1038-00010 · Cascade Retail Holdings · Contracts & Vendor Management

dpa-template-service-providers.docx DOCUMENT Finance & Banking

11 / 38 ← → ✕

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT

September 30, 2025

CALDERWOOD & HARKNESS LLP Privacy & Data Security Practice Group

Document Title: Master Data Processing Agreement Template — Service Providers Filename: dpa-template-service-providers.docx Date: September 30, 2025 Prepared by: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP Reviewed by: Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP Matter Number: 1038-00010 Client: Cascade Retail Holdings Inc. Classification: THIS IS A BLANK TEMPLATE / STANDARD FORM — All fields contain placeholder instructions and generic guidance; no matter-specific information is pre-populated.

MASTER DATA PROCESSING AGREEMENT — SERVICE PROVIDERS

Template for Use by Cascade Retail Holdings Inc. and Subsidiaries

This template is designed for use with vendors that qualify as "service providers" under the California Consumer Privacy Act (CCPA/CPRA) and as "processors" under the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and equivalent state privacy statutes. This template should be adapted for each vendor engagement based on the specific data processing activities, categories of personal information, and applicable state laws. Consult Calderwood & Harkness LLP before material modifications.

Version: v1.0 — September 30, 2025

COMPANY:

[Insert full legal name of Cascade entity entering into this DPA]

SERVICE PROVIDER:

[Insert full legal name of vendor/service provider]

Right-click to update Table of Contents

PREAMBLE AND PARTIES

This Data Processing Agreement ("DPA") is entered into as of [Insert Effective Date] (the "Effective Date") by and between:

COMPANY: [Insert full legal name of Cascade entity entering into this DPA] ("Company"), a [Insert entity type] organized under the laws of [Insert jurisdiction], with its principal place of business at [Insert address].

Instruction: Use the applicable Cascade entity — e.g., the parent entity or the relevant subsidiary (such as a marketplace subsidiary, fulfillment subsidiary, analytics subsidiary, or loyalty-program subsidiary) that is the contracting party under the underlying services agreement.

SERVICE PROVIDER: [Insert full legal name of vendor/service provider] ("Service Provider"), a [Insert entity type] organized under the laws of [Insert jurisdiction], with its principal place of business at [Insert address].

Each of Company and Service Provider may be referred to individually as a "Party" and collectively as the "Parties."

RECITALS. A. WHEREAS, the Parties have entered into [Insert title and date of underlying services agreement(s)] (collectively, the "Services Agreement"), pursuant to which Service Provider provides certain services to Company;

B. WHEREAS, in the course of providing services under the Services Agreement, Service Provider may Process Personal Information on behalf of Company;

C. WHEREAS, the Parties desire to establish the terms and conditions under which Service Provider will Process Personal Information to ensure compliance with Applicable Data Protection Laws, including without limitation the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), and the state privacy statutes listed in Exhibit A;

D. WHEREAS, this DPA is intended to satisfy the contractual requirements for "service providers" under CCPA/CPRA § 1798.140(ag) and for "processors" under the VCDPA, Colorado CPA, CTDPA, and equivalent state statutes;

NOW, THEREFORE, in consideration of the mutual obligations set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

ARTICLE 1 — DEFINITIONS

For purposes of this DPA, the following capitalized terms shall have the meanings set forth below. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Services Agreement or, where applicable, in the relevant Applicable Data Protection Laws.

1.1 "Applicable Data Protection Laws" means all United States federal and state privacy and data-protection statutes, regulations, and binding guidance applicable to the Processing of Personal Information under this DPA, including but not limited to those listed in Exhibit A hereto, as amended, supplemented, or superseded from time to time.

1.2 "Business Purpose" has the meaning given to that term under CCPA/CPRA § 1798.140(e), and means the operational purposes, or other notified purposes, for which Personal Information is collected or Processed, as specified in Exhibit B to this DPA. For the avoidance of doubt, Business Purposes include performing services on behalf of Company, including maintaining or servicing accounts, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of Company.

1.3 "Consumer" means a natural person who is a resident of a United States state that has enacted an Applicable Data Protection Law, as that term (or its equivalent, including but not limited to "consumer," "individual," or "data subject") is defined under the relevant Applicable Data Protection Law.

1.4 "Controller" means the entity that determines the purposes and means of Processing Personal Information. For purposes of this DPA, the term "Controller" is used as the equivalent of "business" as defined under CCPA/CPRA § 1798.140(d) and as the equivalent of "controller" under the VCDPA, Colorado CPA, CTDPA, and equivalent state privacy statutes.

1.5 "De-identified Data" has the meaning given to that term under CCPA/CPRA § 1798.140(m), and means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular Consumer or household, provided that the entity maintaining such information has implemented technical safeguards and business processes that specifically prohibit re-identification of the Consumer to whom the information may pertain, has implemented business processes to prevent inadvertent release of de-identified information, and has made no attempt to re-identify the information.

1.6 "Personal Information" (or "Personal Data") means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household, as defined under CCPA/CPRA § 1798.140(v) and equivalent definitions under other Applicable Data Protection Laws. The specific categories of Personal Information Processed under this DPA are set forth in Exhibit B. For the avoidance of doubt, Personal Information includes Sensitive Personal Information unless expressly stated otherwise.

1.7 "Process" or "Processing" means any operation or set of operations performed on Personal Information or on sets of Personal Information, whether or not by automated means, including but not limited to collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, destruction, analysis, or modification.

1.8 "Sensitive Personal Information" has the meaning given to that term under CCPA/CPRA § 1798.140(ae), and includes equivalent definitions under other Applicable Data Protection Laws (e.g., "sensitive data" under VCDPA §§ 59.1-575 et seq., Colorado CPA § 6-1-1303, and CTDPA § 42-515 et seq.), including but not limited to Social Security numbers, driver's license numbers, state identification card numbers, financial account numbers in combination with access codes, precise geolocation data, racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sexual orientation, and citizenship or immigration status.

1.9 "Service Provider" has the meaning given to that term under CCPA/CPRA § 1798.140(ag), and means a person or entity that Processes Personal Information on behalf of a business and to which the business discloses a Consumer's Personal Information for a Business Purpose pursuant to a written contract that complies with the requirements of CCPA/CPRA § 1798.100(d). For purposes of this DPA, the term "Service Provider" also encompasses the role of "processor" as defined under the VCDPA, Colorado CPA, CTDPA, and equivalent state privacy statutes.

1.10 "Sub-processor" means any third party (other than an employee or individual contractor of Service Provider) engaged by Service Provider to Process Personal Information on behalf of Company in connection with the services under the Services Agreement. For the avoidance of doubt, the term "Sub-processor" includes any subcontractor, vendor, or agent of Service Provider that accesses, receives, or otherwise Processes Personal Information in the course of performing obligations delegated by Service Provider.

1.11 "Data Subject Request" or "Consumer Rights Request" means any request, complaint, or communication from a Consumer exercising rights under Applicable Data Protection Laws, including but not limited to rights of access (right to know), deletion, correction, data portability, opt-out of sale or sharing of Personal Information, and limitation of use and disclosure of Sensitive Personal Information.

1.12 "Security Incident" means any unauthorized access to, or unauthorized acquisition, use, disclosure, alteration, or destruction of, Personal Information, or any event that compromises the security, confidentiality, or integrity of Personal Information, including any event requiring notification under any Applicable Data Protection Law.

1.13 "Confidential Information" has the meaning given to that term in the Services Agreement, and for purposes of this DPA, includes all Personal Information and all audit findings and reports generated in connection with this DPA.

1.14 Additional Definitions. [Insert additional definitions as needed for specific vendor engagements. Additional defined terms may be included in an addendum or amendment to this DPA as the Parties may agree in writing.]

ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING

2.1 Scope. This DPA applies to all Processing of Personal Information by Service Provider in connection with the Services Agreement, regardless of the medium or form in which such Personal Information is maintained or Processed. The subject matter, duration, nature, and purpose of Processing, the categories of Personal Information Processed, and the categories of Consumers whose Personal Information is Processed are described in Exhibit B. In the event that the scope of Processing changes materially during the term of this DPA, the Parties shall update Exhibit B accordingly.

2.2 Role of the Parties. The Parties acknowledge and agree that, with respect to the Processing of Personal Information under this DPA:

(a) Company is the "business" (as defined under CCPA/CPRA § 1798.140(d)) and the "controller" (as defined under the VCDPA, Colorado CPA, CTDPA, and equivalent state privacy statutes); and

(b) Service Provider is a "service provider" (as defined under CCPA/CPRA § 1798.140(ag)) and a "processor" (as defined under the VCDPA, Colorado CPA, CTDPA, and equivalent state privacy statutes).

Nothing in this DPA shall be construed to create a joint-controller or co-business relationship between the Parties. Service Provider shall not be considered a "third party" as defined under CCPA/CPRA § 1798.140(ai) with respect to Personal Information Processed under this DPA, provided that Service Provider complies with the terms of this DPA and Applicable Data Protection Laws.

2.3 Documented Instructions. Service Provider shall Process Personal Information only in accordance with Company's documented instructions, as set forth in the Services Agreement, this DPA (including all Exhibits), and any subsequent written instructions issued by Company from time to time. Service Provider shall not Process Personal Information for any purpose or in any manner not expressly authorized by Company's documented instructions. If Service Provider believes that any instruction from Company infringes Applicable Data Protection Laws, Service Provider shall immediately inform Company in writing before carrying out such instruction and shall not proceed with the Processing until Company confirms or modifies the instruction.

2.4 No Sale or Sharing. Service Provider shall not sell or share (as those terms are defined under CCPA/CPRA § 1798.140(ad) and § 1798.140(ah), respectively) any Personal Information received from or on behalf of Company. Service Provider acknowledges that the disclosure of Personal Information by Company to Service Provider does not constitute a "sale" or "sharing" of Personal Information, provided that Service Provider complies with the requirements of this DPA and Applicable Data Protection Laws.

ARTICLE 3 — LIMITATIONS ON USE, RETENTION, AND DISCLOSURE

3.1 Purpose Limitation. Service Provider shall not Process Personal Information for any purpose other than the specific Business Purposes set forth in Exhibit B and as otherwise permitted by Applicable Data Protection Laws. Without limiting the generality of the foregoing, Service Provider shall not Process Personal Information for Service Provider's own commercial purposes, including but not limited to advertising, marketing, or product-development purposes that are unrelated to the services provided to Company under the Services Agreement. Service Provider shall not use Personal Information to build or augment profiles of Consumers for the benefit of any party other than Company.

3.2 Prohibition on Combining. Service Provider shall not combine Personal Information received from Company, or received on behalf of Company, with Personal Information that Service Provider receives from or on behalf of any other person or entity, or that Service Provider collects from its own interactions with Consumers, except as expressly permitted by CCPA/CPRA § 1798.140(ag)(1)(A)(iv) or as otherwise expressly authorized in writing by Company. For the avoidance of doubt, this prohibition applies regardless of the purpose for which combining would occur, including but not limited to analytics, advertising, benchmarking, or model training.

