This Data Processing Addendum (“DPA”) forms part of and is incorporated into the Agreement between Level Access Inc. (“Vendor”) and ___________ (“Customer”) (together, the “Parties”). This DPA sets forth Customer’s instructions for the processing of Personal Data in connection with the services provided under the Agreement (the “Services”) and the rights and obligations of both Parties. Except as expressly set forth in this DPA, the Agreement shall remain unmodified and in full force and effect. In the event of any conflicts between this DPA and the Agreement, this DPA will govern to the extent of the conflict.

1. Definitions.
   For the purposes of this DPA, the following terms shall have the meanings set out below. Capitalized terms used but not defined in this DPA shall have the meanings given in the Agreement. All other terms in this DPA not otherwise defined in the Agreement shall have the corresponding meanings given to them in Privacy Laws.
   1. “Controller to Processor Clauses” means (i) in respect of transfers of Personal Data subject to the GDPR, the standard contractual clauses for the transfer of Personal Data to third countries set out in Commission Decision 2021/914 of 4 June 2021, specifically including Module 2 (Controller to Processor) (“EU SCCs”); and (ii) in respect of transfers of Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B.1.0) issued by the UK Information Commissioner (“UK Addendum”), in each case as amended, updated or replaced from time to time.
   2. “EU/UK Privacy Laws” means, as applicable: (a) the General Data Protection Regulation 2016/679 (the “GDPR”); (b) the Privacy and Electronic Communications Directive 2002/58/EC; (c) the UK Data Protection Act 2018, the UK General Data Protection Regulation as defined by the UK Data Protection Act 2018 as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (together with the UK Data Protection Act 2018, the “UK GDPR”), and the Privacy and Electronic Communications Regulations 2003; and (d) any relevant law, directive, order, rule, regulation or other binding instrument which implements any of the above, in each case, as applicable and in force from time to time, and as amended, consolidated, re-enacted or replaced from time to time.
   3. “Personal Data” means any information Vendor processes on behalf of Customer to provide the Services that is defined as “personal data” or “personal information” under any Privacy Law.
   4. “Privacy Laws” means, as applicable, EU/UK Privacy Laws, US Privacy Laws and any similar law of any other jurisdiction which relates to data protection, privacy or the use of Personal Data, in each case, as applicable and in force from time to time, and as amended, consolidated, re-enacted or replaced from time to time.
   5. “Processor to Processor Clauses” means (i) in respect of transfers of Personal Data subject to the GDPR, the standard contractual clauses for the transfer of personal data to third countries set out in Commission Decision 2021/914 of 4 June 2021, specifically including Module 3 (Processor to Processor); and (ii) in respect of transfers of Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B.1.0) issued by the UK Information Commissioner, in each case as amended, updated or replaced from time to time.
   6. “Third Country” means any country or territory outside of the scope of the data protection laws of the European Economic Area or the UK, as relevant, excluding countries or territories approved as providing adequate protection for Personal Data by the relevant competent authority from time to time.
   7. “US Privacy Laws” means, as applicable, the California Consumer Privacy Act, Colorado Privacy Act, Connecticut Data Privacy Act, Delaware Personal Data Privacy Act, Florida Digital Bill of Rights, Indiana Consumer Data Protection Act, Iowa Consumer Data Protection Act, Montana Consumer Data Privacy Act, Oregon Consumer Privacy Act, Tennessee Information Protection Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act, and Virginia Consumer Data Protection Act, and any similar law of any other state related to the processing of Personal Data.
