California Service Provider Addendum

This California Service Provider Addendum (this “Addendum”) forms part of and is incorporated into the Terms of Service between the Customer (“Business”) and MarketCheck (“Service Provider”). This Addendum is effective as of the date on which Business first accepts the Terms of Service (the “Effective Date”). Service Provider may update this Addendum from time to time. The current version will be posted at developers.marketcheck.com/ccpa-addendum.

RECITALS

WHEREAS, Business and Service Provider have entered into Terms of Service, (the “Agreement”), pursuant to which Service Provider processes Personal Information on behalf of Business;

WHEREAS, Business is subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA/CPRA”), codified at California Civil Code §§ 1798.100 et seq., and the regulations promulgated thereunder;

WHEREAS, Service Provider processes Personal Information of California residents on behalf of Business in connection with providing services under the Agreement (the “Services”); and

WHEREAS, the parties desire to ensure compliance with the CCPA/CPRA and to establish the statutory rights, duties, and obligations of the parties with respect to such Personal Information.

NOW, THEREFORE, in consideration of the mutual covenants contained herein and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

ARTICLE 1 — DEFINITIONS AND INTERPRETATION

1.1    Definitions. For purposes of this Addendum, terms such as “Business,” “Consumer,” “Personal Information,” “Process/Processed/Processing,” “Sale/Sell,” “Sensitive Personal Information,” “Service Provider”, and “Share/Shared/Sharing” shall have the meanings set forth in the CCPA/CPRA.

1.2    Business Purpose. “Business Purpose” has the meaning set forth in the CCPA/CPRA and includes solely the specific operational and business purposes for which Service Provider may Process Personal Information on behalf of Business under the Agreement, including:

• performing services on behalf of Business;
• processing Personal Information necessary for Service Provider to provide developer platform access;
• authenticating API requests;
• monitoring account quotas and security, and manage billing for the API services under the Terms of Service;
• maintaining or servicing accounts;
• providing customer service; and
• processing or fulfilling orders and transactions.

1.3    Interpretation. In the event of any conflict or inconsistency between the terms of this Addendum and the underlying Agreement with respect to the Processing of Personal Information, the terms of this Addendum shall control. This Addendum supplements, and does not replace, the Agreement. Except as modified herein, all terms and conditions of the Agreement remain in full force and effect. The obligations under this Addendum survive termination or expiration of the Agreement with regards to the Personal Information Processed during the term. Upon termination or expiration of the Agreement, Service Provider shall, at Business’s election and subject to the Agreement, promptly return or securely delete Personal Information in its possession or control and certify such return or deletion in writing within sixty (60) days, except that Service Provider may retain Personal Information to the extent required by applicable law or maintained in archived backup or disaster-recovery systems in accordance with Service Provider’s ordinary-course retention practices, provided that any retained Personal Information remains subject to this Addendum until deleted.

ARTICLE 2 — SERVICE PROVIDER STATUS & SCOPE

2.1    Status of the Parties.

(a)  Service Provider acknowledges and agrees that with respect to all Personal Information Processed under the Agreement and this Addendum, Service Provider is a “Service Provider” as defined under the CCPA/CPRA.

(b)  Business is a “Business” as defined under the CCPA/CPRA.

2.2    Scope of Processing. Service Provider shall Process Personal Information solely for the limited and specified Business Purposes set forth in Article 1 and as necessary to perform the Services under the Agreement. Service Provider shall not Process Personal Information for any purpose other than the Business Purposes or as otherwise expressly permitted by the CCPA/CPRA.

ARTICLE 3 — MANDATORY STATUTORY PROHIBITIONS & RESTRICTIONS

3.1    Prohibition on Selling. Service Provider shall not Sell Personal Information and shall not receive valuable consideration in exchange for Personal Information.

3.2    Prohibition on Sharing. Service Provider shall not Share Personal Information, including for cross-context behavioral advertising purposes.