Instruction: The prohibition on combining is a critical service-provider requirement under CCPA/CPRA. For vendors that must combine data from multiple sources, consider whether the "contractor" template (which imposes additional restrictions and audit obligations) is more appropriate. Consult Calderwood & Harkness LLP before permitting any exceptions to this prohibition.

3.3 Retention Limitation. Service Provider shall retain Personal Information only for so long as reasonably necessary to fulfill the Business Purposes specified in Exhibit B, and in any event no longer than the applicable retention periods specified in Exhibit C (Retention Schedule). Upon expiration of the applicable retention period, Service Provider shall securely delete or de-identify all Personal Information in accordance with the disposal methods specified in Exhibit C. Service Provider shall not retain Personal Information on the basis that it may be useful for future, unspecified purposes.

3.4 Disclosure Limitation. Service Provider shall not disclose Personal Information to any third party except:

(a) to Sub-processors in accordance with Article 7 of this DPA;

(b) as necessary to comply with Applicable Data Protection Laws, a valid court order, or a lawful subpoena or other compulsory legal process, provided that Service Provider complies with Section 3.5 below;

(d) as otherwise expressly permitted by this DPA.

3.5 Legal Process. If Service Provider receives a subpoena, court order, warrant, or other legal process requiring disclosure of Personal Information, Service Provider shall, to the extent permitted by law, promptly notify Company prior to any such disclosure so that Company may seek a protective order or other appropriate remedy. Service Provider shall disclose only the minimum amount of Personal Information necessary to comply with the legal process and shall use reasonable efforts to ensure confidential treatment of any Personal Information so disclosed.

ARTICLE 4 — COMPLIANCE WITH APPLICABLE DATA PROTECTION LAWS

4.1 General Compliance. Service Provider shall comply with all obligations applicable to service providers and processors under Applicable Data Protection Laws, including without limitation the CCPA/CPRA, VCDPA, Colorado CPA, CTDPA, and all other statutes listed in Exhibit A, as such statutes may be amended, supplemented, or replaced from time to time. Service Provider shall monitor changes in Applicable Data Protection Laws and shall promptly implement any modifications to its Processing activities that are necessary to maintain compliance.

4.2 Assistance with Consumer Rights Requests. Service Provider shall, taking into account the nature of the Processing and the information available to Service Provider, assist Company by appropriate technical and organizational measures, insofar as reasonably practicable, to fulfill Company's obligations to respond to Consumer Rights Requests. Such assistance shall include, without limitation, assistance with requests for:

(a) access to and disclosure of Personal Information (right to know);

(b) deletion of Personal Information;

(d) data portability;

(e) opt-out of the sale or sharing of Personal Information; and

(f) limitation of use and disclosure of Sensitive Personal Information.

Service Provider shall respond to Company's instructions regarding Consumer Rights Requests within [Insert number] business days from receipt of Company's instruction. Service Provider shall maintain the technical capability to search for, locate, retrieve, correct, delete, and export Personal Information in a structured, commonly used, and machine-readable format, as necessary to enable Company to comply with Consumer Rights Requests within the timeframes required by Applicable Data Protection Laws.

Instruction: Specify the process for forwarding Consumer Rights Requests that Service Provider receives directly. Confirm response-time commitments (recommended: no more than five (5) business days from receipt of Company's instruction) and ensure alignment with CCPA/CPRA's 45-day response window and other statutory timeframes.

4.3 Cooperation with Regulatory Inquiries. Service Provider shall reasonably cooperate with Company in responding to inquiries, investigations, audits, or enforcement actions by the California Privacy Protection Agency, any state attorney general, or any other governmental authority related to the Processing of Personal Information under this DPA. Such cooperation shall include providing information, documents, and testimony as reasonably requested by Company, subject to applicable legal privileges.

4.4 Privacy Impact Assessments / Data Protection Assessments. Service Provider shall provide reasonable assistance to Company in conducting privacy impact assessments, data protection assessments, or risk assessments required by Applicable Data Protection Laws (including, without limitation, assessments required under CCPA/CPRA § 1798.185(a)(15)(B), VCDPA § 59.1-580, Colorado CPA § 6-1-1309, and CTDPA § 42-520), to the extent that such assessments relate to Service Provider's Processing activities under this DPA. Such assistance shall include providing information regarding Service Provider's Processing operations, security measures, and Sub-processor arrangements as reasonably necessary for Company to complete such assessments.

ARTICLE 5 — CONFIDENTIALITY AND PERSONNEL

5.1 Confidentiality Obligations. Service Provider shall ensure that all personnel (including employees, contractors, agents, and temporary staff) authorized to Process Personal Information under this DPA are bound by appropriate confidentiality obligations, whether by contract, statute, professional obligation, or otherwise, with respect to such Personal Information. Such confidentiality obligations shall survive the termination of such personnel's employment or engagement with Service Provider.

5.2 Access Limitations. Service Provider shall limit access to Personal Information to those personnel who have a demonstrable need to know such information for the purpose of performing the services under the Services Agreement. Service Provider shall implement and enforce access controls consistent with the principle of least privilege, ensuring that personnel are granted only the minimum level of access necessary to perform their assigned duties. Service Provider shall promptly revoke access for any personnel whose access is no longer necessary.

5.3 Training. Service Provider shall ensure that all personnel who Process Personal Information on behalf of Company receive appropriate and regular training regarding Applicable Data Protection Laws, data-protection obligations under this DPA, and Service Provider's internal data-protection policies and procedures. Such training shall be provided upon initial assignment to duties involving Personal Information and at least annually thereafter. Service Provider shall maintain records of such training and shall make such records available to Company upon reasonable request.

ARTICLE 6 — SECURITY

6.1 Technical and Organizational Measures. Service Provider shall implement and maintain reasonable and appropriate administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized or unlawful Processing and against accidental loss, destruction, damage, theft, alteration, or unauthorized disclosure. Such safeguards shall be commensurate with the nature, scope, context, and purposes of Processing, the sensitivity of the Personal Information being Processed, and the risks to Consumers. The minimum security measures applicable to this DPA are set forth in Exhibit D. Service Provider represents and warrants that it has implemented all security measures described in Exhibit D as of the Effective Date and shall maintain such measures throughout the term of this DPA.

6.2 Security Assessment. Service Provider shall, upon Company's reasonable request and no more frequently than [Insert frequency, e.g., once per calendar year] (unless a Security Incident or material non-compliance event has occurred, in which case Company may request additional assessments), provide Company with evidence of Service Provider's compliance with the security requirements of this DPA. Acceptable forms of evidence include, at Company's election:

(a) a current SOC 2 Type II report issued by a qualified independent auditor;

(b) a current ISO/IEC 27001 certification issued by an accredited certification body;

(d) a summary of penetration-testing results conducted within the preceding twelve (12) months by a qualified third-party assessor.

Service Provider shall bear its own costs in providing such evidence. If the evidence provided reveals material deficiencies, Company may require Service Provider to undergo additional assessment at Service Provider's expense.

6.3 Updates to Security Measures. Service Provider shall review and, where necessary, update its technical and organizational security measures on a periodic basis, and in any event no less frequently than annually, to address evolving threats, vulnerabilities, and changes in Applicable Data Protection Laws and industry best practices. Service Provider shall promptly notify Company of any material changes to the security measures described in Exhibit D that may adversely affect the protection of Personal Information. No reduction in the overall level of security shall be made without Company's prior written consent.

ARTICLE 7 — SUB-PROCESSORS

7.1 Use of Sub-processors. Service Provider shall not engage any Sub-processor to Process Personal Information on behalf of Company without Company's prior [Insert: written consent / general authorization subject to notification and objection right].

Instruction: Select either (a) specific prior written consent for each Sub-processor, or (b) general authorization with a list of approved Sub-processors and an obligation to notify Company of additions, with Company having the right to object. Approach (b) is more common for large-scale technology vendors. If approach (b) is selected, ensure that the notification and objection periods in Sections 7.2 and 7.3 are completed.

7.2 Current Sub-processors. Service Provider's current Sub-processors as of the Effective Date, together with descriptions of their Processing activities and locations, are listed in Exhibit E. Service Provider shall notify Company in writing at least [Insert number, e.g., 30] days prior to engaging any new Sub-processor or replacing an existing Sub-processor. Such notification shall include the name of the proposed Sub-processor, the nature of the Processing to be performed, the categories of Personal Information to be Processed, and the location(s) of Processing.

7.3 Objection Right. Company shall have the right to object to any new or replacement Sub-processor by providing written notice to Service Provider within [Insert number, e.g., 15] days of receipt of Service Provider's notification under Section 7.2. If Company objects to a proposed Sub-processor, Service Provider shall use reasonable efforts to make available to Company an alternative arrangement that avoids the use of the objected-to Sub-processor. If no commercially reasonable alternative is available within [Insert number, e.g., 30] days of Company's objection, either Party may terminate the affected services under the Services Agreement upon [Insert number, e.g., 30] days' written notice, without penalty or liability (other than for fees and charges accrued prior to the effective date of termination).

7.4 Sub-processor Contracts. Service Provider shall enter into a written agreement with each Sub-processor that imposes data-protection obligations no less protective than those set forth in this DPA. Such agreements shall include, at a minimum, all of the obligations imposed upon Service Provider under this DPA, as applicable to the Sub-processor's Processing activities. Service Provider shall make copies of Sub-processor agreements available to Company upon reasonable request (subject to redaction of commercially sensitive terms not relevant to data-protection obligations).

7.5 Flow-Down of Requirements. Each Sub-processor agreement shall include, at a minimum, the same or equivalent obligations regarding:

(a) limitations on use, retention, and disclosure of Personal Information;

(b) technical and organizational security measures;

(d) audit rights;

(e) cooperation with Consumer Rights Requests;

(f) Security Incident notification and cooperation; and

(g) deletion or return of Personal Information upon termination.

7.6 Liability for Sub-processors. Service Provider shall remain fully liable to Company for the acts, omissions, and failures of its Sub-processors to the same extent as Service Provider would be liable if performing the Processing directly. Service Provider's engagement of a Sub-processor shall not relieve Service Provider of any of its obligations under this DPA.

ARTICLE 8 — DATA SUBJECT REQUESTS AND CONSUMER RIGHTS

8.1 Notification of Requests. If Service Provider receives a Consumer Rights Request directly from a Consumer (or from any third party acting on behalf of a Consumer, including an authorized agent) relating to Personal Information Processed under this DPA, Service Provider shall promptly, and in any event within [Insert number, e.g., 3] business days, notify Company of such request. Service Provider shall provide Company with all information reasonably necessary to identify the Consumer and the nature of the request. Service Provider shall not respond to the Consumer directly, provide any Personal Information to the Consumer, or take any action with respect to the Consumer's Personal Information in response to such request, unless instructed to do so by Company or unless required to do so by Applicable Data Protection Laws.

