Contract analysis

ARTICLE 1 — DEFINITIONS 1.1 "Applicable Data Protection Laws" means all federal, state, and local laws, rules, regulations, orders, directives, and regulatory guidance relating to data privacy, data protection, cybersecurity, and information security that are applicable to the Processing of Customer Data under this DPA, including without limitation: (a) Title V of the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.)

ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING 2.1 Scope. This DPA applies to all Processing of Customer Data by Provider (and its Subprocessors) in connection with the provision of the Services under the MSA. The scope of Customer Data subject to this DPA includes, without limitation, transaction data, customer identification program ("CIP") records, account information, SARs and related supporting documentation and da

ARTICLE 3 — PROCESSING INSTRUCTIONS 3.1 Documented Instructions. Provider shall Process Customer Data only in accordance with Customer's documented written instructions. The MSA, this DPA (including its Schedules), and the applicable Order Form(s) constitute Customer's initial documented instructions to Provider regarding the Processing of Customer Data. Customer may issue additional or supplementary written instruct

ARTICLE 4 — DATA CLASSIFICATION AND HANDLING 4.1 Classification. All Customer Data shall be classified and handled in accordance with Customer's data classification policy, as communicated to Provider in writing. Provider acknowledges that it has received a copy of Customer's current data classification policy and that Customer Data encompasses data classified at both the "Confidential" and "Highly Restricted" levels

ARTICLE 5 — DATA RESIDENCY AND CROSS-BORDER TRANSFER RESTRICTIONS 5.1 Data Residency. All Customer Data shall be stored, processed, and maintained exclusively within the continental United States. Provider shall not store, process, or maintain Customer Data at any location outside the continental United States. Provider shall utilize only the following Orion Cloud Services, Inc. ("Orion Cloud") data center regions fo

ARTICLE 6 — SUBPROCESSOR OBLIGATIONS 6.1 Authorized Subprocessors. Customer hereby authorizes Provider's use of the Subprocessor(s) identified in the table below as of the Effective Date (the "Authorized Subprocessor(s)"): Provider represents and warrants that, as of the Effective Date, the Authorized Subprocessor identified above is the only Subprocessor engaged by Provider to Process Customer Data in connection wit

ARTICLE 7 — SECURITY INCIDENT PROCEDURES 7.1 Security Incident Notification. Provider shall notify Customer of any confirmed Security Incident affecting Customer Data without unreasonable delay, and in any event within twenty-four (24) hours of Provider's discovery of such Security Incident. Notification shall be made to the Customer contacts identified in Section 14.5 of this DPA by telephone and confirmed in writin

ARTICLE 8 — DATA RETENTION, EXPORT, AND DESTRUCTION 8.1 Retention During Term. During the term of the MSA, Provider shall retain Customer Data in accordance with Customer's documented instructions and any applicable retention schedules communicated by Customer to Provider in writing. Provider shall not delete or destroy any Customer Data during the term of the MSA without Customer's prior written authorization, excep

ARTICLE 9 — AUDIT AND INSPECTION RIGHTS 9.1 Audit Right. Customer shall have the right, at its own expense (except as otherwise provided herein), to audit, review, and assess Provider's compliance with this DPA, the security obligations set forth in the MSA and Security Exhibit (Exhibit B), and Applicable Data Protection Laws, no more than once per twelve (12)-month period, upon thirty (30) business days' prior writt

ARTICLE 10 — DATA SUBJECT RIGHTS COORDINATION 10.1 Cooperation. Provider shall, taking into account the nature of the Processing and the information available to Provider, assist Customer by appropriate technical and organizational measures, insofar as is reasonably practicable, in fulfilling Customer's obligations to respond to requests from individuals (including Customer's banking customers, employees, and other d

ARTICLE 11 — PROVIDER PERSONNEL 11.1 Background Checks. All Provider personnel (including employees, independent contractors, temporary staff, and agents) who will have access to Customer Data must undergo comprehensive background checks prior to being granted such access. Background checks shall be consistent with the guidance set forth by the Federal Financial Institutions Examination Council ("FFIEC") and shall in

ARTICLE 12 — COMPLIANCE WITH APPLICABLE DATA PROTECTION LAWS 12.1 Mutual Compliance. Each Party shall comply with its respective obligations under Applicable Data Protection Laws in connection with the Processing of Customer Data contemplated by this DPA. Customer, as Controller, shall be responsible for ensuring that its Processing instructions to Provider comply with Applicable Data Protection Laws. Provider, as Pr

ARTICLE 13 — RELATIONSHIP TO THE MSA 13.1 Incorporation. This DPA is incorporated into and forms an integral part of the MSA as Exhibit C. The terms and conditions of this DPA are supplemental to, and shall be read in conjunction with, the MSA and its other Exhibits and Order Form(s). In the event of any conflict or inconsistency between the terms of this DPA and the terms of the MSA (or any other Exhibit to the MSA)

ARTICLE 14 — GENERAL PROVISIONS 14.1 Governing Law. This DPA shall be governed by, and construed and enforced in accordance with, the laws of the State of Delaware, without regard to its conflict of laws principles or rules that would cause the application of the laws of any other jurisdiction. 14.2 Dispute Resolution. Any dispute, controversy, or claim arising out of or relating to this DPA, or the breach, terminati