Legal Privacy Form

LEGAL PRIVACY FORM

This Legal Privacy Form (the Agreement) is entered into as of Effective Date: by and between Company Name: , Entity Type: Individual Corporation Limited Liability Company Other , State of Formation: , Principal Place of Business: (hereinafter "Data Controller"), and Recipient Name: , Entity Type: Individual Corporation Limited Liability Company Other , State of Formation: , Principal Place of Business: (hereinafter "Recipient"). Company Name and Recipient Name each a Party and together the Parties.

RECITALS

WHEREAS, Data Controller possesses certain Confidential Information and Personal Data that is necessary for the Recipient to perform services for the Data Controller;

WHEREAS, the Parties wish to set forth their respective obligations with respect to privacy, data protection, security, and the handling of Personal Data shared between them in connection with the Purpose described below;

WHEREAS, Recipient may receive or process Personal Data on behalf of the Data Controller and agrees to process such Personal Data only in accordance with this Agreement and applicable privacy laws;

NOW THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person provided or made available by Data Controller to Recipient in connection with the Purpose. 1.2 "Processing" means any operation or set of operations performed upon Personal Data, whether or not by automated means. 1.3 "Confidential Information" means non-public information disclosed by a Party that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.

2. PURPOSE

The Recipient shall Process Personal Data solely for the following purpose (Purpose): . Processing for any other purpose is prohibited unless the Parties execute a written amendment.

3. OBLIGATIONS OF RECIPIENT

3.1 Recipient shall process Personal Data only on documented instructions from Data Controller, including with respect to transfers to third countries and the retention period. Recipient shall refrain from using Personal Data for any purpose other than the Purpose set forth in this Agreement.

3.2 Recipient shall ensure that persons authorized to Process Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Recipient shall implement and maintain administrative, technical, and physical measures to protect Personal Data appropriate to the risk, including measures to protect against unauthorized or unlawful Processing and against accidental loss, destruction or damage.

4. DATA SUBJECT RIGHTS

4.1 Recipient shall, taking into account the nature of the Processing, assist Data Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Data Controller's obligation to respond to requests from data subjects exercising their rights under applicable law.

4.2 If Recipient receives a request from a data subject relating to Personal Data, Recipient shall promptly notify Data Controller and shall not respond to the request except on the documented instructions of Data Controller or as required by applicable law.

5. DATA BREACH NOTIFICATION

5.1 Recipient shall notify Data Controller without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach affecting Personal Data processed under this Agreement. Notification shall include, to the extent possible, the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed to address the breach.

6. SUBPROCESSORS

6.1 Recipient shall not engage any subprocessor without prior written authorization from Data Controller. Where Data Controller has given a general written authorization, Recipient shall provide notice of intended additions or replacements of subprocessors and Data Controller shall have the right to object on reasonable grounds.

7. RETENTION AND DELETION

7.1 Recipient shall retain Personal Data only for the time necessary to fulfil the Purpose or as required by applicable law. Upon termination of the Agreement or at Data Controller's instruction, Recipient shall, at Data Controller's choice, return or securely delete all Personal Data and certify deletion unless retention is required by law.

8. AUDIT AND COMPLIANCE

8.1 Upon reasonable notice, Recipient shall make available to Data Controller all information necessary to demonstrate compliance with this Agreement and allow for and contribute to audits, including inspections, conducted by Data Controller or an appointed auditor under confidentiality obligations.

9. NOTICES

All notices under this Agreement shall be in writing and sent to the addresses or contacts designated below. Notice is effective upon receipt by the receiving Party.

10. AMENDMENT, WAIVER, COUNTERPARTS

10.1 No amendment or waiver of any provision of this Agreement shall be effective unless made in writing and signed by authorized representatives of both Parties. 10.2 Failure to exercise a right shall not constitute a waiver. 10.3 This Agreement may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one instrument.

11. GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to conflict of law principles.

12. ENTIRE AGREEMENT; SEVERABILITY

12.1 This Agreement constitutes the entire agreement between the Parties with respect to the subject matter and supersedes all prior and contemporaneous agreements and understandings. 12.2 If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

13. MISCELLANEOUS

13.1 The Parties acknowledge that monetary damages may be an inadequate remedy for breach of this Agreement and that injunctive relief may be appropriate in addition to other remedies. 13.2 Any reference to law or statute includes as amended and successor provisions.

CERTIFICATION

The undersigned certify that they are authorized to enter into this Agreement on behalf of the respective Parties and that the information provided herein is true and accurate to the best of their knowledge.

Sign Now