Data Processing Agreement

Date Effective: Sep 1, 2023 (view archived version)

This Data Processing Agreement (“Agreement”) forms part of the agreement between Customer and BizMerlinHR Inc. (“ClayHR”) covering Customer’s use of the Services (as defined below) (“Agreement”).

I. Introduction

1. Definitions

• “Applicable Data Protection Law” means all laws and regulations applicable to ClayHR’s processing of personal data under the Agreement.
• “controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• “Customer Account Data” means personal data that relates to Customer’s relationship with ClayHR, including the names or contact information of individuals authorized by Customer to access Customer’s account, and billing information of individuals that Customer has associated with its account. Customer Account Data also includes any personal data ClayHR may need to collect for the purpose of identity verification (including providing the Multi-Factor Authentication Services, as defined below), or as part of its legal obligation to retain Subscriber Records (as defined below).
• “Customer Content” means (a) personal data exchanged as a result of using the Services (as defined below), such as text message bodies, voice and video media, images, email bodies, email recipients, sound, and, where applicable, details Customer submits to the Services from its designated software applications and services and (b) data stored on Customer’s behalf such as communication logs within the Services or marketing campaign data that Customer has uploaded to the Services (as defined below).
• “Customer Data” has the meaning given in the Agreement. Customer Data includes Customer Account Data, Customer Usage Data, Customer Content, and Sensitive Data, each as defined in this Agreement.
• “Customer Usage Data” means data processed by ClayHR for the purposes of transmitting or exchanging Customer Content utilizing phone numbers either through the public switched telephone network or by way of other communication networks. Customer Usage Data includes data used to identify the source and destination of a communication, such as (a) individual data subjects’ telephone numbers, data on the location of the device generated in the context of providing the Services, and the date, time, duration and the type of communication and (b) activity logs used to identify the source of Service requests, optimize and maintain performance of the Services, and investigate and prevent system abuse.
• “Multi-Factor Authentication Services” means the provision of a portion of the Services under which Customer adds an additional factor for verification of Customer’s end users’ identity in connection with such end users’ use of Customer’s software applications or services.
• “personal data” means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• “processor” means the entity which processes personal data on behalf of the controller.
• “processing” (and “process”) means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• “Security Incident” means a confirmed or reasonably suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data.
• “Sensitive Data” means (a) social security number, passport number, driver’s license number, or similar identifier (or any portion thereof); (b) credit or debit card number (other than the truncated (last four digits) of a credit or debit card), financial information, banking account numbers or passwords; (c) employment, financial, genetic, biometric or health information; (d) racial, ethnic, political or religious affiliation, trade union membership, or information about sexual life or sexual orientation; (e) account passwords, mother’s maiden name, or date of birth; (f) criminal history; or (g) any other information or combinations of information that falls within the definition of “special categories of data” under GDPR (as defined below) or any other applicable law or regulation relating to privacy and data protection.
• “Services” means the products and services provided by ClayHR or its Affiliates, as applicable, that are (a) used by Customer, including, without limitation, products and services that are on a trial basis or otherwise free of charge or (b) ordered by Customer under an order form.
• “sub-processor” means (a) ClayHR, when ClayHR is processing Customer Content and where Customer is a processor of such Customer Content or (b) any third-party processor engaged by ClayHR to process Customer Content in order to provide the Services to Customer. For the avoidance of doubt, telecommunication providers are not sub-processors.
• “Third Party Request” means any request, correspondence, inquiry, or complaint from a data subject, regulatory authority, or third party.
• “ClayHR Privacy Notice” means the privacy notice for the Services, the current version of which is available at https://www.clayhr.com/policies/privacy-policy.

Any capitalized term not defined in this Section 1 will have the meaning provided in this Agreement or the Agreement.

II. Controller and Processor

2. Relationship

2.1 ClayHR as a Processor. Customer and ClayHR agree that with regard to the processing of Customer Content, Customer may act either as a controller or processor and ClayHR is a processor. ClayHR will process Customer Content in accordance with Customer’s instructions as set forth in Section 5 (Customer Instructions).

2.2 ClayHR as a Controller of Customer Account Data. Customer and ClayHR acknowledge that, with regard to the processing of Customer Account Data, Customer is a controller and ClayHR is an independent controller, not a joint controller with Customer. ClayHR will process Customer Account Data as a controller in order to (a) manage the relationship with Customer; (b) carry out ClayHR’s core business operations, such as accounting and filing taxes; (c) detect, prevent, or investigate security incidents, fraud, and other abuse or misuse of the Services; (d) perform identity verification; (e) comply with ClayHR’s legal or regulatory obligation to retain Subscriber Records; and (f) as otherwise permitted under Applicable Data Protection Law and in accordance with this Agreement, the Agreement, and the ClayHR Privacy Notice.

2.3 ClayHR as a Controller of Customer Usage Data. The parties acknowledge that, with regard to the processing of Customer Usage Data, Customer may act either as a controller or processor and ClayHR is an independent controller, not a joint controller with Customer. ClayHR will process Customer Usage Data as a controller in order to carry out the necessary functions as a communications service provider, such as: (a) ClayHR’s accounting, tax, billing, audit, and compliance purposes; (b) to provide, optimize, and maintain the Services, platform and security; (c) to investigate fraud, spam, wrongful or unlawful use of the Services; (d) as required by applicable law or regulation; or (e) as otherwise permitted under Applicable Data Protection Law and in accordance with this Agreement, the Agreement, and the ClayHR Privacy Notice.

3. Purpose Limitation

ClayHR will process personal data in order to provide the Services in accordance with the Agreement. Schedule 1 (Details of Processing) of this Agreement further specifies the nature and purpose of the processing, the processing activities, the duration of the processing, the types of personal data and categories of data subjects.

4. Compliance

Customer is responsible for ensuring that (a) it has complied, and will continue to comply, with Applicable Data Protection Law in its use of the Services and its own processing of personal data and (b) it has, and will continue to have, the right to transfer, or provide access to, personal data to ClayHR for processing in accordance with the terms of the Agreement and this Agreement.

III. ClayHR as a Processor – Processing Customer Content

5. Customer Instructions

Customer appoints ClayHR as a processor to process Customer Content on behalf of, and in accordance with, Customer’s instructions (a) as set forth in the Agreement, this Agreement, and as otherwise necessary to provide the Services to Customer, and which includes investigating security incidents and preventing spam, fraudulent activity, and violations of the ClayHR Terms of Service, the current version of which is available at https://www.clayhr.com/policies/terms-of-service, and detecting and preventing network exploits or abuse; (b) as necessary to comply with applicable law or regulation, including Applicable Data Protection Law; and (c) as otherwise agreed in writing between Customer and ClayHR (“Permitted Purposes”).

