Legal Privacy Letter

LEGAL PRIVACY LETTER

This Legal Privacy Letter (the Letter) is made on this day of , by and between Disclosing Party Name: with principal address at , and Receiving Party Name: with principal address at (each a Party and together the Parties).

RECITALS

WHEREAS, the Disclosing Party possesses certain confidential and proprietary information, including personal data and business information, that is necessary for the Receiving Party to perform services or evaluate a potential or ongoing business relationship;

WHEREAS, the Parties wish to define the Receiving Party's obligations with respect to the protection, use, handling, retention, disclosure and security of such information and to set forth procedures for notification and remediation in the event of an unauthorized disclosure or data security incident; and

WHEREAS, the Parties intend this Letter to establish legally binding obligations limited to privacy and data protection matters described herein.

NOW, THEREFORE, in consideration of the mutual covenants set forth below, the Parties agree as follows:

1. DEFINITIONS

For purposes of this Letter: (a) "Confidential Information" means any information disclosed by the Disclosing Party to the Receiving Party, whether oral, written or electronic, that is designated as confidential or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure, including but not limited to personal data, financial information, trade secrets, customer lists, technical specifications and business plans; (b) "Personal Data" means any information relating to an identified or identifiable natural person.

2. SCOPE AND PURPOSE

The Receiving Party shall use Confidential Information solely for the purpose of and shall not use such information for any other purpose without the prior written consent of the Disclosing Party.

3. CONFIDENTIAL INFORMATION—INCLUSIONS AND EXCLUSIONS

Confidential Information includes, without limitation, Personal Data and any aggregated or derived data. Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the Receiving Party; (b) was lawfully in the Receiving Party's possession prior to disclosure; (c) is received from a third party without breach of any obligation of confidentiality; or (d) is independently developed by the Receiving Party without use of the Disclosing Party's Confidential Information.

4. OBLIGATIONS OF THE RECEIVING PARTY

The Receiving Party shall: (a) maintain the confidentiality of Confidential Information with at least the same degree of care it uses to protect its own similar information, but in no event less than reasonable care; (b) restrict access to Confidential Information to employees, contractors or agents with a need to know and subject them to confidentiality obligations at least as protective as those in this Letter; and (c) not copy, reproduce, disclose or transfer Confidential Information except as expressly permitted by this Letter or the Disclosing Party in writing.

5. PERMITTED DISCLOSURES

The Receiving Party may disclose Confidential Information only to the extent necessary to perform the Purpose and only to personnel and third-party service providers who are bound by written obligations no less protective than this Letter. The Receiving Party shall remain responsible for acts and omissions of its personnel and permitted third parties. If the Receiving Party is required to disclose Confidential Information by law, regulation, or valid legal process, it shall give the Disclosing Party prompt written notice of such requirement and cooperate, at the Disclosing Party's expense, in seeking a protective order or other remedy.

6. SECURITY AND DATA PROTECTION

The Receiving Party shall implement and maintain administrative, physical and technical safeguards appropriate to the level of risk to protect Confidential Information and Personal Data against unauthorized access, disclosure, alteration and destruction. Such safeguards shall include, where applicable, encryption of data in transit and at rest, access controls, logging, periodic vulnerability assessments, patch management, and employee training.

7. RETENTION; DELETION; RETURN

The Receiving Party shall retain Confidential Information only for as long as necessary to accomplish the Purpose or as required by applicable law. Upon the earlier of the Disclosing Party's written request or termination of the relationship, the Receiving Party shall promptly return or securely destroy all Confidential Information and certify in writing that it has done so, except to the extent retention is required by applicable law, in which case the Receiving Party shall isolate and protect retained information from further use or disclosure.

8. BREACH NOTIFICATION

If the Receiving Party becomes aware of any unauthorized access to or acquisition, disclosure or loss of Confidential Information that could materially compromise Personal Data (a Security Incident), the Receiving Party shall: (a) notify the Disclosing Party without undue delay and in any event within hours of discovery; (b) provide sufficient details regarding the nature and scope of the incident; and (c) take prompt and appropriate remedial steps to contain and mitigate the incident and prevent recurrence. The Receiving Party shall cooperate with the Disclosing Party's reasonable investigatory and notification activities.

9. AUDIT RIGHTS

Upon reasonable prior written notice and during regular business hours, the Disclosing Party may audit the Receiving Party's compliance with this Letter. Audits shall be conducted no more than once per calendar year unless the Disclosing Party has a reasonable basis to suspect material noncompliance. The Parties shall cooperate to protect each other's Confidential Information during any audit and to limit disruption to operations.

10. NO LICENSE; NO WAIVER

Except as expressly set forth in this Letter, no license or other rights, by implication, estoppel or otherwise, are granted under any intellectual property or other rights of the Disclosing Party. Failure to exercise any right under this Letter shall not constitute a waiver of that right.

11. LIMITATION OF LIABILITY

Except for willful misconduct or gross negligence, neither Party shall be liable to the other for consequential, incidental, special, punitive or exemplary damages arising out of or in connection with this Letter. Each Party's aggregate liability for claims arising under this Letter shall not exceed the direct damages proven and attributable to the breach, subject to any mandatory limits under applicable law.

12. TERM AND TERMINATION

This Letter shall commence on the date set forth above and continue until terminated by either Party upon thirty (30) days' prior written notice. Termination shall not affect rights or obligations that accrued prior to termination, including obligations with respect to Confidential Information retained in accordance with Section 7.

13. NOTICES

14. GOVERNING LAW

This Letter shall be governed by and construed in accordance with the laws of without regard to its conflict of laws principles.

15. ENTIRE AGREEMENT

This Letter constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, representations and understandings, whether written or oral, relating to such subject matter.

16. SEVERABILITY

If any provision of this Letter is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect and the Parties shall negotiate in good faith to replace the invalid provision with a valid provision that achieves, to the extent possible, the economic, legal and commercial objectives of the invalid provision.

17. AMENDMENT; WAIVER; COUNTERPARTS

No amendment or modification of this Letter shall be effective unless in writing and signed by authorized representatives of both Parties. No waiver shall be valid unless in writing. This Letter may be executed in counterparts, each of which shall be an original and all of which together shall constitute one instrument. Signatures delivered by electronic means shall be deemed original signatures for all purposes.

18. ADDITIONAL TERMS

The Parties confirm that the foregoing terms represent binding obligations with respect to privacy, security and confidentiality.

Sign Now