The terms and conditions set out below shall be added to the Principal Agreement effective as of May 25, 2018.
Please read these Terms carefully. By using this service and signing up for an account, you’re agreeing to these Terms. This is a legal agreement. The following definitions should provide an understanding of this agreement.
Mindmatrix (or the "Service") is a provider of automated software supporting a marketing and sales platform. The platform allows you to create, send, and manage marketing campaigns with the goal of better defined business leads along with efficient sales efforts. In conjunction with this service, Mindmatrix will process your personal data and as such is known as the "Processor."
As a Customer of the Service or a representative of an entity that's a Customer of the Service, you will provide the personal data, inclusive of any content that may not be yours, such as contacts acquired or leads generated through use of the service, that shall be processed and as such you are known as the "Controller." As Controller you are responsible for all your personal data, or content supplied.
content, unacceptable content, along with providing your consent that the personal data can be processed.
If you have any questions about our terms, feel free to contact us or access us through email@example.com.
PLEASE READ THESE TERMS AND CONDITIONS OF USE CAREFULLY. THESE TERMS AND CONDITIONS OF USE MAY HAVE CHANGED SINCE YOUR LAST VISIT TO THIS WEBSITE OR USE OF THE PRODUCTS. YOU AGREE TO CHECK FOR UPDATES TO THESE TERMS AND CONDITIONS OF USE. BY USING THIS WEBSITE OR THE PRODUCTS, YOU INDICATE YOUR ACCEPTANCE OF THESE TERMS AND CONDITIONS OF USE. IF YOU DO NOT ACCEPT THESE TERMS AND CONDITIONS OF USE, THEN DO NOT USE THIS WEBSITE OR THE PRODUCTS.
In this Addendum, the following terms shall have the meanings set out below:
"Applicable Law" - means any laws or regulations, regulatory policies, guidelines or industry codes (whether national or international) which apply to Mindmatrix (or any of its Sub-Processors) and/or the provision of or the subject matter of the Services in each case as in force from time to time;
"Customer Group Member" - means Customer or any entity that owns or controls, is owned or controlled by or is or under common control or ownership with Customer, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise;
"Customer Personal Data" - means any Personal Data Processed by Mindmatrix on behalf of a Customer Group Member pursuant to or in connection with the Principal Agreement;
"Data Protection Laws" - means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country, such as the California Consumer Privacy Act;
"EEA" - means the European Economic Area;
"EU Data Protection Laws" - means EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced or superseded from time to time, including by the GDPR and laws implementing or supplementing the GDPR;
"GDPR" - means EU General Data Protection Regulation 2016/679;
"CCPA" - means the California Consumer Privacy Act effective January 1, 2020;
"Personal Data" - means any data that relates to an identified or identifiable natural person and where such data is protected under applicable Data Protection Laws;
"Service(s)" - means the services and other activities to be supplied to or carried out by or on behalf of Mindmatrix for Customer Group Members pursuant to the Principal Agreement.
"Standard Contractual Clause(s)" - means the contractual clauses set out in Schedule A;
The terms, "Commission", "Controller", "Processor", "Data Subject(s)", "Member State", "Personal Data Breach", "Processing" and "Supervisory Authority" - shall have the same meaning as in the GDPR, or in the CCPA, and their cognate terms shall be construed accordingly.
The Controller acknowledges that any Customer and/or Customer Group Member, sharing personal data, follow the terms of this agreement and that the Customer and/or Customer Group Member, particularly residing in the EU, or the State of California, have given their consent, and such consent is current as defined by the applicable laws.
Customer is soley responsible for maintaining the security and confidentiality of the information you hold for your Account, including, without limitation, your user name and password, and for any and all activity that occurs through your Account as a result of your failure to keep this information secure and confidential. You hereby agree to notify Mindmatrix immediately if you become aware of any unauthorized use of your Account, user name or password, or any other breach of security in connection therewith. You may be held liable for losses incurred by Mindmatrix or any third party due to someone else using your Account, user name or password as a result of your failing to keep your Account information secure and confidential.
 Customer hereby represents and warrants not to store or otherwise use any Personal Data or Content in connection with the Service that: (a) violates these Terms; (b) is defamatory, libelous, abusive, illegal, profane, indecent, pornographic, obscene, hateful, offensive, harassing, or threatening in any way; (c) constitutes or encourages conduct that would be considered a criminal offense or give rise to civil liability, or otherwise intentionally or unintentionally violate any law, rule or regulation; (d) violates any third party's copyright, trademark, patent, trade secret, or other personal or proprietary right; (e) invades or interferes with the rights of privacy or publicity of any person; or (f) contains a virus, malicious code or any other harmful component.
