dpa-template-contractors.docx

1038-00010 · Cascade Retail Holdings · Contracts & Vendor Management

dpa-template-contractors.docx DOCUMENT Finance & Banking

10 / 38 ← → ✕

Template Reference: C&H Template — DPA-Contractor-v1.0 Prepared by: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP Date: September 30, 2025 Matter Number: 1038-00010 Client: Cascade Retail Holdings Inc. Classification: Template — For Use with Vendors Qualifying as "Contractors" Under CCPA/CPRA and Equivalent Categories Under Other Applicable State Privacy Statutes

INSTRUCTIONAL NOTE: This is a standard-form template. Bracketed fields and instructions in *bold italic indicate items requiring completion for each specific vendor engagement. Remove all instructional annotations before execution. Contact [Insert name of responsible attorney] with questions.*

MASTER DATA PROCESSING AGREEMENT (CONTRACTORS)

This Master Data Processing Agreement ("DPA" or "Agreement") is entered into as of [Insert Effective Date] (the "Effective Date") by and between:

[Insert full legal name of Company entity], a [Insert state of incorporation/organization and entity type], with its principal place of business at [Insert address] (referred to herein as "Company"); and

[Insert full legal name of Contractor/Vendor], a [Insert state of incorporation/organization and entity type], with its principal place of business at [Insert address] (referred to herein as "Contractor," and together with Company, the "Parties," and each individually a "Party").

RECITALS

WHEREAS, Company and Contractor have entered into one or more underlying agreements for the provision of services (collectively, the "Services Agreement(s)"), pursuant to which Contractor may receive, access, or otherwise Process Personal Information on behalf of Company;

WHEREAS, the Parties intend this DPA to govern Contractor's Processing of Personal Information in connection with the Services Agreement(s), to satisfy the requirements of the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"), and all other applicable United States state privacy and data-protection statutes (collectively with the CCPA, "Applicable Privacy Laws");

WHEREAS, the Parties intend that Contractor's role under this DPA is that of a "contractor" as defined in California Civil Code Section 1798.140(j), and the equivalent classification under other Applicable Privacy Laws where a heightened-restriction category exists, and not that of a "service provider," "processor," or "third party" as those terms are defined in Applicable Privacy Laws; and

WHEREAS, this DPA supplements and is incorporated into the Services Agreement(s), and in the event of any conflict or inconsistency between this DPA and the Services Agreement(s), this DPA shall control with respect to the Processing of Personal Information.

NOW, THEREFORE, in consideration of the mutual promises and covenants contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

Section 1: Definitions

The following defined terms apply throughout this DPA. Capitalized terms not defined herein shall have the meanings given to them in the Services Agreement(s) or in Applicable Privacy Laws, as applicable.

1.1 "Applicable Privacy Laws" means all United States state comprehensive privacy and data-protection statutes applicable to Company's operations as they relate to the Processing of Personal Information, including but not limited to: the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100 et seq.) ("CCPA"); the Virginia Consumer Data Protection Act (Va. Code Ann. §§ 59.1-575 et seq.) ("VCDPA"); the Colorado Privacy Act (Colo. Rev. Stat. §§ 6-1-1301 et seq.) ("CPA"); the Connecticut Data Privacy Act (Conn. Gen. Stat. §§ 42-515 et seq.) ("CTDPA"); the Utah Consumer Privacy Act (Utah Code Ann. §§ 13-61-101 et seq.) ("UCPA"); the Iowa Consumer Data Protection Act (Iowa Code §§ 715D.1 et seq.) ("ICDPA"); the Indiana Consumer Data Protection Act (Ind. Code §§ 24-15-1-1 et seq.) ("INCDPA"); the Tennessee Information Protection Act (Tenn. Code Ann. §§ 47-18-3201 et seq.) ("TIPA"); the Montana Consumer Data Privacy Act (Mont. Code Ann. §§ 30-14-2801 et seq.) ("MCDPA"); the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code §§ 541.001 et seq.) ("TDPSA"); the Oregon Consumer Privacy Act (Or. Rev. Stat. §§ 646A.570 et seq.) ("OCPA"); the Delaware Personal Data Privacy Act (Del. Code Ann. tit. 6, §§ 12D-101 et seq.) ("DPDPA"); the New Jersey Data Privacy Act (N.J. Stat. Ann. §§ 56:8-166 et seq.) ("NJDPA"); the New Hampshire Data Privacy Act (N.H. Rev. Stat. Ann. §§ 507-H:1 et seq.) ("NHDPA"); the Nebraska Data Privacy Act (Neb. Rev. Stat. §§ 87-1101 et seq.) ("NDPA"); the Minnesota Consumer Data Privacy Act (Minn. Stat. §§ 325O.01 et seq.) ("Minnesota MCDPA"); the Maryland Online Data Privacy Act (Md. Code Ann., Com. Law §§ 14-4601 et seq.) ("MODPA"); the Kentucky Consumer Data Protection Act (Ky. Rev. Stat. Ann. §§ 367.700 et seq.) ("KYDPA"); and any other state privacy or data-protection statutes that become effective during the term of this DPA and that are applicable to Company's Processing activities.

*[INSTRUCTION: Update this list as new statutes are enacted or become effective. Confirm applicability of each statute to the Company's operations and the relevant vendor engagement.]*

1.2 "Contractor" means, as defined in California Civil Code Section 1798.140(j), a person to whom Company makes available a Consumer's Personal Information for a Business Purpose, pursuant to a written contract that meets the requirements of CCPA Section 1798.100(d), and that prohibits the Contractor from retaining, using, or disclosing the Personal Information for any purpose other than for the specific Business Purpose(s) identified in this DPA, including retaining, using, or disclosing the Personal Information for a commercial purpose other than the specified Business Purpose(s). The term "Contractor" as used in this DPA also encompasses any equivalent heightened-restriction classification recognized under other Applicable Privacy Laws.

1.3 "Consumer" means a natural person who is a California resident, as defined in California Civil Code Section 1798.140(i), or the equivalent term used under any other Applicable Privacy Law (including, without limitation, "consumer," "data subject," or similar terminology), whose Personal Information is Processed by Contractor in connection with this DPA.

1.4 "De-identified Data" means information that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable Consumer, household, or device, provided that the requirements set forth in California Civil Code Section 1798.140(m) and any equivalent requirements under other Applicable Privacy Laws have been satisfied, including the implementation of technical safeguards, business processes, and contractual obligations that prohibit re-identification.

1.5 "Personal Information" or "PI" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household, as defined in California Civil Code Section 1798.140(v) and equivalent definitions under other Applicable Privacy Laws. This term includes all categories of "personal data," "consumer data," or similar terms used by Applicable Privacy Laws, to the extent such information is Processed by Contractor under or in connection with this DPA.

1.6 "Process" or "Processing" means any operation or set of operations that is performed on Personal Information or on sets of Personal Information, whether or not by automated means, including without limitation collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.

1.7 "Sensitive Personal Information" means Personal Information that reveals or contains: (a) a Consumer's Social Security number, driver's license number, state identification card number, or passport number; (b) a Consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) a Consumer's precise geolocation; (d) a Consumer's racial or ethnic origin, religious or philosophical beliefs, or union membership; (e) the contents of a Consumer's mail, email, and text messages unless the Contractor is the intended recipient of the communication; (f) a Consumer's genetic data; (g) biometric information for the purpose of uniquely identifying a Consumer; (h) Personal Information collected and analyzed concerning a Consumer's health; or (i) Personal Information collected and analyzed concerning a Consumer's sex life or sexual orientation, in each case as defined in California Civil Code Section 1798.140(ae) and equivalent definitions under other Applicable Privacy Laws.

1.8 "Service Provider" means a person that Processes Personal Information on behalf of a business and to which the business discloses a Consumer's Personal Information for a business purpose pursuant to a written contract, as defined in California Civil Code Section 1798.140(ag). This definition is included for purposes of contrast and clarification; Contractor does not operate in a Service Provider capacity under this DPA.

1.9 "Sub-Contractor" means any third party engaged by Contractor to assist in Processing Personal Information on behalf of Company under this DPA, including any subprocessor, subcontractor, or agent of Contractor that receives, accesses, or otherwise Processes Personal Information in connection with the performance of Contractor's obligations under this DPA or the Services Agreement(s).

1.10 "Business Purpose" means the use of Personal Information for Company's or Contractor's operational purposes, or other notified purposes, as defined in California Civil Code Section 1798.140(e), and the specific purposes for which Personal Information is made available to Contractor, as set forth in Schedule A attached hereto and incorporated herein by reference.

1.11 "Third Party" means a person who is not the business with which the Consumer intentionally interacts and that collects Personal Information from the Consumer, as defined in California Civil Code Section 1798.140(ai), or the equivalent definition under other Applicable Privacy Laws. Contractor acknowledges and agrees that it is not authorized to act as a Third Party with respect to the Personal Information received under this DPA.

Section 2: Scope of Processing

2.1 Subject Matter and Duration. Contractor shall Process Personal Information solely in connection with the services described in the Services Agreement(s) and this DPA and only as necessary to perform such services on behalf of Company. The duration of Processing shall correspond to the term of the Services Agreement(s), unless earlier terminated or extended by written amendment executed by both Parties. Contractor shall not Process Personal Information before the Effective Date or after the termination or expiration of this DPA, except as expressly provided in Section 10 (Data Retention, Return, and Deletion).

2.2 Categories of Personal Information. The categories of Personal Information subject to Processing under this DPA are set forth in Schedule A. The Parties acknowledge that the categories of Personal Information may be updated from time to time by mutual written agreement to reflect changes in the scope of the Services Agreement(s) or the data elements involved.

*[INSTRUCTION: Complete Schedule A for each vendor engagement, specifying all categories of PI involved — e.g., identifiers, commercial information, internet/network activity, geolocation data, inferences, sensitive personal information. Be as specific as practicable to ensure the scope of permissible Processing is clearly delineated.]*

2.3 Categories of Consumers. The categories of Consumers whose Personal Information is Processed under this DPA are set forth in Schedule A. Contractor shall not Process Personal Information relating to categories of Consumers not identified in Schedule A without Company's prior written authorization.

*[INSTRUCTION: Specify all categories of Consumers — e.g., retail customers, loyalty-program members, online visitors, marketplace sellers, employees, job applicants. Where Contractor may Process employee PI, confirm that applicable employee-data provisions and any employee privacy notices are addressed.]*

2.4 Business Purpose(s). Contractor shall Process Personal Information only for the specific Business Purpose(s) identified in Schedule A. Contractor shall not Process Personal Information for any purpose outside the scope of the identified Business Purpose(s), including for Contractor's own commercial purposes, without Company's express prior written consent.

*[INSTRUCTION: Specify the particular business purposes — e.g., analytics, order fulfillment support, advertising measurement, customer-service support, fraud detection and prevention. Reference Cal. Civ. Code § 1798.140(e) enumerated purposes as applicable.]*

2.5 Nature of Processing. Schedule A shall describe the nature of the Processing operations to be performed by Contractor, including without limitation the types of Processing activities (e.g., storage, analysis, transmission, aggregation, anonymization, profiling, segmentation) and the systems, platforms, and environments in which such Processing will occur. Contractor shall not materially alter the nature of its Processing operations without Company's prior written consent.

Section 3: Contractor Obligations — General Restrictions

3.1 Purpose Limitation. Contractor shall not retain, use, or disclose Personal Information for any purpose other than the specific Business Purpose(s) set forth in Schedule A and as otherwise expressly permitted by this DPA. Without limiting the foregoing, Contractor shall not retain, use, or disclose the Personal Information for a commercial purpose other than providing the services specified in the Services Agreement(s) and this DPA. Contractor acknowledges that it is prohibited from using Personal Information for purposes such as marketing its own products or services to Consumers, enriching its own data assets, or developing products or services for other clients, unless such use is expressly identified as a Business Purpose in Schedule A and is permitted under Applicable Privacy Laws.

