This Service Provider Addendum (“SPA”) is referenced by and integrated into the G5 Terms of Service (“Terms”) or other agreement governing the use of the applicable G5 services (“Services”), as applicable, entered into by and between G5 Search Marketing, Inc. (“G5”) and Client, as defined in the Terms or other applicable agreement, (collectively, the “Agreement”). This SPA shall apply to any Consumer Data, as defined below. For the avoidance of doubt, the restrictions set forth in this SPA do not apply to data that has been de-identified or to aggregate data. This SPA shall be effective the later of: (a) the date G5 receives Client’s written agreement to the terms of the SPA or (b) January 1, 2020 (the “SPA Effective Date”). Any capitalized defined terms not otherwise defined herein shall have the meanings set forth in the Terms. This SPA may be modified or amended only in writing signed by both G5 and Client.
Data Processing
1. Definitions.
1.1 “Aggregate Consumer Information” means information from which individual Consumer identities have been removed and is not linked or reasonably linkable to any Consumer, as defined in Section 1798.140(a) of the CCPA and other Data Protection Laws.
1.2 “Business” means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners that collects Consumer Data and alone, or jointly with others, determines the purposes and means of processing Consumer Data, as defined under Section 1798.140(c) of the CCPA and other Data Protection Laws.
1.3 “Business Purpose” means a Business’s or Service Provider’s operational purposes or other notified purposes, provided that the use of Personal Information is necessary and proportionate to achieve the operational purpose for which the Personal Information was collected or processed, as defined under Section 1798.140(d) of the CCPA and other Data Protection Laws.
1.4 “Consumer” means the particular individual, or household, as applicable, that Personal Information identifies, relates to, describes, or is capable of being associated with, as defined under Section 1798.140(g) of the CCPA and other applicable Data Protection Laws.
1.5 “Consumer Data” means any Personal Information of a Consumer that is included with or incorporated into the User Data that G5 processes in the course of providing Client with the Services under the Agreement. Consumer Data excludes (i) data that has been De-Identified and (ii) Aggregate Consumer Information.
1.6 “Data Protection Laws” means the California Consumer Privacy Act of 2018 (“CCPA”) and any equivalent or similar United States laws, rules, regulations, directives, and governmental requirements in applicable jurisdictions, and any laws intended to implement, replace or supplement them, as amended, consolidated, re-enacted or replaced from time to time.
1.7 “De-Identified” means information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular Consumer, as defined in Section 1798.140(h) of the CCPA and other Data Protection Laws.
1.8 “Personal Information” means information defined as personal data, personal information, or a similar term by applicable Data Protection Laws, and any other information that identifies, relates to, describes, or is capable of being associated with, directly or indirectly, an individual or household.
1.9 “Sale” or “Selling” is as defined under Section 1798.140(t) of the CCPA and other Data Protection Laws, to the extent that such other Data Protection Laws contain or incorporate such a term.
1.10 “Service Provider” means a third party that processes Consumer Data as defined under Section 1798.140(v) of the CCPA and other Data Protection Laws.
2. Client’s Role.
Client is a Business and determines the purpose(s) and means of processing Consumer Data. Client shall provide Consumer Data to G5 solely for a valid Business Purpose and for G5 to perform the Services.
3. G5’s Role.
G5 is a Service Provider to Client. G5 shall provide the Services and process any Consumer Data in accordance with the terms of this SPA and the Agreement.
4. Data Processing.
G5 shall process Consumer Data only for the purposes of providing the Services. G5 shall not retain, use, or disclose Consumer Data for any purpose other than providing the Services and in performance of the Agreement.
5. Restriction on Further Processing.
G5 shall not further collect, use, retain, access, share, transfer, or otherwise process Consumer Data for any purpose not related to providing the Services. Except as permitted under this SPA, G5 shall not retain, use, or disclose Consumer Data outside of the direct business relationship between G5 and Client.
6. Restriction on Sale.
G5 is prohibited from “Selling” Consumer Data.
7. Certification.
G5 understands the restrictions set forth under sections 4, 5, and 6 of this SPA and agrees to comply with them.
8. Sub-Service Providers.
Client agrees that G5 may engage other Service Providers (as defined under the CCPA), to assist in providing the Services to Client (“Sub-Service Providers”).
9. Security.
G5 will implement and maintain industry-standard technical and organizational security measures that are reasonably designed to prevent unauthorized access to and disclosure of Consumer Data.
10. Assistance with Consumers’ Rights Requests.
Client is responsible for handling and responding to all Consumer rights requests under the CCPA, including but not limited to communicating with the Consumer who is the subject of each request. If G5 receives a request from a Consumer to exercise a Consumer right provided for under the CCPA in relation to that Consumer’s Consumer Data, G5 will promptly notify Client of the request and provide a copy of the request to Client.
11. Client’s Obligations Regarding Consumer Notices and Information.
Client shall implement and publish a Consumer-facing privacy policy that incorporates the information required under Data Protection Laws, including under Section 1798.130(a)(5) of the CCPA and in the applicable CCPA regulations. Client shall provide Consumers with an initial notice regarding the categories of Consumer Data collected and the business purposes for which such Consumer Data is processed as required under Data Protection Laws, including under Section 1798.100(b) of the CCPA and in the applicable CCPA regulations.
General
12. CCPA Section References.
To the extent that any future changes to the CCPA result in changes to the section references for the CCPA defined terms referenced in this SPA, the most recent, updated section references are deemed incorporated into this SPA.
13. Changes in Data Protection and Privacy Laws.
Notwithstanding any provisions to the contrary in this SPA, if any change in Data Protection Laws in the United States may require or result in any variation to this SPA, G5 will modify this SPA as necessary to incorporate such change(s) and provide a copy of the modified SPA to Client. Client shall notify G5 of any objection to such modifications of the SPA within thirty (30) days’ of G5’s dispatch of such modified SPA. If G5 does not receive any objection from Client within this thirty (30) day period, Client will be deemed to have accepted such modifications and such modifications will become binding and enforceable as part of this SPA. Should Client submit objections to G5 within the above-referenced thirty (30) days, Client and G5 agree to discuss and negotiate in good faith any such necessary modifications to this SPA to address the changes with a view to agreeing and implementing modifications as mutually agreeable to both Client and G5 as soon as is reasonably practicable but no later than thirty (30) days following G5’s receipt of Client’s objections. If Client and G5 are unable to reach agreement on modifications to this SPA within such thirty (30) day time period, G5 may terminate the Agreement without notice to Client.
14. Order of Precedence.
In the event of any conflict between the SPA, the Agreement, and/or any applicable order form or other terms, the following order of precedence shall apply (in descending order): (1) the SPA, (2) the Agreement, (3) the Order Form, and (4) other terms. There will be no force or effect to any different terms of any related statement of work, purchase order, online terms of service, or similar form even if signed by the parties after the SPA Effective Date hereof.
15. Governing Law.
The rights and obligations of G5 and Client under this SPA shall be governed by and construed under the substantive and procedural law of the State of California, excluding its Uniform Commercial Code, without reference to its conflict of law principles.
16. Severance.
Should any provision of this SPA be held invalid or unenforceable, then the remainder of this SPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
17. Liability.
For the avoidance of doubt, each party’s liability and remedies under this SPA are subject to the aggregate liability limitations and damages exclusions set forth in the Agreement.
Updated November 26, 2019