 Mindmatrix reserves the right, at any time in its sole discretion and without notice to Customer, to pre-screen, review, monitor and or refuse any or all Personal Data or Content from the Service, but Mindmatrix has no obligation to do so. Customer agrees to immediately take down, delete or modify any Personal Data or Content that is stored through the Service that violates these Terms or any applicable laws, rules, or regulations, including pursuant to a take down, deletion or modification request from Mindmatrix . In the event that Customer elects not to comply with a request to take down, delete or modify certain Personal Data or Content, Mindmatrix reserves the right to directly take down, delete or modify such Personal Data or Content. Mindmatrix assumes no liability or responsibility arising from your activities in connection with the Service, including, without limitation, Personal Data or Content that you store or otherwise use in connection with Service.
Mindmatrix , in Processing the Customer Personal Data in accordance with Section 2.B. above, shall reasonably comply with all applicable Data Protection Laws. Mindmatrix shall not be responsible for complying with Data Protection Laws applicable to Customer or its industry that are not otherwise consistent with the provision of the Services or if, and to the extent that, the relevant provision of Data Protection Law would not also apply to Mindmatrix 's provision of services equivalent to the Services to other customers. Customer shall comply with all Data Protection Laws applicable to Customer as Controller.
Mindmatrix shall take reasonable steps to (i) require background screening and to ensure the reliability of any personnel who may have access to the Customer Personal Data or the Customer environments in which the Personal Data is processed, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Customer Personal Data, as strictly necessary for the purposes of the Principal Agreement; and (ii) ensuring that any personnel are informed of the confidential nature of Personal Data, have received training, and are subject to confidentiality obligations or professional or statutory obligations of confidentiality.
Mindmatrix has appointed a data protection officer. The appointed person may be reached at firstname.lastname@example.org.
Customer acknowledges, as part of the Services, it is responsible for responding to any Data Subjects' request under any Data Protection Law to exercise the Data Subject's right of access, right of rectification, restriction of Processing, right to be forgotten, data portability, object to processing, or its right not to be subjected to an automated decision-making process ("Data Subject Request").
 to the extent permitted by Applicable Law, promptly notify Customer if it receives a Data Subject Request from a
Data Subject; and
 taking into account the nature of the Processing, reasonably assist Customer to access Customer Personal Data to the extent that Customer Personal Data is not accessible to Customer (as part of the Services) to fulfill the Customer's obligations, as reasonably understood by Customer, to respond to Data Subject Requests and to comply with Data Protection Laws.
Unless prohibited by Applicable Law or a legally-binding request of law enforcement, Mindmatrix shall promptly notify Customer of any request by government agency or law enforcement authority for access to or seizure of Personal Data.
Mindmatrix shall, to the extent necessary, provide reasonable assistance to Customer or each Customer Group Member with respect to any data protection impact assessment required of the Customer or Customer Group Member by Applicable Law, in each case solely in relation to Processing of Customer Personal Data and taking into account the nature of the Processing.
Subject to Section 6B, below, Mindmatrix shall, to the extent necessary, allow for and contribute to audits, including inspections, by any Customer Group Member or an auditor mandated by any Customer Group Member in relation to the Processing of the Company Personal Data.
Customer shall give Mindmatrix reasonable notice of any audit or inspection to be conducted under Section 6A and
shall make reasonable endeavors to avoid causing any damages, injury or disruption to Mindmatrix 's premises,
equipment, personnel and business while Customer's personnel are on those premises in the course of an audit or
inspection. Mindmatrix need not give access to its premises for the purposes of an audit or inspection:
 to any individual unless such individual is participating in the audit or inspection;
 outside normal business hours, unless the audit or inspection must be conducted on an emergency basis and Customer has provided advanced notice supporting the same;
 for the purposes of more than one audit or inspection in any calendar year, unless the Customer considers such audit or inspection reasonably necessary due to genuine concerns regarding Mindmatrix 's compliance with this Addendum or unless Customer is required to so perform such audit or inspection by a Supervisory Authority.
Mindmatrix shall notify Customer within 24 hours upon Mindmatrix becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data. To the extent able within the scope of the Services, Mindmatrix will provide Customer with sufficient information to allow it to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.
