Extract to table

Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement

Processor shall not process Customer Data for any purpose other than as expressly authorized under this DPA or as subsequently directed in writing by Controller

Processor shall process Customer Data only in accordance with Controller's documented instructions

Any additional or supplemental instructions must be provided in writing and must be authorized by Controller's General Counsel or Chief Information Officer (or such other officer as Controller may designate in writing from time to time)

Processor shall promptly notify Controller if, in Processor's reasonable opinion, an instruction from Controller infringes or would infringe upon any Applicable Data Protection Law, and Processor shall not be required to comply with such instruction until the matter has been resolved between the parties

Processor shall not: (a) sell, rent, trade, or otherwise make available Customer Data to any third party for monetary or other valuable consideration; (b) use Customer Data for purposes unrelated to the performance of the Agreement, including without limitation for Processor's own marketing, advertising, or business-development activities; (c) combine Customer Data with data obtained from or on behalf of any other Processor customer or any other source, except as expressly authorized under Section 4 (Aggregated Data) and subject to all conditions and limitations set forth therein; (d) process Customer Data in a manner inconsistent with Applicable Data Protection Laws, including any processing that would cause Controller to be in violation of its obligations under any insurance regulatory requirements; or (e) transfer, disclose, or otherwise make Customer Data available to any government authority or regulatory body, except as required by applicable law or valid legal process, in which case Processor shall comply with Section 12