3.2 Prohibition on Combining Personal Information. Contractor shall not combine the Personal Information received from, or on behalf of, Company with (a) Personal Information that Contractor receives from, or on behalf of, another person or persons, or (b) Personal Information that Contractor collects from its own interaction with Consumers, except as expressly permitted by California Civil Code Section 1798.140(j)(1)(A)(iv) — that is, to the extent necessary to perform the Business Purpose(s) specified in Schedule A, subject to the restrictions set forth in this DPA and Applicable Privacy Laws. This prohibition extends to combining, merging, appending, linking, or otherwise joining Company's Personal Information with any external data sets, customer files, or other personal information maintained by Contractor in connection with its operations or its engagements with other entities.

*[NOTE: This prohibition is a heightened restriction distinguishing the Contractor template from the Service Provider template. It reflects the specific CCPA § 1798.140(j) requirement that Contractors may not combine PI across client engagements. This restriction should be carefully reviewed with each vendor to ensure understanding and operational compliance.]*

3.3 Prohibition on Sale or Sharing. Contractor shall not sell or share (as those terms are defined by Applicable Privacy Laws, including California Civil Code Sections 1798.140(ad) and 1798.140(ah)) any Personal Information received under this DPA. Contractor shall not make Personal Information available to any Third Party for cross-context behavioral advertising or any other purpose that would constitute a "sale" or "sharing" of Personal Information under Applicable Privacy Laws. This prohibition applies regardless of whether Contractor receives monetary or other valuable consideration in connection with such disclosure.

3.4 Prohibition on Retention Beyond Business Purpose. Contractor shall not retain Personal Information after the Business Purpose(s) have been fulfilled, unless retention is required by applicable law. Contractor shall implement and maintain internal policies and procedures to ensure that Personal Information is not retained beyond the period necessary to fulfill the applicable Business Purpose(s). Upon completion of the Business Purpose(s) or at Company's request, Contractor shall delete or return Personal Information in accordance with Section 10 of this DPA.

3.5 Compliance with Applicable Privacy Laws. Contractor shall comply with all Applicable Privacy Laws with respect to its Processing of Personal Information under this DPA and shall provide the same level of privacy protection as is required by Applicable Privacy Laws. In the event that Contractor determines that it can no longer meet its obligations under Applicable Privacy Laws or this DPA, Contractor shall promptly notify Company in writing, and Company may take appropriate steps, including those described in Section 5.4 and Section 14.3, to address such non-compliance.

3.6 No Derogation. Contractor shall not take any action that would cause any transfer of Personal Information to or from Contractor to qualify as a "sale" or "sharing" of Personal Information under Applicable Privacy Laws. Contractor shall structure its operations, systems, and relationships with Sub-Contractors and other third parties so as to ensure that its receipt and Processing of Personal Information under this DPA is and remains consistent with the "contractor" classification set forth in Section 1.2 and the requirements of Applicable Privacy Laws.

Section 4: Contractor Certifications

4.1 Certification of Understanding. Contractor certifies that it understands and will comply with the restrictions and obligations set forth in this DPA, including but not limited to:

(a) the prohibition on retaining, using, or disclosing Personal Information for any purpose other than the specified Business Purpose(s) set forth in Schedule A;

(b) the prohibition on combining Personal Information received from Company with Personal Information received from other persons or collected from Contractor's own interaction with Consumers, except as expressly permitted by this DPA and Applicable Privacy Laws;

(c) the obligation to comply with all Applicable Privacy Laws applicable to Contractor's Processing of Personal Information under this DPA;

(d) the obligation to cooperate with Company's compliance-monitoring activities, including audits, assessments, and certifications, as described in Section 5 of this DPA; and

(e) the obligation to notify Company if Contractor determines that it can no longer meet its obligations under this DPA or Applicable Privacy Laws.

4.2 Annual Certification. Not less than once per calendar year, and additionally upon Company's written request at any time, Contractor shall provide Company with a written certification signed by a duly authorized officer of Contractor (at the level of vice president or above) confirming Contractor's continued compliance with this DPA and all Applicable Privacy Laws during the applicable certification period. The form of such certification shall be substantially in the form set forth in Schedule D attached hereto. The annual certification shall be delivered to Company no later than [Insert date — e.g., January 31] of each calendar year during the term of this DPA. Where Company submits a written request for certification outside the annual cycle, Contractor shall deliver the requested certification within [Insert number — e.g., 30] calendar days of receipt of Company's written request.

*[INSTRUCTION: Adjust timing to align with Company's privacy-program assessment cycle. Cascade's current program contemplates annual certifications due by January 31 of each year, with supplemental certifications upon request for high-risk contractor relationships.]*

4.3 Certification Upon Termination. Upon termination or expiration of the Services Agreement(s) or this DPA, whichever occurs first, Contractor shall certify in writing, within the time period specified in Section 10.3, that it has deleted or returned all Personal Information in Contractor's possession, custody, or control in accordance with Section 10, except to the extent retention is permitted under Section 10.4.

Section 5: Compliance Monitoring and Audit Rights

5.1 Right to Monitor. Company shall have the right, upon [Insert number — e.g., 15] business days' prior written notice to Contractor, to take reasonable and appropriate steps to help ensure that Contractor's use of Personal Information is consistent with Company's obligations under Applicable Privacy Laws and this DPA. Such steps may include, without limitation, ongoing manual reviews of Contractor's privacy practices and data-handling procedures, automated scans and technical assessments of systems and platforms used by Contractor to Process Personal Information, regular assessments based on questionnaires or information requests, and formal audits conducted by Company or its designated agents. Company's exercise of its monitoring rights under this Section 5.1 shall not relieve Contractor of any of its obligations under this DPA.

5.2 Audit Rights. Company (or its designated third-party auditor or agent, subject to reasonable confidentiality obligations) shall have the right to audit Contractor's Processing of Personal Information no more than [Insert number — e.g., once per 12-month period] during the term of this DPA; provided, however, that Company may conduct additional audits in the event of a Security Incident, a material change in Applicable Privacy Laws, or a reasonable belief that Contractor is not in compliance with this DPA. Contractor shall make available to Company all information, systems, records, and documentation necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including on-site inspections of Contractor's data-processing facilities, systems, and records, during normal business hours and upon reasonable advance notice. Contractor shall bear its own costs incurred in connection with such audits. If an audit reveals material non-compliance, Contractor shall bear the reasonable costs incurred by Company (or its designated auditor) in conducting the audit.

*[INSTRUCTION: Consider whether the Company requires more frequent audit rights — e.g., semi-annually for high-risk contractors. Note: Cascade's program targets heightened monitoring for contractors processing Sensitive PI or large volumes of PI (defined as more than 100,000 Consumer records).]*

5.3 Cooperation. Contractor shall cooperate fully and in good faith with Company's compliance-monitoring activities described in this Section 5 and shall promptly provide all information, documentation, system access, and personnel assistance reasonably requested by Company or its designated auditor in connection with such activities. Contractor shall designate a primary point of contact to coordinate with Company on compliance-monitoring matters and shall ensure that such contact is responsive to Company's inquiries within a reasonable time frame, and in no event more than ten (10) business days from the date of Company's request.

5.4 Remediation. If Company determines, through monitoring, audit, certification review, or otherwise, that Contractor is not in compliance with this DPA or Applicable Privacy Laws, Company shall notify Contractor in writing, specifying the nature of the non-compliance and the corrective actions required. Contractor shall take prompt corrective action to remediate the non-compliance and shall report to Company on the status of remediation. If Contractor fails to cure the non-compliance within [Insert number — e.g., 30] calendar days of receipt of Company's written notice (or such shorter period as is reasonable under the circumstances given the nature and severity of the non-compliance), Company shall have the right, in its sole discretion and without prejudice to any other rights or remedies available to it under this DPA, at law, or in equity, to:

(a) suspend Contractor's Processing of Personal Information, in whole or in part, until such time as the non-compliance has been cured to Company's reasonable satisfaction;

(b) require Contractor to delete or return all Personal Information in Contractor's possession, custody, or control in accordance with Section 10;

(c) terminate this DPA and the Services Agreement(s) immediately without penalty, liability, or obligation to Company; and/or

(d) exercise any other remedies available under this DPA, the Services Agreement(s), or applicable law.

5.5 Stop Processing Obligation. Company shall have the right, upon written notice to Contractor, to require Contractor to stop Processing Personal Information, in whole or in part, if Company determines in good faith that Contractor is Processing Personal Information in a manner inconsistent with this DPA, Applicable Privacy Laws, or Company's instructions. Upon receipt of such a stop-processing directive, Contractor shall cease the identified Processing activities within [Insert number — e.g., 5] business days (or such shorter period as Company specifies, to the extent reasonably practicable) and shall confirm compliance with the directive in writing to Company. Contractor shall not resume the affected Processing activities until Company provides written authorization to do so.

Section 6: Consumer Rights Assistance

6.1 Consumer-Rights Requests. Contractor shall assist Company in fulfilling its obligations to respond to verifiable consumer requests to exercise rights under Applicable Privacy Laws. Such rights include, without limitation, requests to:

(a) know and access the Personal Information collected about a Consumer;

(b) delete Personal Information held about a Consumer;

(d) port Personal Information in a structured, commonly used, and machine-readable format;

(e) opt out of the sale or sharing of Personal Information;

(f) limit the use and disclosure of Sensitive Personal Information; and

(g) exercise any other rights conferred by Applicable Privacy Laws.

Contractor shall respond to Company's instructions regarding such requests within [Insert number — e.g., 5] business days of receiving the instruction, or such shorter period as may be required for Company to meet the response deadlines established by Applicable Privacy Laws. Contractor shall implement and maintain systems and processes sufficient to enable it to comply with Company's consumer-rights request instructions in a timely and accurate manner.

6.2 Direct Consumer Requests. If Contractor receives any request directly from a Consumer regarding Personal Information Processed under this DPA, including but not limited to requests to access, delete, correct, or opt out, Contractor shall promptly — and in no event later than [Insert number — e.g., 2] business days after receipt of such request — redirect the Consumer to Company and notify Company's designated privacy contact:

[Insert name, title, and contact information of Company's designated privacy contact]

Contractor shall not independently respond to, act upon, or fulfill any such Consumer request unless expressly authorized by Company in writing, in advance, on a case-by-case or categorical basis. Contractor shall maintain a log of all direct Consumer requests received and shall make such log available to Company upon request.

6.3 Information for Responses. Contractor shall maintain the technical and organizational capability to search for, retrieve, identify, and — if applicable — delete, correct, or export Personal Information that it Processes on behalf of Company, in order to enable Company to comply with Applicable Privacy Laws' consumer-rights requirements. Contractor shall ensure that its systems and processes support the ability to respond to consumer requests at the individual-consumer level and within the time frames required by Applicable Privacy Laws. Where Personal Information is stored across multiple systems, databases, or archives, Contractor shall ensure that its search and retrieval capabilities extend to all such locations.

6.4 Opt-Out signal compliance. To the extent Contractor Processes Personal Information obtained through or in connection with online properties (including websites, mobile applications, connected devices, and other digital platforms) on behalf of Company, Contractor shall honor opt-out preference signals received by Company and communicated to Contractor, including without limitation the Global Privacy Control ("GPC") signal as recognized under the CCPA and other Applicable Privacy Laws. Contractor shall implement and maintain the technical capability to receive, interpret, and act upon opt-out preference signals within the systems and platforms it operates on behalf of Company, and shall treat such signals as valid opt-out requests in accordance with Applicable Privacy Laws unless Company provides contrary instructions consistent with applicable law.