5.1 Lawfulness of Instructions. Customer will ensure that its instructions comply with Applicable Data Protection Law. Customer acknowledges that ClayHR is neither responsible for determining which laws or regulations are applicable to Customer’s business nor whether ClayHR’s provision of the Services meets or will meet the requirements of such laws or regulations. Customer will ensure that ClayHR’s processing of Customer Content, when done in accordance with Customer’s instructions, will not cause ClayHR to violate any applicable law or regulation, including Applicable Data Protection Law. ClayHR will inform Customer if it becomes aware, or reasonably believes, that Customer’s instructions violate any applicable law or regulation, including Applicable Data Protection Law.

5.2 Additional Instructions. Additional instructions outside the scope of the Agreement or this Agreement will be agreed to in writing between Customer and ClayHR, including any additional fees that may be payable by Customer to ClayHR for carrying out such additional instructions.

6. Confidentiality

6.1 Responding to Third Party Requests. In the event any Third Party Request is made directly to ClayHR in connection with ClayHR’s processing of Customer Content, ClayHR will promptly inform Customer and provide details of the same, to the extent legally permitted. ClayHR will not respond to any Third Party Request without Customer’s prior consent, except as legally required to do so or to confirm that such Third Party Request relates to Customer.

6.2 Confidentiality Obligations of ClayHR Personnel. ClayHR will ensure that any person it authorizes to process Customer Content has agreed to protect personal data in accordance with ClayHR's confidentiality obligations in the Agreement.

7. Sub-processors

7.1 Authorization for Onward Sub-processing. Customer provides a general authorization for ClayHR to engage onward sub-processors that is conditioned on the following requirements:

(a) ClayHR will restrict the onward sub-processor’s access to Customer Content only to what is strictly necessary to provide the Services, and ClayHR will prohibit the sub-processor from processing the personal data for any other purpose;

(b) ClayHR agrees to impose contractual data protection obligations, including appropriate technical and organizational measures to protect personal data, on any sub-processor it appoints that require such sub-processor to protect Customer Content to the standard required by Applicable Data Protection Law, including the requirements set forth in Schedule 4 (Jurisdiction Specific Terms) of this Agreement.

7.2 Current Sub-processors and Notification of Sub-processor Changes. Customer consents to ClayHR engaging third party sub-processors to process Customer Content within the Services for the Permitted Purposes provided that ClayHR maintains an up-to-date list of its sub-processors at https://www.clayhr.com/policies/sub-processors, which contains a mechanism for Customer to subscribe to notifications of new sub-processors. If Customer subscribes to such notifications, ClayHR will provide details of any change in sub-processors as soon as reasonably practicable. With respect to changes in infrastructure providers, ClayHR will endeavor to give written notice sixty (60) days prior to any change, but in any event will give written notice no less than thirty (30) days prior to any such change. With respect to ClayHR’s other sub-processors, ClayHR will endeavor to give written notice thirty (30) days prior to any change, but will give written notice no less than ten (10) days prior to any such change.

7.3 Objection Right for new Sub-processors. Customer may object to ClayHR's appointment or replacement of a sub-processor prior to its appointment or replacement, provided such objection is in writing and based on reasonable grounds relating to data protection. In such an event, Customer and ClayHR agree to discuss commercially reasonable alternative solutions in good faith. If Customer and ClayHR cannot reach a resolution within ninety (90) days from the date of ClayHR’s receipt of Customer’s written objection, Customer may discontinue the use of the affected Services by providing written notice to ClayHR. Such discontinuation will be without prejudice to any fees incurred by Customer prior to the discontinuation of the affected Services. If no objection has been raised prior to ClayHR replacing or appointing a new sub-processor, ClayHR will deem Customer to have authorized the new sub-processor.

8. Data Subject Rights

ClayHR provides Customer with a number of self-service features via the Services, including the ability to delete, obtain a copy of, or restrict use of Customer Content. Customer may use such self-service features to assist in complying with its obligations under Applicable Data Protection Law with respect to responding to Third Party Requests from data subjects via the Services at no additional cost. Upon Customer’s request, ClayHR will provide reasonable additional and timely assistance to Customer in complying with Customer's data protection obligations with respect to data subject rights under Applicable Data Protection Law to the extent Customer does not have the ability to resolve a Third Party Request from a data subject through self-service features made available via the Services.

9. Impact Assessments and Consultations

ClayHR will provide reasonable cooperation to Customer in connection with any data protection impact assessment (at Customer’s expense only if such reasonable cooperation will require ClayHR to assign significant resources to that effort) or consultations with regulatory authorities that may be required in accordance with Applicable Data Protection Law.

10. Return or Deletion of Customer Content

ClayHR will, in accordance with Section 3 (Duration of the Processing) of Schedule 1 (Details of Processing) of this Agreement, delete or return to Customer any Customer Content stored within the Services.

10.1 Extension of Agreement. Upon termination of the Agreement, ClayHR may retain Customer Content in storage for the time periods set forth in Schedule 1 (Details of Processing) of this Agreement, provided that ClayHR will ensure that Customer Content (a) is processed only as necessary for the Permitted Purposes and (b) remains protected in accordance with the terms of the Agreement, this Agreement, and Applicable Data Protection Law.

10.2 Retention Required by Law. Notwithstanding anything to the contrary in this Section 10, ClayHR may retain Customer Content, or any portion of it, if required by applicable law or regulation, including Applicable Data Protection Law, provided such Customer Content remains protected in accordance with the terms of the Agreement, this Agreement, and Applicable Data Protection Law.

IV. Security and Audits

11. Security

11.1 Security Measures. ClayHR has implemented and will maintain the technical and organizational security measures as set forth in the Agreement. Additional information about ClayHR’s technical and organizational security measures to protect Customer Data is set forth in Schedule 2 (Technical and Organizational Security Measures) of this Agreement.