Mindmatrix shall co-operate with Customer and take such reasonable commercial steps as are directed by Customer to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
Taking into account the state of the art, the costs of implementation and the nature, scope, and purpose of Processing, as well as the risk and severity for the rights and freedoms of Data Subjects, Mindmatrix shall implement and maintain appropriate technical and organizational measures designed to protect the security, confidentiality and integrity of Customer Personal Data, including to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access. Mindmatrix regularly monitors compliance with these measures. Mindmatrix reserves the right to update its technical and organizational measures and will not materially decrease the overall security of the Services pursuant to the Principal Agreement.
Upon termination of the Services, Mindmatrix shall at Customer's option, return and/or delete any Personal Data retained on the Services in accordance with the terms of the Principal Agreement and not retain any copies unless Mindmatrix is required to do so by Applicable Law.
Upon request of any customer of the Controller's, Controller agrees to notify Mindmatrix of said request whereby the Personal Data of said customer and/or Customer Group Member shall be deleted.
IN NO EVENT WILL MINDMATRIX, OR MINDMATRIX PARTIES, BE LIABLE TO YOU, OR ANY THIRD PARTY, FOR ANY SPECIAL, INDIRECT, INCIDENTAL, PUNITIVE, EXEMPLARY, RELIANCE, OR CONSEQUENTIAL DAMAGES OF ANY KIND, INCLUDING, BUT NOT LIMITED TO, COMPENSATION, REIMBURSEMENT OR DAMAGES IN CONNECTION WITH, ARISING OUT OF, OR RELATING TO, THE USE, OR LOSS OF USE OF, THE SERVICE, LOSS OF PROFITS, LOSS OF GOODWILL, LOSS OF DATA OR CONTENT, COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, SUBSEQUENT OR OTHER COMMERCIAL LOSS, OR FOR ANY OTHER REASON OF ANY KIND, WHETHER BASED ON CONTRACT OR TORT (INCLUDING, WITHOUT LIMITATION, NEGLIGENCE OR STRICT LIABILITY), EVEN IF MINDMATRIX, OR MINDMATRIX PARTIES, HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Without prejudice to Schedule A, Standard Contractual Clauses, Clause 7 Mediation and Jurisdiction, and Clause 9 Governing Law, or the applicability of any Data Protection Laws:
b. The obligations of Mindmatrix arising hereunder are subject to and governed by the laws of the country or territory expressly set forth in the Principal Agreement.
In addition to the terms set out in Part A above, the terms set out in this Part B shall apply to the Processing of Personal Data by Mindmatrix on behalf of a Customer established in the European Union (EU), or the State of California, or otherwise subject to the requirements of the GDPR or the terms of the CCPA.
With effect from 25 May 2018, Mindmatrix will Process any Personal Data in accordance with the requirements of GDPR as directly applicable to Mindmatrix 's provision of the Services. Effective from January 1, 2020, the same shall apply to the terms of the CCPA, but the data collection and consent remains the responsibility of the Controller.
Mindmatrix will Process Customer Personal Data to provide the Services. The subject matter, nature and purpose of the Processing shall be as required to perform the Services and shall be determined by the nature of Customer Personal Data submitted for Processing by the Customer. The duration of the Processing of Personal Data shall be for the term of the Principal Agreement.
As per the terms of CCPA, the following key elements shall apply. These are not all inclusive and users should refer to the Office of the Attorney General at https://oag.ca.gov/privacy/ccpa or the summary narrative provided near the end of this agreement.
Unless otherwise agreed and notwithstanding Section 10, Location and Storage of Personal Data above, in order to provide the Services Mindmatrix only access Personal Data from (i) countries in the EEA, (ii) countries or territories formally recognized by the European Commission as providing an adequate level of data protection ("Adequate Countries") and (iii) the United States provided, in this case, that Mindmatrix makes available to Customer a Valid Transfer Mechanism in accordance with Section 12.E. below. When Mindmatrix access Personal Data from outside the Designated Data Center Location for the purposes of providing the Services, Customer agrees that such Personal Data may be transferred accordingly.
Standard Contractual Clauses.
Notwithstanding the foregoing, Mindmatrix shall be entitled to access Personal Data from, or transfer Personal Data to, territories outside the EEA other than in the circumstances specified in Section 11.E. if required to do so by Applicable Law. Unless prohibited by Applicable Law, Mindmatrix shall inform Customer of the requirement for such transfer or access before taking steps to implement the transfer or access.