8.2 Assistance with Fulfillment. Service Provider shall assist Company in fulfilling Consumer Rights Requests in a timely and complete manner. Such assistance shall include, without limitation:

(a) providing the technical capability to search for, locate, access, correct, delete, or export Personal Information as necessary to enable Company to respond within applicable statutory timeframes;

(b) implementing technical mechanisms to apply Consumer preferences (such as opt-out signals and limitation-of-use instructions) to the Personal Information Processed by Service Provider;

(c) confirming in writing to Company the completion of any actions taken in response to Company's instructions regarding Consumer Rights Requests; and

(d) maintaining records of all Consumer Rights Requests received or processed by Service Provider for a period of no less than twenty-four (24) months.

8.3 Verification Assistance. Service Provider shall assist Company with identity-verification processes for Consumer Rights Requests to the extent that Service Provider holds information relevant to verifying the Consumer's identity. Service Provider shall not independently verify the identity of a Consumer or fulfill a Consumer Rights Request without Company's express authorization.

8.4 Appeal Process. Service Provider shall cooperate with Company in processing any appeals filed by Consumers as required under Applicable Data Protection Laws, including but not limited to appeals under the VCDPA § 59.1-577, Colorado CPA § 6-1-1306, CTDPA § 42-517, and equivalent provisions of other state privacy statutes. Service Provider shall provide any information or assistance reasonably required by Company to respond to such appeals within the statutory timeframes.

ARTICLE 9 — SECURITY INCIDENTS AND BREACH NOTIFICATION

9.1 Notification Obligation. Service Provider shall notify Company without undue delay, and in any event within [Insert number, e.g., 48] hours after becoming aware of any Security Incident involving Personal Information Processed under this DPA. For purposes of this Section, Service Provider shall be deemed to have become "aware" of a Security Incident at the time any employee, officer, or agent of Service Provider (including any Sub-processor) reasonably believes that a Security Incident has occurred. Notification shall be directed to Company's Information Security Contact as identified in Exhibit F, and simultaneously to Company's Legal Contact and Privacy Contact.

9.2 Content of Notification. The notification required under Section 9.1 shall include, to the extent reasonably known or ascertainable at the time of notification:

(a) a description of the nature of the Security Incident, including the categories and approximate number of Consumers whose Personal Information is affected;

(b) the categories and approximate volume of Personal Information records affected;

(d) a description of the measures taken or proposed to be taken by Service Provider to address the Security Incident and mitigate its potential adverse effects;

(e) the identity and contact information of Service Provider's designated point of contact for purposes of the Security Incident; and

(f) any other information reasonably required by Company to assess the scope and impact of the Security Incident and to comply with applicable notification obligations under Applicable Data Protection Laws.

If complete information is not available at the time of the initial notification, Service Provider shall provide the information in phases without further undue delay as it becomes available.

9.3 Cooperation. Service Provider shall fully cooperate with Company in investigating, remediating, and mitigating the Security Incident and in complying with any notification obligations owed to Consumers, governmental authorities, or other parties under Applicable Data Protection Laws. Such cooperation shall include, without limitation:

(a) preserving and providing evidence and logs related to the Security Incident;

(b) making knowledgeable personnel available for interviews and discussions with Company, Company's counsel, and Company's forensic investigators;

(d) providing timely updates regarding the investigation and remediation of the Security Incident.

9.4 Prohibition on Public Disclosure. Service Provider shall not make any public statement, press release, regulatory filing, or notification to affected Consumers regarding a Security Incident involving Personal Information Processed under this DPA without Company's prior written consent, unless Service Provider is independently required to do so by Applicable Data Protection Laws. In such event, Service Provider shall provide Company with advance notice and a copy of the proposed disclosure for review and comment before issuance, to the extent permitted by law.

9.5 Record-Keeping. Service Provider shall maintain a written record of all Security Incidents involving Personal Information Processed under this DPA, including a description of the facts relating to each Security Incident, the effects of such incident, the remedial actions taken, and any notifications provided. Service Provider shall retain such records for a minimum period of five (5) years from the date of the Security Incident and shall make such records available to Company upon reasonable request.

ARTICLE 10 — AUDITS AND ASSESSMENTS

10.1 Audit Rights. Company shall have the right, upon [Insert number, e.g., 30] days' prior written notice, to audit or inspect (or to engage a qualified independent third-party auditor, subject to reasonable confidentiality obligations, to audit or inspect) Service Provider's Processing activities, information systems, facilities, and records related to the Processing of Personal Information under this DPA, to verify Service Provider's compliance with the terms of this DPA and Applicable Data Protection Laws.

Instruction: Consider including frequency limitations (e.g., no more than once per calendar year absent reasonable cause, such as a Security Incident or material non-compliance). Also consider provisions permitting Service Provider to participate in multi-client audits or to provide existing audit reports (e.g., SOC 2 Type II) in lieu of on-site audits where such reports are reasonably sufficient to address Company's compliance-verification requirements.

10.2 Scope. Audits conducted under this Article may include, without limitation, review of:

(a) policies, procedures, and standards related to the Processing and protection of Personal Information;

(b) technical configurations, access controls, and security measures;

(d) records of Processing activities maintained by Service Provider;

(e) records of Security Incidents and remedial actions;

(f) records of Consumer Rights Requests received and processed;

(g) training records for personnel who Process Personal Information; and

(h) any other information reasonably necessary to verify compliance with this DPA and Applicable Data Protection Laws.

Service Provider shall provide reasonable cooperation and assistance during audits, including making knowledgeable personnel available for questions and providing access to relevant systems and facilities during normal business hours.

10.3 Confidentiality of Audit Results. All audit findings, reports, and related materials shall be treated as Confidential Information of Service Provider and shall be subject to the confidentiality provisions of the Services Agreement. Company shall not disclose audit results to any third party except to Company's legal counsel, auditors, and regulators, as necessary for compliance purposes.

10.4 Remediation. If an audit reveals any non-compliance with this DPA or Applicable Data Protection Laws, Service Provider shall promptly develop and implement a remediation plan to address such non-compliance. The remediation plan shall be submitted to Company for review within [Insert number, e.g., 15] days of Service Provider's receipt of the audit findings. Service Provider shall implement all remediation actions at its own cost and expense and shall report to Company on the completion of each remediation action within [Insert number, e.g., 30] days of the date on which such action was due to be completed.

10.5 Regulatory Audit Cooperation. Service Provider shall cooperate fully with any audit, inquiry, examination, or investigation by the California Privacy Protection Agency, any state attorney general, or any other regulatory authority concerning Company's or Service Provider's compliance with Applicable Data Protection Laws, to the extent such audit, inquiry, examination, or investigation relates to the Processing of Personal Information under this DPA. Such cooperation shall include providing information, documents, access to facilities, and access to personnel as reasonably requested.

ARTICLE 11 — DELETION AND RETURN OF PERSONAL INFORMATION

11.1 Upon Termination or Expiration. Upon termination or expiration of the Services Agreement for any reason, or at any time upon Company's written request, Service Provider shall, at Company's election:

(a) return all Personal Information to Company in a structured, commonly used, and machine-readable format designated by Company, together with all copies, extracts, and derivations thereof; or

(b) securely delete or de-identify all Personal Information in Service Provider's possession, custody, or control, including all copies, backups, archives, and any derivative data, except to the extent retention is required by Applicable Data Protection Laws.

Company shall communicate its election to Service Provider in writing within [Insert number, e.g., 30] days following the effective date of termination or expiration. If Company fails to make an election within such period, Service Provider shall securely delete or de-identify all Personal Information in accordance with clause (b) above.

11.2 Certification of Deletion. Service Provider shall provide Company with written certification of the completion of deletion or de-identification within [Insert number, e.g., 30] days of completing such deletion or de-identification. The certification shall be signed by an authorized officer or representative of Service Provider and shall confirm that all Personal Information has been deleted or de-identified in accordance with this Article, specifying the method of deletion or de-identification used.

11.3 Retained Copies. To the extent Service Provider is required by Applicable Data Protection Laws, a valid court order, or other binding legal obligation to retain any Personal Information following the termination or expiration of the Services Agreement, Service Provider shall:

(a) promptly notify Company of such retention requirement in writing, specifying the legal basis for retention, the categories of Personal Information to be retained, and the anticipated duration of retention;

(b) continue to protect such Personal Information in accordance with all applicable provisions of this DPA, including the security measures set forth in Article 6 and Exhibit D, and the confidentiality obligations set forth in Article 5;

(c) limit Processing of such retained Personal Information to the purposes required by the applicable legal obligation; and

(d) delete or de-identify such Personal Information promptly upon expiration of the applicable retention obligation and provide written certification of such deletion or de-identification to Company.

ARTICLE 12 — CERTIFICATION OF UNDERSTANDING

12.1 Certification. Service Provider certifies that it understands and will comply with the restrictions and obligations set forth in this DPA and in Applicable Data Protection Laws applicable to service providers and processors, including without limitation the restrictions and obligations set forth in CCPA/CPRA § 1798.140(ag) and § 1798.100(d). Service Provider further certifies that it has reviewed the specific Business Purposes set forth in Exhibit B and understands the scope of its authorized Processing activities under this DPA.

12.2 No Circumvention. Service Provider certifies that it will not take any action that would cause any transfer of Personal Information to or from Service Provider to qualify as a "sale" or "sharing" of Personal Information under Applicable Data Protection Laws. Service Provider further certifies that it will not attempt to circumvent the restrictions set forth in this DPA through any means, including by re-identifying De-identified Data, combining Personal Information in violation of Section 3.2, or engaging in Processing activities outside the scope of the Business Purposes set forth in Exhibit B.

12.3 Notification of Inability to Comply. Service Provider shall promptly notify Company in writing if Service Provider determines or has reason to believe that it can no longer meet its obligations under Applicable Data Protection Laws or under this DPA, including as a result of changes in Service Provider's operations, technology, business practices, or legal obligations. Upon receipt of such notification, Company may take reasonable and appropriate steps to stop and remediate any unauthorized Processing of Personal Information by Service Provider, including by directing Service Provider to cease Processing, requiring immediate return or deletion of Personal Information, or terminating this DPA and the affected portions of the Services Agreement.

Instruction: This certification is a statutory requirement under CCPA/CPRA § 1798.100(d). Ensure the counterparty's authorized signatory acknowledges this provision and that the signatory has authority to bind the Service Provider to this certification.

ARTICLE 13 — SENSITIVE PERSONAL INFORMATION

13.1 Processing Restrictions. If Service Provider Processes Sensitive Personal Information on behalf of Company, Service Provider shall Process such information only for the specific purposes identified in Exhibit B with respect to Sensitive Personal Information and in strict compliance with Applicable Data Protection Laws, including any applicable consent, opt-in, or notice requirements. Service Provider shall not Process Sensitive Personal Information for any purpose other than those expressly authorized by Company.

13.2 Heightened Security. Service Provider shall apply enhanced technical and organizational safeguards to Sensitive Personal Information that are appropriate to the increased risk associated with such information. The specific enhanced security measures applicable to Sensitive Personal Information are set forth in Exhibit D. At a minimum, Sensitive Personal Information shall be encrypted at rest and in transit and shall be subject to more restrictive access controls than non-sensitive Personal Information.

