This Data Privacy Addendum (this “Addendum”) is attached and made part of the agreement between Customer and Company (the “Agreement”).

The following specific terms apply to all processing of Personal Information (as defined below) for the Customer as part of the Services provided under the Agreement.

Whereas, the Parties have entered into an Agreement;

Whereas, the Parties would like to further specify the data privacy principles that apply to the Agreement;

Now, therefore, in consideration of the rights and obligations set forth in the Agreement, which they acknowledge, the Parties agree as follows:

1. DEFINITIONS

• Capitalized terms used but not defined in this Addendum will have the meanings assigned to them in the Agreement.
• “Business Contact Information” is defined as name, job title, department name, company name, business telephone, mobile phone number (if used for business purposes between Company and Customer), business fax number, and business e-mail address.
  
• “CCPA” is the California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100 et seq.
• “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual. For clarity, Personal Information excludes Business Contact Information. For information covered by the CCPA, the above definition shall be subject to any applicable qualifications or exclusions contained in the CCPA.
• “Personal Information Request” means a request from a consumer under the CCPA to exercise the right to know or right to delete.
• “Security Breach” means an unauthorized acquisition or use of unsecured Personal Information that creates a substantial risk of identity theft or fraud against an individual. For clarity, a good faith acquisition of Personal Information by an employee or agent of Company is not a Security Breach unless such employee or agent uses or discloses the Personal Information in an unauthorized manner.

2. GENERAL

• This Addendum amends and supplements the Agreement between the Parties. The terms of this Addendum will apply to all processing of Personal Information in relation to the Services provided under the terms of the Agreement. The Company shall be deemed to be ‘service provider’ and the Customer a ‘business’ as understood in the CCPA.
• Notices to the Company are to be delivered via e-mail to: legal@oloid.ai
• The Company shall carry out the Services and process Personal Information received from the Customer as set out in the Agreement or as otherwise notified in writing by the Customer to the Company during the Term of the Agreement.
• With respect to a Personal Information Request, the Company shall to the extent legally permitted, promptly notify Customer if it receives a Personal Information Request. Taking into account the nature of the processing, Company shall assist Customer by appropriate technical and organizational measures, to the extent possible, for the fulfillment of Customer’s obligation to respond to a Personal Information Request, provided however, the Customer understands and acknowledges that the Company does not store any Personal Information in the course of discharging its obligations under the Agreement. Except to the extent required by applicable law, Company shall not respond to any such Personal Information Request without Customer’s prior written consent except to confirm that the request relates to Customer.

3. PERMITTED USES AND DISCLOSURES

• Company shall use, disclose, and retain all Personal Information:
  1. As specifically authorized in the Agreement and this Addendum;
  2. Solely for the purpose of performing the Services described in the Agreement; and
  3. In accordance with applicable laws.
• Company shall not sell, rent, transfer, distribute, or otherwise disclose or make available any Personal Information to any third party without prior written permission from Customer, unless and to the extent required by law. Notwithstanding the foregoing, Company has the right to use third parties, including offshore entities who employ foreign nationals, as well as employees and contractors of Company’s affiliates and subsidiaries, who may also be foreign nationals, in performance of its obligations described in the Agreement, and Company has the right to disclose Personal Information to such third parties provided that such third parties are subject to confidentiality obligations similar to those between Company and Customer.

4. DATA SECURITY OBLIGATIONS

• Company shall:
  • Implement a comprehensive information security program which includes commercially reasonable technical and administrative safeguards to protect the confidentiality of Personal Information that are no less rigorous than accepted security industry practices;
  • Keep all Personal Information contained in any format (e.g., paper, computer system, and removable media) in a secure facility where access of unauthorized personnel is restricted;
  • Install reasonably up-to-date firewall protection and operating system patches for files containing Personal Information on a system that is connected to the Internet;
  • Install reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions, or a version of such software that can still be supported with up-to-date patches and virus definitions, and is set to receive the most current security updates on a regular basis, on systems vulnerable to malware and containing or channeling access to systems containing Personal Information;
  • Implement secure access control measures that:
    1. Restrict access to records and files containing Personal Information to those who need such information to perform their job’s duties; and
    2. Assign unique identifications plus passwords, which are not vendor supplied default passwords, to each person with computer access that are reasonably designed to maintain the integrity of the security of the access controls;
  • Use strong encryption in the following situations:
    1. When Personal Information is transmitted over a public network;
    2. When Personal Information is stored on portable devices; and
    3. When Personal Information is stored on removable media and that media is in transit between physical locations;
  • Provide ongoing employee training with respect to its information security program, the proper use of the computer security system, and the importance of Personal Information security;
  • Designate responsibility for maintaining Company’s comprehensive information security program;
  • Oversee its third-party companies by taking reasonable steps to select and retain third-party companies that are capable of maintaining security measures to protect Personal Information consistent with applicable laws;
  • Review the scope of its comprehensive security program at least once a year; and
  • Document responsive actions taken in connection with any incident involving a Security Breach, and mandatory post-incident reviews of events and actions taken, if any, in order to make changes in business practices relating to the protection of Personal Information.

5. OBLIGATIONS OF CUSTOMER

• Customer is solely responsible for:
• 1. Ensuring that the processing of the Personal Information is in compliance with all applicable laws;
  2. Ensuring that any consents required by law (including CCPA) and/or Customer policies and procedures for the collection, access, use, maintenance, and/or disclosure of the Personal Information have been obtained from each individual and entity (including without limitation consumers, business customers, and/or Customer employees and contractors) to whom the Personal Information relates.
  3. Establishing the applicable information security safeguards and associated policies for protecting Personal Information in its facilities. Customer must communicate the relevant safeguards and policies to Company with reasonable advance notice and in writing when Company provides services at a Customer facility or accesses Customer’s systems.
•  It shall be the Customer’s duty to ensure that it does not share any personal information or sensitive personal data or information (as defined by applicable laws) of any individual who is a citizen of or is otherwise governed by laws of the EEA, United Kingdom or Switzerland.

6. MISCELLANEOUS

• No alteration, amendment, or modification of this Addendum will be valid unless in writing and signed by an authorized representative of both Parties.
• Any ambiguity in the terms of this Addendum will be resolved to permit Company or Customer to comply with applicable laws.
• This Addendum is the entire and complete agreement between the Parties with respect to the privacy and security of Personal Information and supersedes any other agreements, representations, or understandings whether oral or written. To the extent there are any inconsistencies between the terms of this Addendum and the terms of the Agreement, this Addendum will prevail. Notwithstanding the foregoing, for the sake of clarity, the limitation of liability set forth in the Agreement remains in full force and effect and applies to this Addendum.
  
• For the sake of clarity, this Addendum will be subject to the choice of law and dispute resolution procedure set forth in the Agreement.