Singlewire Software, LLC
Data Processing Addendum
This Data Processing Addendum (“DPA“) is incorporated into, and supplements, the applicable Agreement(s)s between Singlewire Software, LLC (“Singlewire“) and Customer governing Singlewire’s provision, and Customer’s receipt of the Services (collectively, the “Agreement“).
This DPA is an agreement between Singlewire and the entity who receives the Services from Singlewire pursuant to an Agreement that incorporates this DPA (“Customer“) and is effective as of the date this DPA is incorporated into such Agreement (the “DPA Effective Date“). Customer and Singlewire are each referred to herein as a “Party” and collectively as the “Parties“.
1. DEFINITIONS
For purposes of this DPA, the following capitalized terms shall have the meanings ascribed thereto. Other capitalized terms used in this DPA are defined in the context in which they are used and shall have the meanings indicated. Capitalized terms which are not defined herein shall have the meanings ascribed to them in the applicable Agreement(s).
1.1 “CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et. seq. and its implementing regulations, each as amended from time to time, including, without limitation, as amended by the California Privacy Rights Act of 2020.
1.2 “Controller” means the natural or legal person or entity who determines the purposes and means of the Processing of Personal Data.
1.3 “CPA” means the Colorado Privacy Act, Colo. Rev. Stat. § 6-1-1301 et. seq. and its implementing regulations, each as amended from time to time.
1.4 “CTDPA” means the Connecticut Data Privacy Act, Conn. Gen. Stat. § 45-151 et. seq., as amended from time to time.
1.5 “Customer Instructions” means Customer’s instructions to Singlewire to Process Customer Personal Data on Customer’s behalf: (1) as necessary to provide the Services to Customer; (2) as documented in the applicable Agreement(s) and this DPA; and (3) as otherwise instructed by Customer in writing and acknowledged and agreed by Singlewire.
1.6 “Customer Personal Data” means any Personal Data Processed by Singlewire on behalf of Customer via Singlewire’s provision of the Services. Notwithstanding anything to the contrary herein, Customer Personal Data does not include any Operational Data.
1.7 “Data Protection Law” means all laws, rules, regulations, and orders issued thereunder relating in any way to data protection, breach notification, privacy, or electronic marketing enacted within the United States of America, including any state or other jurisdiction within the United States of America, that are applicable to the Processing of Customer Personal Data under the applicable Agreement(s), which may include, where applicable and without limitation, the CCPA, CPA, CTDPA, FERPA and/or VCDPA.
1.8 “Data Subject” means the identified or identifiable natural person to whom Personal Data relates.
1.9 “Data Subject Request” means a request from an individual seeking to exercise rights granted to individuals under the Data Protection Laws.
1.10 “FERPA” means the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g) and the Family Educational Rights and Privacy Act Regulations (34 CFR Part 99), as amended or otherwise modified from time to time.
1.11 “Operational Data” means any Customer Personal Data and any other data or information related to Customer’s use of the Services that is aggregated and deidentified by or on behalf of Singlewire in a manner that complies with any requirements under applicable law relating to the nature and effect of such aggregation and deidentification, and, in all cases, does not, as applicable, identify the source of such Customer Personal Data or other data or information, or with respect to any Customer Personal Data, any individual to whom such Customer Personal Data relates. For clarity, Operational Data includes, without limitation, aggregated and deidentified statistical and performance information and data created, derived, or otherwise generated in connection with Singlewire’s provision and operation, and Customer’s use of the Services.
1.12 “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable Data Subject.
1.13 “Processing” (including corollary terms) means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, including, without limitation, collection, recording, organization, structuring, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
1.14 “Processor” means the entity which Processes Personal Data on behalf of the Controller, or, as applicable, on behalf of a Processor.
1.15 “Security Breach” means a breach of Singlewire’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data on systems managed or otherwise controlled by Singlewire.
1.16 “Security Documentation” means the security documents applicable to the specific Services provided to Customer, as updated from time to time and as made reasonably available to Customer by Singlewire.
1.17 “Services” means those services provided by Singlewire to Customer pursuant to an Agreement where, in the performance of such services, Singlewire Processes Customer Personal Data on behalf of Customer as a Processor.