13.3 Limitation of Use. Service Provider acknowledges that Consumers may exercise the right to limit the use and disclosure of their Sensitive Personal Information under CCPA/CPRA § 1798.121 and equivalent provisions of other Applicable Data Protection Laws. Service Provider shall implement and maintain technical measures sufficient to honor such limitations upon notice from Company, including the ability to restrict Processing of specified categories of Sensitive Personal Information for specified Consumers within the timeframes required by Applicable Data Protection Laws.

ARTICLE 14 — CROSS-BORDER DATA TRANSFERS

14.1 Data Localization. Service Provider shall Process Personal Information only within [Insert jurisdiction(s), e.g., the United States], unless otherwise approved in writing by Company. Service Provider represents and warrants that, as of the Effective Date, all Processing of Personal Information under this DPA occurs within the jurisdictions specified in this Section 14.1, including Processing by Sub-processors.

14.2 Transfer Restrictions. Service Provider shall not transfer Personal Information outside the jurisdictions specified in Section 14.1 without Company's prior written consent. If Company consents to a cross-border transfer, Service Provider shall implement appropriate safeguards as required by Applicable Data Protection Laws and as reasonably directed by Company, which may include data transfer agreements, contractual clauses, or other mechanisms designed to ensure an adequate level of protection for Personal Information. Service Provider shall promptly notify Company if any Applicable Data Protection Law requires or restricts a cross-border transfer of Personal Information.

ARTICLE 15 — INDEMNIFICATION

15.1 Indemnification by Service Provider. Service Provider shall indemnify, defend, and hold harmless Company and its parents, subsidiaries, and affiliates, and their respective directors, officers, employees, agents, successors, and assigns (collectively, the "Company Indemnitees"), from and against all third-party claims, actions, suits, proceedings, liabilities, losses, damages, costs, and expenses (including reasonable attorneys' fees and court costs) (collectively, "Losses") arising out of or relating to:

(a) any breach of this DPA by Service Provider or any of its Sub-processors;

(b) any Processing of Personal Information by Service Provider or any of its Sub-processors in violation of Applicable Data Protection Laws or in a manner inconsistent with Company's documented instructions;

(c) any Security Incident caused by or resulting from Service Provider's or its Sub-processors' failure to comply with the security requirements of this DPA or Applicable Data Protection Laws; or

(d) any failure by Service Provider or its Sub-processors to comply with the certification obligations set forth in Article 12.

Instruction: Negotiate scope and caps on indemnification as appropriate for each vendor engagement. Consider whether to include indemnification for regulatory fines, penalties, and assessments imposed by the California Privacy Protection Agency or other regulatory authorities. Consult Calderwood & Harkness LLP regarding enforceability of indemnification for regulatory fines under applicable law.

15.2 Indemnification Procedures. The following procedures shall apply to any claim for indemnification under this Article 15:

(a) Notice. The Company Indemnitee seeking indemnification (the "Indemnified Party") shall provide Service Provider with prompt written notice of any claim, action, or proceeding for which indemnification is sought (a "Claim"). Failure to provide prompt notice shall not relieve Service Provider of its indemnification obligations except to the extent that Service Provider is materially prejudiced by such failure.

(b) Control of Defense. Service Provider shall have the right to assume the defense of any Claim using counsel reasonably acceptable to the Indemnified Party, provided that Service Provider shall not settle, compromise, or consent to any judgment with respect to any Claim without the Indemnified Party's prior written consent (not to be unreasonably withheld or delayed) if such settlement, compromise, or judgment would impose any obligation on the Indemnified Party, would not include a complete release of the Indemnified Party, or would involve an admission of liability or wrongdoing by the Indemnified Party.

(c) Cooperation. The Indemnified Party shall provide reasonable cooperation to Service Provider in the defense of any Claim, at Service Provider's expense.

(d) Reservation of Rights. The Indemnified Party shall have the right to participate in the defense of any Claim at its own expense, using counsel of its own choosing.

ARTICLE 16 — LIABILITY

16.1 Limitation of Liability. [Insert agreed-upon limitation of liability for this DPA. This provision should be coordinated with the limitation-of-liability provisions in the Services Agreement to ensure consistency and should address the following considerations:]

(a) [Insert aggregate liability cap, if applicable — e.g., a multiple of fees paid or payable under the Services Agreement during a specified period.]

(b) [Insert any carve-outs from the liability cap — e.g., breaches of Article 3 (Limitations on Use), Article 9 (Security Incidents), Article 12 (Certification), and indemnification obligations under Article 15 may be carved out from general liability caps.]

(c) [Insert any exclusions of consequential, incidental, or indirect damages, subject to carve-outs for data-protection breaches.]

Instruction: Data-protection liability carve-outs are strongly recommended for high-volume data processors and for engagements involving Sensitive Personal Information. The scope of carve-outs should be proportionate to the risk profile of the engagement. Discuss with Calderwood & Harkness LLP.

ARTICLE 17 — TERM AND TERMINATION

17.1 Term. This DPA shall become effective on the Effective Date and shall remain in full force and effect for the duration of the Services Agreement. The obligations of Service Provider under this DPA with respect to Personal Information in its possession, custody, or control shall survive the termination or expiration of this DPA and the Services Agreement until all Personal Information has been deleted, de-identified, or returned to Company in accordance with Article 11.

17.2 Termination for Breach. Company may terminate this DPA and the Services Agreement (or the affected portions thereof) immediately upon written notice to Service Provider if:

(a) Service Provider materially breaches any provision of this DPA and fails to cure such breach within [Insert number, e.g., 30] days after receipt of written notice specifying the nature of the breach;

(b) Service Provider notifies Company under Section 12.3 that it can no longer meet its obligations under Applicable Data Protection Laws or this DPA;

(d) Service Provider is found to have engaged in a pattern or practice of unauthorized Processing of Personal Information; or

(e) Service Provider undergoes a change of control, merger, or acquisition that, in Company's reasonable judgment, materially affects Service Provider's ability to comply with this DPA.

17.3 Effect of Termination. Upon termination of this DPA for any reason:

(a) Service Provider shall immediately cease all Processing of Personal Information, except as necessary to comply with Article 11;

(b) the provisions of Article 5 (Confidentiality), Article 9 (Security Incidents), Article 10 (Audits), Article 11 (Deletion and Return), Article 12 (Certification), Article 15 (Indemnification), Article 16 (Liability), Article 17.3 (Effect of Termination), and Article 18 (General Provisions) shall survive termination; and

ARTICLE 18 — GENERAL PROVISIONS

18.1 Conflicts. In the event of any conflict or inconsistency between the terms of this DPA and the terms of the Services Agreement, or any other agreement between the Parties, the terms of this DPA shall prevail and control with respect to the Processing of Personal Information. In the event of any conflict between the terms of this DPA and the requirements of Applicable Data Protection Laws, the requirements of Applicable Data Protection Laws shall prevail.

18.2 Amendments. This DPA may be amended only by a written instrument signed by duly authorized representatives of both Parties. Notwithstanding the foregoing, Company reserves the right to update this DPA to reflect changes in Applicable Data Protection Laws, including the enactment of new state privacy statutes or the issuance of new regulations or binding guidance, upon [Insert number, e.g., 60] days' written notice to Service Provider. Service Provider shall comply with any such updates upon the effective date specified in Company's notice.

18.3 Governing Law. This DPA shall be governed by and construed in accordance with the laws of the State of [Insert state], without regard to its conflict-of-laws principles. For the avoidance of doubt, Applicable Data Protection Laws of each relevant jurisdiction shall apply to the Processing of Personal Information of Consumers who are residents of such jurisdiction, regardless of the governing law of this DPA.

18.4 Dispute Resolution. [Insert dispute-resolution provision — e.g., Any dispute arising out of or relating to this DPA that cannot be resolved through good-faith negotiation between the Parties within thirty (30) days shall be resolved by [binding arbitration administered by (Insert arbitration body) in accordance with its (Insert rules) / litigation in the state and federal courts located in (Insert city and state)], and the Parties hereby consent to the exclusive jurisdiction and venue of such [arbitral tribunal / courts].]