11.2 Determination of Security Requirements. Customer acknowledges the Services include certain features and functionalities that Customer may elect to use which impact the security of Customer Data processed by Customer’s use of the Services, such as, but not limited to, encryption of voice recordings, availability of multi-factor authentication on Customer’s account, or optional Transport Layer Security (TLS) encryption. Customer is responsible for reviewing the information ClayHR makes available regarding its data security, including its audit reports, and making an independent determination as to whether the Services meet the Customer’s requirements and legal obligations, including its obligations under Applicable Data Protection Law. Customer is further responsible for properly configuring the Services and using features and functionalities made available by ClayHR to maintain appropriate security in light of the nature of Customer Data processed as a result of Customer’s use of the Services.

11.3 Security Incident Notification. ClayHR will provide notification of a Security Incident in the following manner:

(a) ClayHR will, to the extent permitted by applicable law or regulation, notify Customer without undue delay, but in no event later than seventy-two (72) hours after ClayHR’s discovery of a Security Incident impacting Customer Data of which ClayHR is a processor;

(b) ClayHR will, to the extent permitted and required by applicable law or regulation, notify Customer without undue delay of any Security Incident involving Customer Data of which ClayHR is a controller; and

(c) ClayHR will notify Customer of any Security Incident via email to the email address(es) designated by Customer in Customer’s account.

ClayHR will make reasonable efforts to identify a Security Incident, and to the extent a Security Incident is caused by ClayHR’s violation of this Agreement, remediate the cause of such Security Incident. ClayHR will provide reasonable assistance to Customer in the event that Customer is required under Applicable Data Protection Law to notify a regulatory authority or any data subjects impacted by a Security Incident.

12. Audits

Customer and ClayHR acknowledge that Customer must be able to assess ClayHR’s compliance with its obligations under Applicable Data Protection Law and this Agreement, insofar as ClayHR is acting as a processor on behalf of Customer.

12.1 Customer Audit. Upon Customer’s written request at reasonable intervals, and subject to reasonable confidentiality controls, ClayHR will make available to Customer a copy of ClayHR’s most recent Internal Audit Report. Customer agrees that any audit rights granted by Applicable Data Protection Law will be satisfied by these Audit Reports.

V. International Provisions

13. Jurisdiction Specific Terms

To the extent ClayHR processes personal data originating from and protected by Applicable Data Protection Law in one of the jurisdictions listed in Schedule 4 (Jurisdiction Specific Terms) of this Agreement, the terms specified in Schedule 4 with respect to the applicable jurisdiction(s) apply in addition to the terms of this Agreement.

14. Cross Border Data Transfer Mechanisms

To the extent Customer’s use of the Services requires an onward transfer mechanism to lawfully transfer personal data from a jurisdiction (i.e., the European Economic Area, the United Kingdom, Switzerland, Guernsey, Jersey, or any other jurisdiction listed in Schedule 4 (Jurisdiction Specific Terms) of this Agreement) to ClayHR located outside of that jurisdiction (“Transfer Mechanism”), the terms set forth in Schedule 3 (Cross Border Transfer Mechanisms) of this Agreement will apply.

VI. Miscellaneous

15. Cooperation and Data Subject Rights

In the event that either party receives (a) any request from a data subject to exercise any of its rights under Applicable Data Protection Law (including its rights of access, correction, objection, erasure, and data portability, as applicable) or (b) any Third Party Request relating to the processing of Customer Account Data or Customer Usage Data conducted by the other party, such party will promptly inform such other party in writing. Customer and ClayHR agree to cooperate, in good faith, as necessary to respond to any Third Party Request and fulfill their respective obligations under Applicable Data Protection Law.

16. Conflict

In the event of any conflict or inconsistency among the following documents, the order of precedence will be: (1) the applicable terms set forth in Schedule 4 (Jurisdiction Specific Terms) of this Agreement; (2) the terms of this Agreement outside of Schedule 4 (Jurisdiction Specific Terms); (3) the Agreement; and (4) the ClayHR Privacy Notice. Any claims brought in connection with this Agreement will be subject to the terms and conditions, including, without limitation, the exclusions and limitations set forth in the Agreement.

17. Updates

ClayHR may update the terms of this Agreement from time to time; provided, however, ClayHR will provide at least thirty (30) days prior written notice to Customer when an update is required as a result of (a) changes in Applicable Data Protection Law; (b) a merger, acquisition, or other similar transaction; or (c) the release of new products or services or material changes to any of the existing Services. The then-current terms of this Agreement are available at https://www.clayhr.com/policies/data-processing-agreement.

Schedule 1: Details of Processing

1. Nature and Purpose of the Processing

ClayHR will process personal data as necessary to provide the Services under the Agreement. ClayHR does not sell Customer’s personal data or Customer end users’ personal data and does not share such end users’ information with third parties for compensation or for those third parties’ own business interests.

1.1 Customer Content. ClayHR will process Customer Content as a processor in accordance with Customer’s instructions as set forth in Section 5 (Customer Instructions) of this Agreement.

1.2 Customer Account Data. ClayHR will process Customer Account Data as a controller for the purposes set forth in Section 2.2 (ClayHR as a Controller of Customer Account Data) of this Agreement.

1.3 Customer Usage Data. ClayHR will process Customer Usage Data as a controller for the purposes set forth in Section 2.3 (ClayHR as a Controller of Customer Usage Data) of this Agreement.

2. Processing Activities

2.1 Customer Content. Personal data contained in Customer Content will be subject to the following basic processing activities:

(a) the provision of programmable communication products and services, primarily offered in the form of application programming interfaces, to Customer, including transmittal to or from Customer’s software applications or; services and designated third parties as directed by Customer, from or to the publicly-switched telephone network or by way of other communications networks. Storage of personal data on ClayHR’s network;

(b) the provision of products and services which allow the transmission and delivery of email communications on behalf of Customer to its recipients. ClayHR will also provide Customer with analytic reports regarding the email communications it sends on Customer's behalf. Storage of personal data on ClayHR’s network; and

(c) the provision of products and services which allows Customer to integrate, manage and control its data relating to end users. Storage of personal data on ClayHR’s network.

2.2 Customer Account Data. Personal data contained in Customer Account Data will be subject to the processing activities of providing the Services.

2.3 Customer Usage Data. Personal data contained in Customer Usage Data will be subject to the processing activities of providing the Services.

3. Duration of the Processing

The period for which personal data will be retained and the criteria used to determine that period is as follows:

3.1 Customer Content. (Services. Prior to the termination of the Agreement, (x) ClayHR will process stored Customer Content for the Permitted Purposes until Customer elects to delete such Customer Content via the Services and (y) Customer agrees that it is solely responsible for deleting Customer Content via the Services. Upon termination of the Agreement, ClayHR will (i) provide Customer thirty (30) days after the termination effective date to obtain a copy of any stored Customer Content via the Services; (ii) automatically delete any stored Customer Content thirty (30) days after the termination effective date; and (iii) automatically delete any stored Customer Content on ClayHR’s back-up systems sixty (60) days after the termination effective date. Any Customer Content archived on ClayHR’s back-up systems will be securely isolated and protected from any further processing, except as otherwise required by applicable law or regulation.