1.18 “Sub-Processor” means a Processor engaged by Singlewire to Process Customer Personal Data on Customer’s behalf under the applicable Agreement(s) and this DPA. Sub-Processors may include third parties or Singlewire’s Affiliates but will not include any Singlewire employee or consultant. For clarity, any independent Processor to whom Customer instructs Singlewire to provide Customer Personal Data shall not be considered a Sub-Processor under this DPA.
1.19 “Supervisory Authority” means any applicable federal, state, or local government within the United States, or any departmental or other political subdivision thereof, or any entity, body, or authority within the United States having or asserting executive, legislative, judicial, regulatory, administrative, or other governmental functions of any court, department, commission, board, bureau, agency, or instrumentality of any of the foregoing, responsible for or involved in the enforcement and/or oversight of the Data Protection Laws.
1.20 “VCDPA” means the Virginia Consumer Data Protection Act, Va. Code § 59.1-575 et. seq., as amended from time to time.
2. SCOPE OF DPA
2.1 Role of the Parties. As between Singlewire and Customer, Customer shall be the Controller and Singlewire shall be the Processor with respect to Customer Personal Data Processed by Singlewire on Customer’s behalf in connection with Singlewire’s provision of the Services and the Customer Instructions.
2.2 Purpose of Processing. The specific business purpose for which Singlewire Processes Customer Personal Data on Customer’s behalf pursuant to the applicable Agreement(s) and this DPA is to enable Singlewire’s provision and operation, and Customer’s use, of the Services during the term of the applicable Agreement(s). Customer’s disclosure of Customer Personal Data to Singlewire is only for the limited and specified business purpose(s) set forth in the applicable Agreement(s) and this DPA.
2.3 Limitation of Obligations. Notwithstanding anything to the contrary in the applicable Agreement(s) or this DPA, Customer acknowledges and agrees that Singlewire has no obligation to assess Customer Personal Data in order to identify information subject to any legal requirements. Customer further acknowledges and agrees that this DPA, and Singlewire’s actions under this DPA, do not, and shall not be interpreted to, relieve Customer of its obligations under the Data Protection Laws and Customer shall be solely responsible for its compliance therewith.
2.4 Exclusions. Customer expressly agrees that any Personal Data Processed by or on behalf of Singlewire in its role as a Controller is not subject to this DPA. Further, the Parties agree that with respect to any Personal Data to which each party is a Controller, the Parties are independent Controllers with respect to such Personal Data.
2.5 Operational Data. Notwithstanding anything to the contrary in the applicable Agreement(s) or this DPA, Customer acknowledges and agrees that Singlewire is permitted, subject to compliance with applicable Data Protection Laws, to create, collect, generate, or otherwise obtain Operational Data through or in connection with Singlewire’s provision and operation, and Customer’s use, of the Services. Customer further acknowledges and agrees that Customer shall not acquire any right, title, or interest in or to any Operational Data.
3. CUSTOMER OBLIGATIONS
3.1 Compliance. Customer shall comply with the applicable Agreement(s), this DPA, and the Data Protection Laws in connection with the Processing of Personal Data applicable to Customer as a Controller, including, without limitation:
(a) providing legally-compliant privacy notices to, and obtaining all necessary consents and permissions from, Data Subjects with respect to the Processing of such Data Subjects’ Personal Data included within the Customer Personal Data;
(b) responding to and fulfilling Data Subject Requests in accordance with applicable Data Protection Laws; and
(c) ensuring Customer has the right to disclose to Singlewire, or provide Singlewire with access to, Customer Personal Data for the purpose of Singlewire Processing the Customer Personal Data on Customer’s behalf as contemplated under the applicable Agreement(s), this DPA, and the Customer Instructions.
3.2 Accuracy and Quality of Customer Personal Data. Customer shall have the sole responsibility for the accuracy and quality of the Customer Personal Data provided by Customer to Singlewire for Processing through or in connection with the Services and complying with all applicable laws, including, without limitation, the Data Protection Laws, with respect to the means by which Customer acquired such Customer Personal Data.
3.3 Customer Instructions. Customer shall be solely responsible for ensuring that all Customer Instructions comply with all applicable laws, including, without limitation, the Data Protection Laws.