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
September 30, 2025
CALDERWOOD & HARKNESS LLP Privacy & Data Security Practice Group
Document Title: Master Data Processing Agreement Template — Service Providers Filename: dpa-template-service-providers.docx Date: September 30, 2025 Prepared by: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP Reviewed by: Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP Matter Number: 1038-00010 Client: Cascade Retail Holdings Inc. Classification: THIS IS A BLANK TEMPLATE / STANDARD FORM — All fields contain placeholder instructions and generic guidance; no matter-specific information is pre-populated.
MASTER DATA PROCESSING AGREEMENT — SERVICE PROVIDERS
Template for Use by Cascade Retail Holdings Inc. and Subsidiaries
This template is designed for use with vendors that qualify as "service providers" under the California Consumer Privacy Act (CCPA/CPRA) and as "processors" under the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and equivalent state privacy statutes. This template should be adapted for each vendor engagement based on the specific data processing activities, categories of personal information, and applicable state laws. Consult Calderwood & Harkness LLP before material modifications.
Version: v1.0 — September 30, 2025
COMPANY:
[Insert full legal name of Cascade entity entering into this DPA]
SERVICE PROVIDER:
[Insert full legal name of vendor/service provider]
Right-click to update Table of Contents
PREAMBLE AND PARTIES
This Data Processing Agreement ("DPA") is entered into as of [Insert Effective Date] (the "Effective Date") by and between:
COMPANY: [Insert full legal name of Cascade entity entering into this DPA] ("Company"), a [Insert entity type] organized under the laws of [Insert jurisdiction], with its principal place of business at [Insert address].
Instruction: Use the applicable Cascade entity — e.g., the parent entity or the relevant subsidiary (such as a marketplace subsidiary, fulfillment subsidiary, analytics subsidiary, or loyalty-program subsidiary) that is the contracting party under the underlying services agreement.
SERVICE PROVIDER: [Insert full legal name of vendor/service provider] ("Service Provider"), a [Insert entity type] organized under the laws of [Insert jurisdiction], with its principal place of business at [Insert address].
Each of Company and Service Provider may be referred to individually as a "Party" and collectively as the "Parties."
RECITALS.  A. WHEREAS, the Parties have entered into [Insert title and date of underlying services agreement(s)] (collectively, the "Services Agreement"), pursuant to which Service Provider provides certain services to Company;
B. WHEREAS, in the course of providing services under the Services Agreement, Service Provider may Process Personal Information on behalf of Company;
C. WHEREAS, the Parties desire to establish the terms and conditions under which Service Provider will Process Personal Information to ensure compliance with Applicable Data Protection Laws, including without limitation the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), and the state privacy statutes listed in Exhibit A;
D. WHEREAS, this DPA is intended to satisfy the contractual requirements for "service providers" under CCPA/CPRA § 1798.140(ag) and for "processors" under the VCDPA, Colorado CPA, CTDPA, and equivalent state statutes;
NOW, THEREFORE, in consideration of the mutual obligations set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1 — DEFINITIONS
For purposes of this DPA, the following capitalized terms shall have the meanings set forth below. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Services Agreement or, where applicable, in the relevant Applicable Data Protection Laws.
1.1 "Applicable Data Protection Laws" means all United States federal and state privacy and data-protection statutes, regulations, and binding guidance applicable to the Processing of Personal Information under this DPA, including but not limited to those listed in Exhibit A hereto, as amended, supplemented, or superseded from time to time.
1.2 "Business Purpose" has the meaning given to that term under CCPA/CPRA § 1798.140(e), and means the operational purposes, or other notified purposes, for which Personal Information is collected or Processed, as specified in Exhibit B to this DPA. For the avoidance of doubt, Business Purposes include performing services on behalf of Company, including maintaining or servicing accounts, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of Company.
1.3 "Consumer" means a natural person who is a resident of a United States state that has enacted an Applicable Data Protection Law, as that term (or its equivalent, including but not limited to "consumer," "individual," or "data subject") is defined under the relevant Applicable Data Protection Law.
1.4 "Controller" means the entity that determines the purposes and means of Processing Personal Information. For purposes of this DPA, the term "Controller" is used as the equivalent of "business" as defined under CCPA/CPRA § 1798.140(d) and as the equivalent of "controller" under the VCDPA, Colorado CPA, CTDPA, and equivalent state privacy statutes.
1.5 "De-identified Data" has the meaning given to that term under CCPA/CPRA § 1798.140(m), and means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular Consumer or household, provided that the entity maintaining such information has implemented technical safeguards and business processes that specifically prohibit re-identification of the Consumer to whom the information may pertain, has implemented business processes to prevent inadvertent release of de-identified information, and has made no attempt to re-identify the information.
1.6 "Personal Information" (or "Personal Data") means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household, as defined under CCPA/CPRA § 1798.140(v) and equivalent definitions under other Applicable Data Protection Laws. The specific categories of Personal Information Processed under this DPA are set forth in Exhibit B. For the avoidance of doubt, Personal Information includes Sensitive Personal Information unless expressly stated otherwise.
1.7 "Process" or "Processing" means any operation or set of operations performed on Personal Information or on sets of Personal Information, whether or not by automated means, including but not limited to collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, destruction, analysis, or modification.
1.8 "Sensitive Personal Information" has the meaning given to that term under CCPA/CPRA § 1798.140(ae), and includes equivalent definitions under other Applicable Data Protection Laws (e.g., "sensitive data" under VCDPA §§ 59.1-575 et seq., Colorado CPA § 6-1-1303, and CTDPA § 42-515 et seq.), including but not limited to Social Security numbers, driver's license numbers, state identification card numbers, financial account numbers in combination with access codes, precise geolocation data, racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sexual orientation, and citizenship or immigration status.
1.9 "Service Provider" has the meaning given to that term under CCPA/CPRA § 1798.140(ag), and means a person or entity that Processes Personal Information on behalf of a business and to which the business discloses a Consumer's Personal Information for a Business Purpose pursuant to a written contract that complies with the requirements of CCPA/CPRA § 1798.100(d). For purposes of this DPA, the term "Service Provider" also encompasses the role of "processor" as defined under the VCDPA, Colorado CPA, CTDPA, and equivalent state privacy statutes.
1.10 "Sub-processor" means any third party (other than an employee or individual contractor of Service Provider) engaged by Service Provider to Process Personal Information on behalf of Company in connection with the services under the Services Agreement. For the avoidance of doubt, the term "Sub-processor" includes any subcontractor, vendor, or agent of Service Provider that accesses, receives, or otherwise Processes Personal Information in the course of performing obligations delegated by Service Provider.
1.11 "Data Subject Request" or "Consumer Rights Request" means any request, complaint, or communication from a Consumer exercising rights under Applicable Data Protection Laws, including but not limited to rights of access (right to know), deletion, correction, data portability, opt-out of sale or sharing of Personal Information, and limitation of use and disclosure of Sensitive Personal Information.
1.12 "Security Incident" means any unauthorized access to, or unauthorized acquisition, use, disclosure, alteration, or destruction of, Personal Information, or any event that compromises the security, confidentiality, or integrity of Personal Information, including any event requiring notification under any Applicable Data Protection Law.
1.13 "Confidential Information" has the meaning given to that term in the Services Agreement, and for purposes of this DPA, includes all Personal Information and all audit findings and reports generated in connection with this DPA.
1.14 Additional Definitions. [Insert additional definitions as needed for specific vendor engagements. Additional defined terms may be included in an addendum or amendment to this DPA as the Parties may agree in writing.]
ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING
2.1 Scope. This DPA applies to all Processing of Personal Information by Service Provider in connection with the Services Agreement, regardless of the medium or form in which such Personal Information is maintained or Processed. The subject matter, duration, nature, and purpose of Processing, the categories of Personal Information Processed, and the categories of Consumers whose Personal Information is Processed are described in Exhibit B. In the event that the scope of Processing changes materially during the term of this DPA, the Parties shall update Exhibit B accordingly.
2.2 Role of the Parties. The Parties acknowledge and agree that, with respect to the Processing of Personal Information under this DPA:
(a) Company is the "business" (as defined under CCPA/CPRA § 1798.140(d)) and the "controller" (as defined under the VCDPA, Colorado CPA, CTDPA, and equivalent state privacy statutes); and
(b) Service Provider is a "service provider" (as defined under CCPA/CPRA § 1798.140(ag)) and a "processor" (as defined under the VCDPA, Colorado CPA, CTDPA, and equivalent state privacy statutes).
Nothing in this DPA shall be construed to create a joint-controller or co-business relationship between the Parties. Service Provider shall not be considered a "third party" as defined under CCPA/CPRA § 1798.140(ai) with respect to Personal Information Processed under this DPA, provided that Service Provider complies with the terms of this DPA and Applicable Data Protection Laws.
2.3 Documented Instructions. Service Provider shall Process Personal Information only in accordance with Company's documented instructions, as set forth in the Services Agreement, this DPA (including all Exhibits), and any subsequent written instructions issued by Company from time to time. Service Provider shall not Process Personal Information for any purpose or in any manner not expressly authorized by Company's documented instructions. If Service Provider believes that any instruction from Company infringes Applicable Data Protection Laws, Service Provider shall immediately inform Company in writing before carrying out such instruction and shall not proceed with the Processing until Company confirms or modifies the instruction.
2.4 No Sale or Sharing. Service Provider shall not sell or share (as those terms are defined under CCPA/CPRA § 1798.140(ad) and § 1798.140(ah), respectively) any Personal Information received from or on behalf of Company. Service Provider acknowledges that the disclosure of Personal Information by Company to Service Provider does not constitute a "sale" or "sharing" of Personal Information, provided that Service Provider complies with the requirements of this DPA and Applicable Data Protection Laws.
ARTICLE 3 — LIMITATIONS ON USE, RETENTION, AND DISCLOSURE
3.1 Purpose Limitation. Service Provider shall not Process Personal Information for any purpose other than the specific Business Purposes set forth in Exhibit B and as otherwise permitted by Applicable Data Protection Laws. Without limiting the generality of the foregoing, Service Provider shall not Process Personal Information for Service Provider's own commercial purposes, including but not limited to advertising, marketing, or product-development purposes that are unrelated to the services provided to Company under the Services Agreement. Service Provider shall not use Personal Information to build or augment profiles of Consumers for the benefit of any party other than Company.
3.2 Prohibition on Combining. Service Provider shall not combine Personal Information received from Company, or received on behalf of Company, with Personal Information that Service Provider receives from or on behalf of any other person or entity, or that Service Provider collects from its own interactions with Consumers, except as expressly permitted by CCPA/CPRA § 1798.140(ag)(1)(A)(iv) or as otherwise expressly authorized in writing by Company. For the avoidance of doubt, this prohibition applies regardless of the purpose for which combining would occur, including but not limited to analytics, advertising, benchmarking, or model training.
Instruction: The prohibition on combining is a critical service-provider requirement under CCPA/CPRA. For vendors that must combine data from multiple sources, consider whether the "contractor" template (which imposes additional restrictions and audit obligations) is more appropriate. Consult Calderwood & Harkness LLP before permitting any exceptions to this prohibition.
3.3 Retention Limitation. Service Provider shall retain Personal Information only for so long as reasonably necessary to fulfill the Business Purposes specified in Exhibit B, and in any event no longer than the applicable retention periods specified in Exhibit C (Retention Schedule). Upon expiration of the applicable retention period, Service Provider shall securely delete or de-identify all Personal Information in accordance with the disposal methods specified in Exhibit C. Service Provider shall not retain Personal Information on the basis that it may be useful for future, unspecified purposes.
3.4 Disclosure Limitation. Service Provider shall not disclose Personal Information to any third party except:
(a) to Sub-processors in accordance with Article 7 of this DPA;