3.2 Customer Account Data. ClayHR will process Customer Account Data as long as required (a) to provide the Services to Customer; (b) for ClayHR’s legitimate business needs; or (c) by applicable law or regulation. Customer Account Data will be stored in accordance with the ClayHR Privacy Notice.

3.3 Customer Usage Data. Upon termination of the Agreement, ClayHR may retain, use, and disclose Customer Usage Data for the purposes set forth in Section 1.3 (Customer Usage Data) of this Schedule 1, subject to the confidentiality obligations set forth in the Agreement. ClayHR will anonymize or delete Customer Usage Data when ClayHR no longer requires it for the purposes set forth in Section 1.3 (Customer Usage Data) of this Schedule 1.

4. Categories of Data Subjects

4.1 Customer Content. Customer’s end users.

4.2 Customer Account Data. Customer’s employees and individuals authorized by Customer to access Customer’s ClayHR account or make use of the Multi-Factor Authentication Services or telephone number assignments received from ClayHR.

4.3 Customer Usage Data. Customer’s end users.

5. Categories of Personal Data.

ClayHR processes personal data contained in Customer Account Data, Customer Content, and Customer Usage Data.

6. Sensitive Data or Special Categories of Data

6.1 Customer Content. Sensitive Data may, from time to time, be processed via the Services where Customer or its end users choose to include Sensitive Data within the communications that are transmitted using the Services. Customer is responsible for ensuring that suitable safeguards are in place prior to transmitting or processing, or prior to permitting Customer’s end users to transmit or process any Sensitive Data via the Services.

6.2 Customer Account Data and Customer Usage Data.

(a) Sensitive Data may be found in Customer Account Data in the form of Subscriber Records containing passport or similar identifier data necessarily processed in order to receive telephone number assignments.

(b) Customer Usage Data does not contain Sensitive Data.

Schedule 2: Security Measures

We currently observe the Security Measures described in this Annex 2. All capitalized terms not otherwise defined herein will have the meanings as set forth in the General Terms.

a) Access Control

1. Preventing Unauthorized Product Access

1.1 Outsourced processing. We host our Service with outsourced cloud infrastructure providers. Additionally, we maintain contractual relationships with vendors in order to provide the Service in accordance with our DPA. We rely on contractual agreements, privacy policies, and vendor compliance programs in order to protect data processed or stored by these vendors.

1.2 Physical and environmental security. We host our product infrastructure with multi-tenant, outsourced infrastructure providers. We do not own or maintain hardware located at the outsourced infrastructure providers’ data centers. Production servers and client-facing applications are logically and physically secured from our internal corporate information systems. The physical and environmental security controls are audited for SOC 2 compliance, among other certifications.

1.3 Authentication. Customers who interact with the ClayHR products via the user interface must authenticate before accessing non-public customer data.

1.4 Authorization. Customer Data is stored in multi-tenant storage systems accessible to Customers via only application user interfaces and application programming interfaces. Customers are not allowed direct access to the underlying application infrastructure. The authorization model in each of our products is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customization options. Authorization to data sets is performed through validating the user’s permissions against the attributes associated with each data set.

1.5 Application Programming Interface (API) access. Public product APIs may be accessed using an API key.

2. Preventing Unauthorized Product Use

We implement industry standard access controls and detection capabilities for the internal networks that support its products.

2.1 Access controls. Network access control mechanisms are designed to prevent network traffic using unauthorized protocols from reaching the product infrastructure. The technical measures implemented differ between infrastructure providers and include Virtual Private Cloud (VPC) implementations, security group assignments, and traditional firewall rules.

2.2 Intrusion detection and prevention. We implement a Web Application Firewall (WAF) solution to protect hosted customer websites and other internet-accessible applications. The WAF is designed to identify and prevent attacks against publicly available network services.

2.3 Static code analysis. Code stored in our source code repositories is checked for best practices and identifiable software flaws using automated tooling.

2.4 Penetration testing. We conduct periodic penetration tests using industry standard penetration testing software applications. The intent of the penetration tests is to identify and resolve foreseeable attack vectors and potential abuse scenarios. Penetration tests are performed against the application layers and infrastructure layers of the ClayHR technology stack.

2.5 Responsible disclosure of vulnerability. Responsible disclosure of vulnerability program invites and incentivizes independent security researchers to ethically discover and disclose security flaws. We implement this program in an effort to widen the available opportunities to engage with the security community and improve product defenses against sophisticated attacks.

3. Limitations of Privilege & Authorization Requirements

3.1 Product access. A subset of our employees has access to the products and to customer data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective customer support, product development, and research, troubleshoot potential problems, detect and respond to security incidents and implement data security. Access is enabled through “just in time” (JITA) requests for access; all such requests are logged. Employees are granted access by role, and reviews of high-risk privilege grants are initiated daily. Administrative or high-risk access permissions are reviewed at least once every six months.

3.2 Background checks. Where permitted by applicable law, ClayHR employees undergo third-party background or reference checks. In the United States, employment offers are contingent upon the results of a third-party background check. All ClayHR employees are required to conduct themselves in a manner consistent with company guidelines, non-disclosure requirements, and ethical standards.

b) Transmission Control

1. In-transit

We require HTTPS encryption (also referred to as SSL or TLS) on all login interfaces and for free on every customer site hosted on the ClayHR products. Our HTTPS implementation uses industry-standard algorithms and certificates.

2. At-rest

We store user passwords following policies that follow industry standard practices for security. We have implemented technologies to ensure that stored data is encrypted at rest.

c) Input Control

1. Detection

We designed our infrastructure to log extensive information about the system behavior, traffic received, system authentication, and other application requests. Internal systems aggregate log data and alert appropriate employees of malicious, unintended, or anomalous activities. Our personnel, including security, operations, and support personnel, are responsive to known incidents.

2. Response and tracking

We maintain a record of known security incidents that includes descriptions, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, we will take appropriate steps to minimize product and Customer damage or unauthorized disclosure. Notification to you will be in accordance with the terms of the Agreement.

d) Availability Control

1. Infrastructure availability

The infrastructure providers use commercially reasonable efforts to ensure a minimum of 99.5% uptime. The providers maintain a minimum of N+1 redundancy to power, network, heating, ventilation, and air conditioning (HVAC) services.