3.3    Prohibition on Retention, Use, or Disclosure. Service Provider shall not retain, use, or disclose Personal Information:

• For any purpose other than the specific Business Purposes set forth in this Addendum and the performance of the Services under the Agreement;
• Outside of the direct business relationship between Service Provider and Business; or
• For any commercial purpose other than providing the Services specified in the Agreement.

3.4    Prohibition on Combining Personal Information.

(a)  General Restriction. Service Provider shall not combine Personal Information received from, or on behalf of, Business with Personal Information received from, or on behalf of, another person or entity or collected from its own interaction with the Consumer, except as permitted by CCPA/CPRA (e.g., for detecting security incidents or protecting against fraudulent or illegal activity).

(b)  Deidentified and Aggregated Data. Service Provider shall not use Business Personal Information, or data derived therefrom, to train, tune, or improve any public, third-party, or internal artificial intelligence or machine learning models without Business’s prior express written permission. Service Provider may create deidentified or aggregated data solely for internal operational improvements, provided that Service Provider complies with all statutory requirements under the CCPA/CPRA and does not attempt to reidentify such data.

3.5    Minors’ Data. Service Provider certifies that it has no actual knowledge that it Sells or Shares the Personal Information of Consumers under sixteen (16) years of age.

3.6    Sub-processor Requirements.

(a)  Flow-Down Obligations. Service Provider shall ensure that any sub-processor, subcontractor, or agent engaged to Process Personal Information is bound by a written agreement imposing data protection obligations no less restrictive than those in this Addendum, including all prohibitions in Sections 3.1 through 3.5.

(b)  Liability. Subject to Article 7 and the limitations and exclusions of liability in the Agreement, Service Provider remains responsible for acts or omissions of its sub-processors to the extent Service Provider would be responsible if performing the applicable Processing directly.

(c)  Notification of Non-Compliance. Service Provider shall require each sub-processor to notify Service Provider without undue delay if the sub-processor determines it can no longer meet its CCPA/CPRA obligations. Service Provider shall notify Business of any such sub-processor notification without undue delay following Service Provider’s actual receipt and verification of such notice.

3.7    Certification of Understanding. Service Provider certifies that it understands the restrictions in this Article 3 and will comply with them.

ARTICLE 4 — SENSITIVE PERSONAL INFORMATION

4.1    Restrictions on Use and Disclosure. To the extent Business submits Sensitive Personal Information to the Services, Service Provider shall not use or disclose such Sensitive Personal Information except as necessary to provide the Services, comply with the Agreement, protect the Services, or as otherwise permitted for Service Providers under the CCPA/CPRA regulations.

4.2    No Inference. Service Provider shall not use Sensitive Personal Information to infer characteristics about a Consumer.

ARTICLE 5 — COMPLIANCE MONITORING AND AUDIT RIGHTS

5.1    Right to Audit. Business shall have the right to take reasonable and appropriate steps to verify that Service Provider uses Personal Information in a manner consistent with Business’s obligations under the CCPA/CPRA.

5.2    Audit Methods. Business may verify Service Provider’s compliance with this Addendum through the following methods:

(a)  Compliance Assessments. Business may submit reasonable compliance questionnaires or requests for documentation regarding Service Provider’s data privacy and security program no more than once per calendar year.

(b)  Direct Audits. Direct manual or system audits shall only be permitted if (i) the documentation provided under this Section 5.2(A) is demonstrably insufficient to verify compliance; or (ii) required by a competent data protection authority or following a verified security incident involving Business’s Personal Information.

5.3    Audit Procedures.

(a)  Notice and Timing. Any routine direct audit permitted under Section 5.2 shall occur no more than once per calendar year upon at least thirty (30) days’ prior written notice. Audits shall take place during Service Provider’s normal business hours and shall be conducted in a manner that does not disrupt Service Provider’s operational activities.

(b)  Conditions. Service Provider may require Business (and any third-party auditor) to agree to reasonable written confidentiality obligations prior to granting access. Business shall not be permitted access to Service Provider’s proprietary systems, trade secrets, or data belonging to other clients.