Section 7: Sub-Contractors

7.1 Restrictions on Sub-Contracting. Contractor shall not engage any Sub-Contractor to Process Personal Information on behalf of Company without Company's prior written consent, which may be granted or withheld in Company's sole discretion. For the avoidance of doubt, this restriction applies to any arrangement in which a Sub-Contractor would receive, access, store, or otherwise Process Personal Information that Contractor has obtained from or on behalf of Company under this DPA.

*[INSTRUCTION: Determine whether to require prior written consent for each Sub-Contractor (specific consent) or to permit a list of approved Sub-Contractors (general consent with notification of changes). If the latter, add a mechanism for Company to object to the addition of new Sub-Contractors within a specified notice period. The general consent approach may be appropriate for Contractors with established Sub-Contractor networks, subject to Company's right to object.]*

7.2 Sub-Contractor Agreements. Where Company consents to the engagement of a Sub-Contractor, Contractor shall, prior to allowing such Sub-Contractor to Process Personal Information, enter into a written agreement with such Sub-Contractor that imposes data-protection obligations no less restrictive than those imposed on Contractor under this DPA. Such Sub-Contractor agreement shall include, at a minimum:

(a) the purpose limitation and prohibition on retaining, using, or disclosing Personal Information for purposes other than the specified Business Purpose(s);

(b) the prohibition on combining Personal Information from multiple sources, as set forth in Section 3.2;

(d) certification requirements substantially equivalent to those set forth in Section 4;

(e) compliance-monitoring provisions substantially equivalent to those set forth in Section 5;

(f) data-security obligations substantially equivalent to those set forth in Section 8 and Schedule C;

(g) breach-notification obligations substantially equivalent to those set forth in Section 9; and

(h) data return/deletion obligations substantially equivalent to those set forth in Section 10.

Contractor shall provide Company with copies of Sub-Contractor agreements (or relevant excerpts thereof) upon Company's written request.

7.3 Liability. Contractor shall remain fully liable to Company for the acts, omissions, and non-compliance of its Sub-Contractors with respect to Personal Information Processed under this DPA, as if such acts, omissions, or non-compliance were those of Contractor itself. Contractor's engagement of a Sub-Contractor shall not relieve Contractor of any of its obligations under this DPA or the Services Agreement(s).

7.4 Sub-Contractor List. Contractor shall maintain a current and accurate list of all Sub-Contractors Processing Personal Information under this DPA, including the name, address, and description of Processing activities of each Sub-Contractor. Contractor shall provide such list to Company upon request and shall notify Company in writing of any proposed additions to or removals from the Sub-Contractor list at least [Insert number — e.g., 30] calendar days prior to the proposed change. Schedule B attached hereto sets forth the initial list of approved Sub-Contractors as of the Effective Date.

Section 8: Data Security

8.1 Security Measures. Contractor shall implement and maintain reasonable and appropriate administrative, technical, and physical safeguards designed to protect Personal Information from unauthorized access, use, disclosure, alteration, loss, or destruction, consistent with industry standards (including, where applicable, NIST Cybersecurity Framework, CIS Controls, or equivalent frameworks), the requirements of Applicable Privacy Laws, and the nature and sensitivity of the Personal Information Processed. Contractor's security measures shall be no less protective than those described in Schedule C attached hereto. Contractor shall periodically review and update its security measures to address evolving threats, vulnerabilities, and industry best practices.

8.2 Sensitive Personal Information. Where Contractor Processes Sensitive Personal Information (including, without limitation, precise geolocation data, payment-card data, financial account information, account login credentials, biometric data, health information, or any other category of Sensitive Personal Information as defined in Section 1.7), Contractor shall implement enhanced security measures appropriate to the sensitivity and volume of such information. Such enhanced measures shall include, at a minimum:

(a) encryption of Sensitive Personal Information at rest and in transit using industry-standard encryption algorithms and key-management practices;

(b) role-based access controls limiting access to Sensitive Personal Information to personnel with a demonstrated business need;

(d) comprehensive logging and monitoring of access to Sensitive Personal Information, with logs retained for a minimum of [Insert number — e.g., 12] months; and

(e) segregation of Sensitive Personal Information from other data, to the extent technically feasible.

*[INSTRUCTION: Specify any additional security requirements for Sensitive PI categories relevant to the Company's operations. Consult with Company's CISO or information-security team to confirm minimum requirements.]*

8.3 Personnel. Contractor shall ensure that all personnel (including employees, temporary workers, and independent contractors) authorized to Process Personal Information under this DPA: (a) are subject to binding obligations of confidentiality that survive the termination of their relationship with Contractor; (b) have received appropriate training on data protection, privacy, and information security prior to being granted access to Personal Information and on a periodic basis thereafter (not less than annually); and (c) are subject to disciplinary measures for violations of data-protection obligations. Contractor shall limit access to Personal Information to those personnel who require such access to perform the services under the Services Agreement(s).

8.4 Security Assessment. Upon Company's written request (not more than once per calendar year, unless a Security Incident has occurred or Company has a reasonable basis for concern regarding Contractor's security posture), Contractor shall provide Company with:

(a) a summary of Contractor's current information-security program, including the organizational structure, governance, and key policies;

(b) results of any relevant third-party security assessments, certifications, or audit reports (e.g., SOC 2 Type II report, ISO/IEC 27001 certification, PCI-DSS Report on Compliance), subject to reasonable confidentiality protections; and

(c) evidence of remediation of material findings identified in such assessments or reports, including a timeline for remediation of any open findings.

Section 9: Security Incident / Breach Notification

9.1 Definition. For purposes of this DPA, "Security Incident" means any actual or reasonably suspected unauthorized access to, acquisition of, use of, disclosure of, or destruction of Personal Information Processed by Contractor under this DPA, or any breach or compromise of Contractor's security measures that affects or is reasonably likely to affect the confidentiality, integrity, or availability of Personal Information. A Security Incident includes, without limitation, any "breach of the security of the system" or "data breach" as defined under Applicable Privacy Laws or applicable state data-breach notification statutes.

9.2 Notification. Contractor shall notify Company's designated privacy contact at:

[Insert name, title, email address, and telephone number of Company's designated privacy/security incident contact]

of any Security Incident without unreasonable delay and, in any event, within [Insert number — e.g., 48] hours of Contractor becoming aware of the Security Incident (or reasonably suspecting that a Security Incident has occurred). Such notification shall include, to the extent known at the time of notification:

(a) the nature and scope of the Security Incident, including a description of the incident and the systems, data, and facilities affected;

(b) the categories and approximate number of Consumers and Personal Information records affected or potentially affected;

(d) the measures taken or proposed to be taken by Contractor to address the Security Incident, mitigate its effects, and prevent recurrence; and

(e) the identity and contact information of Contractor's designated incident-response lead.

If Contractor is unable to provide all of the foregoing information at the time of initial notification, Contractor shall provide such information on a rolling basis as it becomes available, without undue delay.

9.3 Cooperation. Contractor shall cooperate fully with Company in investigating and remediating any Security Incident and shall provide Company with all information, documentation, and technical assistance reasonably necessary for Company to: (a) assess the scope and impact of the Security Incident; (b) comply with its own breach-notification obligations under Applicable Privacy Laws, including any applicable state data-breach notification statutes; (c) respond to inquiries from regulatory authorities, affected Consumers, or the media; and (d) mitigate harm to affected Consumers. Contractor shall designate a senior representative to serve as the primary point of contact with Company for all matters related to the Security Incident and shall ensure that such representative is available and responsive throughout the investigation and remediation process.

9.4 No Unauthorized Notifications. Contractor shall not notify any Consumer, regulatory authority, law enforcement agency, media outlet, or other third party of a Security Incident involving Personal Information Processed under this DPA without Company's prior written approval, unless Contractor is independently and separately required by applicable law to make such notification (in which case Contractor shall provide Company with advance notice of the notification and a copy of any proposed notification to the extent permitted by applicable law, and shall afford Company a reasonable opportunity to review and comment on the notification prior to issuance).

9.5 Records. Contractor shall maintain comprehensive records of all Security Incidents, including the facts relating to each incident, its effects, the remedial actions taken, and the timeline of response activities. Such records shall be retained for a minimum of [Insert number — e.g., five (5)] years following the resolution of the Security Incident and shall be made available to Company upon request. Contractor shall incorporate lessons learned from Security Incidents into its ongoing information-security program.

Section 10: Data Retention, Return, and Deletion

10.1 Retention Limitation. Contractor shall not retain Personal Information for longer than is reasonably necessary to fulfill the Business Purpose(s) specified in Schedule A, and in no event longer than [Insert retention period or mechanism for determining retention period — e.g., the term of the Services Agreement(s) plus thirty (30) days, or as specified in Company's Data Retention and Disposal Schedule, a copy of which has been provided to Contractor]. Contractor shall implement and enforce internal data-retention policies and schedules that are consistent with this Section 10.1 and shall apply such policies to all copies, backups, and archived instances of Personal Information.

*[INSTRUCTION: Align with Company's Data Retention & Disposal Schedule. Ensure that the retention period specified here is consistent with the retention periods established by Company's privacy program and the requirements of Applicable Privacy Laws.]*

10.2 Return or Deletion. Upon the earliest of: (a) Company's written request at any time during the term; (b) completion of the Business Purpose(s) for which Personal Information was provided to Contractor; or (c) termination or expiration of the Services Agreement(s) or this DPA, whichever occurs first, Contractor shall, at Company's sole election:

(i) promptly return all Personal Information to Company in a structured, commonly used, and machine-readable format reasonably designated by Company; or

(ii) securely delete and destroy all Personal Information in Contractor's possession, custody, or control, including all copies, reproductions, backups, archived data, disaster-recovery copies, and any other instances of Personal Information, using methods consistent with industry-standard data-destruction practices (e.g., NIST SP 800-88 guidelines) and the sensitivity of the information involved.

Company shall communicate its election to Contractor in writing. If Company does not make an election within [Insert number — e.g., 30] calendar days of the triggering event, Contractor shall securely delete all Personal Information in accordance with this Section 10.2.

10.3 Certification of Deletion. Within [Insert number — e.g., 30] calendar days of the deletion of Personal Information pursuant to this Section 10, Contractor shall provide Company with a written certification, signed by a duly authorized officer of Contractor, confirming that all Personal Information (including all copies, backups, and archived data) has been securely deleted in accordance with this Section 10. The certification shall describe the method of deletion used and the date(s) on which deletion was completed.

10.4 Exceptions. Contractor may retain Personal Information beyond the periods specified in this Section 10 only to the extent required by applicable law (including, for the avoidance of doubt, any applicable record-retention statute, regulation, or legal hold obligation), provided that:

(a) Contractor limits the retention to the minimum scope and duration necessary to comply with the applicable legal requirement;

(b) Contractor notifies Company in writing of the legal basis for retention, the specific categories of Personal Information retained, and the anticipated duration of retention;

(c) Contractor continues to protect such Personal Information in accordance with the terms of this DPA, including the data-security requirements of Section 8 and Schedule C; and

(d) Contractor does not use or Process such retained Personal Information for any purpose other than compliance with the applicable legal requirement.