(b) as necessary to comply with Applicable Data Protection Laws, a valid court order, or a lawful subpoena or other compulsory legal process, provided that Service Provider complies with Section 3.5 below;
(c) as expressly instructed in writing by Company; or
(d) as otherwise expressly permitted by this DPA.
3.5 Legal Process. If Service Provider receives a subpoena, court order, warrant, or other legal process requiring disclosure of Personal Information, Service Provider shall, to the extent permitted by law, promptly notify Company prior to any such disclosure so that Company may seek a protective order or other appropriate remedy. Service Provider shall disclose only the minimum amount of Personal Information necessary to comply with the legal process and shall use reasonable efforts to ensure confidential treatment of any Personal Information so disclosed.
ARTICLE 4 — COMPLIANCE WITH APPLICABLE DATA PROTECTION LAWS
4.1 General Compliance. Service Provider shall comply with all obligations applicable to service providers and processors under Applicable Data Protection Laws, including without limitation the CCPA/CPRA, VCDPA, Colorado CPA, CTDPA, and all other statutes listed in Exhibit A, as such statutes may be amended, supplemented, or replaced from time to time. Service Provider shall monitor changes in Applicable Data Protection Laws and shall promptly implement any modifications to its Processing activities that are necessary to maintain compliance.
4.2 Assistance with Consumer Rights Requests. Service Provider shall, taking into account the nature of the Processing and the information available to Service Provider, assist Company by appropriate technical and organizational measures, insofar as reasonably practicable, to fulfill Company's obligations to respond to Consumer Rights Requests. Such assistance shall include, without limitation, assistance with requests for:
(a) access to and disclosure of Personal Information (right to know);
(b) deletion of Personal Information;
(c) correction of inaccurate Personal Information;
(d) data portability;
(e) opt-out of the sale or sharing of Personal Information; and
(f) limitation of use and disclosure of Sensitive Personal Information.
Service Provider shall respond to Company's instructions regarding Consumer Rights Requests within [Insert number] business days from receipt of Company's instruction. Service Provider shall maintain the technical capability to search for, locate, retrieve, correct, delete, and export Personal Information in a structured, commonly used, and machine-readable format, as necessary to enable Company to comply with Consumer Rights Requests within the timeframes required by Applicable Data Protection Laws.
Instruction: Specify the process for forwarding Consumer Rights Requests that Service Provider receives directly. Confirm response-time commitments (recommended: no more than five (5) business days from receipt of Company's instruction) and ensure alignment with CCPA/CPRA's 45-day response window and other statutory timeframes.
4.3 Cooperation with Regulatory Inquiries. Service Provider shall reasonably cooperate with Company in responding to inquiries, investigations, audits, or enforcement actions by the California Privacy Protection Agency, any state attorney general, or any other governmental authority related to the Processing of Personal Information under this DPA. Such cooperation shall include providing information, documents, and testimony as reasonably requested by Company, subject to applicable legal privileges.
4.4 Privacy Impact Assessments / Data Protection Assessments. Service Provider shall provide reasonable assistance to Company in conducting privacy impact assessments, data protection assessments, or risk assessments required by Applicable Data Protection Laws (including, without limitation, assessments required under CCPA/CPRA § 1798.185(a)(15)(B), VCDPA § 59.1-580, Colorado CPA § 6-1-1309, and CTDPA § 42-520), to the extent that such assessments relate to Service Provider's Processing activities under this DPA. Such assistance shall include providing information regarding Service Provider's Processing operations, security measures, and Sub-processor arrangements as reasonably necessary for Company to complete such assessments.
ARTICLE 5 — CONFIDENTIALITY AND PERSONNEL
5.1 Confidentiality Obligations. Service Provider shall ensure that all personnel (including employees, contractors, agents, and temporary staff) authorized to Process Personal Information under this DPA are bound by appropriate confidentiality obligations, whether by contract, statute, professional obligation, or otherwise, with respect to such Personal Information. Such confidentiality obligations shall survive the termination of such personnel's employment or engagement with Service Provider.
5.2 Access Limitations. Service Provider shall limit access to Personal Information to those personnel who have a demonstrable need to know such information for the purpose of performing the services under the Services Agreement. Service Provider shall implement and enforce access controls consistent with the principle of least privilege, ensuring that personnel are granted only the minimum level of access necessary to perform their assigned duties. Service Provider shall promptly revoke access for any personnel whose access is no longer necessary.
5.3 Training. Service Provider shall ensure that all personnel who Process Personal Information on behalf of Company receive appropriate and regular training regarding Applicable Data Protection Laws, data-protection obligations under this DPA, and Service Provider's internal data-protection policies and procedures. Such training shall be provided upon initial assignment to duties involving Personal Information and at least annually thereafter. Service Provider shall maintain records of such training and shall make such records available to Company upon reasonable request.
ARTICLE 6 — SECURITY
6.1 Technical and Organizational Measures. Service Provider shall implement and maintain reasonable and appropriate administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized or unlawful Processing and against accidental loss, destruction, damage, theft, alteration, or unauthorized disclosure. Such safeguards shall be commensurate with the nature, scope, context, and purposes of Processing, the sensitivity of the Personal Information being Processed, and the risks to Consumers. The minimum security measures applicable to this DPA are set forth in Exhibit D. Service Provider represents and warrants that it has implemented all security measures described in Exhibit D as of the Effective Date and shall maintain such measures throughout the term of this DPA.
6.2 Security Assessment. Service Provider shall, upon Company's reasonable request and no more frequently than [Insert frequency, e.g., once per calendar year] (unless a Security Incident or material non-compliance event has occurred, in which case Company may request additional assessments), provide Company with evidence of Service Provider's compliance with the security requirements of this DPA. Acceptable forms of evidence include, at Company's election:
(a) a current SOC 2 Type II report issued by a qualified independent auditor;
(b) a current ISO/IEC 27001 certification issued by an accredited certification body;
(c) a completed security questionnaire in Company's standard format; or
(d) a summary of penetration-testing results conducted within the preceding twelve (12) months by a qualified third-party assessor.
Service Provider shall bear its own costs in providing such evidence. If the evidence provided reveals material deficiencies, Company may require Service Provider to undergo additional assessment at Service Provider's expense.
6.3 Updates to Security Measures. Service Provider shall review and, where necessary, update its technical and organizational security measures on a periodic basis, and in any event no less frequently than annually, to address evolving threats, vulnerabilities, and changes in Applicable Data Protection Laws and industry best practices. Service Provider shall promptly notify Company of any material changes to the security measures described in Exhibit D that may adversely affect the protection of Personal Information. No reduction in the overall level of security shall be made without Company's prior written consent.
ARTICLE 7 — SUB-PROCESSORS
7.1 Use of Sub-processors. Service Provider shall not engage any Sub-processor to Process Personal Information on behalf of Company without Company's prior [Insert: written consent / general authorization subject to notification and objection right].
Instruction: Select either (a) specific prior written consent for each Sub-processor, or (b) general authorization with a list of approved Sub-processors and an obligation to notify Company of additions, with Company having the right to object. Approach (b) is more common for large-scale technology vendors. If approach (b) is selected, ensure that the notification and objection periods in Sections 7.2 and 7.3 are completed.
7.2 Current Sub-processors. Service Provider's current Sub-processors as of the Effective Date, together with descriptions of their Processing activities and locations, are listed in Exhibit E. Service Provider shall notify Company in writing at least [Insert number, e.g., 30] days prior to engaging any new Sub-processor or replacing an existing Sub-processor. Such notification shall include the name of the proposed Sub-processor, the nature of the Processing to be performed, the categories of Personal Information to be Processed, and the location(s) of Processing.
7.3 Objection Right. Company shall have the right to object to any new or replacement Sub-processor by providing written notice to Service Provider within [Insert number, e.g., 15] days of receipt of Service Provider's notification under Section 7.2. If Company objects to a proposed Sub-processor, Service Provider shall use reasonable efforts to make available to Company an alternative arrangement that avoids the use of the objected-to Sub-processor. If no commercially reasonable alternative is available within [Insert number, e.g., 30] days of Company's objection, either Party may terminate the affected services under the Services Agreement upon [Insert number, e.g., 30] days' written notice, without penalty or liability (other than for fees and charges accrued prior to the effective date of termination).
7.4 Sub-processor Contracts. Service Provider shall enter into a written agreement with each Sub-processor that imposes data-protection obligations no less protective than those set forth in this DPA. Such agreements shall include, at a minimum, all of the obligations imposed upon Service Provider under this DPA, as applicable to the Sub-processor's Processing activities. Service Provider shall make copies of Sub-processor agreements available to Company upon reasonable request (subject to redaction of commercially sensitive terms not relevant to data-protection obligations).
7.5 Flow-Down of Requirements. Each Sub-processor agreement shall include, at a minimum, the same or equivalent obligations regarding:
(a) limitations on use, retention, and disclosure of Personal Information;
(b) technical and organizational security measures;
(c) confidentiality obligations;
(d) audit rights;
(e) cooperation with Consumer Rights Requests;
(f) Security Incident notification and cooperation; and
(g) deletion or return of Personal Information upon termination.
7.6 Liability for Sub-processors. Service Provider shall remain fully liable to Company for the acts, omissions, and failures of its Sub-processors to the same extent as Service Provider would be liable if performing the Processing directly. Service Provider's engagement of a Sub-processor shall not relieve Service Provider of any of its obligations under this DPA.
ARTICLE 8 — DATA SUBJECT REQUESTS AND CONSUMER RIGHTS
8.1 Notification of Requests. If Service Provider receives a Consumer Rights Request directly from a Consumer (or from any third party acting on behalf of a Consumer, including an authorized agent) relating to Personal Information Processed under this DPA, Service Provider shall promptly, and in any event within [Insert number, e.g., 3] business days, notify Company of such request. Service Provider shall provide Company with all information reasonably necessary to identify the Consumer and the nature of the request. Service Provider shall not respond to the Consumer directly, provide any Personal Information to the Consumer, or take any action with respect to the Consumer's Personal Information in response to such request, unless instructed to do so by Company or unless required to do so by Applicable Data Protection Laws.
8.2 Assistance with Fulfillment. Service Provider shall assist Company in fulfilling Consumer Rights Requests in a timely and complete manner. Such assistance shall include, without limitation:
(a) providing the technical capability to search for, locate, access, correct, delete, or export Personal Information as necessary to enable Company to respond within applicable statutory timeframes;
(b) implementing technical mechanisms to apply Consumer preferences (such as opt-out signals and limitation-of-use instructions) to the Personal Information Processed by Service Provider;
(c) confirming in writing to Company the completion of any actions taken in response to Company's instructions regarding Consumer Rights Requests; and
(d) maintaining records of all Consumer Rights Requests received or processed by Service Provider for a period of no less than twenty-four (24) months.
8.3 Verification Assistance. Service Provider shall assist Company with identity-verification processes for Consumer Rights Requests to the extent that Service Provider holds information relevant to verifying the Consumer's identity. Service Provider shall not independently verify the identity of a Consumer or fulfill a Consumer Rights Request without Company's express authorization.
8.4 Appeal Process. Service Provider shall cooperate with Company in processing any appeals filed by Consumers as required under Applicable Data Protection Laws, including but not limited to appeals under the VCDPA § 59.1-577, Colorado CPA § 6-1-1306, CTDPA § 42-517, and equivalent provisions of other state privacy statutes. Service Provider shall provide any information or assistance reasonably required by Company to respond to such appeals within the statutory timeframes.
ARTICLE 9 — SECURITY INCIDENTS AND BREACH NOTIFICATION
