Legal Exhibit H

Legal Exhibit H — Confidentiality and Data Security Addendum

This Exhibit H is entered into and forms part of the Agreement effective as of (the "Effective Date"), by and between Party A Name: and Party B Name: .

RECITALS

WHEREAS, the parties have entered into a written agreement to which this Exhibit H is attached and desire to set forth additional covenants regarding the protection of Confidential Information and Personal Data disclosed or processed in connection with the Agreement; and

WHEREAS, Party A and Party B acknowledge that unauthorized disclosure or loss of Confidential Information or Personal Data would cause irreparable harm and that specific administrative, technical and physical safeguards are required; and

WHEREAS, the parties intend that the obligations contained in this Exhibit H survive termination or expiration of the Agreement to the extent provided herein.

NOW THEREFORE, in consideration of the mutual covenants contained in the Agreement and herein, the parties agree as follows:

1. DEFINITIONS

For purposes of this Exhibit H, "Confidential Information" means all non-public information disclosed by one party ("Disclosing Party") to the other ("Receiving Party"), whether oral, written or electronic, and includes Personal Data (as defined below), business operations, financial information, technical data, trade secrets and other information that a reasonable person would understand to be confidential. "Personal Data" means any information that identifies or can be used to identify an individual and that is processed under the Agreement.

2. CONFIDENTIALITY OBLIGATIONS

The Receiving Party shall: (a) protect Confidential Information using at least the same degree of care it uses to protect its own confidential information, but in no event less than reasonable care; (b) use Confidential Information solely for the purposes permitted under the Agreement; (c) not disclose Confidential Information to any third party except as expressly permitted herein; and (d) ensure that employees, contractors and agents with access to Confidential Information are bound by confidentiality obligations no less protective than those set forth in this Exhibit H.

3. DATA SECURITY AND CONTROLS

The Receiving Party shall implement and maintain administrative, technical and physical controls appropriate to the sensitivity of the Confidential Information and to protect against unauthorized access, disclosure, alteration or destruction. At a minimum, Receiving Party will:

a. Maintain access controls that restrict access to Confidential Information on a need-to-know basis and require unique user authentication for privileged access;

b. Employ encryption for Confidential Information in transit and at rest where feasible and commercially reasonable given the sensitivity of the data;

c. Maintain vulnerability management, patching and logging practices reasonably designed to detect and prevent unauthorized access to systems processing Confidential Information; and

d. Conduct periodic training of personnel with access to Confidential Information regarding their security and confidentiality obligations.

4. SECURITY ATTESTATIONS

5. INCIDENT RESPONSE AND NOTIFICATION

In the event of a confirmed security incident or unauthorized access to Confidential Information, the Receiving Party shall: (a) notify the Disclosing Party without undue delay and in any event within the timeframe required by applicable law; (b) provide sufficient information regarding the nature and scope of the incident to enable the Disclosing Party to assess risk; (c) promptly take reasonable steps to contain and remediate the incident; and (d) cooperate with the Disclosing Party's reasonable requests for mitigation and notification to affected individuals or regulators.

6. RETURN OR DESTRUCTION OF MATERIALS

Upon termination or expiration of the Agreement, or upon written request of the Disclosing Party, the Receiving Party shall, at the Disclosing Party's election, return all tangible Confidential Information and permanently destroy or irreversibly delete all electronic Confidential Information in its possession, except to the extent retention is required by applicable law. Receiving Party shall certify in writing within thirty (30) days that such return or destruction has been completed.

7. AUDIT AND RECORDS

The Receiving Party shall maintain adequate records demonstrating compliance with this Exhibit H. Upon reasonable prior written notice, and subject to appropriate confidentiality protections, the Disclosing Party shall have the right to audit, or cause an independent auditor to audit, the Receiving Party's compliance with the security and confidentiality obligations set forth in this Exhibit H; such audit shall be conducted no more than once per calendar year unless a material breach is suspected.

8. SUBPROCESSORS AND THIRD PARTIES

Receiving Party shall not engage third party processors to process Confidential Information without providing prior written notice to the Disclosing Party. Receiving Party shall ensure that any authorized third party processor is subject to written contractual obligations that substantially mirror the confidentiality and security obligations of this Exhibit H, and Receiving Party shall remain liable for any acts or omissions of such third parties in the same manner as for its own acts or omissions.

9. INDEMNITY AND LIMITATION

Each party shall indemnify, defend and hold harmless the other from and against any losses, damages, liabilities and expenses arising from a breach of this Exhibit H caused by its negligence or willful misconduct. Notwithstanding the foregoing, the parties' liability shall be subject to any limitations or caps set forth in the Agreement; where the Agreement contains no such limitations, nothing in this Exhibit H shall limit a party's liability for willful misconduct or gross negligence.

10. GOVERNING LAW

This Exhibit H shall be governed by and construed in accordance with the laws specified in the Agreement; if the Agreement does not specify governing law, the parties agree that the substantive law of the state identified below shall govern:

11. ENTIRE AGREEMENT; SEVERABILITY

This Exhibit H, together with the Agreement, constitutes the entire agreement with respect to the subject matter hereof and supersedes all prior and contemporaneous understandings. If any provision of this Exhibit H is held invalid or unenforceable, the remainder of this Exhibit H shall remain in full force and effect and the invalid or unenforceable provision shall be replaced by a valid, enforceable provision that most closely reflects the parties' original intent.

12. NOTICES

All notices required under this Exhibit H shall be given in writing and delivered in accordance with the Agreement's notice provisions or, if none, to the addresses set forth below.

13. AMENDMENTS; WAIVER; COUNTERPARTS

No amendment or waiver of any provision of this Exhibit H shall be effective unless in writing and signed by authorized representatives of both parties. Failure or delay to enforce any provision shall not constitute a waiver. This Exhibit H may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

Sign Now