3.4 Data Localization Requirements. Without limiting anything set forth in the applicable Agreement(s) or this DPA, Customer shall notify Singlewire of any data localization requirement or restriction on the transfer of Customer Personal Data to the extent that such requirement or restriction may affect Singlewire’s Processing of such Customer Personal Data in accordance with the applicable Agreement(s), this DPA, or the Customer Instructions.
3.5 Restrictions on Customer Personal Data. For the avoidance of doubt and without limiting anything set forth in the applicable Agreement(s) or this DPA, in connection with Customer’s use of the Services and Customer’s performance under the applicable Agreement(s) and this DPA, Customer shall not disclose to Singlewire, or otherwise provide Singlewire access to, any Personal Data subject to the data protection laws and regulations applicable to any country, state, principality or other territory outside the United States of America. For clarity and without limitation, Customer shall not disclose, provide access to, or otherwise instruct Singlewire to Process any Personal Data subject to: (1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC; (2) Switzerland’s Federal Act on Data Protection of June 19, 1992; (3) the United Kingdom’s Data Protection Act of 2018; and/or (4) the retained EU law version of the General Data Protection Regulation as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments, etc.) (EU Exit) Regulations 2019 (SI 2019/419).
3.6 Additional Obligations for Student Information. Without limiting anything otherwise set forth in the applicable Agreement(s)s or this DPA, in the event Customer Personal Data includes information that is protected under, or otherwise subject to, FERPA and/or other similar federal or state laws pertaining to the privacy and security of student information (such information is collectively referred to herein as “Student Information” and such laws are collectively referred to herein as “Student Privacy Laws“), Customer shall notify Singlewire thereof. Further, in addition to, and not in lieu of, any other applicable obligations or requirements under the applicable Agreement(s) or this DPA, Customer’s obligations with respect to the Processing of any such Student Information shall include the following:
(a) Customer shall comply with all applicable Student Privacy Laws. Without limiting the foregoing, Customer represents, warrants and covenants to Singlewire that, as applicable, Customer has:
(1) complied with the Directory Information (as defined under FERPA) or similar exemption under the applicable Student Privacy Laws, including, without limitation, informing, as applicable, students or parents what information Customer deems to be Directory Information and that such Directory Information may be disclosed, and allowing, as applicable, students or parents a reasonable amount of time to request Customer not disclose Directory Information about such student, and, if applicable, Customer shall not provide Singlewire any Directory Information for any student that has opted out of the disclosure of such student’s Directory Information;
(2) complied with the School Official (as defined under FERPA) exemption or similar exemption under the applicable Student Privacy Laws, including, without limitation, in Customer’s annual notification of FERPA rights, defining “school official” to include service providers and defining “legitimate educational interest” to include services such as the type provided by Singlewire; and
(3) obtained all necessary written consent from, as applicable, students or parents to provide Student Information to Singlewire to enable Singlewire to provide the applicable Services.
(b) Customer shall employ administrative, physical and technical safeguards consistent with industry standards designed to protect usernames, passwords and any other means of gaining access to the Services and/or hosted data from unauthorized access, disclosure or acquisition by an unauthorized person.
(c) Without limiting anything set forth in the applicable Agreement(s) or this DPA, except as otherwise agreed by the Parties, Customer will only provide Student Information to Singlewire where, and solely to the extent, necessary to enable Singlewire to provide the applicable Services.
4. SINGLEWIRE OBLIGATIONS
4.1 Compliance.
(a) Singlewire shall comply with the applicable Agreement(s), this DPA, the Customer Instructions and the applicable provisions of the Data Protection Laws, including, without respect to any Customer Personal Data collected by Singlewire pursuant to the applicable Agreement(s) or this DPA, providing the same level of privacy protection required of Customer as a Controller under the applicable Data Protection Laws.
(b) Singlewire shall only Process Customer Personal Data as specified in the applicable Agreement(s), this DPA and the Customer Instructions or as otherwise permitted under applicable Data Protection Laws. In the event applicable law to which Singlewire is subject requires Singlewire to undertake other Processing of Customer Personal Data, Singlewire will notify Customer (unless otherwise prohibited by such applicable law) before undertaking such other Processing.
