Business Privacy Requirements

BUSINESS PRIVACY REQUIREMENTS

This Business Privacy Requirements Agreement (Agreement) is entered into between Client Name: (Client) and Service Provider Name: (Provider) effective as of Effective Date:

WHEREAS

WHEREAS, Client engages Provider to perform services that may require Provider to access, receive, process or store Confidential Information and Personal Data belonging to Client, Client's customers, or other data subjects; and

WHEREAS, the parties desire to set forth the privacy, security and data-handling requirements applicable to such Confidential Information and Personal Data, including technical and organizational safeguards, breach notification, data retention, permitted disclosures, and audit rights.

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the parties agree as follows:

Scope of Work

Data Types Collected

Check all categories of data that Provider will collect, access, or process in connection with the Scope of Work:

Personal Identifying Information (names, identifiers)

Financial and payment information

Health or medical data (if applicable)

Authentication credentials and access logs

Security Measures

Provider shall implement and maintain, at a minimum, the following technical and organizational measures appropriate to the risk:

Encryption of data in transit (TLS)

Encryption of data at rest

Role-based access controls and least-privilege policies

Audit logging and monitoring of access

Employee security and privacy training

Breach Notification

Provider shall notify Client without undue delay and in any event no later than after becoming aware of a confirmed security incident or unauthorized access affecting Client Confidential Information or Personal Data. Notification shall include the nature of the incident, categories of data affected, likely consequences, and the measures Provider has taken or proposes to mitigate harm.

Payment Terms

In consideration for the services under this Agreement, Client shall pay Provider as follows:

Term and Termination

This Agreement shall commence on Start Date: and shall continue until End Date: unless earlier terminated in accordance with this section.

Either party may terminate this Agreement for material breach by the other party if the breaching party fails to cure the breach within after receipt of written notice. Termination shall not relieve Provider of obligations to return or securely delete Client Confidential Information as set forth below.

Data Retention and Deletion

Provider shall retain Personal Data only for the period necessary to fulfill the purposes set forth in the Scope of Work and in accordance with applicable law. Upon termination or expiration, Provider shall, at Client's direction, either return or securely delete Personal Data within .

Subprocessors and Third Parties

Provider shall not engage any subcontractor or subprocessors to process Personal Data without prior written or documented consent from Client. Provider shall ensure that any authorized subprocessors are bound by written obligations consistent with this Agreement.

Client permits Provider to engage subprocessors subject to agreement requirements

Audit and Compliance

Client has the right to request reasonable documentation of Provider's compliance with the security measures set forth in this Agreement, including audit reports, certifications, or other evidence. Provider shall cooperate with audits on reasonable notice and under mutually agreed confidentiality protections.

Client audit rights (subject to confidentiality and reasonable notice)

Confidentiality

For purposes of this Agreement, Confidential Information means all non-public information disclosed by Client to Provider, including Personal Data, business information, technical data, and trade secrets. Provider shall: (a) treat Confidential Information as strictly confidential; (b) use Confidential Information solely to perform its obligations under this Agreement; (c) limit access to those employees or contractors with a need to know and who are subject to written confidentiality obligations; and (d) implement reasonable administrative, physical, and technical safeguards to protect Confidential Information from unauthorized access, use, disclosure or destruction.

Confidential Information excludes information that: (i) is or becomes public through no breach by Provider; (ii) is rightfully received from a third party without restriction; (iii) is independently developed without use of Client Confidential Information; or (iv) is required to be disclosed by law, provided Provider gives prompt notice to Client to seek protective measures.

Provider acknowledges that monetary damages may be inadequate to remedy a breach of this section and that Client is entitled to seek equitable relief, including injunctive relief, without waiving any other available remedies.

Limitation of Liability and Indemnification

Each party's liability for direct damages arising from a breach of this Agreement shall be subject to the limits agreed between the parties. Provider shall indemnify and hold Client harmless from third-party claims arising from Provider's unauthorized disclosure or mishandling of Personal Data, except to the extent caused by Client's negligence or breach of its obligations.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of: without regard to conflict of laws principles.

Entire Agreement

This Agreement, together with any exhibits or appendices expressly incorporated herein, constitutes the entire agreement between the parties relating to the subject matter and supersedes all prior or contemporaneous agreements, representations and understandings, whether written or oral, relating to such subject matter. Any amendment must be in writing and signed by authorized representatives of both parties.

Notices

Sign Now