The Standard Contractual Clauses apply (i) to the entity that has executed the Standard Contractual Clauses as the Data Exporter and its Affiliates established within the European Economic Area and Switzerland that utilize the Services. For the purposes of the Standard Contractual Clauses such entities shall be deemed "Data Exporters". Where the Customer is itself a Processor of the Customer Personal Data, the Customer warrants that it is entering into the Standard Contractual Clauses with the authority of, and as agent for, the relevant Controller.
For the purposes of Clause 12.1. of the Standard Contractual Clauses, Mindmatrix shall return and delete Data Exporter's data in accordance with the Principal Agreement.
These Clauses are deemed to be amended from time to time to reflect (to the extent possible without material uncertainty as to the result) any change (including any replacement) made in accordance with EU Data Protection Laws by the Commission to or of the equivalent contractual clauses approved by the Commission under EU Directive 95/46/EC or the GDPR.
For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection.
The following information regarding the "data exporter" shall remain blank. For the purposes of this Agreement, the user reading and accepting the terms of this Agreement is the data exporter. The applicable data exporter information listed below, along with the acceptance of terms, is hosted and referenced to this Agreement from CLIENT NAME system.
Name of the data exporting organization: the CLIENT - for data exporter information and acceptance of terms.
Tel.:..............................................................................; fax:.........................................................................; e-mail:
Other information needed to identify the organization:
(the data exporter)
Name of the data importing organisation: Mindmatrix , Inc.
Address: 2403 Sidney Street, Suite150, Pittsburgh, PA 15203
Tel.:412.381.0230 x.1092; e-mail: email@example.com
Other information needed to identify the organization:
Mindmatrix , Inc.
(the data importer)
each a "party"; together "the parties",
HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.
For the purposes of the Clauses:
(a) 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
(b) 'the data exporter' means the controller who transfers the personal data;
(c) 'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
(d) 'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
(e) 'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
(f) 'technical and organisational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
1. The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
2. The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
3. The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
The data exporter agrees and warrants:
(a) that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
(b) that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;
(c) that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
(d) that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
(e) that it will ensure compliance with the security measures;
(f) that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
(g) to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
(h) to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
(i) that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
The data importer agrees and warrants:
(a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(c) that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;
(d) that it will promptly notify the data exporter about:
(i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
(ii) any accidental or unauthorised access, and
(iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
(e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
(f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
(g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
(h) that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
(i) that the processing services by the subprocessor will be carried out in accordance with Clause 11;
1. The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.
2. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.
The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.
1. The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:
(a) to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;
2. The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.
1. The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
2. The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement.
2. The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
3. The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data importer is established, namely the Commonwealth of Pennsylvania, United States.
1 shall be governed by the law of the Member State in which the data importer is established, namely the Commonwealth of Pennsylvania, United States.
1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
2. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.
On behalf of the data exporter:
Name (See CUSTOMER for data exporter information and acceptance of terms.):
Other information necessary in order for the contract to be binding (if any):
e-signature via electronic portal acceptable noting CUSTOMER and data exporter.
(stamp of organization not applicable if e-signature provided)
On behalf of the data importer:
Name: Harbinder S. Khera
Address: 2403 Sidney Street, Pittsburgh, PA 15203
Other information necessary in order for the contract to be binding (if any):
This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.
The data exporter is (please specify briefly your activities relevant to the transfer):
..........exporting contact records for email marketing, asset personalization and lead generation.
The data importer is (please specify briefly activities relevant to the transfer):
..........managing contact records for email marketing, asset personalization and lead generation.
The personal data transferred concern the following categories of data subjects (please specify):
..........contact record information, such as first name, last name email addresses.
Categories of data
The personal data transferred concern the following categories of data (please specify):
..........contact record information, such as first name, last name, email addresses related business information, but shall EXCLUDE any personal data such as social security #'s, race, religion, credit history and the like.
Special categories of data (if appropriate)
The personal data transferred concern the following special categories of data (please specify):
The personal data transferred will be subject to the following basic processing activities (please specify):
..........email marketing, asset personalization and lead generation.
This Appendix forms part of the Clauses and must be completed and signed by the parties.
Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):
1. Data accessed using 256-bit encryption (HTTPS)
2. Encrypted passwords. Passwords not even available to Siteadmin.
3. Applications secure against SQL injections and passed all industry standard secure application deployment and development.