(c)  Costs. Business shall bear all costs associated with any audit, including Service Provider’s reasonable costs incurred in preparing for and assisting with such audit, unless the audit reveals material non-compliance with this Addendum by Service Provider, in which case Service Provider shall bear its own reasonable costs of the audit.

5.4    Remediation Plan. If an audit reveals non-compliance with this Addendum, the parties shall address remediation as follows:

(a)  Severity-Based Timelines. Within fifteen (15) business days of receiving notice of a material non-compliance finding, Service Provider shall submit a commercially reasonable remediation plan.

(b)  Mutual Agreement. Service Provider shall use commercially reasonable efforts to complete corrective actions within the mutually agreed timeline set forth in the remediation plan, taking into account the severity and technical complexity of the finding.

(c)  Minor Findings. Non-material or administrative findings shall be addressed in the ordinary course of business during standard operational review cycles.

5.5    Material Non-Compliance. If Service Provider fails to remediate a material finding of non-compliance in accordance with the mutually agreed remediation plan under Section 5.4, Business shall provide written notice specifying the failure. Service Provider shall have thirty (30) days from receipt of such notice to cure the failure. If Service Provider fails to cure within this 30-day period, Business may, as its sole and exclusive remedy, suspend the specific non-compliant processing activities or terminate the affected Services to the extent permitted under the Agreement. Termination of the Agreement shall be governed strictly by the default and termination provisions set forth in the Agreement.

ARTICLE 6 — NOTIFICATION, REMEDIATION, AND CONSUMER RIGHTS

6.1    Inability to Comply and Breach Notification. Service Provider shall notify Business immediately (and in any event within five (5) business days) if it determines that it can no longer meet its statutory obligations under the CCPA/CPRA or this Addendum. Upon receiving such notice, Business shall have the right to terminate the processing or take other reasonable steps to remediate any unauthorized processing. Service Provider shall also notify Business without unreasonable delay, and where feasible, within seventy-two (72) hours upon discovering any actual or reasonably suspected security breach or unauthorized access, acquisition, use, or disclosure of Personal Information, and shall cooperate with Business in investigating and remediating such breach.

6.2    Business Right to Stop Unauthorized Use. Upon receiving notice or otherwise determining that Service Provider is using Personal Information in an unauthorized manner, Business reserves the right to:

• Direct Service Provider to immediately cease the unauthorized processing;
• Require deletion or return of specified Personal Information; and
• Suspend access to data until remediation is verified.

6.3    Assistance with Consumer Rights Requests.

(a)  Scope of Assistance. Upon Business’s written request, and to the extent the requested Personal Information is within Service Provider’s possession or control and reasonably accessible through the Services, Service Provider shall use commercially reasonable efforts to assist Business within ten (10) calendar days of receipt of such instruction, to ensure Business can meet its statutory 45-day response requirement.

(b)  Direct Consumer Requests. If Service Provider receives a Consumer request directly, Service Provider shall not respond to the Consumer except to direct them to submit the request to Business. Service Provider shall notify Business of any such request within three (3) business days and provide a copy of the request.

ARTICLE 7 — LIMITATION OF LIABILITY

7.1    Limitation of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, SERVICE PROVIDER’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS ADDENDUM, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), BREACH OF STATUTORY DUTY, OR OTHERWISE, SHALL BE SUBJECT TO THE LIMITATIONS AND EXCLUSIONS OF LIABILITY SET FORTH IN THE AGREEMENT.

7.2    Indirect Damages. IN NO EVENT SHALL SERVICE PROVIDER BE LIABLE TO BUSINESS FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OR FOR LOSS OF PROFITS, DATA, OR GOODWILL, ARISING OUT OF OR IN CONNECTION WITH THIS ADDENDUM OR THE PROCESSING OF PERSONAL INFORMATION HEREUNDER.

Market Check Cars, Inc. · 169 Madison Ave STE 57434, New York, NY 10016 · Terms of Service · Privacy Policy · Data Processing Agreement