Section 11: De-identified and Aggregated Data

11.1 De-identification. If Contractor de-identifies Personal Information in connection with its performance under this DPA, Contractor shall:

(a) take reasonable measures to ensure that the De-identified Data cannot be associated with, linked to, or used to identify any specific Consumer, household, or device;

(b) publicly commit to maintaining and using the information in de-identified form and not attempt to re-identify the information, except solely for the purpose of determining whether its de-identification processes satisfy the requirements of Applicable Privacy Laws;

(c) implement technical safeguards and business processes that specifically prohibit re-identification of the information;

(d) contractually obligate any recipients of De-identified Data to comply with the same de-identification requirements set forth in this Section 11.1; and

(e) comply with all requirements for de-identified information set forth in California Civil Code Section 1798.140(m) and equivalent provisions under other Applicable Privacy Laws.

11.2 Aggregated Data. Contractor may create aggregated, de-identified data derived from Personal Information solely for the purpose of providing the services under the Services Agreement(s), provided that: (a) such data meets the de-identification requirements of Applicable Privacy Laws and this Section 11; (b) such data cannot be used, either alone or in combination with other information, to identify any individual Consumer; and (c) Contractor does not use such aggregated, de-identified data to enrich data sets maintained for other clients, develop independent products or services, or for any commercial purpose unrelated to the services provided under the Services Agreement(s), unless expressly authorized by Company in writing.

Section 12: Representations and Warranties

12.1 Contractor Representations. Contractor represents and warrants to Company that:

(a) Contractor has the legal authority and organizational capability to enter into this DPA and to comply with all of its obligations hereunder;

(b) Contractor will not Process Personal Information in a manner that violates Applicable Privacy Laws or that is inconsistent with the terms of this DPA;

(c) Contractor has implemented and will maintain throughout the term of this DPA reasonable administrative, technical, and physical security measures consistent with the requirements of Section 8 and Schedule C;

(d) Contractor is not aware of any circumstances, pending or threatened litigation, regulatory action, or other matter that would prevent it from fulfilling its obligations under this DPA;

(e) Contractor does not, and will not during the term of this DPA, meet the definition of a "Third Party" under California Civil Code Section 1798.140(ai) or equivalent definitions under other Applicable Privacy Laws with respect to the Personal Information received under this DPA;

(f) Contractor's representations in this Section 12.1 are true, accurate, and complete as of the Effective Date and will remain true, accurate, and complete throughout the term of this DPA; and

(g) Contractor will promptly notify Company in writing if any of its representations and warranties under this Section 12.1 become inaccurate or incomplete at any time during the term.

12.2 Company Representations. Company represents and warrants to Contractor that:

(a) Company has provided all required notices and obtained all required consents from Consumers for the Processing of Personal Information by Contractor as contemplated by this DPA and the Services Agreement(s), to the extent such notices and consents are required by Applicable Privacy Laws;

(b) Company's instructions to Contractor regarding the Processing of Personal Information comply with Applicable Privacy Laws; and

(c) Company has the legal authority to enter into this DPA and to make Personal Information available to Contractor for Processing as described in Schedule A.

Section 13: Indemnification

13.1 Contractor Indemnification. Contractor shall indemnify, defend, and hold harmless Company and its affiliates, and their respective officers, directors, members, managers, employees, agents, successors, and assigns (collectively, "Company Indemnitees"), from and against any and all claims, demands, actions, suits, investigations, proceedings, losses, liabilities, damages, fines, penalties, assessments, judgments, settlements, costs, and expenses (including reasonable attorneys' fees and costs of litigation, investigation, and remediation) (collectively, "Losses") arising out of or relating to:

(a) any breach by Contractor of its obligations, representations, or warranties under this DPA;

(b) any violation by Contractor of Applicable Privacy Laws in connection with its Processing of Personal Information under this DPA;

(c) any Security Incident to the extent caused by Contractor's acts, omissions, negligence, or willful misconduct, or Contractor's failure to implement and maintain the security measures required by this DPA;

(d) any act, omission, or non-compliance of Contractor's Sub-Contractors with respect to Personal Information Processed under this DPA; and

(e) any claim by a Consumer or regulatory authority arising from Contractor's unauthorized Processing, use, disclosure, sale, or sharing of Personal Information in violation of this DPA or Applicable Privacy Laws.

*[INSTRUCTION: Review and negotiate indemnification scope, caps, and carve-outs with each Contractor. Consider whether to include coverage for regulatory fines and penalties, and whether the indemnification should be subject to any aggregate cap or the limitations of liability in the Services Agreement(s). Certain Applicable Privacy Laws may impose penalties of up to $7,500 per intentional violation. Consult with responsible attorney.]*

13.2 Mutual Limitations. The indemnification obligations set forth in this Section 13 are subject to any mutually agreed-upon limitations of liability set forth in the Services Agreement(s); provided, however, that the Parties acknowledge that certain Applicable Privacy Laws may restrict the ability of the Parties to limit liability for privacy violations, and nothing in this DPA or the Services Agreement(s) shall be construed to limit Contractor's liability to the extent prohibited by applicable law.

*[INSTRUCTION: Insert any agreed-upon limitations of liability from the Services Agreement(s), noting that certain Applicable Privacy Laws may restrict the ability to limit liability for privacy violations. Consult with responsible attorney before agreeing to caps on indemnification for data-privacy breaches. Consider whether data-privacy indemnification should be carved out from any general cap on liability in the Services Agreement(s).]*

Section 14: Term and Termination

14.1 Term. This DPA shall become effective on the Effective Date and shall remain in full force and effect for the duration of the Services Agreement(s) and for so long as Contractor retains any Personal Information in its possession, custody, or control, unless earlier terminated in accordance with this Section 14.

14.2 Termination for Breach. Either Party may terminate this DPA upon written notice to the other Party if the other Party materially breaches this DPA and fails to cure such breach within [Insert number — e.g., 30] calendar days of receiving written notice from the non-breaching Party specifying the nature of the breach in reasonable detail. If the breach is not capable of cure, the non-breaching Party may terminate this DPA immediately upon written notice.

14.3 Termination for Non-Compliance. Company may terminate this DPA immediately upon written notice to Contractor, without opportunity to cure, if:

(a) Contractor fails to comply with a stop-processing directive issued by Company under Section 5.5 within the time period specified therein;

(b) Company reasonably determines that Contractor can no longer meet its obligations under Applicable Privacy Laws, including as a result of a change in law, a regulatory enforcement action against Contractor, or a material change in Contractor's operations or business practices;

(d) Contractor is found to have made a materially false or misleading certification under Section 4.

14.4 Effect of Termination. Upon termination or expiration of this DPA for any reason:

(a) Contractor shall immediately cease all Processing of Personal Information under this DPA, except as necessary to comply with its data return/deletion obligations under Section 10;

(b) the provisions of this DPA relating to data return and deletion (Section 10), certification upon termination (Section 4.3), indemnification (Section 13), audit rights (Section 5, which shall survive for a period of [Insert number — e.g., 12] months following the effective date of termination), confidentiality, representations and warranties (Section 12), de-identified and aggregated data (Section 11), and this Section 14.4 shall survive termination or expiration; and

(c) termination of this DPA shall not relieve either Party of any liability arising from a breach of this DPA that occurred prior to the effective date of termination.

Section 15: Miscellaneous

15.1 Governing Law. This DPA shall be governed by and construed in accordance with the laws of the State of [Insert state], without regard to its conflict-of-laws principles. Nothing in this Section 15.1 shall be construed to limit the applicability of Applicable Privacy Laws of other states to the Processing of Personal Information under this DPA.

*[INSTRUCTION: Typically the law governing the Services Agreement(s). Cascade's standard form uses the laws of the State of Washington.]*

15.2 Entire Agreement. This DPA, together with the Services Agreement(s) and Schedules A, B, C, and D attached hereto and incorporated herein by reference, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations, discussions, and representations, whether written or oral, relating to the Processing of Personal Information in connection with the Services Agreement(s).

15.3 Amendments. This DPA may be amended, modified, or supplemented only by a written instrument executed by duly authorized representatives of both Parties, except as provided in Section 15.9 with respect to regulatory updates.

15.4 Severability. If any provision of this DPA is held by a court of competent jurisdiction or regulatory authority to be invalid, illegal, or unenforceable, the remaining provisions of this DPA shall remain in full force and effect, and the invalid, illegal, or unenforceable provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving the Parties' original intent, or if such modification is not possible, such provision shall be deemed severed from this DPA.

15.5 Notices. All notices, requests, demands, consents, and other communications required or permitted under this DPA shall be in writing and shall be deemed duly given: (a) upon delivery, if delivered by hand; (b) upon confirmation of transmission, if sent by email to the email address specified below; or (c) one (1) business day after deposit with a nationally recognized overnight courier service, or three (3) business days after deposit in the United States mail, postage prepaid, certified or registered, return receipt requested, addressed to the applicable Party at the address set forth in the preamble of this DPA, or to such other address or email address as either Party may designate by written notice to the other Party.

*[INSTRUCTION: Specify notice methods, addresses, and email contacts for each Party. Include both legal/contracts notice addresses and privacy-specific notice contacts.]*

15.6 Waiver. No failure or delay by either Party in exercising any right, power, or remedy under this DPA shall operate as a waiver thereof, nor shall any single or partial exercise of any right, power, or remedy preclude any other or further exercise thereof or the exercise of any other right, power, or remedy. No waiver of any provision of this DPA shall be effective unless in writing and signed by the Party granting the waiver.

15.7 Assignment. Contractor shall not assign, delegate, or transfer this DPA or any of its rights, obligations, or duties hereunder without Company's prior written consent, which may be withheld in Company's sole discretion. Any purported assignment, delegation, or transfer in violation of this Section 15.7 shall be null and void. Company may assign this DPA to an affiliate or to a successor in connection with a merger, acquisition, reorganization, or sale of all or substantially all of Company's assets, upon written notice to Contractor.

15.8 Counterparts. This DPA may be executed in one or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Execution and delivery of this DPA by electronic signature (including PDF or Brightwater Software) shall be deemed to have the same legal effect as delivery of an original signed copy.

15.9 Regulatory Updates. The Parties acknowledge that Applicable Privacy Laws are evolving and that new state privacy statutes may be enacted or existing statutes may be amended during the term of this DPA. Company may update this DPA (including any Schedules hereto) upon [Insert number — e.g., 60] calendar days' written notice to Contractor to reflect changes in Applicable Privacy Laws, regulatory guidance, or enforcement interpretations that affect the Parties' obligations with respect to the Processing of Personal Information. If Contractor objects to any such update, Contractor shall notify Company in writing within thirty (30) calendar days of receipt of the update notice, and the Parties shall negotiate in good faith to resolve any disagreement. If the Parties are unable to reach agreement within thirty (30) calendar days of Contractor's objection, either Party may terminate this DPA upon thirty (30) calendar days' written notice.

*[INSTRUCTION: This provision allows Company to adapt the DPA as new state statutes take effect during the term. Consider whether this unilateral update mechanism is acceptable to the specific vendor; for high-value vendor relationships, bilateral amendment may be more appropriate.]*

Section 16: Execution

IN WITNESS WHEREOF, the Parties have caused this Master Data Processing Agreement (Contractors) to be executed by their duly authorized representatives as of the Effective Date.

