Common use of California Consumer Privacy Act Clause in Contracts

California Consumer Privacy Act. (CCPA) | To the extent applicable, Cutover represents and warrants to Customer that (i) it is acting as a service provider in connection with this Agreement with respect to any California User Data, and (ii) it receives such California User Data from Customer pursuant to and solely for the provision of Cutover Services and its legitimate business purposes. To the extent applicable, Customer represents and warrants to Cutover that it is (i) acting as a business in connection with this Agreement with respect to any California User Data, and (ii) sharing and making available to Cutover the California User Data pursuant to and solely for a legitimate business purpose and in accordance with the CCPA. Cutover shall not sell, retain, use or disclose California User Data (x) for any purpose (commercial or otherwise) other than for the specific purpose of providing the Cutover Services and performing its obligations under this Agreement, or (y) outside of the direct business relationship between Cutover and Customer. Cutover certifies that it understands and will comply with the restrictions in the foregoing sentence. Additionally, Cutover confirms that its Sub-Processors are acting as service providers and have entered into written contracts with Cutover containing terms with substantially similar effect to those in this clause restricting Sub-Processor’s use of California User Data. As used in this clause, “California User Data" means the personal information of consumers (whether the Users or other representatives) of Customer or its Affiliates provided or made available by Customer to Cutover in connection with this Agreement and the provision of Cutover Services. “CCPA" means the California Consumer Privacy Act 2018, Cal. Civ. Code § 1798.100 et seq as amended by the California Privacy Rights Act of 2020, and any regulations promulgated thereunder, in each case, as amended from time to time. The terms “business", “business purpose", “consumer", “personal information", “sell" and “service provider have the meaning given to each term in the CCPA.

California Consumer Privacy Act. (CCPA) | To the extent applicable‌ Consultant agrees that, Cutover represents and warrants to Customer that (i) it is acting as a service provider in connection with this Agreement with respect to any California User Datathe performance of its obligations hereunder, and (ii) it receives such California User Data from Customer pursuant to and solely for the provision of Cutover Services and its legitimate business purposes. To the extent applicable, Customer represents and warrants to Cutover that it is (i) acting as a business in connection with this Agreement with respect to any California User Data, and (ii) sharing and making available to Cutover “service provider” of Company within the meaning of the California User Data pursuant Consumer Privacy Act (as in effect from time to and solely for a legitimate business purpose and in accordance time, including all applicable regulations issued thereunder, the “CCPA”). Accordingly, Consultant agrees to comply with all of the requirements of the CCPA that apply to service providers (as defined under the CCPA. Cutover shall not sell), retainincluding without limitation the prohibition on retaining, use using, selling or disclose California User Data disclosing personal information (xas so defined) provided by or collected on behalf of Company for any purpose (commercial or otherwise) other than for the specific business purpose of providing performing obligations on behalf of Company hereunder, or as otherwise permitted under the Cutover Services and performing CCPA. Moreover, to the extent Consultant’s obligations under this Agreement include the collection of personal information on behalf of Company, Consultant agrees that it shall limit the personal information it collects to that personal information which is necessary to enable it to perform its obligations under this AgreementContract. Consultant will defend, indemnify and hold Company harmless from and against any claims and losses (including reasonable attorney’s fees) to the extent arising from actual or (y) outside alleged breaches of this Section or violations of the direct business relationship between Cutover and Customer. Cutover certifies that it understands and will comply CCPA by Consultant with the restrictions in the foregoing sentence. Additionally, Cutover confirms that its Sub-Processors are acting as service providers and have entered into written contracts with Cutover containing terms with substantially similar effect respect to those in this clause restricting Sub-Processor’s use of California User Data. As used in this clause, “California User Data" means the personal information of consumers (whether the Users received, collected, processed, disclosed or other representatives) of Customer or its Affiliates provided or made available retained by Customer to Cutover Consultant in connection with the performance or non- performance of its obligations under this Agreement and the provision of Cutover ServicesContract. “CCPA" means the California Consumer Privacy Act 2018Consultant further warrants, Cal. Civ. Code § 1798.100 et seq as amended by the California Privacy Rights Act of 2020acknowledges, and any regulations promulgated thereunderagrees that in the event: a. Company receives a verifiable consumer request from a consumer to delete the consumer’s personal information, Consultant shall delete the consumer’s personal information from its records promptly upon Company’s request. b. Company receives a verifiable consumer request from a consumer to provide the consumer with consumer’s personal information stored or retained by Consultant on behalf of Company, Consultant shall promptly provide Company all of the requesting consumer’s personal information retained in its records in a secure format and secure mean of transmission as is approved by Company and otherwise in a manner that is consistent with the requirements of the CCPA. c. Consultant either receives the foregoing requests to delete or disclose or receives a “do not sell” request, in each case, directly from a consumer whose personal information Consultant collects, processes, retains or stores on behalf of Company, Consultant shall provide prompt written notice to Company, and, as amended from time directed by Company, Consultant shall either act on behalf of Company in responding to time. The terms “business", “business purpose", “consumer", “personal information", “sell" and “the request or inform the consumer that the request cannot be acted upon because the request has been sent to a service provider have the meaning given to each term in the CCPA.instead of Company.‌

