Supplier California Data Processing Addendum
This California Data Processing Addendum (“CDPA”) is effective upon execution of the Agreement to which this CDPA is attached, by and between ChannelApe, Inc. (“ChannelApe”) and the Party serving as a supplier or subcontractor in the Agreement (“Subcontractor”) (each, a “Party” and collectively the “Parties”). Capitalized terms used but not defined in this CDPA shall have the meanings given to them in the Agreement. This CDPA shall be an extension of the Agreement and shall apply to any Personal Information (as defined below) Subcontractor Processes in the course of providing the Services.
- Definitions.
- “CCPA” means the California Consumer Privacy Act of 2018 as set forth in California Civil Code § 1798.100 et seq., including any amendments and implementing regulations thereto that become effective on or after the effective date of this CDPA.
- “Business,” “Business Purpose,” “Consumer,” “Person,” “Personal Information,” “Process,” “Sell,” “Service Provider” and “Third Party” shall have the meanings set forth in the CCPA.
- "Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, any Personal Information;
- “Services” means the services provided by Subcontractor to ChannelApe under the Agreement, including but not limited to the Services.
- “Subprocessor” means any person or legal entity engaged by ChannelApe who Processes any Personal Information on behalf of ChannelApe.
All other defined terms shall have the meanings set forth in the Agreement.
- Scope
- The terms of this CDPA shall take effect upon execution of the Agreement and continue on concurrently for the term of the Agreement.
- For the purposes of the CCPA, the Parties acknowledge and agree that ChannelApe shall act as a Service Provider and Subcontractor shall act as a Subprocessor in the course of Subcontractor’s provision of the Services. Subcontractor agrees to comply at all times with the applicable provisions of the CCPA with respect to the collection, transmission, and Processing of all Personal Information exchanged or shared pursuant to the Agreement.
- Subcontractor certifies that it understands the restrictions set forth in Section 1798.140(w)(2)(A) of the CCPA and will comply with them.
- Processing of Personal Information
With respect to Personal Information Processed in the course of providing the Services, Subcontractor:
- shall Process Personal Information only in accordance with the documented instructions of ChannelApe (as set out in this CDPA or the Agreement or as otherwise notified by ChannelApe to Subcontractor from time to time); provided ChannelApe may Process Personal Information as otherwise permitted by the CCPA. Processing Personal Information outside the scope of this CDPA or the Agreement will require prior written agreement between ChannelApe and Subcontractor on additional instructions for Processing;
shall Process Personal Information only in accordance with the documented instructions of ChannelApe (as set out in this CDPA or the Agreement or as otherwise notified by ChannelApe to Subcontractor from time to time); provided ChannelApe may Process Personal Information as otherwise permitted by the CCPA. Processing Personal Information outside the scope of this CDPA or the Agreement will require prior written agreement between ChannelApe and Subcontractor on additional instructions for Processing; - shall not disclose, release, transfer, make available or otherwise communicate any Personal Information to another business or third party, except that Subcontractor may hire other companies to provide limited services on its behalf, provided that Subcontractor complies with the provisions of this clause. Any such subcontractors will be permitted to Process Personal Information only to deliver the Services. Subcontractor remains responsible for its subcontractors’ compliance with the obligations of this CDPA, and Subcontractor shall ensure that any subcontractors to whom Subcontractor transfers Personal Information will enter into written agreements with Subcontractor requiring that the subcontractor abide by terms substantially similar to this CDPA. Notwithstanding the foregoing, nothing in this CDPA shall restrict Subcontractor’s ability to disclose Personal Information to comply with applicable laws or as otherwise permitted by the CCPA;
- shall not Sell any Personal Information to another business or third party;
- shall reasonably assist ChannelApe with any obligation ChannelApe may have to respond or assist its customers in responding to requests from Consumers under the CCPA (including requests for information, deletion or opting out relating to the Processing of Personal Information); and
shall promptly notify ChannelApe of any request Subcontractor or any of its subcontractors receives from a Consumer in respect of the Personal Information of the Consumer, and shall not respond to the Consumer.