[INSERT FULL LEGAL NAME OF COMPANY ENTITY]

By: ________

Name: [Insert name]

Title: [Insert title]

Date: ________

[INSERT FULL LEGAL NAME OF CONTRACTOR/VENDOR]

By: ________

Template Reference: C&H Template — DPA-Contractor-v1.0 Prepared by: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP Date: September 30, 2025 Matter Number: 1038-00010 Client: Cascade Retail Holdings Inc. Classification: Template — For Use with Vendors Qualifying as "Contractors" Under CCPA/CPRA and Equivalent Categories Under Other Applicable State Privacy Statutes
INSTRUCTIONAL NOTE: This is a standard-form template. Bracketed fields and instructions in *bold italic indicate items requiring completion for each specific vendor engagement. Remove all instructional annotations before execution. Contact [Insert name of responsible attorney] with questions.*
MASTER DATA PROCESSING AGREEMENT (CONTRACTORS)
This Master Data Processing Agreement ("DPA" or "Agreement") is entered into as of [Insert Effective Date] (the "Effective Date") by and between:
[Insert full legal name of Company entity], a [Insert state of incorporation/organization and entity type], with its principal place of business at [Insert address] (referred to herein as "Company"); and
[Insert full legal name of Contractor/Vendor], a [Insert state of incorporation/organization and entity type], with its principal place of business at [Insert address] (referred to herein as "Contractor," and together with Company, the "Parties," and each individually a "Party").
RECITALS
WHEREAS, Company and Contractor have entered into one or more underlying agreements for the provision of services (collectively, the "Services Agreement(s)"), pursuant to which Contractor may receive, access, or otherwise Process Personal Information on behalf of Company;
WHEREAS, the Parties intend this DPA to govern Contractor's Processing of Personal Information in connection with the Services Agreement(s), to satisfy the requirements of the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"), and all other applicable United States state privacy and data-protection statutes (collectively with the CCPA, "Applicable Privacy Laws");
WHEREAS, the Parties intend that Contractor's role under this DPA is that of a "contractor" as defined in California Civil Code Section 1798.140(j), and the equivalent classification under other Applicable Privacy Laws where a heightened-restriction category exists, and not that of a "service provider," "processor," or "third party" as those terms are defined in Applicable Privacy Laws; and
WHEREAS, this DPA supplements and is incorporated into the Services Agreement(s), and in the event of any conflict or inconsistency between this DPA and the Services Agreement(s), this DPA shall control with respect to the Processing of Personal Information.
NOW, THEREFORE, in consideration of the mutual promises and covenants contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
Section 1: Definitions
The following defined terms apply throughout this DPA. Capitalized terms not defined herein shall have the meanings given to them in the Services Agreement(s) or in Applicable Privacy Laws, as applicable.
1.1 "Applicable Privacy Laws" means all United States state comprehensive privacy and data-protection statutes applicable to Company's operations as they relate to the Processing of Personal Information, including but not limited to: the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100 et seq.) ("CCPA"); the Virginia Consumer Data Protection Act (Va. Code Ann. §§ 59.1-575 et seq.) ("VCDPA"); the Colorado Privacy Act (Colo. Rev. Stat. §§ 6-1-1301 et seq.) ("CPA"); the Connecticut Data Privacy Act (Conn. Gen. Stat. §§ 42-515 et seq.) ("CTDPA"); the Utah Consumer Privacy Act (Utah Code Ann. §§ 13-61-101 et seq.) ("UCPA"); the Iowa Consumer Data Protection Act (Iowa Code §§ 715D.1 et seq.) ("ICDPA"); the Indiana Consumer Data Protection Act (Ind. Code §§ 24-15-1-1 et seq.) ("INCDPA"); the Tennessee Information Protection Act (Tenn. Code Ann. §§ 47-18-3201 et seq.) ("TIPA"); the Montana Consumer Data Privacy Act (Mont. Code Ann. §§ 30-14-2801 et seq.) ("MCDPA"); the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code §§ 541.001 et seq.) ("TDPSA"); the Oregon Consumer Privacy Act (Or. Rev. Stat. §§ 646A.570 et seq.) ("OCPA"); the Delaware Personal Data Privacy Act (Del. Code Ann. tit. 6, §§ 12D-101 et seq.) ("DPDPA"); the New Jersey Data Privacy Act (N.J. Stat. Ann. §§ 56:8-166 et seq.) ("NJDPA"); the New Hampshire Data Privacy Act (N.H. Rev. Stat. Ann. §§ 507-H:1 et seq.) ("NHDPA"); the Nebraska Data Privacy Act (Neb. Rev. Stat. §§ 87-1101 et seq.) ("NDPA"); the Minnesota Consumer Data Privacy Act (Minn. Stat. §§ 325O.01 et seq.) ("Minnesota MCDPA"); the Maryland Online Data Privacy Act (Md. Code Ann., Com. Law §§ 14-4601 et seq.) ("MODPA"); the Kentucky Consumer Data Protection Act (Ky. Rev. Stat. Ann. §§ 367.700 et seq.) ("KYDPA"); and any other state privacy or data-protection statutes that become effective during the term of this DPA and that are applicable to Company's Processing activities.
*[INSTRUCTION: Update this list as new statutes are enacted or become effective. Confirm applicability of each statute to the Company's operations and the relevant vendor engagement.]*
1.2 "Contractor" means, as defined in California Civil Code Section 1798.140(j), a person to whom Company makes available a Consumer's Personal Information for a Business Purpose, pursuant to a written contract that meets the requirements of CCPA Section 1798.100(d), and that prohibits the Contractor from retaining, using, or disclosing the Personal Information for any purpose other than for the specific Business Purpose(s) identified in this DPA, including retaining, using, or disclosing the Personal Information for a commercial purpose other than the specified Business Purpose(s). The term "Contractor" as used in this DPA also encompasses any equivalent heightened-restriction classification recognized under other Applicable Privacy Laws.
1.3 "Consumer" means a natural person who is a California resident, as defined in California Civil Code Section 1798.140(i), or the equivalent term used under any other Applicable Privacy Law (including, without limitation, "consumer," "data subject," or similar terminology), whose Personal Information is Processed by Contractor in connection with this DPA.
1.4 "De-identified Data" means information that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable Consumer, household, or device, provided that the requirements set forth in California Civil Code Section 1798.140(m) and any equivalent requirements under other Applicable Privacy Laws have been satisfied, including the implementation of technical safeguards, business processes, and contractual obligations that prohibit re-identification.
1.5 "Personal Information" or "PI" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household, as defined in California Civil Code Section 1798.140(v) and equivalent definitions under other Applicable Privacy Laws. This term includes all categories of "personal data," "consumer data," or similar terms used by Applicable Privacy Laws, to the extent such information is Processed by Contractor under or in connection with this DPA.
1.6 "Process" or "Processing" means any operation or set of operations that is performed on Personal Information or on sets of Personal Information, whether or not by automated means, including without limitation collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.
1.7 "Sensitive Personal Information" means Personal Information that reveals or contains: (a) a Consumer's Social Security number, driver's license number, state identification card number, or passport number; (b) a Consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) a Consumer's precise geolocation; (d) a Consumer's racial or ethnic origin, religious or philosophical beliefs, or union membership; (e) the contents of a Consumer's mail, email, and text messages unless the Contractor is the intended recipient of the communication; (f) a Consumer's genetic data; (g) biometric information for the purpose of uniquely identifying a Consumer; (h) Personal Information collected and analyzed concerning a Consumer's health; or (i) Personal Information collected and analyzed concerning a Consumer's sex life or sexual orientation, in each case as defined in California Civil Code Section 1798.140(ae) and equivalent definitions under other Applicable Privacy Laws.
1.8 "Service Provider" means a person that Processes Personal Information on behalf of a business and to which the business discloses a Consumer's Personal Information for a business purpose pursuant to a written contract, as defined in California Civil Code Section 1798.140(ag). This definition is included for purposes of contrast and clarification; Contractor does not operate in a Service Provider capacity under this DPA.
1.9 "Sub-Contractor" means any third party engaged by Contractor to assist in Processing Personal Information on behalf of Company under this DPA, including any subprocessor, subcontractor, or agent of Contractor that receives, accesses, or otherwise Processes Personal Information in connection with the performance of Contractor's obligations under this DPA or the Services Agreement(s).
1.10 "Business Purpose" means the use of Personal Information for Company's or Contractor's operational purposes, or other notified purposes, as defined in California Civil Code Section 1798.140(e), and the specific purposes for which Personal Information is made available to Contractor, as set forth in Schedule A attached hereto and incorporated herein by reference.
1.11 "Third Party" means a person who is not the business with which the Consumer intentionally interacts and that collects Personal Information from the Consumer, as defined in California Civil Code Section 1798.140(ai), or the equivalent definition under other Applicable Privacy Laws. Contractor acknowledges and agrees that it is not authorized to act as a Third Party with respect to the Personal Information received under this DPA.
Section 2: Scope of Processing
2.1 Subject Matter and Duration. Contractor shall Process Personal Information solely in connection with the services described in the Services Agreement(s) and this DPA and only as necessary to perform such services on behalf of Company. The duration of Processing shall correspond to the term of the Services Agreement(s), unless earlier terminated or extended by written amendment executed by both Parties. Contractor shall not Process Personal Information before the Effective Date or after the termination or expiration of this DPA, except as expressly provided in Section 10 (Data Retention, Return, and Deletion).
2.2 Categories of Personal Information. The categories of Personal Information subject to Processing under this DPA are set forth in Schedule A. The Parties acknowledge that the categories of Personal Information may be updated from time to time by mutual written agreement to reflect changes in the scope of the Services Agreement(s) or the data elements involved.
*[INSTRUCTION: Complete Schedule A for each vendor engagement, specifying all categories of PI involved — e.g., identifiers, commercial information, internet/network activity, geolocation data, inferences, sensitive personal information. Be as specific as practicable to ensure the scope of permissible Processing is clearly delineated.]*
2.3 Categories of Consumers. The categories of Consumers whose Personal Information is Processed under this DPA are set forth in Schedule A. Contractor shall not Process Personal Information relating to categories of Consumers not identified in Schedule A without Company's prior written authorization.
*[INSTRUCTION: Specify all categories of Consumers — e.g., retail customers, loyalty-program members, online visitors, marketplace sellers, employees, job applicants. Where Contractor may Process employee PI, confirm that applicable employee-data provisions and any employee privacy notices are addressed.]*
2.4 Business Purpose(s). Contractor shall Process Personal Information only for the specific Business Purpose(s) identified in Schedule A. Contractor shall not Process Personal Information for any purpose outside the scope of the identified Business Purpose(s), including for Contractor's own commercial purposes, without Company's express prior written consent.
*[INSTRUCTION: Specify the particular business purposes — e.g., analytics, order fulfillment support, advertising measurement, customer-service support, fraud detection and prevention. Reference Cal. Civ. Code § 1798.140(e) enumerated purposes as applicable.]*
2.5 Nature of Processing. Schedule A shall describe the nature of the Processing operations to be performed by Contractor, including without limitation the types of Processing activities (e.g., storage, analysis, transmission, aggregation, anonymization, profiling, segmentation) and the systems, platforms, and environments in which such Processing will occur. Contractor shall not materially alter the nature of its Processing operations without Company's prior written consent.
Section 3: Contractor Obligations — General Restrictions
3.1 Purpose Limitation. Contractor shall not retain, use, or disclose Personal Information for any purpose other than the specific Business Purpose(s) set forth in Schedule A and as otherwise expressly permitted by this DPA. Without limiting the foregoing, Contractor shall not retain, use, or disclose the Personal Information for a commercial purpose other than providing the services specified in the Services Agreement(s) and this DPA. Contractor acknowledges that it is prohibited from using Personal Information for purposes such as marketing its own products or services to Consumers, enriching its own data assets, or developing products or services for other clients, unless such use is expressly identified as a Business Purpose in Schedule A and is permitted under Applicable Privacy Laws.
3.2 Prohibition on Combining Personal Information. Contractor shall not combine the Personal Information received from, or on behalf of, Company with (a) Personal Information that Contractor receives from, or on behalf of, another person or persons, or (b) Personal Information that Contractor collects from its own interaction with Consumers, except as expressly permitted by California Civil Code Section 1798.140(j)(1)(A)(iv) — that is, to the extent necessary to perform the Business Purpose(s) specified in Schedule A, subject to the restrictions set forth in this DPA and Applicable Privacy Laws. This prohibition extends to combining, merging, appending, linking, or otherwise joining Company's Personal Information with any external data sets, customer files, or other personal information maintained by Contractor in connection with its operations or its engagements with other entities.