9.1 Notification Obligation. Service Provider shall notify Company without undue delay, and in any event within [Insert number, e.g., 48] hours after becoming aware of any Security Incident involving Personal Information Processed under this DPA. For purposes of this Section, Service Provider shall be deemed to have become "aware" of a Security Incident at the time any employee, officer, or agent of Service Provider (including any Sub-processor) reasonably believes that a Security Incident has occurred. Notification shall be directed to Company's Information Security Contact as identified in Exhibit F, and simultaneously to Company's Legal Contact and Privacy Contact.
9.2 Content of Notification. The notification required under Section 9.1 shall include, to the extent reasonably known or ascertainable at the time of notification:
(a) a description of the nature of the Security Incident, including the categories and approximate number of Consumers whose Personal Information is affected;
(b) the categories and approximate volume of Personal Information records affected;
(c) a description of the likely consequences of the Security Incident for affected Consumers;
(d) a description of the measures taken or proposed to be taken by Service Provider to address the Security Incident and mitigate its potential adverse effects;
(e) the identity and contact information of Service Provider's designated point of contact for purposes of the Security Incident; and
(f) any other information reasonably required by Company to assess the scope and impact of the Security Incident and to comply with applicable notification obligations under Applicable Data Protection Laws.
If complete information is not available at the time of the initial notification, Service Provider shall provide the information in phases without further undue delay as it becomes available.
9.3 Cooperation. Service Provider shall fully cooperate with Company in investigating, remediating, and mitigating the Security Incident and in complying with any notification obligations owed to Consumers, governmental authorities, or other parties under Applicable Data Protection Laws. Such cooperation shall include, without limitation:
(a) preserving and providing evidence and logs related to the Security Incident;
(b) making knowledgeable personnel available for interviews and discussions with Company, Company's counsel, and Company's forensic investigators;
(c) implementing remedial measures as directed by Company; and
(d) providing timely updates regarding the investigation and remediation of the Security Incident.
9.4 Prohibition on Public Disclosure. Service Provider shall not make any public statement, press release, regulatory filing, or notification to affected Consumers regarding a Security Incident involving Personal Information Processed under this DPA without Company's prior written consent, unless Service Provider is independently required to do so by Applicable Data Protection Laws. In such event, Service Provider shall provide Company with advance notice and a copy of the proposed disclosure for review and comment before issuance, to the extent permitted by law.
9.5 Record-Keeping. Service Provider shall maintain a written record of all Security Incidents involving Personal Information Processed under this DPA, including a description of the facts relating to each Security Incident, the effects of such incident, the remedial actions taken, and any notifications provided. Service Provider shall retain such records for a minimum period of five (5) years from the date of the Security Incident and shall make such records available to Company upon reasonable request.
ARTICLE 10 — AUDITS AND ASSESSMENTS
10.1 Audit Rights. Company shall have the right, upon [Insert number, e.g., 30] days' prior written notice, to audit or inspect (or to engage a qualified independent third-party auditor, subject to reasonable confidentiality obligations, to audit or inspect) Service Provider's Processing activities, information systems, facilities, and records related to the Processing of Personal Information under this DPA, to verify Service Provider's compliance with the terms of this DPA and Applicable Data Protection Laws.
Instruction: Consider including frequency limitations (e.g., no more than once per calendar year absent reasonable cause, such as a Security Incident or material non-compliance). Also consider provisions permitting Service Provider to participate in multi-client audits or to provide existing audit reports (e.g., SOC 2 Type II) in lieu of on-site audits where such reports are reasonably sufficient to address Company's compliance-verification requirements.
10.2 Scope. Audits conducted under this Article may include, without limitation, review of:
(a) policies, procedures, and standards related to the Processing and protection of Personal Information;
(b) technical configurations, access controls, and security measures;
(c) Sub-processor agreements and Sub-processor compliance;
(d) records of Processing activities maintained by Service Provider;
(e) records of Security Incidents and remedial actions;
(f) records of Consumer Rights Requests received and processed;
(g) training records for personnel who Process Personal Information; and
(h) any other information reasonably necessary to verify compliance with this DPA and Applicable Data Protection Laws.
Service Provider shall provide reasonable cooperation and assistance during audits, including making knowledgeable personnel available for questions and providing access to relevant systems and facilities during normal business hours.
10.3 Confidentiality of Audit Results. All audit findings, reports, and related materials shall be treated as Confidential Information of Service Provider and shall be subject to the confidentiality provisions of the Services Agreement. Company shall not disclose audit results to any third party except to Company's legal counsel, auditors, and regulators, as necessary for compliance purposes.
10.4 Remediation. If an audit reveals any non-compliance with this DPA or Applicable Data Protection Laws, Service Provider shall promptly develop and implement a remediation plan to address such non-compliance. The remediation plan shall be submitted to Company for review within [Insert number, e.g., 15] days of Service Provider's receipt of the audit findings. Service Provider shall implement all remediation actions at its own cost and expense and shall report to Company on the completion of each remediation action within [Insert number, e.g., 30] days of the date on which such action was due to be completed.
10.5 Regulatory Audit Cooperation. Service Provider shall cooperate fully with any audit, inquiry, examination, or investigation by the California Privacy Protection Agency, any state attorney general, or any other regulatory authority concerning Company's or Service Provider's compliance with Applicable Data Protection Laws, to the extent such audit, inquiry, examination, or investigation relates to the Processing of Personal Information under this DPA. Such cooperation shall include providing information, documents, access to facilities, and access to personnel as reasonably requested.
ARTICLE 11 — DELETION AND RETURN OF PERSONAL INFORMATION
11.1 Upon Termination or Expiration. Upon termination or expiration of the Services Agreement for any reason, or at any time upon Company's written request, Service Provider shall, at Company's election:
(a) return all Personal Information to Company in a structured, commonly used, and machine-readable format designated by Company, together with all copies, extracts, and derivations thereof; or
(b) securely delete or de-identify all Personal Information in Service Provider's possession, custody, or control, including all copies, backups, archives, and any derivative data, except to the extent retention is required by Applicable Data Protection Laws.
Company shall communicate its election to Service Provider in writing within [Insert number, e.g., 30] days following the effective date of termination or expiration. If Company fails to make an election within such period, Service Provider shall securely delete or de-identify all Personal Information in accordance with clause (b) above.
11.2 Certification of Deletion. Service Provider shall provide Company with written certification of the completion of deletion or de-identification within [Insert number, e.g., 30] days of completing such deletion or de-identification. The certification shall be signed by an authorized officer or representative of Service Provider and shall confirm that all Personal Information has been deleted or de-identified in accordance with this Article, specifying the method of deletion or de-identification used.
11.3 Retained Copies. To the extent Service Provider is required by Applicable Data Protection Laws, a valid court order, or other binding legal obligation to retain any Personal Information following the termination or expiration of the Services Agreement, Service Provider shall:
(a) promptly notify Company of such retention requirement in writing, specifying the legal basis for retention, the categories of Personal Information to be retained, and the anticipated duration of retention;
(b) continue to protect such Personal Information in accordance with all applicable provisions of this DPA, including the security measures set forth in Article 6 and Exhibit D, and the confidentiality obligations set forth in Article 5;
(c) limit Processing of such retained Personal Information to the purposes required by the applicable legal obligation; and
(d) delete or de-identify such Personal Information promptly upon expiration of the applicable retention obligation and provide written certification of such deletion or de-identification to Company.
ARTICLE 12 — CERTIFICATION OF UNDERSTANDING
12.1 Certification. Service Provider certifies that it understands and will comply with the restrictions and obligations set forth in this DPA and in Applicable Data Protection Laws applicable to service providers and processors, including without limitation the restrictions and obligations set forth in CCPA/CPRA § 1798.140(ag) and § 1798.100(d). Service Provider further certifies that it has reviewed the specific Business Purposes set forth in Exhibit B and understands the scope of its authorized Processing activities under this DPA.
12.2 No Circumvention. Service Provider certifies that it will not take any action that would cause any transfer of Personal Information to or from Service Provider to qualify as a "sale" or "sharing" of Personal Information under Applicable Data Protection Laws. Service Provider further certifies that it will not attempt to circumvent the restrictions set forth in this DPA through any means, including by re-identifying De-identified Data, combining Personal Information in violation of Section 3.2, or engaging in Processing activities outside the scope of the Business Purposes set forth in Exhibit B.
12.3 Notification of Inability to Comply. Service Provider shall promptly notify Company in writing if Service Provider determines or has reason to believe that it can no longer meet its obligations under Applicable Data Protection Laws or under this DPA, including as a result of changes in Service Provider's operations, technology, business practices, or legal obligations. Upon receipt of such notification, Company may take reasonable and appropriate steps to stop and remediate any unauthorized Processing of Personal Information by Service Provider, including by directing Service Provider to cease Processing, requiring immediate return or deletion of Personal Information, or terminating this DPA and the affected portions of the Services Agreement.
Instruction: This certification is a statutory requirement under CCPA/CPRA § 1798.100(d). Ensure the counterparty's authorized signatory acknowledges this provision and that the signatory has authority to bind the Service Provider to this certification.
ARTICLE 13 — SENSITIVE PERSONAL INFORMATION
13.1 Processing Restrictions. If Service Provider Processes Sensitive Personal Information on behalf of Company, Service Provider shall Process such information only for the specific purposes identified in Exhibit B with respect to Sensitive Personal Information and in strict compliance with Applicable Data Protection Laws, including any applicable consent, opt-in, or notice requirements. Service Provider shall not Process Sensitive Personal Information for any purpose other than those expressly authorized by Company.
13.2 Heightened Security. Service Provider shall apply enhanced technical and organizational safeguards to Sensitive Personal Information that are appropriate to the increased risk associated with such information. The specific enhanced security measures applicable to Sensitive Personal Information are set forth in Exhibit D. At a minimum, Sensitive Personal Information shall be encrypted at rest and in transit and shall be subject to more restrictive access controls than non-sensitive Personal Information.
13.3 Limitation of Use. Service Provider acknowledges that Consumers may exercise the right to limit the use and disclosure of their Sensitive Personal Information under CCPA/CPRA § 1798.121 and equivalent provisions of other Applicable Data Protection Laws. Service Provider shall implement and maintain technical measures sufficient to honor such limitations upon notice from Company, including the ability to restrict Processing of specified categories of Sensitive Personal Information for specified Consumers within the timeframes required by Applicable Data Protection Laws.
ARTICLE 14 — CROSS-BORDER DATA TRANSFERS
14.1 Data Localization. Service Provider shall Process Personal Information only within [Insert jurisdiction(s), e.g., the United States], unless otherwise approved in writing by Company. Service Provider represents and warrants that, as of the Effective Date, all Processing of Personal Information under this DPA occurs within the jurisdictions specified in this Section 14.1, including Processing by Sub-processors.
14.2 Transfer Restrictions. Service Provider shall not transfer Personal Information outside the jurisdictions specified in Section 14.1 without Company's prior written consent. If Company consents to a cross-border transfer, Service Provider shall implement appropriate safeguards as required by Applicable Data Protection Laws and as reasonably directed by Company, which may include data transfer agreements, contractual clauses, or other mechanisms designed to ensure an adequate level of protection for Personal Information. Service Provider shall promptly notify Company if any Applicable Data Protection Law requires or restricts a cross-border transfer of Personal Information.
ARTICLE 15 — INDEMNIFICATION