- shall Process Personal Information only in accordance with the documented instructions of ChannelApe (as set out in this CDPA or the Agreement or as otherwise notified by ChannelApe to Subcontractor from time to time); provided ChannelApe may Process Personal Information as otherwise permitted by the CCPA. Processing Personal Information outside the scope of this CDPA or the Agreement will require prior written agreement between ChannelApe and Subcontractor on additional instructions for Processing;
- Security
- Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Subcontractor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including without limitation the technical and organizational measures set out in Schedule 1 of this CDPA to protect the Personal Information against any Security Incident.
- ChannelApe may audit (by itself or using independent third-party auditors) Subcontractor’s compliance with this CDPA (including the technical and organizational measures as set out in Schedule 1), including by conducting audits of Subcontractor’s (and its subcontractors’) data processing facilities, and such audits may be performed at least once annually.
- If Subcontractor or any subcontractor discovers or becomes aware of a Security Incident, then Subcontractor shall promptly notify ChannelApe, take any additional steps that are reasonably necessary to remedy any non-compliance with this CDPA, including complying with all applicable requirements of the Agreement, and reasonably cooperate in the investigation of the Security Incident.
- Subcontractor shall limit access to Personal Information to those employees or other personnel who have a business need to have access to such Personal Information. Further, the Subcontractor shall ensure that such employees or other personnel have agreed in writing to protect the confidentiality and security of such Personal Information in accordance with the provisions of this DPA.
- Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Subcontractor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including without limitation the technical and organizational measures set out in Schedule 1 of this CDPA to protect the Personal Information against any Security Incident.
- Deletion of Personal Information
- Subject to clause 5.b below, Subcontractor shall promptly and in any event within 90 (ninety) days of the date of termination of the Agreement (or within such shorter timeframe as may be required by the Agreement) delete and procure the deletion of all other copies of Personal Information Processed by Subcontractor or any subcontractors.
- Subcontractor may retain Personal Information to the extent required by applicable laws, and only to the extent and for such period as required by applicable laws, and always provided that Subcontractor shall ensure the confidentiality of all such Personal Information in accordance with this CDPA and the Agreement and shall ensure that such Personal Information is only Processed as necessary for the purpose(s) specified in the applicable laws requiring its storage and for no other purpose.
- Subcontractor shall provide written certification to ChannelApe that it has fully complied with this clause 5 within 90 days (ninety) days after the date of termination of the Agreement (or within such shorter timeframe as may be required by the Agreement).
- Subject to clause 5.b below, Subcontractor shall promptly and in any event within 90 (ninety) days of the date of termination of the Agreement (or within such shorter timeframe as may be required by the Agreement) delete and procure the deletion of all other copies of Personal Information Processed by Subcontractor or any subcontractors.
- Miscellaneous
- Except as expressly provided in this CDPA, the Parties intend no amendment or modification of the Agreement or in such other addendum or supplement which may have been signed by the Parties.
- Any notice to be provided under this CDPA to ChannelApe shall be sent via email to the email address associated with ChannelApe’s account.
- This CDPA supplements the terms of the Agreement. In the event of any conflict between this CDPA and the Agreement regarding the Processing of Consumers’ Personal Information, the terms of this CDPA shall control.
- If any provision of this CDPA is held by a court of competent jurisdiction to be contrary to the law, the provision shall be modified by the court and interpreted so as best to accomplish the objectives of the original provision to the fullest extent permitted by law, and the remaining provisions of this CDPA shall remain in full force and effect.
- No waiver under this CDPA will be valid or binding unless set forth in writing and duly executed by the Party against whom enforcement of such waiver is sought. Any such waiver will constitute a waiver only with respect to the specific matter described therein and will in no way impair the rights of the Party granting such waiver in any other respect or at any other time. Any delay or forbearance by either Party in exercising any right hereunder will not be deemed a waiver of that right.
- Except as expressly provided in this CDPA, the Parties intend no amendment or modification of the Agreement or in such other addendum or supplement which may have been signed by the Parties.
Last Updated: December 15, 2021