4.2 Restrictions. Without limiting anything set forth in the applicable Agreement(s) or this DPA, Singlewire shall not:
(a) sell or share (as and to the extent such term is defined in the Data Protection Laws) Customer Personal Data;
(b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the applicable Agreement(s) or this DPA, including, retaining, using, or disclosing Customer Personal Data for a commercial purpose other than the applicable business purposes or as otherwise permitted under the Data Protection Laws;
(c) retain, use, or disclose Customer Personal Data outside of the direct relationship between Singlewire and Customer except as necessary to perform the Services under the applicable Agreement(s) or otherwise pursuant to the Customer Instructions; and/or
(d) combine the Customer Personal Data Singlewire receives from or on behalf of Customer with Personal Data Singlewire receives from or on behalf of any third party or collects through Singlewire’s own interactions with Data Subjects, provided that Singlewire may combine Customer Personal Data with other Personal Data to perform any business purpose as defined or permitted under the Data Protection Laws where applicable.
4.3 Certification. Singlewire certifies to Customer that Singlewire:
(a) understands and will comply with the foregoing restrictions placed on Singlewire’s Processing of Customer Personal Data, including complying with applicable obligations under the Data Protection Laws; and
(b) will notify Customer without undue delay if Singlewire is or is likely to become unable to substantially comply with any of Singlewire’s material obligations under this DPA or applicable Data Protection Laws.
4.4 Student Information. In addition to, and not in lieu of, any other applicable obligations or requirements under the applicable Agreement(s) or this DPA, Singlewire’s obligations with respect to any Processing of Student Information undertaken by Singlewire through or in connection with the Services shall include the following:
(a) Singlewire will comply with all applicable Student Privacy Laws.
(b) Singlewire will not:
(1) collect, retain, use, or disclose Student Information for any purpose other than the specific purpose of performing the Services specified in the applicable Agreement(s), provided that, subject to Singlewire’s compliance with applicable Student Privacy Laws, Singlewire may aggregate, de-identify or otherwise anonymize any Student Information (“Operational Student Information“) and shall own any such Operational Student Information;
(2) engage in targeted advertising or retargeting to students or parents using the Student Information;
(3) use Student Information, including persistent unique identifiers, created or gathered by the Services to amass a profile about a student;
(4) sell Student Information; or
(5) disclose Student Information, unless required by law, for legitimate research purposes or as part of the maintenance, development, support, operation or improvement of the Services in accordance with applicable law.
For clarity, the foregoing shall not prohibit Singlewire from using Student Information to provide the Services or as otherwise permitted under the applicable Agreement(s) or this DPA.
(c) As soon as reasonably practicable, and in any event, except as otherwise required under applicable laws or as otherwise provided under the applicable Agreement(s), within ninety (90) days, after the expiration or termination of the applicable Agreement(s) or any applicable Service provided under the applicable Agreement(s), Singlewire will delete all applicable Student Information (including existing copies) in Singlewire’s possession or under its reasonable control in accordance with applicable law; provided, however, Customer acknowledges and agrees that Singlewire will security erase or destroy any Student Information stored on Singlewire’s backup or archive systems within six (6) months after the expiration or earlier termination of the applicable Agreement. For clarity, the foregoing shall not apply, without limitation, to Operational Student Information.
(d) For parent or eligible student requests regarding Student Information:
(1) Singlewire will provide commercially reasonable assistance to Customer for the fulfillment of Customer’s obligations to respond to student requests regarding Student Information, including requests related to access, correction or deletion of such Student Information. For clarity, Customer acknowledges that Singlewire may, but is not required to, comply with its obligations to provide such commercially reasonable assistance to Customer by making appropriate features and functionalities available to Customer through the Services that enable Customer to engage in or facilitate Customer’s response to the foregoing requests. Without limiting the foregoing: (1) Customer shall establish reasonable procedures by which a parent or eligible student may access, correct, or delete Student Information; and (2) Singlewire may, but has no obligation to, enable parents or eligible students to access (but not correct or delete) Student Information based on a direct request received by Singlewire from a parent or eligible student, provided, with respect to any requests provided by a parent, the foregoing shall only apply to a verified parent.