*[NOTE: This prohibition is a heightened restriction distinguishing the Contractor template from the Service Provider template. It reflects the specific CCPA § 1798.140(j) requirement that Contractors may not combine PI across client engagements. This restriction should be carefully reviewed with each vendor to ensure understanding and operational compliance.]*
3.3 Prohibition on Sale or Sharing. Contractor shall not sell or share (as those terms are defined by Applicable Privacy Laws, including California Civil Code Sections 1798.140(ad) and 1798.140(ah)) any Personal Information received under this DPA. Contractor shall not make Personal Information available to any Third Party for cross-context behavioral advertising or any other purpose that would constitute a "sale" or "sharing" of Personal Information under Applicable Privacy Laws. This prohibition applies regardless of whether Contractor receives monetary or other valuable consideration in connection with such disclosure.
3.4 Prohibition on Retention Beyond Business Purpose. Contractor shall not retain Personal Information after the Business Purpose(s) have been fulfilled, unless retention is required by applicable law. Contractor shall implement and maintain internal policies and procedures to ensure that Personal Information is not retained beyond the period necessary to fulfill the applicable Business Purpose(s). Upon completion of the Business Purpose(s) or at Company's request, Contractor shall delete or return Personal Information in accordance with Section 10 of this DPA.
3.5 Compliance with Applicable Privacy Laws. Contractor shall comply with all Applicable Privacy Laws with respect to its Processing of Personal Information under this DPA and shall provide the same level of privacy protection as is required by Applicable Privacy Laws. In the event that Contractor determines that it can no longer meet its obligations under Applicable Privacy Laws or this DPA, Contractor shall promptly notify Company in writing, and Company may take appropriate steps, including those described in Section 5.4 and Section 14.3, to address such non-compliance.
3.6 No Derogation. Contractor shall not take any action that would cause any transfer of Personal Information to or from Contractor to qualify as a "sale" or "sharing" of Personal Information under Applicable Privacy Laws. Contractor shall structure its operations, systems, and relationships with Sub-Contractors and other third parties so as to ensure that its receipt and Processing of Personal Information under this DPA is and remains consistent with the "contractor" classification set forth in Section 1.2 and the requirements of Applicable Privacy Laws.
Section 4: Contractor Certifications
4.1 Certification of Understanding. Contractor certifies that it understands and will comply with the restrictions and obligations set forth in this DPA, including but not limited to:
(a) the prohibition on retaining, using, or disclosing Personal Information for any purpose other than the specified Business Purpose(s) set forth in Schedule A;
(b) the prohibition on combining Personal Information received from Company with Personal Information received from other persons or collected from Contractor's own interaction with Consumers, except as expressly permitted by this DPA and Applicable Privacy Laws;
(c) the obligation to comply with all Applicable Privacy Laws applicable to Contractor's Processing of Personal Information under this DPA;
(d) the obligation to cooperate with Company's compliance-monitoring activities, including audits, assessments, and certifications, as described in Section 5 of this DPA; and
(e) the obligation to notify Company if Contractor determines that it can no longer meet its obligations under this DPA or Applicable Privacy Laws.
4.2 Annual Certification. Not less than once per calendar year, and additionally upon Company's written request at any time, Contractor shall provide Company with a written certification signed by a duly authorized officer of Contractor (at the level of vice president or above) confirming Contractor's continued compliance with this DPA and all Applicable Privacy Laws during the applicable certification period. The form of such certification shall be substantially in the form set forth in Schedule D attached hereto. The annual certification shall be delivered to Company no later than [Insert date — e.g., January 31] of each calendar year during the term of this DPA. Where Company submits a written request for certification outside the annual cycle, Contractor shall deliver the requested certification within [Insert number — e.g., 30] calendar days of receipt of Company's written request.
*[INSTRUCTION: Adjust timing to align with Company's privacy-program assessment cycle. Cascade's current program contemplates annual certifications due by January 31 of each year, with supplemental certifications upon request for high-risk contractor relationships.]*
4.3 Certification Upon Termination. Upon termination or expiration of the Services Agreement(s) or this DPA, whichever occurs first, Contractor shall certify in writing, within the time period specified in Section 10.3, that it has deleted or returned all Personal Information in Contractor's possession, custody, or control in accordance with Section 10, except to the extent retention is permitted under Section 10.4.
Section 5: Compliance Monitoring and Audit Rights
5.1 Right to Monitor. Company shall have the right, upon [Insert number — e.g., 15] business days' prior written notice to Contractor, to take reasonable and appropriate steps to help ensure that Contractor's use of Personal Information is consistent with Company's obligations under Applicable Privacy Laws and this DPA. Such steps may include, without limitation, ongoing manual reviews of Contractor's privacy practices and data-handling procedures, automated scans and technical assessments of systems and platforms used by Contractor to Process Personal Information, regular assessments based on questionnaires or information requests, and formal audits conducted by Company or its designated agents. Company's exercise of its monitoring rights under this Section 5.1 shall not relieve Contractor of any of its obligations under this DPA.
5.2 Audit Rights. Company (or its designated third-party auditor or agent, subject to reasonable confidentiality obligations) shall have the right to audit Contractor's Processing of Personal Information no more than [Insert number — e.g., once per 12-month period] during the term of this DPA; provided, however, that Company may conduct additional audits in the event of a Security Incident, a material change in Applicable Privacy Laws, or a reasonable belief that Contractor is not in compliance with this DPA. Contractor shall make available to Company all information, systems, records, and documentation necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including on-site inspections of Contractor's data-processing facilities, systems, and records, during normal business hours and upon reasonable advance notice. Contractor shall bear its own costs incurred in connection with such audits. If an audit reveals material non-compliance, Contractor shall bear the reasonable costs incurred by Company (or its designated auditor) in conducting the audit.
*[INSTRUCTION: Consider whether the Company requires more frequent audit rights — e.g., semi-annually for high-risk contractors. Note: Cascade's program targets heightened monitoring for contractors processing Sensitive PI or large volumes of PI (defined as more than 100,000 Consumer records).]*
5.3 Cooperation. Contractor shall cooperate fully and in good faith with Company's compliance-monitoring activities described in this Section 5 and shall promptly provide all information, documentation, system access, and personnel assistance reasonably requested by Company or its designated auditor in connection with such activities. Contractor shall designate a primary point of contact to coordinate with Company on compliance-monitoring matters and shall ensure that such contact is responsive to Company's inquiries within a reasonable time frame, and in no event more than ten (10) business days from the date of Company's request.
5.4 Remediation. If Company determines, through monitoring, audit, certification review, or otherwise, that Contractor is not in compliance with this DPA or Applicable Privacy Laws, Company shall notify Contractor in writing, specifying the nature of the non-compliance and the corrective actions required. Contractor shall take prompt corrective action to remediate the non-compliance and shall report to Company on the status of remediation. If Contractor fails to cure the non-compliance within [Insert number — e.g., 30] calendar days of receipt of Company's written notice (or such shorter period as is reasonable under the circumstances given the nature and severity of the non-compliance), Company shall have the right, in its sole discretion and without prejudice to any other rights or remedies available to it under this DPA, at law, or in equity, to:
(a) suspend Contractor's Processing of Personal Information, in whole or in part, until such time as the non-compliance has been cured to Company's reasonable satisfaction;
(b) require Contractor to delete or return all Personal Information in Contractor's possession, custody, or control in accordance with Section 10;
(c) terminate this DPA and the Services Agreement(s) immediately without penalty, liability, or obligation to Company; and/or
(d) exercise any other remedies available under this DPA, the Services Agreement(s), or applicable law.
5.5 Stop Processing Obligation. Company shall have the right, upon written notice to Contractor, to require Contractor to stop Processing Personal Information, in whole or in part, if Company determines in good faith that Contractor is Processing Personal Information in a manner inconsistent with this DPA, Applicable Privacy Laws, or Company's instructions. Upon receipt of such a stop-processing directive, Contractor shall cease the identified Processing activities within [Insert number — e.g., 5] business days (or such shorter period as Company specifies, to the extent reasonably practicable) and shall confirm compliance with the directive in writing to Company. Contractor shall not resume the affected Processing activities until Company provides written authorization to do so.
Section 6: Consumer Rights Assistance
6.1 Consumer-Rights Requests. Contractor shall assist Company in fulfilling its obligations to respond to verifiable consumer requests to exercise rights under Applicable Privacy Laws. Such rights include, without limitation, requests to:
(a) know and access the Personal Information collected about a Consumer;
(b) delete Personal Information held about a Consumer;
(c) correct inaccurate Personal Information maintained about a Consumer;
(d) port Personal Information in a structured, commonly used, and machine-readable format;
(e) opt out of the sale or sharing of Personal Information;
(f) limit the use and disclosure of Sensitive Personal Information; and
(g) exercise any other rights conferred by Applicable Privacy Laws.
Contractor shall respond to Company's instructions regarding such requests within [Insert number — e.g., 5] business days of receiving the instruction, or such shorter period as may be required for Company to meet the response deadlines established by Applicable Privacy Laws. Contractor shall implement and maintain systems and processes sufficient to enable it to comply with Company's consumer-rights request instructions in a timely and accurate manner.
6.2 Direct Consumer Requests. If Contractor receives any request directly from a Consumer regarding Personal Information Processed under this DPA, including but not limited to requests to access, delete, correct, or opt out, Contractor shall promptly — and in no event later than [Insert number — e.g., 2] business days after receipt of such request — redirect the Consumer to Company and notify Company's designated privacy contact:
[Insert name, title, and contact information of Company's designated privacy contact]
Contractor shall not independently respond to, act upon, or fulfill any such Consumer request unless expressly authorized by Company in writing, in advance, on a case-by-case or categorical basis. Contractor shall maintain a log of all direct Consumer requests received and shall make such log available to Company upon request.
6.3 Information for Responses. Contractor shall maintain the technical and organizational capability to search for, retrieve, identify, and — if applicable — delete, correct, or export Personal Information that it Processes on behalf of Company, in order to enable Company to comply with Applicable Privacy Laws' consumer-rights requirements. Contractor shall ensure that its systems and processes support the ability to respond to consumer requests at the individual-consumer level and within the time frames required by Applicable Privacy Laws. Where Personal Information is stored across multiple systems, databases, or archives, Contractor shall ensure that its search and retrieval capabilities extend to all such locations.
6.4 Opt-Out signal compliance. To the extent Contractor Processes Personal Information obtained through or in connection with online properties (including websites, mobile applications, connected devices, and other digital platforms) on behalf of Company, Contractor shall honor opt-out preference signals received by Company and communicated to Contractor, including without limitation the Global Privacy Control ("GPC") signal as recognized under the CCPA and other Applicable Privacy Laws. Contractor shall implement and maintain the technical capability to receive, interpret, and act upon opt-out preference signals within the systems and platforms it operates on behalf of Company, and shall treat such signals as valid opt-out requests in accordance with Applicable Privacy Laws unless Company provides contrary instructions consistent with applicable law.
Section 7: Sub-Contractors
7.1 Restrictions on Sub-Contracting. Contractor shall not engage any Sub-Contractor to Process Personal Information on behalf of Company without Company's prior written consent, which may be granted or withheld in Company's sole discretion. For the avoidance of doubt, this restriction applies to any arrangement in which a Sub-Contractor would receive, access, store, or otherwise Process Personal Information that Contractor has obtained from or on behalf of Company under this DPA.
