Privacy Contract Addendum Form

Privacy Contract Addendum Form

This Privacy Contract Addendum ("Addendum") is made as of , by and between Controller: (Entity Type: Individual Corporation LLC Other ), with principal place of business at ; and Processor: (Entity Type: Individual Corporation LLC Other ), with principal place of business at .

Recitals

WHEREAS, the parties have entered into one or more agreements pursuant to which Processor may receive, process, or store personal data on behalf of Controller (collectively, the "Underlying Agreement");

WHEREAS, the parties desire to set forth additional, contractual obligations and safeguards concerning the processing, transfer, retention, and protection of personal data to ensure compliance with applicable privacy and data protection requirements;

WHEREAS, this Addendum supplements and amends the Underlying Agreement and prevails to the extent of any conflict with the Underlying Agreement with respect to data protection and privacy matters;

NOW, THEREFORE, in consideration of the mutual covenants herein, the parties agree as follows:

1. Definitions

For purposes of this Addendum, the following definitions apply: "Personal Data" means any information relating to an identified or identifiable natural person processed by Processor on behalf of Controller. "Processing" means any operation performed on Personal Data. Terms used that are otherwise defined in applicable data protection law shall have the same meaning when used in this Addendum.

2. Scope and Purpose

Processor shall only process Personal Data on documented instructions from Controller, including as necessary to perform the services described in the Underlying Agreement and as otherwise documented in writing. Any processing beyond those instructions requires prior written authorization from Controller.

3. Personal Data; Categories; Purposes

4. Controller Instructions and Authorized Personnel

Processor shall act only on the documented instructions of Controller. Processor shall ensure that processing is carried out only by personnel who are subject to a duty of confidentiality and have received appropriate training. Controller may, from time to time, provide written instructions specifying additional permitted processing activities.

5. Security Measures

Processor represents that it has implemented and will maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, cost of implementation, and the nature, scope, context and purposes of processing.

6. Use of Subprocessors

Controller authorizes Processor to engage subprocessors to carry out specific processing activities, provided that Processor: (a) enters into a written contract with each subprocessor that imposes obligations equivalent to those in this Addendum; (b) remains liable for the subprocessor's performance of such obligations; and (c) provides Controller with prior notice of intended changes concerning the addition or replacement of subprocessors. List current subprocessors and their functions:

7. International Transfers

Any transfer of Personal Data to jurisdictions outside the country in which the data was collected shall be subject to appropriate safeguards. Describe cross-border transfer mechanisms or limitations here:

8. Data Subject Rights; Assistance

Processor shall, to the extent legally permitted and practicable, promptly notify Controller of any request from a data subject to exercise rights (access, rectification, erasure, restriction, objection, portability) and shall assist Controller in responding to such requests in accordance with applicable law. Describe operational procedure for subject requests:

9. Incident Management and Notification

Processor shall notify Controller without undue delay and in any event within hours of becoming aware of a security incident affecting Personal Data. Processor's notice shall include details sufficient to allow Controller to meet any legal obligations and to mitigate harm.

10. Return, Deletion and Retention

Upon expiration or termination of the Underlying Agreement or upon Controller's written request, Processor shall, at Controller's option, return all Personal Data to Controller and delete existing copies, unless retention is required by law. Retention period if any after termination:

11. Audit and Inspection

Processor shall make available to Controller all information necessary to demonstrate compliance with this Addendum and permit and contribute to audits, including inspections, by Controller or an auditor mandated by Controller, subject to reasonable confidentiality protections. Proposed audit frequency and scope:

12. Liability and Indemnity

Each party shall be liable for its breach of this Addendum in accordance with applicable law. Processor shall indemnify Controller for losses arising from Processor's unauthorized use, disclosure, or processing of Personal Data that breaches this Addendum, subject to any limitations of liability set forth in the Underlying Agreement. If a monetary cap is applicable, specify cap:

13. Term and Termination

This Addendum shall commence on the effective date set forth above and shall remain in effect for the term of the Underlying Agreement or as otherwise agreed in writing. Termination of the Underlying Agreement shall terminate this Addendum, subject to obligations surviving as required to effect data return or deletion.

14. Notices

15. Amendments; Waiver; Counterparts

This Addendum may be amended only by a written instrument executed by authorized representatives of both parties. No failure or delay by either party in exercising any right under this Addendum constitutes a waiver of that right. This Addendum may be executed in counterparts, each of which shall be deemed an original.

16. Governing Law; Entire Agreement; Severability

This Addendum shall be governed by the laws of the state of , excluding its choice of law rules. This Addendum, together with the Underlying Agreement, constitutes the entire agreement between the parties with respect to its subject matter and supersedes prior agreements. If any provision of this Addendum is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

17. Certifications

Each party certifies that it has the full right, power and authority to enter into this Addendum and to perform its obligations hereunder, and that the execution, delivery and performance of this Addendum by such party will not violate any other agreement to which it is a party.

Sign Now