2. Fault tolerance

Backup and replication strategies are designed to ensure redundancy and fail-over protections during a significant processing failure. Customer data is backed up to multiple durable data stores and replicated across multiple availability zones.

3. Online replicas and backups

Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary database. All databases are backed up and maintained using industry standard methods.

4. Disaster Recovery Plans

We maintain and regularly test disaster recovery plans to help ensure the availability of information following an interruption to, or failure of, critical business processes.

Our products are designed to ensure redundancy and seamless failover. The server instances that support the products are also architected with a goal to prevent single points of failure. This design assists our operations in maintaining and updating the product applications and backend while limiting downtime.

Schedule 3: Cross Border Data Transfer Mechanisms

1. Definitions

• “SCC Services” means all Services
• “EEA” means the European Economic Area
• “EU Standard Contractual Clauses” means the Standard Contractual Clauses approved by the European Commission in decision 2021/914.
• “ClayHR SCCs” means ClayHR’s Standard Contractual Clauses as set forth at https://www.clayhr.com/policies/standard-contractual-clauses.
• “UK International Data Transfer Agreement” means the International Data Transfer Agreement to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022.
• "Data Privacy Framework" means the EU-US and/or Swiss-US Data Privacy Framework self-certification program operated by the US Department of Commerce.
• "Data Privacy Principles" means the Data Privacy Framework principles (as supplemented by the Supplemental Principles).

2. Cross Border Data Transfer Mechanisms

2.1 Order of Precedence

In the event the Services are covered by more than one Transfer Mechanism, the transfer of personal data will be subject to a single Transfer Mechanism, as applicable, and in accordance with the following order of precedence: (a) the Data Privacy Framework as set forth in Section 2.2 (Data Privacy Framework) of this Schedule 3; (b) ClayHR SCCs as set forth in Section 2.3 (ClayHR SCCs) of this Schedule 3; (c) the EU Standard Contractual Clauses as set forth in Section 2.4 (EU Standard Contractual Clauses) of this Schedule 3; (d) the UK International Data Transfer Agreement as set forth in Section 2.5 (UK International Data Transfer Agreement) of this Schedule 3; and, if neither (a), (b), (c), nor (d) is applicable, then (e) other applicable data Transfer Mechanisms permitted under Applicable Data Protection Law.

2.2 Data Privacy Framework

To the extent ClayHR Inc. processes any personal data via the Services originating from the EEA or Switzerland, ClayHR represents that ClayHR Inc. is self-certified under the Data Privacy Framework and complies with the Data Privacy Principles when processing any such personal data. To the extent that Customer is (a) located in the United States of America and is self-certified under the Data Privacy Framework or (b) located in the EEA or Switzerland, ClayHR further agrees (i) to provide at least the same level of protection to any personal data as required by the Data Privacy Principles; (ii) to notify Customer in writing, without undue delay, if its self-certification to the Data Privacy Framework is withdrawn, terminated, revoked, or otherwise invalidated (in which case, an alternative Transfer Mechanism will apply in accordance with the order of precedence in Section 2.1 (Order of Precedence) of this Schedule 3; and (iii) upon written notice, to work with Customer to take reasonable and appropriate steps to stop and remediate any unauthorized processing of personal data.

2.3 ClayHR Standard Contractual Clauses

ClayHR will process personal data within the SCC Services in accordance with the ClayHR SCCs. Customer and ClayHR agree that, with respect to the SCC Services, the ClayHR SCCs will be the lawful Transfer Mechanism of Customer Account Data, Customer Content, and Customer Usage Data from the EEA, Switzerland, or the United Kingdom to (a) ClayHR in the United States of America or (b) any other non-EEA ClayHR entity. 

2.4 EU Standard Contractual Clauses

The EU Standard Contractual Clauses will apply to personal data that is transferred via the Services from the EEA, Switzerland, Guernsey, or Jersey, either directly or via onward transfer, to any country or recipient outside the EEA, Switzerland, Guernsey, or Jersey that is not (a) recognized by the relevant competent authority as providing an adequate level of protection for personal data and (b) covered by the ClayHR SCCs. For data transfers that are subject to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will be deemed entered into, and incorporated into this Agreement by this reference, and completed as follows:

(a) Module One (Controller to Controller) of the EU Standard Contractual Clauses will apply where (i) ClayHR is processing Customer Account Data and (ii) Customer is a controller of Customer Usage Data and ClayHR is processing Customer Usage Data;

(b) Module Two (Controller to Processor) of the EU Standard Contractual Clauses will apply where Customer is a controller of Customer Content and ClayHR is processing Customer Content;

(c) Module Three (Processor to Processor) of the EU Standard Contractual Clauses will apply where Customer is a processor of Customer Content and ClayHR is processing Customer Content;

(d) Module Four (Processor to Controller) of the EU Standard Contractual Clauses will apply where Customer is a processor of Customer Usage Data and ClayHR processes Customer Usage Data; and

(e) For each Module, where applicable:

(i) in Clause 7 of the EU Standard Contractual Clauses, the optional docking clause will not apply;

(ii) in Clause 9 of the EU Standard Contractual Clauses, Option 2 will apply and the time period for prior written notice of sub-processor changes will be as set forth in Section 7.2 (Current Sub-processors and Notification of Sub-processor Changes) of this Agreement;

(iii) in Clause 11 of the EU Standard Contractual Clauses, the optional language will not apply;

(iv) in Clause 17 (Option 1), the EU Standard Contractual Clauses will be governed by Irish law;

(v) in Clause 18(b) of the EU Standard Contractual Clauses, disputes will be resolved before the courts of Ireland;

(vi) in Annex I, Part A of the EU Standard Contractual Clauses:

Data Exporter: Customer

Contact details: The email address(es) designated by Customer in Customer’s account via its notification preferences.

Data Exporter Role: The Data Exporter’s role is set forth in Section 2 (Relationship) of this Agreement.

Signature and Date: By entering into the Agreement, Data Exporter is deemed to have signed these EU Standard Contractual Clauses incorporated herein, including their Annexes, as of the effective date of the Agreement.

Data Importer: ClayHR Inc.

Contact details: ClayHR Privacy Team - privacy@clayhr.com

Data Importer Role: The Data Importer’s role is set forth in Section 2 (Relationship) of this Agreement.