2. Amendments. The Parties agree to negotiate in good faith modifications to this DPA if changes are required for Vendor to continue to process the Personal Data as contemplated by the Agreement or this DPA in compliance with Privacy Laws, or to address the legal interpretation of the Privacy Laws.
3. Roles of the Parties. The Parties acknowledge that for purposes of Privacy Laws, Customer is the “controller,” “business,” or any similar term provided under Privacy Laws, and Vendor is the “service provider,” “processor,” “contractor,” or any similar term provided under Privacy Laws.
4. Details of Processing. The Parties agree that the details of processing are as described in Annex 1.
5. Customer Obligations. Customer shall comply with all Privacy Laws in providing Personal Data to Vendor in connection with the Services. Customer represents and warrants that: (a) the Privacy Laws applicable to Customer do not prevent Vendor from fulfilling the instructions received from Customer and performing Vendor’s obligations under this DPA; (b) all Personal Data was collected and at all times processed and maintained by or on behalf of Customer in compliance with all Privacy Laws, including with respect to any obligations to provide notice to and/or obtain consent from individuals; and (c) Customer has a lawful basis for disclosing the Personal Data to Vendor and enabling Vendor to process the Personal Data as set out in this DPA. Customer shall notify Vendor without undue delay if Customer makes a determination that the processing of Personal Data under the Agreement does not or will not comply with Privacy Laws, in which case, Vendor shall not be required to continue processing such Personal Data.
6. Processing of Personal Data. In processing Personal Data under the Agreement, Vendor shall:
   1. only process Personal Data on documented instructions from Customer, for the limited and specific purpose described in Annex 1, and at all times in compliance with Privacy Laws, unless required to process such Personal Data by applicable law to which Vendor is subject; in such a case, Vendor shall inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
   2. notify Customer (i) without undue delay if it makes a determination that it can no longer meet its obligations under applicable US Privacy Laws, and (ii) immediately if Vendor, in its opinion, on the instruction of Customer, infringes applicable EU/UK Privacy Laws;
   3. to the extent required by US Privacy Laws, and upon reasonable written notice that Customer reasonably believes Vendor is using Personal Data in violation of Privacy Laws or this DPA, grant Customer the right to take reasonable and appropriate steps to help ensure that Vendor uses the Personal Data in a manner consistent with Customer’s obligations under Privacy Laws, and stop and remediate any unauthorized use of the Personal Data; and
   4. require that each employee or other person processing Personal Data is subject to an appropriate duty of confidentiality with respect to such Personal Data.
7. Anonymized Data. Vendor may aggregate and/or anonymize Personal Data such that it no longer constitutes Personal Data under Privacy Laws and process such data for its own purposes.
8. Prohibitions. To the extent required by applicable US Privacy Laws, and except to the extent permitted by such US Privacy Laws, Vendor is prohibited from:
   1. selling the Personal Data or sharing the Personal Data for cross-context behavioral advertising purposes;
   2. retaining, using, or disclosing the Personal Data outside of the direct business relationship between Vendor and Customer and for any purpose other than for the specific purpose of performing the Services; and
   3. combining the Personal Data received from, or on behalf of, Customer with any Personal Data that may be collected from Vendor’s separate interactions with the individual(s) to whom the Personal Data relates or from any other sources, except to perform a business purpose or as otherwise permitted by Privacy Laws.

