CCPA Service Provider Clause

Data Protection: US State Privacy Laws

1. Definitions. “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its regulations. “Personal Information”, “Service Provider”, “Sell”, “Share”, “Business Purpose” and “Consumer” have the meanings given in the CCPA. “Client Personal Information” means Personal Information that Agency receives from or processes for Client under this Agreement. “US Privacy Laws” means the CCPA and any other US state consumer privacy law that applies to the processing.

2. Role and purpose. Agency acts as Client’s Service Provider (or processor, where another US Privacy Law uses that term). Agency processes Client Personal Information only for the Business Purposes of providing the services described in the Agreement, and only on Client’s documented instructions.

3. Restrictions. Agency will not:

• (a) Sell or Share Client Personal Information;
• (b) retain, use or disclose Client Personal Information for any purpose other than the Business Purposes in section 2, including any commercial purpose of its own;
• (c) retain, use or disclose Client Personal Information outside the direct business relationship between Agency and Client; or
• (d) combine Client Personal Information with Personal Information it receives from or on behalf of other persons or collects from its own interactions with Consumers, except as permitted by the CCPA.

4. Compliance. Agency will comply with its obligations under US Privacy Laws and provide the same level of privacy protection they require. Agency will notify Client within 5 business days if it determines it can no longer meet these obligations.

5. Client oversight. Client may take reasonable and appropriate steps to ensure Agency uses Client Personal Information consistently with Client’s obligations under US Privacy Laws, including by requesting written confirmation of Agency’s compliance or through other reasonable review on reasonable notice. On notice, Client may require Agency to stop and remediate any unauthorized use.

6. Subcontractors. Agency may engage subcontractors under written contracts that bind them to restrictions at least as protective as this section. Agency will inform Client before adding a new subcontractor that processes Client Personal Information.

7. Consumer requests. Agency will forward any Consumer request about Client Personal Information to Client within 3 business days, and will help Client respond within the period US Privacy Laws require, including by deleting or correcting the information.

8. Security. Agency will maintain reasonable security procedures and practices appropriate to the nature of Client Personal Information, as set out in Agency’s Information Security Policy.

9. Security incidents. Agency will notify Client without undue delay, and no later than 48 hours after becoming aware of a security incident affecting Client Personal Information, and will cooperate with Client’s investigation and any notifications Client must make.

10. Deletion. Within 30 days after this Agreement ends, Agency will delete all Client Personal Information, unless retention is required by law, and will confirm deletion in writing on request.

11. Certification. Agency certifies that it understands the restrictions in this section and will comply with them.