*[INSTRUCTION: Determine whether to require prior written consent for each Sub-Contractor (specific consent) or to permit a list of approved Sub-Contractors (general consent with notification of changes). If the latter, add a mechanism for Company to object to the addition of new Sub-Contractors within a specified notice period. The general consent approach may be appropriate for Contractors with established Sub-Contractor networks, subject to Company's right to object.]*
7.2 Sub-Contractor Agreements. Where Company consents to the engagement of a Sub-Contractor, Contractor shall, prior to allowing such Sub-Contractor to Process Personal Information, enter into a written agreement with such Sub-Contractor that imposes data-protection obligations no less restrictive than those imposed on Contractor under this DPA. Such Sub-Contractor agreement shall include, at a minimum:
(a) the purpose limitation and prohibition on retaining, using, or disclosing Personal Information for purposes other than the specified Business Purpose(s);
(b) the prohibition on combining Personal Information from multiple sources, as set forth in Section 3.2;
(c) the prohibition on selling or sharing Personal Information, as set forth in Section 3.3;
(d) certification requirements substantially equivalent to those set forth in Section 4;
(e) compliance-monitoring provisions substantially equivalent to those set forth in Section 5;
(f) data-security obligations substantially equivalent to those set forth in Section 8 and Schedule C;
(g) breach-notification obligations substantially equivalent to those set forth in Section 9; and
(h) data return/deletion obligations substantially equivalent to those set forth in Section 10.
Contractor shall provide Company with copies of Sub-Contractor agreements (or relevant excerpts thereof) upon Company's written request.
7.3 Liability. Contractor shall remain fully liable to Company for the acts, omissions, and non-compliance of its Sub-Contractors with respect to Personal Information Processed under this DPA, as if such acts, omissions, or non-compliance were those of Contractor itself. Contractor's engagement of a Sub-Contractor shall not relieve Contractor of any of its obligations under this DPA or the Services Agreement(s).
7.4 Sub-Contractor List. Contractor shall maintain a current and accurate list of all Sub-Contractors Processing Personal Information under this DPA, including the name, address, and description of Processing activities of each Sub-Contractor. Contractor shall provide such list to Company upon request and shall notify Company in writing of any proposed additions to or removals from the Sub-Contractor list at least [Insert number — e.g., 30] calendar days prior to the proposed change. Schedule B attached hereto sets forth the initial list of approved Sub-Contractors as of the Effective Date.
Section 8: Data Security
8.1 Security Measures. Contractor shall implement and maintain reasonable and appropriate administrative, technical, and physical safeguards designed to protect Personal Information from unauthorized access, use, disclosure, alteration, loss, or destruction, consistent with industry standards (including, where applicable, NIST Cybersecurity Framework, CIS Controls, or equivalent frameworks), the requirements of Applicable Privacy Laws, and the nature and sensitivity of the Personal Information Processed. Contractor's security measures shall be no less protective than those described in Schedule C attached hereto. Contractor shall periodically review and update its security measures to address evolving threats, vulnerabilities, and industry best practices.
8.2 Sensitive Personal Information. Where Contractor Processes Sensitive Personal Information (including, without limitation, precise geolocation data, payment-card data, financial account information, account login credentials, biometric data, health information, or any other category of Sensitive Personal Information as defined in Section 1.7), Contractor shall implement enhanced security measures appropriate to the sensitivity and volume of such information. Such enhanced measures shall include, at a minimum:
(a) encryption of Sensitive Personal Information at rest and in transit using industry-standard encryption algorithms and key-management practices;
(b) role-based access controls limiting access to Sensitive Personal Information to personnel with a demonstrated business need;
(c) multi-factor authentication for all systems and applications used to Process Sensitive Personal Information;
(d) comprehensive logging and monitoring of access to Sensitive Personal Information, with logs retained for a minimum of [Insert number — e.g., 12] months; and
(e) segregation of Sensitive Personal Information from other data, to the extent technically feasible.
*[INSTRUCTION: Specify any additional security requirements for Sensitive PI categories relevant to the Company's operations. Consult with Company's CISO or information-security team to confirm minimum requirements.]*
8.3 Personnel. Contractor shall ensure that all personnel (including employees, temporary workers, and independent contractors) authorized to Process Personal Information under this DPA: (a) are subject to binding obligations of confidentiality that survive the termination of their relationship with Contractor; (b) have received appropriate training on data protection, privacy, and information security prior to being granted access to Personal Information and on a periodic basis thereafter (not less than annually); and (c) are subject to disciplinary measures for violations of data-protection obligations. Contractor shall limit access to Personal Information to those personnel who require such access to perform the services under the Services Agreement(s).
8.4 Security Assessment. Upon Company's written request (not more than once per calendar year, unless a Security Incident has occurred or Company has a reasonable basis for concern regarding Contractor's security posture), Contractor shall provide Company with:
(a) a summary of Contractor's current information-security program, including the organizational structure, governance, and key policies;
(b) results of any relevant third-party security assessments, certifications, or audit reports (e.g., SOC 2 Type II report, ISO/IEC 27001 certification, PCI-DSS Report on Compliance), subject to reasonable confidentiality protections; and
(c) evidence of remediation of material findings identified in such assessments or reports, including a timeline for remediation of any open findings.
Section 9: Security Incident / Breach Notification
9.1 Definition. For purposes of this DPA, "Security Incident" means any actual or reasonably suspected unauthorized access to, acquisition of, use of, disclosure of, or destruction of Personal Information Processed by Contractor under this DPA, or any breach or compromise of Contractor's security measures that affects or is reasonably likely to affect the confidentiality, integrity, or availability of Personal Information. A Security Incident includes, without limitation, any "breach of the security of the system" or "data breach" as defined under Applicable Privacy Laws or applicable state data-breach notification statutes.
9.2 Notification. Contractor shall notify Company's designated privacy contact at:
[Insert name, title, email address, and telephone number of Company's designated privacy/security incident contact]
of any Security Incident without unreasonable delay and, in any event, within [Insert number — e.g., 48] hours of Contractor becoming aware of the Security Incident (or reasonably suspecting that a Security Incident has occurred). Such notification shall include, to the extent known at the time of notification:
(a) the nature and scope of the Security Incident, including a description of the incident and the systems, data, and facilities affected;
(b) the categories and approximate number of Consumers and Personal Information records affected or potentially affected;
(c) the likely consequences of the Security Incident, including an assessment of the risk of harm to affected Consumers;
(d) the measures taken or proposed to be taken by Contractor to address the Security Incident, mitigate its effects, and prevent recurrence; and
(e) the identity and contact information of Contractor's designated incident-response lead.
If Contractor is unable to provide all of the foregoing information at the time of initial notification, Contractor shall provide such information on a rolling basis as it becomes available, without undue delay.
9.3 Cooperation. Contractor shall cooperate fully with Company in investigating and remediating any Security Incident and shall provide Company with all information, documentation, and technical assistance reasonably necessary for Company to: (a) assess the scope and impact of the Security Incident; (b) comply with its own breach-notification obligations under Applicable Privacy Laws, including any applicable state data-breach notification statutes; (c) respond to inquiries from regulatory authorities, affected Consumers, or the media; and (d) mitigate harm to affected Consumers. Contractor shall designate a senior representative to serve as the primary point of contact with Company for all matters related to the Security Incident and shall ensure that such representative is available and responsive throughout the investigation and remediation process.
9.4 No Unauthorized Notifications. Contractor shall not notify any Consumer, regulatory authority, law enforcement agency, media outlet, or other third party of a Security Incident involving Personal Information Processed under this DPA without Company's prior written approval, unless Contractor is independently and separately required by applicable law to make such notification (in which case Contractor shall provide Company with advance notice of the notification and a copy of any proposed notification to the extent permitted by applicable law, and shall afford Company a reasonable opportunity to review and comment on the notification prior to issuance).
9.5 Records. Contractor shall maintain comprehensive records of all Security Incidents, including the facts relating to each incident, its effects, the remedial actions taken, and the timeline of response activities. Such records shall be retained for a minimum of [Insert number — e.g., five (5)] years following the resolution of the Security Incident and shall be made available to Company upon request. Contractor shall incorporate lessons learned from Security Incidents into its ongoing information-security program.
Section 10: Data Retention, Return, and Deletion
10.1 Retention Limitation. Contractor shall not retain Personal Information for longer than is reasonably necessary to fulfill the Business Purpose(s) specified in Schedule A, and in no event longer than [Insert retention period or mechanism for determining retention period — e.g., the term of the Services Agreement(s) plus thirty (30) days, or as specified in Company's Data Retention and Disposal Schedule, a copy of which has been provided to Contractor]. Contractor shall implement and enforce internal data-retention policies and schedules that are consistent with this Section 10.1 and shall apply such policies to all copies, backups, and archived instances of Personal Information.
*[INSTRUCTION: Align with Company's Data Retention & Disposal Schedule. Ensure that the retention period specified here is consistent with the retention periods established by Company's privacy program and the requirements of Applicable Privacy Laws.]*
10.2 Return or Deletion. Upon the earliest of: (a) Company's written request at any time during the term; (b) completion of the Business Purpose(s) for which Personal Information was provided to Contractor; or (c) termination or expiration of the Services Agreement(s) or this DPA, whichever occurs first, Contractor shall, at Company's sole election:
(i) promptly return all Personal Information to Company in a structured, commonly used, and machine-readable format reasonably designated by Company; or
(ii) securely delete and destroy all Personal Information in Contractor's possession, custody, or control, including all copies, reproductions, backups, archived data, disaster-recovery copies, and any other instances of Personal Information, using methods consistent with industry-standard data-destruction practices (e.g., NIST SP 800-88 guidelines) and the sensitivity of the information involved.
Company shall communicate its election to Contractor in writing. If Company does not make an election within [Insert number — e.g., 30] calendar days of the triggering event, Contractor shall securely delete all Personal Information in accordance with this Section 10.2.
10.3 Certification of Deletion. Within [Insert number — e.g., 30] calendar days of the deletion of Personal Information pursuant to this Section 10, Contractor shall provide Company with a written certification, signed by a duly authorized officer of Contractor, confirming that all Personal Information (including all copies, backups, and archived data) has been securely deleted in accordance with this Section 10. The certification shall describe the method of deletion used and the date(s) on which deletion was completed.
10.4 Exceptions. Contractor may retain Personal Information beyond the periods specified in this Section 10 only to the extent required by applicable law (including, for the avoidance of doubt, any applicable record-retention statute, regulation, or legal hold obligation), provided that:
(a) Contractor limits the retention to the minimum scope and duration necessary to comply with the applicable legal requirement;
(b) Contractor notifies Company in writing of the legal basis for retention, the specific categories of Personal Information retained, and the anticipated duration of retention;
(c) Contractor continues to protect such Personal Information in accordance with the terms of this DPA, including the data-security requirements of Section 8 and Schedule C; and
(d) Contractor does not use or Process such retained Personal Information for any purpose other than compliance with the applicable legal requirement.
Section 11: De-identified and Aggregated Data
11.1 De-identification. If Contractor de-identifies Personal Information in connection with its performance under this DPA, Contractor shall:
(a) take reasonable measures to ensure that the De-identified Data cannot be associated with, linked to, or used to identify any specific Consumer, household, or device;