   Vendor certifies that Vendor understands and will comply with each of the foregoing restrictions.

9. Use of Sub-processors. To the extent Vendor engages any subcontractors to process Personal Data (sub-processors) on its behalf:
   1. Customer hereby grants Vendor general written authorization to engage the sub-processor set out on the Vendor’s website, currently at: https://trust.levelaccess.com (as such website address may be amended or replaced from time to time, subject to the requirements of this Section [9].
   2. If Vendor appoints a new sub-processor or intends to make any changes concerning the addition or replacement of any sub-processor, it shall provide Customer with 20 business days’ prior written notice, during which Customer can object to the appointment or replacement on reasonable and documented grounds related to the confidentiality or security of Personal Data or the subcontractor’s compliance with Privacy Laws (and if Customer does not so object, Vendor may proceed with the appointment or replacement). In case Customer does object, Vendor shall soley have the right to cure the objection through one of the following options: (i) Vendor will cancel its plans to use the Sub-processor with regards to processing Personal Data or will offer an alternative to provide the Services without such Sub-processor; or (ii) Vendor will take the corrective steps requested by Customer in its objection notice and proceed to use the Sub-processor. If either of the above options are not commercially feasible, in either of the parties’ reasonable judgment, and the objection(s) have not been resolved to the satisfaction of the parties within thirty (30) days after Vendor’s receipt of Customer’s objection notice, then either party may terminate the Agreement, this DPA, and applicable order for cause and in such case, Customer will be refunded any pre-paid amounts for unused Services for the then applicable service order pro-rated per term.
   3. Vendor shall engage sub-processors only pursuant to a written agreement that contains obligations on the sub-processor which are no less onerous on the relevant sub-processor than the obligations on Vendor under this DPA.
   4. In the event Vendor engages a sub-processor to carry out specific processing activities on behalf of Customer pursuant to EU/UK Privacy Laws, where that sub-processor fails to fulfil its obligations, Vendor shall remain fully liable under applicable EU/UK Privacy Laws to Customer for the performance of that sub-processor’s obligations.
10. Assistance. To the extent required by Privacy Laws, and taking into account the nature of the processing, Vendor shall, in relation to the processing of Personal Data and to enable Customer to comply with its obligations which arise as a result thereof, provide reasonable assistance to Customer, through appropriate technical and organizational measures, in:
    1. responding to requests from individuals pursuant to their rights under Privacy Laws, including by providing, deleting or correcting the relevant Personal Data, or by enabling Customer to do the same, insofar as this is possible;
    2. implementing reasonable security procedures and practices appropriate to the nature of the Personal Data to protect the Personal Data from unauthorized or illegal access, destruction, use, modification, or disclosure;
    3. notifying relevant competent authorities and/or affected individuals of Personal Data breaches;
    4. conducting data protection impact assessments and, if required, prior consultation with relevant competent authorities; and
    5. entering into this DPA.
11. Security Measures. Vendor shall, taking into account the state-of-the-art, the costs of implementation and the nature, scope, context and purpose of the processing, implement appropriate technical and organizational measures designed to provide a level of security appropriate to the risk, as set out in Annex 2, or otherwise agreed and documented between Customer and Vendor from time to time. To the extent required by Privacy Laws, Vendor shall without undue delay notify Customer in writing of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, with further information about the breach provided in phases as more details become available.
12. Access and Audits. Upon reasonable request of Customer, Vendor shall make available to Customer such information in its possession as is reasonably necessary to demonstrate Vendor’s compliance with its obligations under this DPA, and allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer and reasonably accepted by Vendor. Customer shall be permitted to conduct such an assessment no more than once every 12 months, upon 30 days’ advance written notice to Vendor, and only after the Parties come to agreement on the scope of the audit and the auditor is bound by a duty of confidentiality. As an alternative to an audit performed by or at the direction of Customer, to the extent permitted by Privacy Laws, Vendor may arrange for a qualified and independent auditor to conduct, at Vendor’s expense, an assessment of Vendor’s policies and technical and organizational measures in support of its obligations under Privacy Laws using an appropriate and accepted control standard or framework and assessment procedure for such assessment, and will provide a report of such assessment to Customer upon reasonable request. Notwithstanding the foregoing, in no event shall Vendor be required to give Customer access to information, facilities or systems to the extent doing so would cause Vendor to be in violation of confidentiality obligations owed to other customers or its legal obligations.
13. Deletion of Personal Data. At Customer’s written direction, Vendor shall delete or return all Personal Data to Customer as requested at the end of the provision of the Services, unless retention of the Personal Data is required by law.
14. Data Transfers. To the extent Vendor processes Personal Data subject to EU/UK Privacy Laws in a Third Country not covered by an existing adequacy decision and it is acting as data importer, Vendor shall comply with the data importer’s obligations and Customer shall comply with the data exporter’s obligations set out in the EU SCC Controller to Processor Clauses, which are hereby incorporated into and form part of this DPA, and:
    1. for the purposes of Annex I or Part 1 (as relevant), Customer is a controller and Vendor is a processor, and the parties, contact person’s details and processing details set out in the Agreement, this DPA and Annex 1 shall apply and the Start Date is the effective date of the Agreement;
    2. if applicable, for the purposes of Part 1 of the UK Addendum, the relevant Addendum EU SCCs (as such term is defined in the UK Addendum) are the EU SCCs as incorporated into this DPA by virtue of this Section 14;
    3. for the purposes of Annex II or Part 1 (as relevant), the technical and organizational security measures, and the technical and organizational measures taken by Vendor to assist Customer, as each are set out in Annex 2, shall apply; and
    4. if applicable, for the purposes of:
       (i) Clause 9, Option 2 (“General written authorization”) is deemed to be selected and the notice period specified in Section [9] shall apply; (ii) Clause 11(a), the optional wording in relation to independent dispute resolution is deemed to be omitted; (iii) Clause 13 and Annex I.C, the competent supervisory authority shall be: for the EU Standard Contractual Clauses, the supervisory authority of the EU Member State in which the data exporter is established;for the UK Addendum, the Information Commissioner’s Office (ICO);
       (iv) Clauses 17 and 18, Option 1 is deemed to be selected and: for the EU Standard Contractual Clauses, the governing law and competent courts shall be those of the EU Member State in which the data exporter is established; for the UK Addendum, the governing law shall be the laws of England and Wales, and the courts of England and Wales shall have exclusive jurisdiction; (vi) Part 1, Vendor as importer may terminate the UK Addendum pursuant to Section 19 of such UK Addendum.

