CPRA Compliance Notice

CPRA COMPLIANCE NOTICE

This CPRA Compliance Notice (the Notice) is entered into by and between Company Name: , with principal business address at Company Address: (hereinafter "Company"), and Recipient Name: , with principal business address at Recipient Address: (hereinafter "Recipient"). Effective Date: .

RECITALS

WHEREAS, Company collects, stores, processes and discloses personal information of California residents and is subject to the California Privacy Rights Act (CPRA) and related obligations concerning the handling of Personal Information; and

WHEREAS, Recipient performs services for Company that may involve access to, receipt of, or processing of Personal Information on behalf of Company and, as such, must implement reasonable technical, administrative and organizational measures to ensure compliance with CPRA; and

WHEREAS, the parties desire to document Recipient's obligations with respect to Personal Information and to establish procedures for handling consumer requests and protecting Sensitive Personal Information.

NOW THEREFORE

In consideration of the mutual promises contained herein and other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the parties agree as follows:

1. DEFINITIONS

1.1 "Personal Information" means information that identifies, relates to, describes, or could reasonably be linked with an identified or identifiable California resident, including but not limited to identifiers, commercial information, biometric information, internet activity, geolocation data, and inferences drawn from such data. "Sensitive Personal Information" means categories of Personal Information that CPRA designates as sensitive, including precise geolocation, financial account information, racial or ethnic origin, health, sex life or sexual orientation, or government identifiers, and any other information treated as sensitive under applicable law.

2. CATEGORIES OF PERSONAL INFORMATION

Recipient acknowledges that, in performing services for Company, Recipient may collect, receive, or otherwise process the following categories of Personal Information on behalf of Company (check all that apply):

Identifiers (name, email, phone) Financial information Health information

Biometric and sensory data Internet or network activity Inferences drawn from data

3. PURPOSES AND LIMITS ON PROCESSING

3.1 Recipient shall process Personal Information only for the specific, documented purposes set forth by Company:

3.2 Recipient shall not process Personal Information for any purpose that is incompatible with Company’s instructions, except as required by law, in which case Recipient shall promptly notify Company to the extent permitted by law.

4. CONSUMER RIGHTS AND ASSISTANCE

4.1 Recipient shall reasonably assist Company in fulfilling requests from consumers exercising CPRA rights, including requests to access, correct, delete, opt-out of sharing or sale, and limit use of Sensitive Personal Information. Assistance activities include: identifying records, exporting records in a commonly used format, and securely transmitting required information.

4.2 If Recipient receives a direct request from a consumer to exercise CPRA rights, Recipient shall promptly notify Company by email or written notice within and shall not respond to the consumer without Company’s prior instruction, unless legally required to do so.

5. DATA SECURITY AND BREACH NOTIFICATION

5.1 Recipient shall implement and maintain reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the Personal Information processed, including measures to protect against unauthorized access, disclosure, alteration or destruction.

5.2 In the event of a security incident or unauthorized access to Personal Information that could materially affect Company or consumers, Recipient shall notify Company without undue delay and in no event later than after discovery. The notification shall include: a description of the incident, categories of data affected, remedial steps taken, and contact information for further inquiries.

6. SUBPROCESSORS

6.1 Recipient shall not engage subprocessors to process Personal Information without Company’s prior written authorization. Recipient shall maintain a current list of authorized subprocessors:

6.2 Recipient shall flow down to each subprocessor the same obligations that apply to Recipient under this Notice and shall remain liable for the subprocessor’s performance.

7. DATA RETENTION, RETURN AND DELETION

7.1 Recipient shall retain Personal Information only for as long as necessary to provide the services to Company or as required by law. Retention period: .

7.2 Upon expiration or termination of Recipient’s engagement or upon Company’s written instruction, Recipient shall, at Company’s option, return or securely delete all Personal Information and certify completion of such return or deletion within .

8. AUDIT AND COMPLIANCE

8.1 Company or an independent auditor engaged by Company shall have the right to audit Recipient’s relevant records and facilities to verify compliance with this Notice, subject to reasonable notice and confidentiality protections. Audit notice period: .

8.2 Recipient shall provide evidence of compliance, including certifications, policies, procedures, and where appropriate, access to systems and personnel, subject to reasonable redaction of confidential business information.

9. INDEMNIFICATION AND LIMITATION OF LIABILITY

9.1 Recipient shall indemnify, defend and hold harmless Company and its officers, directors and employees from and against any claims, liabilities, losses, damages, fines or expenses (including reasonable attorneys' fees) arising from Recipient’s breach of this Notice, failure to comply with CPRA obligations, or unauthorized disclosure of Personal Information caused by Recipient.

9.2 The parties' aggregate liability arising out of or related to this Notice shall be subject to any limitations agreed in the parties’ underlying master services agreement; if no such limitation exists, liability shall not be excluded for: (a) damages resulting from willful misconduct or gross negligence; (b) breaches of confidentiality or data security obligations; or (c) indemnification obligations under this Section.

10. CONFIDENTIALITY

Each party shall maintain the confidentiality of Personal Information and shall use appropriate safeguards to prevent unauthorized use or disclosure. Recipient acknowledges that Personal Information is Company Confidential Information and shall treat it in accordance with the confidentiality provisions of the underlying agreement.

11. NOTICES

Notices under this Notice shall be in writing and delivered to the party contacts listed above, and will be effective upon receipt.

12. AMENDMENT; WAIVER; COUNTERPARTS

12.1 This Notice may be amended only by a written instrument executed by authorized representatives of both parties.

12.2 No failure or delay by either party in exercising any right shall operate as a waiver of that right. Any waiver must be in writing and signed by the waiving party.

12.3 This Notice may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

13. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

13.1 Governing Law. This Notice shall be governed by and construed in accordance with the laws of the State of California, without regard to its choice of law principles.

13.2 Entire Agreement. This Notice constitutes the entire understanding between the parties with respect to the subject matter hereof and supersedes any prior or contemporaneous agreements or understandings, whether written or oral, relating to such subject matter.

13.3 Severability. If any provision of this Notice is held to be invalid, illegal or unenforceable in any respect, the validity, legality and enforceability of the remaining provisions shall not be affected and the parties shall negotiate in good faith to replace the invalid provision with a valid provision that most closely approximates the parties' original intent.

Sign Now