California Consumer Privacy Act. (CCPA) | To the extent applicable, Cutover represents and warrants to Customer that (i) it is acting as a service provider in connection with this Agreement with respect to any California User Data, and (ii) it receives such California User Data from Customer pursuant to and solely for the provision of Cutover Services and its a legitimate business purposespurpose. To the extent applicable, Customer represents and warrants to Cutover that it is (i) acting as a business in connection with this Agreement with respect to any California User Data, and (ii) sharing and making available to Cutover the California User Data pursuant to and solely for a legitimate business purpose and in accordance with the CCPA. Cutover shall not sell, retain, use or disclose California User Data (x) for any purpose (commercial or otherwise) other than for the specific purpose of providing the Cutover Services and performing its obligations under this Agreement, or (y) outside of the direct business relationship between Cutover and Customer. Cutover certifies that it understands and will comply with the restrictions in the foregoing sentence. Additionally, Cutover confirms that its Sub-Processors are acting as service providers and have entered into written contracts with Cutover containing terms with substantially similar effect to those in this clause restricting Sub-Processor’s use of California User Data. As used in this clause, “California User Data" means the personal information of consumers (whether the Users or other representatives) of Customer or its Affiliates provided or made available by Customer to Cutover in connection with this Agreement and the provision of Cutover Services. “CCPA" means the California Consumer Privacy Act 2018, Cal. Civ. Code § 1798.100 et seq as amended by the California Privacy Rights Act of 2020, and any regulations promulgated thereunder, in each case, as amended from time to time. The terms “business", “business purpose", “consumer", “personal information", “sell" and “service provider have the meaning given to each term in the CCPA.

California Consumer Privacy Act. 12.1 This Section shall apply only insofar as Customer Personal Data contains personal information subject to the CCPA (CCPAas defined below) | To the extent applicableand shall apply in addition to, Cutover represents and warrants to Customer that (i) it is acting as a service provider not in connection with this Agreement with respect to place of, any California User Data, and (ii) it receives such California User Data from Customer pursuant to and solely for the provision of Cutover Services and its legitimate business purposes. To the extent applicable, Customer represents and warrants to Cutover that it is (i) acting as a business in connection with this Agreement with respect to any California User Data, and (ii) sharing and making available to Cutover the California User Data pursuant to and solely for a legitimate business purpose and in accordance with the CCPA. Cutover shall not sell, retain, use or disclose California User Data (x) for any purpose (commercial or otherwise) other than for the specific purpose of providing the Cutover Services and performing its obligations under this Agreement, or (y) outside of the direct business relationship between Cutover and Customer. Cutover certifies that it understands and will comply with the restrictions in the foregoing sentence. Additionally, Cutover confirms that its Sub-Processors are acting as service providers and have entered into written contracts with Cutover containing terms with substantially similar effect to those requirements in this clause restricting Sub-Processor’s use of California User Data. As used in DPA. 12.2 In this clauseSection, “California User Data" means the personal information of consumers (whether the Users or other representatives) of Customer or its Affiliates provided or made available by Customer to Cutover in connection with this Agreement and the provision of Cutover Services. “CCPA" ” means the California Consumer Privacy Act 2018, Cal. Civ. Code § 1798.100 et seq of 2018 (as amended by the California Privacy Rights Act of 2020), codified at Cal. Civ. Code §§ 1798.100 – 1798.199.100, and any the California Consumer Privacy Act Regulations issued thereto, Cal. Code Regs. tit. 11, div. 6, ch. 1, each as amended. 12.3 The Parties agree as follows: (a) Each party shall comply with their respective applicable obligations under the CCPA and rules or regulations promulgated thereunder, in each case, and provide the same level of privacy protection as amended from time to timeis required under the CCPA; (b) Heap shall promptly notify the Customer if Heap determines that it can no longer meet its obligations under this Addendum or the CCPA. The terms “business", “business purpose", “consumer", “personal information", “sell" and “service provider Customer shall have the meaning given right, upon notice, to each term take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information by Heap. (c) Heap is processing Customer Personal Data subject to the CCPA for, or on behalf of, Customer, or Customer has made available Customer Personal Data to Heap, for the business or commercial purpose(s) identified in the Agreement. (d) Heap shall not retain, use or disclose Customer Personal Data for any purpose outside the scope of the business relationship of the parties and other than for the specific purpose of performing services specified in the Agreement (including retaining, using or disclosing the Customer Personal Data for a commercial purpose other than providing the services specified in the Agreement) or as otherwise permitted by the CCPA as applicable to service providers; (e) Heap shall not collect or use Customer Personal Data except to perform the services pursuant to the Agreement; (f) Heap shall not Sell or Share (as defined in the CCPA), rent, release, disclose, disseminate, make available, transfer, or otherwise communicate Customer Personal Data that Heap receives from, or on behalf of, Customer to any third party for monetary or other valuable consideration. (g) If Customer discloses deidentified Customer Personal Data to Heap, or Heap deidentifies Customer Personal Data previously disclosed by Customer, Heap shall take reasonable measures to ensure the deidentified Customer Personal Data cannot be associated with a consumer or household and shall not attempt to reidentify the deidentified personal information. (h) Heap shall use reasonable efforts to assist Customer in Customer’s fulfilment of its obligation to respond to California residents’ requests to exercise rights with respect to their Customer Personal Data under the CCPA. (i) Heap certifies it understands the obligations and restrictions contained above and will comply with them.