Signature and Date: By entering into the Agreement, Data Importer is deemed to have signed these EU Standard Contractual Clauses, incorporated herein, including their Annexes, as of the effective date of the Agreement;

(vii) in Annex I, Part B of the EU Standard Contractual Clauses:

The categories of data subjects are set forth in Section 4 of Schedule 1 (Details of Processing) of this Agreement.

The Sensitive Data transferred is set forth in Section 6 of Schedule 1 (Details of Processing) of this Agreement.

The frequency of the transfer is a continuous basis for the duration of the Agreement.

The nature of the processing is set forth in Section 1 of Schedule 1 (Details of Processing) of this Agreement.

The purpose of the processing is set forth in Section 1 of Schedule 1 (Details of Processing) of this Agreement.

The period for which the personal data will be retained is set forth in Section 3 of Schedule 1 (Details of Processing) of this Agreement.

For transfers to sub-processors, the subject matter, nature, and duration of the processing is set forth at https://www.clayhr.com/policies/sub-processors ;

(viii) in Annex I, Part C of the EU Standard Contractual Clauses: The Irish Data Protection Commission will be the competent supervisory authority; and

(ix) Schedule 2 (Technical and Organizational Security Measures) of this Agreement serves as Annex II of the EU Standard Contractual Clauses.

2.5 UK International Data Transfer Agreement

Customer and ClayHR agree that the UK International Data Transfer Agreement will apply to personal data that is transferred via the Services from the United Kingdom, either directly or via onward transfer, to any country or recipient outside of the United Kingdom that is not (a) recognized by the competent United Kingdom regulatory authority or governmental body for the United Kingdom as providing an adequate level of protection for personal data and (b) covered by the ClayHR SCCs. For data transfers from the United Kingdom that are subject to the UK International Data Transfer Agreement, the UK International Data Transfer Agreement will be deemed entered into, and incorporated into this Agreement by this reference, and completed as follows:

(a) In Table 1 of the UK International Data Transfer Agreement, Customer's and ClayHR's details and key contact information are set forth in Section 2.4 (e)(vi) of this Schedule 3;

(b) In Table 2 of the UK International Data Transfer Agreement, information about the version of the Approved EU SCCs, modules, and selected clauses, which the UK International Data Transfer Agreement is appended to, are set forth in Section 2.4 (EU Standard Contractual Clauses) of this Schedule 3;

(c) In Table 3 of the UK International Data Transfer Agreement:

(i) The list of Parties is set forth in Section 2.4(e)(vi) of this Schedule 3.

(ii) The description of the transfer is set forth in Section 1 (Nature and Purpose of the Processing) of Schedule 1 (Details of the Processing).

(iii) Annex II is located in Schedule 2 (Technical and Organizational Security Measures) of this Agreement.

(iv) The list of sub-processors is available at https://www.clayhr.com/policies/sub-processors ; and

(d) In Table 4 of the UK International Data Transfer Agreement, both the Importer and the exporter may end the UK International Data Transfer Agreement in accordance with the terms of the UK International Data Transfer Agreement.

2.6 Conflict

To the extent there is any conflict or inconsistency between the EU Standard Contractual Clauses or UK International Data Transfer Agreement and any other terms in this Agreement, including Schedule 4 (Jurisdiction Specific Terms), the Agreement, or the ClayHR Privacy Notice, the provisions of the EU Standard Contractual Clauses or UK International Data Transfer Agreement, as applicable, will prevail.

Schedule 4: Jurisdiction Specific Terms

1. Australia

1.1 The definition of “Applicable Data Protection Law” includes the Australian Privacy Principles and the Australian Privacy Act (1988).

1.2 The definition of “personal data” includes “Personal Information” as defined under Applicable Data Protection Law.

1.3 The definition of “Sensitive Data” includes “Sensitive Information” as defined under Applicable Data Protection Law.

2. Brazil

2.1 The definition of “Applicable Data Protection Law” includes the Lei Geral de Proteção de Dados (General Personal Data Protection Act).

2.2 The definition of “Security Incident” includes a security incident that may result in any relevant risk or damage to data subjects.

2.3 The definition of “processor” includes “operator” as defined under Applicable Data Protection Law.

3. Canada

3.1 The definition of “Applicable Data Protection Law” includes the Federal Personal Information Protection and Electronic Documents Act.

3.2 ClayHR’s sub-processors, as set forth in Section 7 (Sub-processors) of this Agreement, are third parties under Applicable Data Protection Law, with whom ClayHR has entered into a written contract that includes terms substantially similar to this Agreement. ClayHR has conducted appropriate due diligence on its sub-processors.

3.3 ClayHR will implement technical and organizational measures as set forth in Section 11 (Security) of this Agreement.

4. European Economic Area (EEA)

4.1 The definition of “Applicable Data Protection Law” includes the General Data Protection Regulation (EU 2016/679) (“GDPR”).

4.2 When ClayHR engages a sub-processor under Section 7.1 (Authorization for Onward Sub-processing) of this Agreement, it will:

(a) require any appointed sub-processor to protect the Customer Content to the standard required by Applicable Data Protection Law, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR, and

(b) require any appointed sub-processor to (i) agree in writing to only process personal data in a country that the European Union has declared to have an “adequate” level of protection or (ii) only process personal data on terms equivalent to the EU Standard Contractual Clauses or pursuant to a Binding Corporate Rules approval granted by competent European Union data protection authorities.

4.3 Notwithstanding anything to the contrary in this Agreement or in the Agreement (including, without limitation, either party’s indemnification obligations), neither party will be responsible for any GDPR fines issued or levied under Article 83 of the GDPR against the other party by a regulatory authority or governmental body in connection with such other party’s violation of the GDPR.

4.4 Customer acknowledges that ClayHR, as a controller, may be required under Applicable Data Protection Law to notify a regulatory authority of Security Incidents involving Customer Usage Data. If a regulatory authority requires ClayHR to notify impacted data subjects with whom ClayHR does not have a direct relationship (e.g., Customer’s end users), ClayHR will notify Customer of this requirement. Customer will provide reasonable assistance to ClayHR to notify the impacted data subjects.