    Customer acknowledges and agrees that Vendor may appoint an affiliate or third-party subcontractor to process the Personal Data in a Third Country, in which case, Vendor shall execute the Processor to Processor Clauses with any relevant subcontractor (including affiliates) it appoints on behalf of Customer.

15. Severability. If any provision in this DPA is deemed by a court of competent jurisdiction or regulatory authority to be invalid, prohibited or unenforceable, such provision shall, as to the relevant jurisdiction, be ineffective to the extent of such prohibition or unenforceability but shall be valid and enforceable to the fullest extent permitted by law. The remainder of this DPA will remain in full force and effect, and will be modified to any extent necessary to give such force and effect to the remaining provisions, but only to such extent.
16. Execution and Counterparts. This DPA may be executed in one or more counterparts, each of which shall be deemed an original but all of which taken together shall constitute one and the same instrument. The Parties agree that this DPA shall be legally binding upon the electronic transmission, including by electronic facsimile or email, by each Party of a signed signature page hereof to the other Party.

IN WITNESS WHEREOF, the Parties have executed this DPA as of the dates listed below.

Signature block for Vendor and Customer

Vendor	Customer
By:	By:
Name:	Name:
Title:	Title:
Date:	Date:

 

Annex 1

Details of Processing

Nature of the processing

As needed for providing the services as outlined in the agreement.

Purpose(s) of the processing

Employee name, business email and technical identifiers (IP address and user agent) to enable access to Supplier’s SaaS platform. If Widget Services are deployed, technical identifiers in the delivery of the accessibility libraries to visitors of Customer’s public websites.

Categories of individuals whose Personal Data is processed

Employees, contractors or other personnel of customer whom they wish to have access to the SaaS platform. If Widget Services are deployed, also visitors of Customer’s public websites.

Categories of Personal Data processed

Employee name, business email and technical identifiers (IP address and user agent) to enable access to Supplier’s SaaS platform. If Widget Services are deployed, technical identifiers in the delivery of the accessibility libraries to visitors of Customer’s public websites.

Types of Personal Data subject to the processing that are considered “sensitive” or “special category” under Privacy Laws

Not applicable.

Frequency (e.g. one-off or continuous) and duration of the processing

Continuous. For the duration of the term of the agreement and any post-termination retention period as set out in the agreement.

The subject matter, nature and duration of processing carried out by any sub-processors authorized pursuant to Section 9 is as set out on https://trust.levelaccess.com.

 

Annex 2

Security Measures

The technical and organizational measures implemented by Vendor (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons are as defined in the current SOC 2 Type 2 report.

For transfers to (sub-) processors, the specific technical and organizational measures to be taken by the (sub-) processor to be able to provide assistance to the Vendor are such applicable controls as defined by the agreement with that (sub-) processor, good industry practice as commensurate to the risks posed by such (sub-) processor’s processing, and any applicable regulations, legislation or other requirements on the data processed by such (sub-) processors.