Legal Secure Addendum

LEGAL SECURE ADDENDUM

This Legal Secure Addendum (the "Addendum") is entered into as of Effective Date: by and between Client Name: and Service Provider Name: (each a "Party" and collectively the "Parties") pursuant to the Agreement titled dated Agreement Date: .

RECITALS

WHEREAS, the Parties desire to supplement the Agreement to establish minimum security, privacy, and incident response obligations applicable to the processing, storage, transmission and access of Confidential Information and Personal Data (as defined below);

WHEREAS, Service Provider maintains technical and organizational measures, and Client requires assurances and remedial obligations with respect to data security, breach notification, audits, and data return or destruction;

WHEREAS, the Parties intend that this Addendum form part of the Agreement and that, in the event of any inconsistency, the terms of this Addendum shall control with respect to security and data handling obligations;

NOW, THEREFORE, in consideration of the mutual covenants set forth below, the Parties agree as follows:

1. Definitions

1.1 "Confidential Information" means information disclosed by or on behalf of a Party in any form that is designated as confidential or that, by its nature, ought reasonably to be treated as confidential. Confidential Information includes Personal Data and trade secrets.

1.2 "Personal Data" means any information relating to an identified or identifiable natural person that is processed by Service Provider on behalf of Client pursuant to the Agreement.

1.3 "Security Incident" means any confirmed or reasonably suspected unauthorized access to, use, disclosure, modification, loss or destruction of Confidential Information or Personal Data.

1.4 "Subprocessor" means any third party engaged by Service Provider to process Personal Data on behalf of Client. Authorized Subprocessors:

2. Scope and Applicability

2.1 This Addendum applies to all processing of Confidential Information and Personal Data by Service Provider under the Agreement. To the extent of any conflict between the Agreement and this Addendum, the terms of this Addendum control with respect to security, breach notification, audits, and data return or destruction.

3. Security Measures

3.1 Service Provider shall implement and maintain administrative, technical and physical safeguards appropriate to the risk, including without limitation: access controls using unique user credentials, multifactor authentication for privileged access, encryption of Personal Data in transit and at rest, regular vulnerability scanning and patch management, secure development lifecycle practices, logical segregation of Client data, and secure disposal procedures.

3.2 Encryption standard or protocol(s) to be used:

3.3 Service Provider shall maintain logging and monitoring sufficient to detect and investigate Security Incidents and shall retain logs for a minimum of .

4. Personnel and Access

4.1 Service Provider shall ensure that personnel granted access to Confidential Information or Personal Data are subject to confidentiality obligations and receive role-appropriate security training. Access shall be granted on a least-privilege basis and revoked promptly upon termination or role change.

4.2 Background screening requirements for personnel:

5. Subprocessors

5.1 Service Provider shall not engage any Subprocessor to process Personal Data without Client's prior written consent. Where consent is provided, Service Provider shall require the Subprocessor to comply with obligations at least as protective as those in this Addendum.

6. Security Incidents and Notification

6.1 Upon discovery of a Security Incident, Service Provider shall promptly take reasonable measures to contain and remediate the incident. Service Provider shall notify Client without undue delay and, in any event, no later than after confirmation of the incident, and shall provide reasonably requested information regarding the nature, scope, and remediation steps.

6.2 Security Incident primary contact for Service Provider:

7. Audit, Inspection and Compliance

7.1 Client, or an independent auditor engaged by Client, may conduct audits or inspections of Service Provider's compliance with this Addendum upon reasonable notice and subject to confidentiality protections. Client shall provide at least days' notice, except in the case of a suspected Security Incident where immediate access may be required.

7.2 Service Provider shall provide evidence of current security certifications, penetration test summaries and remediation plans upon request, to the extent such disclosure does not violate third-party confidentiality obligations.

8. Return and Destruction of Data

8.1 Upon termination or expiration of the Agreement, Service Provider shall, at Client's direction, return all Confidential Information and Personal Data to Client or securely destroy such data and certify destruction within .

8.2 Notwithstanding the foregoing, Service Provider may retain copies of data to the extent required by applicable law, provided that such retained data remains subject to the protections of this Addendum and is not used for any purpose other than compliance with the applicable legal requirement.

9. Liability, Indemnification and Insurance

9.1 Each Party shall be liable for breach of this Addendum to the extent permitted by the Agreement. Service Provider shall indemnify and hold Client harmless from third-party claims arising from Service Provider's failure to implement or maintain the security obligations described herein, except to the extent such claims result from Client's breach or instructions.

9.2 Service Provider shall maintain cyber and privacy liability insurance with minimum coverage of per occurrence and provide proof of insurance upon request.

10. Confidentiality

10.1 The Parties' obligations with respect to Confidential Information shall be as set forth in the Agreement. To the extent not addressed therein, Service Provider shall ensure Confidential Information is accessible only to authorized personnel and is not disclosed except as required to perform Services or as required by law.

11. Term and Termination

11.1 This Addendum commences on the Effective Date and shall continue for the term of the Agreement unless earlier terminated in accordance with the Agreement. Termination of the Agreement shall also terminate this Addendum, subject to obligations that expressly survive termination.

12. Notices

All notices under this Addendum shall be provided in accordance with the Notices provision of the Agreement. For convenience, the Parties' primary contacts for notices regarding security and data matters are set out below.

13. Amendments, Waiver and Counterparts

13.1 No amendment to this Addendum shall be effective unless in writing and signed by authorized representatives of both Parties. No failure or delay in exercising any right under this Addendum shall constitute a waiver. This Addendum may be executed in counterparts, each of which shall be an original and all of which together shall constitute one instrument.

14. Governing Law, Entire Agreement and Severability

14.1 Governing Law: This Addendum shall be governed by and construed in accordance with the laws of the State of , excluding its conflicts of law rules.

14.2 Entire Agreement: This Addendum, together with the Agreement, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous understandings.

14.3 Severability: If any provision of this Addendum is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect and the invalid or unenforceable provision shall be reformed to the minimum extent necessary to make it valid and enforceable.

15. Miscellaneous

15.1 Interpretation: Headings are for convenience only and do not affect interpretation. References to statutes include amendments and successor provisions. Where the Addendum requires that any action be taken "promptly" or "without undue delay," such requirement shall be interpreted in light of the nature of the action and the legitimate needs of the Parties.

Sign Now