect, retain, use, or share Personal Information for any other purpose.
- GENERAL PROVISIONS
- Amendments. Notwithstanding anything else to the contrary in the Agreement and subject to section 10 of the Agreement, We reserve the right to make any updates and changes to this DPA at any time on not less than 30 days’ notice to You.
- Severability. If any individual provisions of this DPA are determined to be invalid or unenforceable, the validity and enforceability of the other provisions of this DPA will not be affected.
- Governing Law. This DPA will be governed by and construed in accordance with section 10 of the Agreement unless required otherwise by Data Protection Laws.