(2) Except as otherwise provided herein, should a third party (other than a Sub-Processor), including, but not limited to, law enforcement or other government entities (a “Requesting Party“) contact Singlewire with a request for Student Information, Singlewire will advise the Requesting Party to request the Student Information directly from Customer and will not provide the requested Student Information to the Requesting Party, unless and to the extent Singlewire reasonably believes it is compelled to grant such access to the Requesting Party because the disclosure is necessary: (1) pursuant to a court order or legal process; (2) to comply with statutes or regulations; (3) enforce the applicable Agreement(s); or (4) to protect the rights, property, or personal safety of Singlewire’s users, employees or others. Singlewire will notify Customer in advance of a compelled disclosure to a Requesting Party unless Singlewire is lawfully directed by the Requesting Party not to inform Customer of the request or as otherwise prohibited under applicable laws.
(e) Customer agrees to utilize administrative, physical and technical safeguards designed to protect Student Information from unauthorized access, disclosure, acquisition, destruction, use or modification.
(f) Where required by law, Student Information shall be stored within the United States. Upon Customer’s request, Singlewire will provide Customer a list of the locations where Student Information is stored.
(g) Customer acknowledges and agrees that Singlewire may engage Sub-Processors to perform the Services. Where Singlewire engages any such Sub-Processor to Process Student Information, Singlewire will:
(1) impose data protection terms on such Sub-Processor that provide the same level of protection for Student Information as those specified in this DPA, to the extent applicable to the nature of the services provided by such Sub-Processor;
(2) Singlewire will remain responsible for all obligations assigned to, and all acts and omissions of, each Sub-Processor with respect to such Sub-Processor’s Processing of Student Information; and
(3) upon Customer’s reasonable written request, provide relevant information to Customer about each such Sub-Processor’s Processing of Student Information.
5. RIGHTS OF DATA SUBJECTS
5.1 Notification of Requests. In the event Singlewire receives a Data Subject Request in relation to Customer Personal Data and the request identifies Customer as the Controller, to the extent reasonably possible, Singlewire will, subject to compliance with applicable Data Protection Laws, at its option and in its discretion, advise the Data Subject to submit their request to Customer or notify Customer of such Data Subject Request. Customer will be responsible for responding to and fulfilling any Data Subject Request.
5.2 Singlewire’s Assistance. Taking into account the nature of the Processing of Customer Personal Data undertaken by Singlewire, Singlewire will provide reasonable assistance to Customer, through Singlewire’s appropriate technical and organizational measures, insofar as this is possible, in the fulfillment of Customer’s obligations to respond to a Data Subject Request under the Data Protection Laws as a Controller.
5.3 Data Subject Requests Seeking Deletion. Except as otherwise provided in the applicable Agreement(s) or this DPA, Singlewire will promptly delete, or subject to Singlewire’s compliance with applicable Data Protection Laws, aggregate, anonymize or de-identify Customer Personal Data upon Customer’s request in connection with an applicable Data Subject Request, unless applicable law, including, without limitation, any applicable Data Protection Laws, requires Singlewire to retain such Customer Personal Data.
6. DISCLOSURES OF CUSTOMER PERSONAL DATA BY SINGLEWIRE
6.1 Singlewire Personnel. Singlewire shall take reasonable steps to ensure the reliability and confidentiality of any employee, agent, or contractor who Singlewire provides access to Customer Personal Data, ensuring that access is strictly limited to those individuals who need to access the relevant Customer Personal Data for the purposes of providing the Services and as otherwise necessary to comply with Singlewire’s obligations under the applicable Agreement(s), this DPA, the Customer Instructions, and applicable laws.
6.2 Third Parties. Singlewire may disclose Customer Personal Data to third parties: (1) as permitted under the applicable Agreement(s), this DPA, and in accordance with Customer Instructions or as otherwise necessary to perform the Services; (2) to the extent required by applicable law (subject to compliance with the Data Protection Laws); (3) to a Supervisory Authority and/or as otherwise required by the Data Protection Laws; and (4) on a “need-to-know” basis under an obligation of confidentiality or professional secrecy to its legal counsel(s), data protection advisor(s), and accountant(s).