4. Automatic lockout after 5 failed login attempts.
5. Secured data storage.
The Act allows any California consumer to demand to see all the information a company has saved on them, as well as a full list of all the third parties that data is shared with. In addition, the California law allows consumers to sue companies if the privacy guidelines are violated, even if there is no breach.
In general, if a company took the steps needed to comply with the GDPR, then it's most of the way there for the California Consumer Privacy Act.
All companies that serve California residents with the following qualifications:
The law is in effect as of January 1, 2020. As a practical matter, companies need to have their data tracking systems in place by the start of 2019, since it gives consumers the right to request all the data a company has collected on them over the previous 12 months.
Companies have 30 days to comply with the law once regulators notify them of a violation. If the issue isn't resolved, there's a fine of up to $7,500 per record. The law assigns specific penalties should unauthorized access occur, whether through a breach, exfiltration, theft, or "disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices," As currently written, the penalties can range from $100 to $750 per consumer per incident, or actual damages, whichever is greater.
The California law takes a broader approach to what constitutes sensitive data than the GDPR. Here's what the Act considers "personal information":
Beaches Reporting: Businesses are not required to report breaches, and consumers must file complaints before fines are possible. The best course of action for security is to know what data is defined as private data and take steps to secure it. Note: If any organization, that complies with the GDPR, likely does not need to take further action to comply with this Act in terms of securing data.
Data Tools Employed: Any tools selected to help deal with the Act will not only need to have full visibility into data stored across the entire heterogenous corporate environment, but also ensure that access to this data is properly secured. Controlling the privacy and personal information that flows between machines is incredibly difficult, and a major challenge for all businesses.
New Law & Quickly Enacted: The law becomes effective in 2020, so expect amendments between now and implementation -- but the core tenets and rights are likely to remain.
By signing this AGREEMENT, you agree to the following terms and conditions of service. Further, that any loss that may occur as a result of this Agreement, you will indemnify and hold harmless both "Client" and MindMatrix.
Service User shall provide Service User Content and utilize the MindMatrix software platform to enlist marketing automation and sales enablement for Service User’s business operations. Service User shall access this data (Service User Content), once placed on the platform, through the established portal.
Service User shall indemnify, defend and hold harmless "Client" and MindMatrix (and its respective officers, directors, employees, agents, successors and permitted assigns thereof) from and against any and all Losses arising out of or in connection with (i) Service User's breach of its obligations set forth in this Agreement, most specifically Point 2 (Confidential Information) hereof, and/or (ii) Service User's willful misconduct and/or intentional or grossly negligent actions or material breaches hereunder.
NEITHER PARTY TO THIS AGREEMENT SHALL BE LIABLE TO THE OTHER PARTY FOR CONSEQUENTIAL, INCIDENTAL, PUNITIVE, OR INDIRECT DAMAGES (INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOST SAVINGS) ARISING FROM, RELATING TO, OR IN CONNECTION WITH THIS AGREEMENT, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF OR COULD HAVE FORESEEN SUCH DAMAGES, AND EACH PARTY’S AGGREGATE LIABILITY HEREUNDER SHALL IN NO EVENT EXCEED THE TOTAL FEES PAID BY CLIENT TO MINDMATRIX UNDER THE APPLICABLE SCHEDULE(S) FOR THE ONE (1) YEAR PERIOD PRIOR TO ANY ACT OR OMISSION GIVING RISE TO ANY POTENTIAL LIABILITY. THIS LIMITATION OF LIABILITY APPLIES REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT, OR OTHERWISE. NOTWITHSTANDING THE FOREGOING, THE LIMITATIONS OF LIABILITY SET FORTH ABOVE IN THIS POINT 5 SHALL NOT APPLY TO LOSSES AGAINST WHICH THE PARTIES HAVE AGREED TO INDEMNIFY EACH OTHER PURSUANT TO POINT 3 INDEMNIFICATION HEREOF.
Service User, at their sole costs, shall maintain insurance coverage throughout the entire term of this Agreement with the limits agreeable to MindMatrix. All cost and deductible amounts shall be for the sole account of Service User. All policies required by MindMatrix pursuant to this Agreement shall name both “Client” and MindMatrix as an additional insured. A Certificate of Insurance shall be provided to MindMatrix at firstname.lastname@example.org verifying the same.