(b) publicly commit to maintaining and using the information in de-identified form and not attempt to re-identify the information, except solely for the purpose of determining whether its de-identification processes satisfy the requirements of Applicable Privacy Laws;
(c) implement technical safeguards and business processes that specifically prohibit re-identification of the information;
(d) contractually obligate any recipients of De-identified Data to comply with the same de-identification requirements set forth in this Section 11.1; and
(e) comply with all requirements for de-identified information set forth in California Civil Code Section 1798.140(m) and equivalent provisions under other Applicable Privacy Laws.
11.2 Aggregated Data. Contractor may create aggregated, de-identified data derived from Personal Information solely for the purpose of providing the services under the Services Agreement(s), provided that: (a) such data meets the de-identification requirements of Applicable Privacy Laws and this Section 11; (b) such data cannot be used, either alone or in combination with other information, to identify any individual Consumer; and (c) Contractor does not use such aggregated, de-identified data to enrich data sets maintained for other clients, develop independent products or services, or for any commercial purpose unrelated to the services provided under the Services Agreement(s), unless expressly authorized by Company in writing.
Section 12: Representations and Warranties
12.1 Contractor Representations. Contractor represents and warrants to Company that:
(a) Contractor has the legal authority and organizational capability to enter into this DPA and to comply with all of its obligations hereunder;
(b) Contractor will not Process Personal Information in a manner that violates Applicable Privacy Laws or that is inconsistent with the terms of this DPA;
(c) Contractor has implemented and will maintain throughout the term of this DPA reasonable administrative, technical, and physical security measures consistent with the requirements of Section 8 and Schedule C;
(d) Contractor is not aware of any circumstances, pending or threatened litigation, regulatory action, or other matter that would prevent it from fulfilling its obligations under this DPA;
(e) Contractor does not, and will not during the term of this DPA, meet the definition of a "Third Party" under California Civil Code Section 1798.140(ai) or equivalent definitions under other Applicable Privacy Laws with respect to the Personal Information received under this DPA;
(f) Contractor's representations in this Section 12.1 are true, accurate, and complete as of the Effective Date and will remain true, accurate, and complete throughout the term of this DPA; and
(g) Contractor will promptly notify Company in writing if any of its representations and warranties under this Section 12.1 become inaccurate or incomplete at any time during the term.
12.2 Company Representations. Company represents and warrants to Contractor that:
(a) Company has provided all required notices and obtained all required consents from Consumers for the Processing of Personal Information by Contractor as contemplated by this DPA and the Services Agreement(s), to the extent such notices and consents are required by Applicable Privacy Laws;
(b) Company's instructions to Contractor regarding the Processing of Personal Information comply with Applicable Privacy Laws; and
(c) Company has the legal authority to enter into this DPA and to make Personal Information available to Contractor for Processing as described in Schedule A.
Section 13: Indemnification
13.1 Contractor Indemnification. Contractor shall indemnify, defend, and hold harmless Company and its affiliates, and their respective officers, directors, members, managers, employees, agents, successors, and assigns (collectively, "Company Indemnitees"), from and against any and all claims, demands, actions, suits, investigations, proceedings, losses, liabilities, damages, fines, penalties, assessments, judgments, settlements, costs, and expenses (including reasonable attorneys' fees and costs of litigation, investigation, and remediation) (collectively, "Losses") arising out of or relating to:
(a) any breach by Contractor of its obligations, representations, or warranties under this DPA;
(b) any violation by Contractor of Applicable Privacy Laws in connection with its Processing of Personal Information under this DPA;
(c) any Security Incident to the extent caused by Contractor's acts, omissions, negligence, or willful misconduct, or Contractor's failure to implement and maintain the security measures required by this DPA;
(d) any act, omission, or non-compliance of Contractor's Sub-Contractors with respect to Personal Information Processed under this DPA; and
(e) any claim by a Consumer or regulatory authority arising from Contractor's unauthorized Processing, use, disclosure, sale, or sharing of Personal Information in violation of this DPA or Applicable Privacy Laws.
*[INSTRUCTION: Review and negotiate indemnification scope, caps, and carve-outs with each Contractor. Consider whether to include coverage for regulatory fines and penalties, and whether the indemnification should be subject to any aggregate cap or the limitations of liability in the Services Agreement(s). Certain Applicable Privacy Laws may impose penalties of up to $7,500 per intentional violation. Consult with responsible attorney.]*
13.2 Mutual Limitations. The indemnification obligations set forth in this Section 13 are subject to any mutually agreed-upon limitations of liability set forth in the Services Agreement(s); provided, however, that the Parties acknowledge that certain Applicable Privacy Laws may restrict the ability of the Parties to limit liability for privacy violations, and nothing in this DPA or the Services Agreement(s) shall be construed to limit Contractor's liability to the extent prohibited by applicable law.
*[INSTRUCTION: Insert any agreed-upon limitations of liability from the Services Agreement(s), noting that certain Applicable Privacy Laws may restrict the ability to limit liability for privacy violations. Consult with responsible attorney before agreeing to caps on indemnification for data-privacy breaches. Consider whether data-privacy indemnification should be carved out from any general cap on liability in the Services Agreement(s).]*
Section 14: Term and Termination
14.1 Term. This DPA shall become effective on the Effective Date and shall remain in full force and effect for the duration of the Services Agreement(s) and for so long as Contractor retains any Personal Information in its possession, custody, or control, unless earlier terminated in accordance with this Section 14.
14.2 Termination for Breach. Either Party may terminate this DPA upon written notice to the other Party if the other Party materially breaches this DPA and fails to cure such breach within [Insert number — e.g., 30] calendar days of receiving written notice from the non-breaching Party specifying the nature of the breach in reasonable detail. If the breach is not capable of cure, the non-breaching Party may terminate this DPA immediately upon written notice.
14.3 Termination for Non-Compliance. Company may terminate this DPA immediately upon written notice to Contractor, without opportunity to cure, if:
(a) Contractor fails to comply with a stop-processing directive issued by Company under Section 5.5 within the time period specified therein;
(b) Company reasonably determines that Contractor can no longer meet its obligations under Applicable Privacy Laws, including as a result of a change in law, a regulatory enforcement action against Contractor, or a material change in Contractor's operations or business practices;
(c) Contractor fails to provide any certification required under Section 4 within the time periods specified therein; or
(d) Contractor is found to have made a materially false or misleading certification under Section 4.
14.4 Effect of Termination. Upon termination or expiration of this DPA for any reason:
(a) Contractor shall immediately cease all Processing of Personal Information under this DPA, except as necessary to comply with its data return/deletion obligations under Section 10;
(b) the provisions of this DPA relating to data return and deletion (Section 10), certification upon termination (Section 4.3), indemnification (Section 13), audit rights (Section 5, which shall survive for a period of [Insert number — e.g., 12] months following the effective date of termination), confidentiality, representations and warranties (Section 12), de-identified and aggregated data (Section 11), and this Section 14.4 shall survive termination or expiration; and
(c) termination of this DPA shall not relieve either Party of any liability arising from a breach of this DPA that occurred prior to the effective date of termination.
Section 15: Miscellaneous
15.1 Governing Law. This DPA shall be governed by and construed in accordance with the laws of the State of [Insert state], without regard to its conflict-of-laws principles. Nothing in this Section 15.1 shall be construed to limit the applicability of Applicable Privacy Laws of other states to the Processing of Personal Information under this DPA.
*[INSTRUCTION: Typically the law governing the Services Agreement(s). Cascade's standard form uses the laws of the State of Washington.]*
15.2 Entire Agreement. This DPA, together with the Services Agreement(s) and Schedules A, B, C, and D attached hereto and incorporated herein by reference, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations, discussions, and representations, whether written or oral, relating to the Processing of Personal Information in connection with the Services Agreement(s).
15.3 Amendments. This DPA may be amended, modified, or supplemented only by a written instrument executed by duly authorized representatives of both Parties, except as provided in Section 15.9 with respect to regulatory updates.
15.4 Severability. If any provision of this DPA is held by a court of competent jurisdiction or regulatory authority to be invalid, illegal, or unenforceable, the remaining provisions of this DPA shall remain in full force and effect, and the invalid, illegal, or unenforceable provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving the Parties' original intent, or if such modification is not possible, such provision shall be deemed severed from this DPA.
15.5 Notices. All notices, requests, demands, consents, and other communications required or permitted under this DPA shall be in writing and shall be deemed duly given: (a) upon delivery, if delivered by hand; (b) upon confirmation of transmission, if sent by email to the email address specified below; or (c) one (1) business day after deposit with a nationally recognized overnight courier service, or three (3) business days after deposit in the United States mail, postage prepaid, certified or registered, return receipt requested, addressed to the applicable Party at the address set forth in the preamble of this DPA, or to such other address or email address as either Party may designate by written notice to the other Party.
*[INSTRUCTION: Specify notice methods, addresses, and email contacts for each Party. Include both legal/contracts notice addresses and privacy-specific notice contacts.]*
15.6 Waiver. No failure or delay by either Party in exercising any right, power, or remedy under this DPA shall operate as a waiver thereof, nor shall any single or partial exercise of any right, power, or remedy preclude any other or further exercise thereof or the exercise of any other right, power, or remedy. No waiver of any provision of this DPA shall be effective unless in writing and signed by the Party granting the waiver.
15.7 Assignment. Contractor shall not assign, delegate, or transfer this DPA or any of its rights, obligations, or duties hereunder without Company's prior written consent, which may be withheld in Company's sole discretion. Any purported assignment, delegation, or transfer in violation of this Section 15.7 shall be null and void. Company may assign this DPA to an affiliate or to a successor in connection with a merger, acquisition, reorganization, or sale of all or substantially all of Company's assets, upon written notice to Contractor.
15.8 Counterparts. This DPA may be executed in one or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Execution and delivery of this DPA by electronic signature (including PDF or Brightwater Software) shall be deemed to have the same legal effect as delivery of an original signed copy.
15.9 Regulatory Updates. The Parties acknowledge that Applicable Privacy Laws are evolving and that new state privacy statutes may be enacted or existing statutes may be amended during the term of this DPA. Company may update this DPA (including any Schedules hereto) upon [Insert number — e.g., 60] calendar days' written notice to Contractor to reflect changes in Applicable Privacy Laws, regulatory guidance, or enforcement interpretations that affect the Parties' obligations with respect to the Processing of Personal Information. If Contractor objects to any such update, Contractor shall notify Company in writing within thirty (30) calendar days of receipt of the update notice, and the Parties shall negotiate in good faith to resolve any disagreement. If the Parties are unable to reach agreement within thirty (30) calendar days of Contractor's objection, either Party may terminate this DPA upon thirty (30) calendar days' written notice.
*[INSTRUCTION: This provision allows Company to adapt the DPA as new state statutes take effect during the term. Consider whether this unilateral update mechanism is acceptable to the specific vendor; for high-value vendor relationships, bilateral amendment may be more appropriate.]*
Section 16: Execution
IN WITNESS WHEREOF, the Parties have caused this Master Data Processing Agreement (Contractors) to be executed by their duly authorized representatives as of the Effective Date.
[INSERT FULL LEGAL NAME OF COMPANY ENTITY]
By: ________
Name: [Insert name]
Title: [Insert title]
Date: ________
[INSERT FULL LEGAL NAME OF CONTRACTOR/VENDOR]
By: ________
Name: [Insert name]
Title: [Insert title]
Date: ________
SCHEDULE A
DESCRIPTION OF PROCESSING
*[INSTRUCTION: Complete this Schedule for each vendor engagement. All fields must be completed prior to execution. This Schedule should be reviewed and approved by the privacy team and the business unit responsible for the vendor relationship.]*
Subject Matter of Processing:
[Insert description of the service

MASTER DATA PROCESSING AGREEMENT (CONTRACTORS)

RECITALS

Record

Parties

Dates

Amounts