California Consumer Privacy Act. (CCPA) | To the extent applicable, Cutover represents The parties acknowledge and warrants to Customer agree that (i) it Arctic Wolf is acting as a service provider in connection with this Agreement with respect to any for the purposes of the California User DataConsumer Privacy Act, as supplemented by the California Privacy Rights Act (collectively, the “CCPA”) and (iimay receive(aspers defined by the CCPA) it receives such California User Data from Customer pursuant to and solely this Agreement for the provision of Cutover Services certain purchased or licensed cybersecurity operations solutions and/or services as chosen by CustomBeursineassnPdurporsee”f.)Tlhee cpatrtieesdagreoe nto alawanys cOomrpdly ewirth theForm applicable provisions of the CCPA in respect to the collection, transmission, and its legitimate business purposesprocessing of all personal information (as defined by the CCPA) exchanged or shared pursuant to the Agreement. To the extent applicable, Customer represents and warrants to Cutover that it is Arctic Wolf shall not (i) acting as a business in connection with this Agreement with respect to sell any California User Data, and such personal information; (ii) sharing and making available to Cutover the California User Data pursuant to and solely for a legitimate business purpose and in accordance with the CCPA. Cutover shall not sell, retain, use or disclose California User Data (x) for any purpose (commercial or otherwise) other than personal information provided by Customer pursuant to this Agreement except as necessary for the specific purpose of providing performing and/or delivering the Cutover Services Business Purpose to Customer pursuant to this Agreement or as permitted by the CCPA, as well as any support and performing its obligations under this Agreementother ancillary services (including, without limitation, services to prevent or address service or technical problems) related to the Solutions; (iii) retain, use, or disclose such personal information for a commercial purpose other than performing the Business Purpose unless otherwise explicitly permitted under the Agreement; (yiv) retain, use, or disclose such personal information outside of the direct business relationship between Cutover Customer and Arctic Wolf for the Business Purpose unless otherwise permitted under the Agreement; or (v) combine any such personal information with personal information that it receives from or on behalf of any other person(s) or collects from its own interaction with the consumer, provided that Arctic Wolf may combine personal information to perform any purpose as defined in and as permitted under the CCPA. Arctic Wolf further agrees that it will: (i) comply with all applicable obligations under the CCPA and Arctic Wolf will provide the same level of privacy protection as is required by the CCPA; (ii) allow Customer to take reasonable and appropriate steps to help to ensure that Arctic Wolf uses personal information in a manner consistent with Customer’s obligat;iaondn(isii) alluownCduestormert, uhpoen noCticCe,PtoAtake reasonable and appropriate steps to stop and remediate unauthorized use of personal information. Cutover The terms “pers“ocnoanlsui“nmsfeorr”vm,iacteiopnr,o“”vsihdaaernred,”“s“eslal”e,a”re in Section 1798.140 of the CCPA. Arctic Wolf certifies that it understands the restrictions of this Section 4.6 and will comply with them and will notify Customer if Arctic Wolf decides that it can no longer meet its obligations under the restrictions CCPA. It is Customer’s sole respon of any requests from consumers (as defined in the foregoing sentence. Additionally, Cutover confirms that its Sub-Processors are acting as service providers and have entered into written contracts with Cutover containing terms with substantially similar effect CCPA) seeking to those exercise rights afforded in this clause restricting Sub-Processor’s use of California User Data. As used in this clause, “California User Data" means the CCPA regarding personal information of consumers (whether the Users received or other representatives) of Customer or its Affiliates provided or made available by Customer to Cutover processed in connection with this Agreement and the provision of Cutover ServicesSolutions. “CCPA" means the California Consumer Privacy Act 2018, Cal. Civ. Code § 1798.100 et seq as amended by the California Privacy Rights Act of 2020, and any regulations promulgated thereunder, Arctic Wolf agrees to provide reasonable cooperation to Customer in each case, as amended from time to time. The terms “business", “business purpose", “consumer", “personal information", “sell" and “service provider have the meaning given to each term in the CCPAconnection with such requests.