Contract analysis

ARTICLE 1 — DEFINITIONS For purposes of this DPA, the following capitalized terms shall have the meanings set forth below. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Services Agreement or, where applicable, in the relevant Applicable Data Protection Laws. 1.1 "Applicable Data Protection Laws" means all United States federal and state privacy and data-protection statu

ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING 2.1 Scope. This DPA applies to all Processing of Personal Information by Service Provider in connection with the Services Agreement, regardless of the medium or form in which such Personal Information is maintained or Processed. The subject matter, duration, nature, and purpose of Processing, the categories of Personal Information Processed, and the categories of Consumers

ARTICLE 3 — LIMITATIONS ON USE, RETENTION, AND DISCLOSURE 3.1 Purpose Limitation. Service Provider shall not Process Personal Information for any purpose other than the specific Business Purposes set forth in Exhibit B and as otherwise permitted by Applicable Data Protection Laws. Without limiting the generality of the foregoing, Service Provider shall not Process Personal Information for Service Provider's own comme

ARTICLE 4 — COMPLIANCE WITH APPLICABLE DATA PROTECTION LAWS 4.1 General Compliance. Service Provider shall comply with all obligations applicable to service providers and processors under Applicable Data Protection Laws, including without limitation the CCPA/CPRA, VCDPA, Colorado CPA, CTDPA, and all other statutes listed in Exhibit A, as such statutes may be amended, supplemented, or replaced from time to time. Servi

ARTICLE 5 — CONFIDENTIALITY AND PERSONNEL 5.1 Confidentiality Obligations. Service Provider shall ensure that all personnel (including employees, contractors, agents, and temporary staff) authorized to Process Personal Information under this DPA are bound by appropriate confidentiality obligations, whether by contract, statute, professional obligation, or otherwise, with respect to such Personal Information. Such con

ARTICLE 6 — SECURITY 6.1 Technical and Organizational Measures. Service Provider shall implement and maintain reasonable and appropriate administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized or unlawful Processing and against accidental loss, destruction, damage, theft, alteration, or unauthorized disclosure. Such safeguards shall be commensurate with the nat

ARTICLE 7 — SUB-PROCESSORS 7.1 Use of Sub-processors. Service Provider shall not engage any Sub-processor to Process Personal Information on behalf of Company without Company's prior [Insert: written consent / general authorization subject to notification and objection right]. Instruction: Select either (a) specific prior written consent for each Sub-processor, or (b) general authorization with a list of approved Sub

ARTICLE 8 — DATA SUBJECT REQUESTS AND CONSUMER RIGHTS 8.1 Notification of Requests. If Service Provider receives a Consumer Rights Request directly from a Consumer (or from any third party acting on behalf of a Consumer, including an authorized agent) relating to Personal Information Processed under this DPA, Service Provider shall promptly, and in any event within [Insert number, e.g., 3] business days, notify Compa

ARTICLE 9 — SECURITY INCIDENTS AND BREACH NOTIFICATION 9.1 Notification Obligation. Service Provider shall notify Company without undue delay, and in any event within [Insert number, e.g., 48] hours after becoming aware of any Security Incident involving Personal Information Processed under this DPA. For purposes of this Section, Service Provider shall be deemed to have become "aware" of a Security Incident at the ti

ARTICLE 10 — AUDITS AND ASSESSMENTS 10.1 Audit Rights. Company shall have the right, upon [Insert number, e.g., 30] days' prior written notice, to audit or inspect (or to engage a qualified independent third-party auditor, subject to reasonable confidentiality obligations, to audit or inspect) Service Provider's Processing activities, information systems, facilities, and records related to the Processing of Personal

ARTICLE 11 — DELETION AND RETURN OF PERSONAL INFORMATION 11.1 Upon Termination or Expiration. Upon termination or expiration of the Services Agreement for any reason, or at any time upon Company's written request, Service Provider shall, at Company's election: (a) return all Personal Information to Company in a structured, commonly used, and machine-readable format designated by Company, together with all copies, ext

ARTICLE 12 — CERTIFICATION OF UNDERSTANDING 12.1 Certification. Service Provider certifies that it understands and will comply with the restrictions and obligations set forth in this DPA and in Applicable Data Protection Laws applicable to service providers and processors, including without limitation the restrictions and obligations set forth in CCPA/CPRA § 1798.140(ag) and § 1798.100(d). Service Provider further ce

ARTICLE 13 — SENSITIVE PERSONAL INFORMATION 13.1 Processing Restrictions. If Service Provider Processes Sensitive Personal Information on behalf of Company, Service Provider shall Process such information only for the specific purposes identified in Exhibit B with respect to Sensitive Personal Information and in strict compliance with Applicable Data Protection Laws, including any applicable consent, opt-in, or notic

ARTICLE 14 — CROSS-BORDER DATA TRANSFERS 14.1 Data Localization. Service Provider shall Process Personal Information only within [Insert jurisdiction(s), e.g., the United States], unless otherwise approved in writing by Company. Service Provider represents and warrants that, as of the Effective Date, all Processing of Personal Information under this DPA occurs within the jurisdictions specified in this Section 14.1,

ARTICLE 15 — INDEMNIFICATION 15.1 Indemnification by Service Provider. Service Provider shall indemnify, defend, and hold harmless Company and its parents, subsidiaries, and affiliates, and their respective directors, officers, employees, agents, successors, and assigns (collectively, the "Company Indemnitees"), from and against all third-party claims, actions, suits, proceedings, liabilities, losses, damages, costs,

ARTICLE 16 — LIABILITY 16.1 Limitation of Liability. [Insert agreed-upon limitation of liability for this DPA. This provision should be coordinated with the limitation-of-liability provisions in the Services Agreement to ensure consistency and should address the following considerations:] (a) [Insert aggregate liability cap, if applicable — e.g., a multiple of fees paid or payable under the Services Agreement during

ARTICLE 17 — TERM AND TERMINATION 17.1 Term. This DPA shall become effective on the Effective Date and shall remain in full force and effect for the duration of the Services Agreement. The obligations of Service Provider under this DPA with respect to Personal Information in its possession, custody, or control shall survive the termination or expiration of this DPA and the Services Agreement until all Personal Inform

ARTICLE 18 — GENERAL PROVISIONS 18.1 Conflicts. In the event of any conflict or inconsistency between the terms of this DPA and the terms of the Services Agreement, or any other agreement between the Parties, the terms of this DPA shall prevail and control with respect to the Processing of Personal Information. In the event of any conflict between the terms of this DPA and the requirements of Applicable Data Protecti