5.Israel

5.1 The definition of “Applicable Data Protection Law” includes the Protection of Privacy Law.

5.2 The definition of “controller” includes “Database Owner” as defined under Applicable Data Protection Law.

5.3 The definition of “processor” includes “Holder” as defined under Applicable Data Protection Law.

5.4 ClayHR will require that any personnel authorized to process Customer Content comply with the principle of data secrecy and have been duly instructed about Applicable Data Protection Law. Such personnel sign confidentiality agreements with ClayHR in accordance with Section 6 (Confidentiality) of this Agreement.

5.5 ClayHR must take sufficient steps to ensure the privacy of data subjects by implementing and maintaining the security measures as specified in Section 11 (Security) of this Agreement and complying with the terms of the Agreement.

5.6 ClayHR must ensure that the personal data will not be transferred to a sub-processor unless such sub-processor has executed an agreement with ClayHR pursuant to Section 7.1 (Authorization for Onward Sub-processing) of this Agreement.

6. Japan

6.1 The definition of “Applicable Data Protection Law” includes the Act on the Protection of Personal Information (“APPI").

6.2 The definition of “personal data” includes information about a specific individual applicable under Section 2(1) of the APPI, which Customer entrusts to ClayHR during ClayHR’s provision of the Services to Customer.

6.3 ClayHR agrees it has and will maintain a privacy program conforming to the standards prescribed by rules of the Personal Information Protection Commission concerning the handling of personal data pursuant to the provisions of Chapter 4 of the APPI. Accordingly:

(a) ClayHR will (i) process personal data as necessary to provide the Services to Customer in accordance with the Agreement and as set forth in Schedule 1 (Details of the Processing) of this Agreement (“Purpose of Use”) and (ii) not process personal data for any purpose other than the Purpose of Use without Customer’s consent;

(b) ClayHR will implement and maintain measures appropriate and necessary to prevent unauthorized disclosure and loss of personal data and for the secure management of personal data in accordance with the APPI as set forth in Section 11 (Security) of this Agreement;

(c) ClayHR will notify Customer for (i) a failure to comply with Section 6.3(a) of this Schedule 4 or (ii) ClayHR’s discovery of a Security Incident impacting Customer Data, in either case, in accordance with Section 11.3 (Security Incident Notification). ClayHR will provide reasonable assistance to Customer in the event that Customer is required to notify a regulatory authority or any data subjects impacted by a Security Incident;

(d) ClayHR will ensure that any of its employees who have access to personal data (i) have executed employee agreements requiring them to keep such personal data confidential and (ii) who violate confidentiality will be subject to disciplinary action and possible termination; (iii) carry out appropriate employee supervision and training for the secure management of personal data; and (iv) limit the number of authorized personnel, including ClayHR’s employees, who have access to personal data and control such access such that it is only permitted for the time period necessary for the Purpose of Use;

(e) ClayHR will not disclose personal data to any third party, except as Customer has authorized ClayHR to do so in the Agreement. When engaging sub-processors, ClayHR will comply with the obligations in Section 7 (Sub-processors) of this Agreement to ensure that procedures are in place to maintain the confidentiality and security of personal data;

(f) ClayHR will keep records of the handling of personal data entrusted to it by, and performed for, Customer;

(g) ClayHR will promptly notify Customer of any Third Party Request and not respond to such Third Party Request without Customer’s prior consent, except as legally required to do so or to confirm that such Third Party Request relates to Customer. To the extent Customer does not have the ability to resolve a Third Party Request from a data subject through the self-service features made available via the Services, then, upon Customer’s request, ClayHR will provide reasonable cooperation and support to assist Customer in resolving such Third Party Request from a data subject in accordance with Section 8 (Data Subject Rights) of this Agreement;

(h) Unless prohibited by applicable law or regulation, ClayHR will promptly notify Customer of any Third Party Request that requires ClayHR to disclose personal data on order or disposition of any governmental authority or court of law. 

(i) Customer may assess ClayHR’s compliance with its obligations under Applicable Data Protection Law and as set forth in Section 12 (Audits) of this Agreement. In addition, ClayHR will respond to any Customer inquiries or questionnaires relating to ClayHR’s processing of personal data under the Agreement in good faith and within a reasonable period of time. Customer may direct APPI-related inquiries to privacy@clayhr.com. ClayHR will identify its Chief Privacy Officer upon written request;

(j) ClayHR will provide reasonable cooperation to Customer upon written request, where Customer is reporting to the Personal Information Protection Commission or other regulatory authorities; and

(k) ClayHR’s primary processing facilities are located in the United States of America, and, depending on Customer’s use of the Services, from the locations set forth at https://www.clayhr.com/policies/sub-processors  (collectively, “Processing Locations”). ClayHR will notify customer of any Processing Location change and provide Customer the opportunity to object in accordance with, respectively, Section 7.2 (Current Sub-processors and Notification of Sub-process or Changes) and Section 7.3 (Objection Right for new Sub-processors) of this Agreement. Where ClayHR processes personal data in a country other than Japan, ClayHR will ensure it complies with its privacy program as described in this Agreement. ClayHR will promptly notify Customer of any changes in applicable law and regulation that may materially affect ClayHR’s obligations with respect to the processing of personal data, and in such case, Customer may, at its discretion, suspend the transfer of personal data.

6.4 The following data subject consent terms apply:

(a) Customer entrusts ClayHR with personal data for the Purpose of Use. Customer agrees that ClayHR is not a “third party” as the term is used in the APPI provisions that restrict the provision of personal data to third parties. As such, the requirement to obtain data subject consent in advance for domestic transfers within Japan do not apply;

(b) Customer agrees that the ClayHR CBPR and PRP Certifications and ClayHR's privacy program set forth in Section 6.3 of this Schedule 4 meets the equivalent standards prescribed by the Personal Information Protection Commission and the APPI. As such, the APPI restrictions on the provision of personal data to third parties in foreign countries outside of Japan, which require data subject consent in advance of such international transfers do not apply. Customer may take the necessary actions set forth in Section 6.3(h) of this Schedule 4 to ensure continuous implementation of the ClayHR CBPR and PRP Certifications and ClayHR's privacy program and respond to Third Party Requests from data subjects; and

(c) Customer acknowledges that data subject consent may be required under Article 4 of the Telecommunications Business Act in the event Customer instructs ClayHR’s support personnel to access the content of communications. Customer will comply with any consent requirements specific to its use of the Services and instructions as required by Section 4 (Compliance) of this Agreement.

7. Mexico

7.1 The definition of “Applicable Data Protection Law” includes the Federal Law for the Protection of Personal Data Held by Private Parties and its Regulations.

