California Data Processing Addendum

Pursuant to the written agreement between you, on behalf of your company and its affiliates ("Customer"), and Indent Inc ("Vendor") (each a "Party"; collectively the "Parties") titled Master Subscription Agreement ("the Agreement"), and in furtherance of obligations under the California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time ("CCPA"), the Parties hereby adopt this CCPA Addendum ("Addendum") for so long as Vendor maintains Personal Information on behalf of Customer. This Addendum prevails over any conflicting terms of the Agreement, but does not otherwise modify the Agreement.

  1. Definitions. For the purposes of this Addendum--
    1. The capitalized terms used in this Addendum and not otherwise defined in this Addendum shall have the definitions set forth in the CCPA.
  2. Roles and Scope.
    1. This Addendum applies to the collection, retention, use, disclosure, and sale of Personal Information provided by Customer or which is collected on behalf of Customer by Vendor ("the Personal Information") to provide Services to Customer pursuant to the Agreement or to perform a Business Purpose.
    2. Customer is a Business and appoints Vendor as a Service Provider to process the Personal Information on behalf of Customer.
    3. Vendor's collection, retention, use, disclosure, or sale of Personal Information for its own purposes independent of Customer's use of the Services specified in the Agreement are outside the scope of this Addendum.
  3. Restrictions on Processing.
    1. Vendor is prohibited from retaining, using, or disclosing the Personal Information for any purpose other than for the specific purpose of performing the Services specified in the Agreement for Customer, as set out in this Addendum, or as otherwise permitted by the CCPA.
    2. Vendor shall not further collect, sell, or use the Personal Information except as necessary to perform the Business Purpose. For the avoidance of doubt, Vendor shall not use the Personal Information for the purpose of providing services to another person or entity, except as permitted by the CCPA.
  4. Notice.
    1. Customer represents and warrants that it has provided notice that the Personal Information is being used or shared consistent with Cal. Civ. Code 1798.140(t)(2)(C)(i).
  5. Consumer Rights.
    1. Vendor shall provide reasonable assistance to Customer in facilitating compliance with Consumer rights requests.
    2. Upon direction by Customer, and in any event no later than 30 days after receipt of a request from Customer, Vendor shall promptly delete the Personal Information as directed by Customer.
      1. Vendor shall not be required to delete any of the Personal Information to comply with a Consumer's request directed by Customer if it is necessary to maintain such information in accordance with Cal. Civ. Code 1798.105(d), in which case Vendor shall promptly inform Customer of the exceptions relied upon under 1798.105(d) and Vendor shall not use the Personal Information retained for any other purpose than provided for by that exception.
  6. Deidentified Information.
    1. In the event that either Party shares Deidentified Information with the other Party, the receiving Party warrants that it: (i) has implemented technical safeguards that prohibit reidentification of the Consumer to whom the information may pertain; (ii) has implemented business processes that specifically prohibit reidentification of the information; (iii) has implemented business processes to prevent inadvertent release of Deidentified Information; and (iv) will make no attempt to reidentify the information.
  7. Mergers, Sales, or Other Asset Transfers.
    1. In the event that either Party transfers to a Third Party the Personal Information of a Consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the Third Party assumes control of all or part of such Party to the Agreement, that information shall be used or shared consistently with applicable law. If a Third Party materially alters how it uses or shares the Personal Information of a Consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the Consumer in accordance with applicable law.
  8. As Required by Law.
    1. Notwithstanding any provision to the contrary of the Agreement or this Addendum, Vendor may cooperate with law enforcement agencies concerning conduct or activity that it reasonably and in good faith believes may violate federal, state, or local law.
  9. Indemnification.
    1. To the extent that the Agreement requires Vendor to collect, use, retain, disclose, or reidentify any Personal Information as directed by Customer, Customer shall be solely liable and shall hold harmless and indemnify Vendor for any damages or reasonable costs, including attorneys' fees and interest, arising from or related to the collection, use, retention, disclosure, or reidentification of such Personal Information by Vendor as directed by Customer.