7. SUB-PROCESSORS
7.1 Engagement. Customer acknowledges and agrees that Singlewire may engage Sub-Processors to Process Customer Personal Data for or on Customer’s behalf. Where Singlewire engages any such Sub-Processor, Singlewire will impose data protection terms on such Sub-Processor that provide at least the same level of protection for Customer Personal Data as those specified in this DPA, to the extent applicable to the nature of the Processing of Customer Personal Data undertaken by such Sub-Processor. Singlewire will remain responsible for all obligations assigned to, and all acts and omissions of, each such Sub-Processor with respect to each such Sub-Processor’s Processing of Customer Personal Data for or on behalf of Customer.
7.2 Notification of Sub-Processors. To the extent required under the Data Protection Laws, in the event Singlewire engages any Sub-Processor to Process Customer Personal Data for or on behalf of Customer, Singlewire will notify Customer of such engagement.
8. SECURITY AND ADDITIONAL ASSISTANCE
8.1 Security Measures. Taking into account the nature of the Processing of Customer Personal Data undertaken by Singlewire for or on behalf of Customer, Singlewire shall, in relation to its Processing of Customer Personal Data, implement and maintain appropriate technical, physical, and organizational measures as described in the Security Documentation, provided that such measures shall provide appropriate protections for Customer Personal Data and include appropriate and commercially reasonable technical and organizational security controls designed to prevent reasonably foreseeable accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access to Customer Personal Data in Singlewire’s possession or otherwise under Singlewire’s reasonable control and other security controls required under the Data Protection Laws (the “Security Measures“).
8.2 Review of Security Documentation. Upon Customer’s written request at reasonable intervals, but no more frequently than annually, and subject to the confidentiality obligations set forth in the applicable Agreement(s) and this DPA, Singlewire will make available to Customer a copy of applicable Security Documentation, which may include, based on the Services provided under the applicable Agreement(s), Singlewire’s most recent third party audits or certifications; provided, however, that such Security Documentation shall only be used by Customer to assess Singlewire’s compliance with this DPA and/or the Data Protection Laws, and Customer shall not use such Security Documentation for any other purpose or disclose such Security Documentation to any third party without Singlewire’s prior written approval and, upon Singlewire’s request, Customer shall return to Singlewire all such Security Documentation in Customer’s possession or under its control.
8.3 Audits.
(a) Solely to the extent required under the Data Protection Laws and subject to this Section 8.3, Singlewire will allow Customer, no more frequently than annually, to conduct audits (including inspections) to verify Singlewire’s compliance with Singlewire’s obligations under this DPA and/or the Data Protection Laws (“Customer Audit“); provided, however, any such Customer Audit, including, without limitation, any observations, conclusions, or other results of any such Customer Audit and any documents reflecting the foregoing (collectively, “Customer Audit Results“), shall only be used by Customer to assess Singlewire’s compliance with this DPA and/or the Data Protection Laws, and shall not be used for any other purpose or disclosed to any third party without Singlewire’s prior written approval and, subject to express requirements under the Data Protection Laws to the contrary, upon Singlewire’s request, Customer shall return to Singlewire all such Customer Audit Results in Customer’s possession or under its control.
(b) Customer must send any requests to conduct a Customer Audit of Singlewire to [email protected]. Following Singlewire’s receipt of such request, Singlewire and Customer will discuss and agree in advance on the reasonable start date and duration of such Customer Audit and the scope of Singlewire’s technical and organizational measures in scope for such Customer Audit. Notwithstanding the foregoing, unless otherwise agreed by Singlewire in writing, any Customer Audit: (1) involving inspection of Singlewire’s business offices or data centers shall be limited to such business offices or data centers where Singlewire Processes Customer Personal Data for or on behalf of Customer and shall expressly exclude inspection of or access to any premises and systems containing Personal Data Singlewire Processes for or on behalf of itself or any third party that is logically but not physically separated from Customer Personal Data; (2) shall only occur during Singlewire’s normal business hours; (3) shall be conducted in a manner that minimizes any disruptions to Singlewire’s business operations; and (4) shall be subject to all confidentiality obligations set forth in the applicable Agreement(s) and this DPA and security measures in effect at the applicable business office or data center. For the avoidance of doubt, Customer shall not have access to any information, including, without limitation, any Personal Data, of or relating to any other Singlewire customer or client.
(c) Except as otherwise expressly prohibited under the Data Protection Laws, Singlewire may charge a fee (based on Singlewire’s reasonable costs) for any Customer Audit conducted pursuant to this Section 8.3. Upon Customer’s written request, Singlewire will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of the applicable Customer Audit. Without limiting the foregoing, Customer will be responsible for any fees charged by any auditor appointed by Customer to conduct any such Customer Audit.