15.1 Indemnification by Service Provider. Service Provider shall indemnify, defend, and hold harmless Company and its parents, subsidiaries, and affiliates, and their respective directors, officers, employees, agents, successors, and assigns (collectively, the "Company Indemnitees"), from and against all third-party claims, actions, suits, proceedings, liabilities, losses, damages, costs, and expenses (including reasonable attorneys' fees and court costs) (collectively, "Losses") arising out of or relating to:
(a) any breach of this DPA by Service Provider or any of its Sub-processors;
(b) any Processing of Personal Information by Service Provider or any of its Sub-processors in violation of Applicable Data Protection Laws or in a manner inconsistent with Company's documented instructions;
(c) any Security Incident caused by or resulting from Service Provider's or its Sub-processors' failure to comply with the security requirements of this DPA or Applicable Data Protection Laws; or
(d) any failure by Service Provider or its Sub-processors to comply with the certification obligations set forth in Article 12.
Instruction: Negotiate scope and caps on indemnification as appropriate for each vendor engagement. Consider whether to include indemnification for regulatory fines, penalties, and assessments imposed by the California Privacy Protection Agency or other regulatory authorities. Consult Calderwood & Harkness LLP regarding enforceability of indemnification for regulatory fines under applicable law.
15.2 Indemnification Procedures. The following procedures shall apply to any claim for indemnification under this Article 15:
(a) Notice. The Company Indemnitee seeking indemnification (the "Indemnified Party") shall provide Service Provider with prompt written notice of any claim, action, or proceeding for which indemnification is sought (a "Claim"). Failure to provide prompt notice shall not relieve Service Provider of its indemnification obligations except to the extent that Service Provider is materially prejudiced by such failure.
(b) Control of Defense. Service Provider shall have the right to assume the defense of any Claim using counsel reasonably acceptable to the Indemnified Party, provided that Service Provider shall not settle, compromise, or consent to any judgment with respect to any Claim without the Indemnified Party's prior written consent (not to be unreasonably withheld or delayed) if such settlement, compromise, or judgment would impose any obligation on the Indemnified Party, would not include a complete release of the Indemnified Party, or would involve an admission of liability or wrongdoing by the Indemnified Party.
(c) Cooperation. The Indemnified Party shall provide reasonable cooperation to Service Provider in the defense of any Claim, at Service Provider's expense.
(d) Reservation of Rights. The Indemnified Party shall have the right to participate in the defense of any Claim at its own expense, using counsel of its own choosing.
ARTICLE 16 — LIABILITY
16.1 Limitation of Liability. [Insert agreed-upon limitation of liability for this DPA. This provision should be coordinated with the limitation-of-liability provisions in the Services Agreement to ensure consistency and should address the following considerations:]
(a) [Insert aggregate liability cap, if applicable — e.g., a multiple of fees paid or payable under the Services Agreement during a specified period.]
(b) [Insert any carve-outs from the liability cap — e.g., breaches of Article 3 (Limitations on Use), Article 9 (Security Incidents), Article 12 (Certification), and indemnification obligations under Article 15 may be carved out from general liability caps.]
(c) [Insert any exclusions of consequential, incidental, or indirect damages, subject to carve-outs for data-protection breaches.]
Instruction: Data-protection liability carve-outs are strongly recommended for high-volume data processors and for engagements involving Sensitive Personal Information. The scope of carve-outs should be proportionate to the risk profile of the engagement. Discuss with Calderwood & Harkness LLP.
ARTICLE 17 — TERM AND TERMINATION
17.1 Term. This DPA shall become effective on the Effective Date and shall remain in full force and effect for the duration of the Services Agreement. The obligations of Service Provider under this DPA with respect to Personal Information in its possession, custody, or control shall survive the termination or expiration of this DPA and the Services Agreement until all Personal Information has been deleted, de-identified, or returned to Company in accordance with Article 11.
17.2 Termination for Breach. Company may terminate this DPA and the Services Agreement (or the affected portions thereof) immediately upon written notice to Service Provider if:
(a) Service Provider materially breaches any provision of this DPA and fails to cure such breach within [Insert number, e.g., 30] days after receipt of written notice specifying the nature of the breach;
(b) Service Provider notifies Company under Section 12.3 that it can no longer meet its obligations under Applicable Data Protection Laws or this DPA;
(c) a regulatory authority issues an order or directive requiring cessation of Processing by Service Provider;
(d) Service Provider is found to have engaged in a pattern or practice of unauthorized Processing of Personal Information; or
(e) Service Provider undergoes a change of control, merger, or acquisition that, in Company's reasonable judgment, materially affects Service Provider's ability to comply with this DPA.
17.3 Effect of Termination. Upon termination of this DPA for any reason:
(a) Service Provider shall immediately cease all Processing of Personal Information, except as necessary to comply with Article 11;
(b) the provisions of Article 5 (Confidentiality), Article 9 (Security Incidents), Article 10 (Audits), Article 11 (Deletion and Return), Article 12 (Certification), Article 15 (Indemnification), Article 16 (Liability), Article 17.3 (Effect of Termination), and Article 18 (General Provisions) shall survive termination; and
(c) all rights and remedies of the Parties accrued prior to termination shall remain in full force and effect.
ARTICLE 18 — GENERAL PROVISIONS
18.1 Conflicts. In the event of any conflict or inconsistency between the terms of this DPA and the terms of the Services Agreement, or any other agreement between the Parties, the terms of this DPA shall prevail and control with respect to the Processing of Personal Information. In the event of any conflict between the terms of this DPA and the requirements of Applicable Data Protection Laws, the requirements of Applicable Data Protection Laws shall prevail.
18.2 Amendments. This DPA may be amended only by a written instrument signed by duly authorized representatives of both Parties. Notwithstanding the foregoing, Company reserves the right to update this DPA to reflect changes in Applicable Data Protection Laws, including the enactment of new state privacy statutes or the issuance of new regulations or binding guidance, upon [Insert number, e.g., 60] days' written notice to Service Provider. Service Provider shall comply with any such updates upon the effective date specified in Company's notice.
18.3 Governing Law. This DPA shall be governed by and construed in accordance with the laws of the State of [Insert state], without regard to its conflict-of-laws principles. For the avoidance of doubt, Applicable Data Protection Laws of each relevant jurisdiction shall apply to the Processing of Personal Information of Consumers who are residents of such jurisdiction, regardless of the governing law of this DPA.
18.4 Dispute Resolution. [Insert dispute-resolution provision — e.g., Any dispute arising out of or relating to this DPA that cannot be resolved through good-faith negotiation between the Parties within thirty (30) days shall be resolved by [binding arbitration administered by (Insert arbitration body) in accordance with its (Insert rules) / litigation in the state and federal courts located in (Insert city and state)], and the Parties hereby consent to the exclusive jurisdiction and venue of such [arbitral tribunal / courts].]
18.5 Notices. All notices required or permitted under this DPA shall be in writing and shall be delivered by hand, by nationally recognized overnight courier, by certified or registered mail (return receipt requested), or by email (with confirmation of receipt) to the addresses specified on the signature page of this DPA, or as otherwise updated in writing by either Party from time to time. Notices shall be deemed received upon actual receipt or, if sent by certified or registered mail, three (3) business days after deposit in the mail. Notices related to Security Incidents shall also be directed to the contacts specified in Exhibit F.
18.6 Severability. If any provision of this DPA is found by a court of competent jurisdiction or regulatory authority to be invalid, illegal, or unenforceable, such finding shall not affect the validity, legality, or enforceability of the remaining provisions of this DPA, which shall continue in full force and effect. The Parties shall negotiate in good faith to replace the invalid, illegal, or unenforceable provision with a valid, legal, and enforceable provision that achieves, to the greatest extent possible, the economic, business, and other purposes of the original provision.
18.7 Entire Agreement. This DPA, together with the Services Agreement and all Exhibits hereto (Exhibits A through F), constitutes the entire agreement between the Parties with respect to the Processing of Personal Information in connection with the Services Agreement and supersedes all prior and contemporaneous agreements, understandings, negotiations, and discussions, whether oral or written, between the Parties on the subject matter hereof.
18.8 Waiver. No waiver of any provision of this DPA shall be effective unless made in writing and signed by the waiving Party. No failure or delay by either Party in exercising any right, power, or remedy under this DPA shall operate as a waiver thereof, nor shall any single or partial exercise of any right, power, or remedy preclude any other or further exercise thereof or the exercise of any other right, power, or remedy.
18.9 Counterparts. This DPA may be executed in one or more counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument. Execution and delivery of this DPA by facsimile, electronic signature (including Brightwater Software or similar technology), or other electronic means shall be deemed to be, and shall have the same legal effect as, execution and delivery of an original signed copy.
SIGNATURE PAGE
IN WITNESS WHEREOF, the Parties have caused this Data Processing Agreement to be executed by their respective duly authorized representatives as of the date last signed below.
COMPANY: [Insert full legal name]
By: ________
Name: [Insert name]
Title: [Insert title]
Date: ________
Address for Notices: [Insert address]
Attention: [Insert name and title]
Email: [Insert email]
SERVICE PROVIDER: [Insert full legal name]
By: ________
Name: [Insert name]
Title: [Insert title]
Date: ________
Address for Notices: [Insert address]
Attention: [Insert name and title]
Email: [Insert email]
EXHIBIT A — APPLICABLE DATA PROTECTION LAWS
This Exhibit A sets forth the United States state privacy statutes applicable to the Processing of Personal Information under this DPA. This Exhibit should be updated as new statutes become effective or as existing statutes are amended. Company personnel should consult Calderwood & Harkness LLP to confirm the current list of applicable statutes at the time of execution.
Instruction: As of the date of this template, there are [Insert number] applicable state privacy statutes. This number is expected to increase. Confirm the current count with Calderwood & Harkness LLP at the time of each DPA execution. Include only those statutes that are applicable to the specific Processing activities under the Services Agreement, taking into account the jurisdictions in which Company operates, the categories of Consumers whose Personal Information is Processed, and the applicability thresholds of each statute.
EXHIBIT B — DESCRIPTION OF PROCESSING
This Exhibit B describes the Processing of Personal Information by Service Provider under this DPA. All fields must be completed with vendor-specific information before this DPA is circulated for signature.
B.1 Subject Matter and Duration of Processing
Subject Matter: [Describe the services under the Services Agreement that involve Processing of Personal Information. For example: "Service Provider provides cloud-hosted customer relationship management (CRM) services to Company, including data storage, analytics, and reporting capabilities related to Company's retail customer base."]
Duration: [Insert duration of Processing — e.g., "Co-terminus with the Services Agreement, currently effective from [Insert date] through [Insert date], subject to renewal terms as set forth therein."]
B.2 Nature and Purpose of Processing
Nature of Processing: [Describe the nature of Processing activities performed by Service Provider. For example: "Processing activities include collection, storage, organization, structuring, retrieval, consultation, use, analysis, and deletion of Personal Information in connection with the following service categories: (i) customer data hosting and management; (ii) order processing and fulfillment support; (iii) customer analytics and segmentation; (iv) marketing campaign execution; (v) customer support and service-ticket management."]
Business Purposes: [Describe the Business Purposes for which Personal Information is Processed, cross-referencing CCPA/CPRA § 1798.140(e) as applicable. For example: "Personal Information is Processed for the following Business Purposes: (i) performing services on behalf of Company, including maintaining and servicing customer accounts; (ii) auditing related to counting ad impressions and verifying compliance with standards; (iii) detecting security incidents and protecting against malicious or illegal activity; (iv) debugging to identify and repair errors; (v) short-term, transient use; (vi) internal research for technological development; (vii) verifying or maintaining the quality and safety of a service."]
B.3 Categories of Personal Information
Instruction: Check all applicable categories and provide specifics for each category that applies to the vendor engagement.
B.4 Categories of Consumers
[Describe the categories of Consumers whose Personal Information is Processed. For example: "The follo

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT

COMPANY:

SERVICE PROVIDER:

PREAMBLE AND PARTIES

Record

Parties

Dates

Amounts