7.2 When acting as a processor, ClayHR will:

(a) treat personal data in accordance with Customer’s instructions set forth in Section 5 (Customer Instructions) of this Agreement;

(b) process personal data only to the extent necessary to provide the Services;

(c) implement security measures in accordance with Applicable Data Protection Law and Section 11 (Security) of this Agreement;

(d) keep confidentiality regarding the personal data processed in accordance with the Agreement;

(e) delete all personal data upon termination of the Agreement in accordance with Section 10 (Return or Deletion of Customer Content) of this Agreement; and

(f) only transfer personal data to sub-processors in accordance with Section 7 (Sub-processors) of this Agreement.

8. Singapore

8.1 The definition of “Applicable Data Protection Law” includes the Personal Data Protection Act 2012 (“PDPA”).

8.2 ClayHR will process personal data to a standard of protection in accordance with the PDPA by implementing adequate technical and organizational measures as set forth in Section 11 (Security) of this Agreement and complying with the terms of the Agreement.

9. Switzerland

9.1 The definition of “Applicable Data Protection Law” includes the Swiss Federal Act on Data Protection, as revised (“FADP”).

9.2 When ClayHR engages a sub-processor under Section 7.1 (Authorization for Onward Sub-processing) of this Agreement, it will:

(a) require any appointed sub-processor to protect the Customer Content to the standard required by Applicable Data Protection Law, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular, providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR, and

(b) require any appointed sub-processor to (i) agree in writing to only process personal data in a country that Switzerland has declared to have an “adequate” level of protection or (ii) only process personal data on terms equivalent to the EU Standard Contractual Clauses or pursuant to a Binding Corporate Rules approval granted by competent European Union data protection authorities.

9.3 To the extent that personal data transfers from Switzerland are subject to the EU Standard Contractual Clauses in accordance with Section 2.4 of Schedule 3 (EU Standard Contractual Clauses), the following amendments will apply to the EU Standard Contractual Clauses:

(a) references to “EU Member State” and “Member State” will be interpreted to include Switzerland, and

(b) insofar as the transfer or onward transfers are subject to the FADP:

(i) references to "Regulation (EU) 2016/679" are to be interpreted as references to the FADP;

(ii) the “competent supervisory authority” in Annex I, Part C will be the Swiss Federal Data Protection and Information Commissioner;

(iii) in Clause 17 (Option 1), the EU Standard Contractual Clauses will be governed by the laws of Switzerland; and

(iv) in Clause 18(b) of the EU Standard Contractual Clauses, disputes will be resolved before the courts of Switzerland.

10. United Kingdom (UK)

10.1 References in this Agreement to “GDPR” will be deemed references to the corresponding laws and regulations of the United Kingdom, including, without limitation, the UK GDPR and Data Protection Act 2018.

10.2 When ClayHR engages a sub-processor under Section 7.1 (Authorization for Onward Sub-processing) of this Agreement, it will:

(a) require any appointed sub-processor to protect the Customer Content to the standard required by Applicable Data Protection Law, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR, and

(b) require any appointed sub-processor to (i) agree in writing to only process personal data in a country that the United Kingdom has declared to have an “adequate” level of protection or (ii) only process personal data on terms equivalent to the UK International Data Transfer Agreement or pursuant to a Binding Corporate Rules approval granted by competent United Kingdom data protection authorities.

10.3 Notwithstanding anything to the contrary in this Agreement or in the Agreement (including, without limitation, either party’s indemnification obligations), neither party will be responsible for any UK GDPR fines issued or levied under Article 83 of the UK GDPR against the other party by a regulatory authority or governmental body in connection with such other party’s violation of the UK GDPR.

10.4 Customer acknowledges that ClayHR, as a controller, may be required under Applicable Data Protection Law to notify a regulatory authority of Security Incidents involving Customer Usage Data. If a regulatory authority requires ClayHR to notify impacted data subjects with whom ClayHR does not have a direct relationship (e.g., Customer’s end users), ClayHR will notify Customer of this requirement. Customer will provide reasonable assistance to ClayHR to notify the impacted data subjects.

11. United States of America

11.1 “US State Privacy Laws” means all state laws relating to the protection and processing of personal data in effect in the United States of America, which may include, without limitation, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act.

11.2 The definition of “Applicable Data Protection Law” includes US State Privacy Laws.

11.3 The following terms apply where ClayHR processes personal data subject to the CCPA:

(a) The term “personal information”, as used in this Section 11.3, will have the meaning provided in the CCPA;

(b) ClayHR is a service provider when processing Customer Content. ClayHR will process any personal information contained in Customer Content only for the business purposes set forth in the Agreement, including the purpose of processing and processing activities set forth in this Agreement (“Purpose”). As a service provider, ClayHR will not sell or share Customer Content or retain, use, or disclose Customer Content (i) for any purpose other than the Purpose, including retaining, using, or disclosing Customer Content for a commercial purpose other than the Purpose, or as otherwise permitted by the CCPA; or (ii) outside of the direct business relationship between Customer and ClayHR;

(c) ClayHR will (i) comply with obligations applicable to it as a service provider under the CCPA and (ii) provide personal information with the same level of privacy protection as is required by the CCPA. Customer is responsible for ensuring that it has complied, and will continue to comply, with the requirements of the CCPA in its use of the Services and its own processing of personal information;

(d) Customer will have the right to take reasonable and appropriate steps to help ensure that ClayHR uses personal information in a manner consistent with Customer’s obligations under the CCPA;

(e) ClayHR will notify Customer if it makes a determination that it can no longer meet its obligations as a service provider under the CCPA;

(f) Upon notice, Customer will have the right to take reasonable and appropriate steps in accordance with the Agreement to stop and remediate unauthorized use of personal information;

(g) ClayHR will provide reasonable additional and timely assistance to assist Customer in complying with its obligations with respect to consumer requests as set forth in the Agreement;

(h) For any sub-processor used by ClayHR to process personal information subject to the CCPA, ClayHR will ensure that ClayHR’s agreement with such sub-processor complies with the CCPA, including, without limitation, the contractual requirements for service providers and contractors;

(i) ClayHR will not combine Customer Content that it receives from, or on behalf of, Customer, with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, unless such combination is required to perform any business purpose as permitted by the CCPA, including any regulations thereto, or by regulations adopted by the California Privacy Protection Agency; and

(j) ClayHR certifies that it understands and will comply with its obligations under the CCPA.

11.4 ClayHR acknowledges and confirms that it does not receive Customer Content as consideration for any Services provided to Customer.

‍