(d) Singlewire may object in writing to any auditor appointed by Customer to conduct any Customer Audit if the auditor is, in Singlewire’s reasonable opinion, not suitably qualified or independent, a competitor of Singlewire, or otherwise manifestly unsuitable. Any such objection by Singlewire will require Customer to appoint another auditor or conduct the Customer Audit itself.
(e) Without limiting the foregoing, prior to conducting any Customer Audit, Customer shall undertake reasonable efforts to conduct any such Customer Audit through a review of the Security Documentation in accordance with the procedures described in Section 8.2.
8.4 Additional Reviews Under CCPA.
(a) Solely to the extent required under the CCPA and solely with respect to Singlewire’s Processing of Customer Personal Data subject to the CCPA (“CCPA Data“):
(1) Singlewire grants Customer the right, upon 14 days’ prior written notice, to: (1) take reasonable and appropriate steps to help ensure that Singlewire uses CCPA Data Singlewire receives from the Customer in a manner consistent with Customer’s obligations under the CCPA; and (2) take reasonable and appropriate steps to stop and remediate Singlewire’s unauthorized use of Customer Personal Data; and
(2) subject to Singlewire’s agreement, in Singlewire’s sole and absolute discretion, no more frequently than annually, Customer may monitor Singlewire’s compliance with this DPA with respect to Singlewire’s Processing of CCPA Data through additional measures that may include, without limitation, ongoing manual reviews, automated scans or other technical and operational testing.
(b) For clarity, except where prohibited under the CCPA:
(1) The rights set forth in Section 8.4(a) shall be subject to any applicable limitations or requirements set forth in the applicable Agreement(s) or this DPA, including, without limitation, all confidentiality obligations set forth in the applicable Agreement(s) and exceptions to Singlewire’s obligations to provide the Services in accordance with any service level agreement or other service level commitment; and
(2) under no circumstances shall Section 8.4(a)(2) prohibit or otherwise preclude Singlewire from: (1) declining to agree to permit Customer to perform any particular additional measures; or (2) conditioning Singlewire’s agreement to permit Customer to perform any particular additional measure on Customer’s agreement to comply with any restrictions or requirements specified by Singlewire.
8.5 Security Breach. In the event of a Security Breach, Singlewire will notify Customer promptly and without undue delay after Singlewire discovers such Security Breach. Such notification of a Security Breach will be delivered to the notice address for Customer provided in the applicable Agreement(s), or, at Singlewire’s discretion, by telephone or other direct communication. Singlewire will provide reasonable assistance to Customer to investigate, remediate, and mitigate the effects of a Security Breach and to comply with any requirements to notify affected Data Subjects, applicable Supervisory Authorities, or other third parties, all as and to the extent required under the Data Protection Laws.
9. RETENTION AND DESTRUCTION OF CUSTOMER PERSONAL DATA
9.1 Return and Destruction During DPA Term. Subject to the terms of the applicable Agreement(s) and this DPA, Singlewire will, at the choice of Customer, delete or return the applicable Customer Personal Data upon Singlewire’s receipt of an applicable Customer Instruction to do so. Without limiting the generality of the foregoing, in the event Customer uses functionalities available via the Services (if any) to delete any Customer Personal Data during the term of this DPA and such Customer Personal Data cannot be recovered by Customer, this will constitute a Customer Instruction to Singlewire to delete the relevant Customer Personal Data from the applicable Singlewire systems in accordance with applicable law, including, without limitation, the Data Protection Laws. Singlewire will comply with such Customer Instruction as soon as reasonably practicable and, in any event, unless applicable law requires Singlewire to retain such Customer Personal Data for a longer period, within ninety (90) days (or, if shorter, the maximum period permitted under the applicable Data Protection Laws); provided, however, Customer acknowledges and agrees that Singlewire will securely erase or destroy any Customer Personal Data stored on Singlewire’s backup or archive systems within six (6) months after Singlewire’s receipt of the applicable Customer Instruction.
9.2 Return and Deletion Upon Expiration or Termination of Agreement or Service(s). Subject to the terms of the applicable Agreement(s) and this DPA, following the expiration or earlier termination of an Agreement, Singlewire will, at the choice of Customer (as indicated through the Services or in a written notification to Singlewire), delete or return to Customer all applicable Customer Personal Data Processed solely on behalf of Customer in Singlewire’s possession or under its reasonable control as of the date of such expiration or earlier termination, and Singlewire will delete existing copies of such Customer Personal Data from the applicable Singlewire systems unless otherwise required under applicable laws, including, without limitation, applicable Data Protection Laws. Singlewire will comply with such Customer Instruction as soon as reasonably practicable and, in any event, unless applicable law requires Singlewire to retain such Customer Personal Data for a longer period, within ninety (90) days (or, if shorter, the maximum period permitted under the applicable Data Protection Laws) after the expiration or earlier termination of the applicable Agreement(s). For clarity, except as expressly required under applicable law or the applicable Agreement(s), in no event shall Singlewire be required or otherwise obligated to retain any applicable Customer Personal Data more than ninety (90) days after the expiration or termination of the applicable Agreement(s); provided, however, Customer acknowledges and agrees that Singlewire will securely erase or destroy any Customer Personal Data stored on Singlewire’s backup or archive systems within six (6) months after the expiration or earlier termination of the Applicable Agreement(s).
9.3 Retention of Customer Personal Data. Notwithstanding anything to the contrary in the applicable Agreement(s) or this DPA and without limiting any rights provided to Singlewire under the applicable Agreement(s), this DPA, or applicable Data Protection Laws, to the extent authorized or required by applicable law, Singlewire may retain one copy of Customer Personal Data solely for evidence purposes and/or for the establishment, exercise or defense of legal claims and/or for compliance with legal obligations.
10. ADDITIONAL TERMS
10.1 Liability and Indemnification. With respect to any claim, loss, or liability based upon, arising out of, resulting from, or in any way connected with a Party’s performance or breach of this DPA: (1) such Party shall only be obligated to indemnify, defend, and hold the other Party harmless to the extent such obligation exists pursuant to such Party’s indemnification, defense, and hold harmless obligations set forth in the applicable Agreement(s) (if any); and (ii) each Party’s total liability to the other Party is limited in accordance with the applicable limitations of liability set forth in the applicable Agreement(s).
10.2 Term. This DPA shall be effective as of the DPA Effective Date and continue in full force and effect until Singlewire ceases providing all Services to Customer under and in accordance with the applicable Agreement(s). The provisions of this DPA which by their nature are intended to survive the expiration or earlier termination of this DPA shall continue as valid and enforceable obligations of the Parties notwithstanding any such termination or expiration. Without limitation, the provisions regarding confidentiality, compliance with applicable laws, and restrictions on the processing of Customer Personal Data shall survive the expiration or earlier termination of this DPA.
10.3 Relationship to Agreement(s). This DPA shall be governed by and construed in accordance with the terms set forth in the applicable Agreement(s) as if fully set forth herein. Without limiting anything set forth herein, the Parties acknowledge and agree that they have taken all actions (if any) required under the applicable Agreement(s) to incorporate this DPA therein. Any dispute arising out of this DPA shall be resolved as set out in the applicable Agreement(s). The requirements set forth in this DPA are in addition to, and not in lieu of, any similar requirements set forth in the applicable Agreement(s). Notwithstanding anything to the contrary in the applicable Agreement(s), to the extent any conflict or inconsistency between the terms of this DPA and any Agreement, this DPA shall control. Except as set forth in this DPA, each and every Agreement remains in full force and effect, as amended, and are hereby ratified and confirmed in all respects.
10.4 Invalidity. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either: (1) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as completely as possible; or (2) if (1) is not possible, construed in a manner as if the invalid or unenforceable part had never been contained in this DPA.
10.5 Amendments. Singlewire may update or modify this DPA from time to time by, without limitation, posting a revised version of this DPA on Singlewire’s website and publishing a general notice of such changes via the Singlewire website or, as applicable and feasible, through the Services. Subject to compliance with applicable laws, Customer’s access to or use of the Services after receiving notice of changes to this DPA, whether by general notice or direct notice provided by Singlewire to Customer, shall constitute Customer’s acceptance of such updates or modifications.