Controlling Access to Personally-Identifiable Information Sample Clauses

Controlling Access to Personally-Identifiable Information. 1. Access to Personally-Identifiable Information stored on Company’s systems must not be granted to members of Company’s staff, subcontractors, or other agents, unless all of the following conditions are met: a. The staff member, subcontractor, or other agent requesting the access can be uniquely identified (e.g., by a unique User ID), with the exception of “root” password access provided by the Company to its core system administration team; b. The staff member, subcontractor, or other agent requesting the access has entered a correct password or other authorizing token to indicate that he/she is the authorized user of this account. If passwords are the only method used for authentication, they must satisfy certain minimal standards mutually agreeable to Intuit and Company that make them sufficiently robust to effectively resist both educated guessing and brute-force attacks. It is recommended that passwords be a minimum of 8 characters in length, contain mixed upper- and lower-case characters and non-alphabetic characters, and be changed every 90 days. c. In all cases, access permissions must be established in a manner that allows only for the minimum access level(s) required for each staff member, subcontractor, or other agent to perform his or her job function. The ability to read, write, modify or delete Personally-Identifiable Information must be limited to those individuals who are specifically authorized to perform those data maintenance functions. d. Whenever Personally-Identifiable Information is modified, the date, time, and requestor must be recorded in a log file. 2. Personally-Identifiable Information stored on Company’s systems must be stored behind firewalls with access to such information limited as described in paragraph A.1. 3. It is recommended that Secret Information never be stored in clear text on Company’s systems. At a minimum, it is recommended that financial services industry-standard encryption techniques be employed to safeguard Secret Information in Company’s systems from retrieval by unauthorized persons. Whenever possible, it is recommended that message digest algorithms such as SHA-1 or MD5 be used to hash and verify the user’s password, and that “salt” be added to the input string prior to encoding to make it unlikely that the same password text chosen by different users will yield identical encodings. 4. Passwords used by Company’s customers are not required to conform to the password standards described in paragraph A.1....
AutoNDA by SimpleDocs

Related to Controlling Access to Personally-Identifiable Information

  • Personally Identifiable Information By submitting any of your personally identifiable information, such as your name, address, email address, phone number or fax number, to us, you consent to our privacy policy located at xxx.xxxxxxxx.xxx/xxxxx.

  • Personally Identifiable Information (PII); Security a. If Grantee or any of its subcontractors may or will create, receive, store or transmit PII under the terms of this Agreement, Grantee must provide for the security of such PII, in a form acceptable to Florida Housing, without limitation, non-disclosure, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections and audits. Grantee shall take full responsibility for the security of all data in its possession or in the possession of its subcontractors and shall hold Florida Housing harmless for any damages or liabilities resulting from the unauthorized disclosure of loss thereof. b. If Grantee or any of its subcontractors may or will create, receive, store or transmit PII under the terms of this Agreement, Grantee shall provide Florida Housing with insurance information for stand-alone cyber liability coverage, including the limits available and retention levels. If Grantee does not carry stand-alone cyber liability coverage, Grantee agrees to indemnify costs related to notification, legal fees, judgments, settlements, forensic experts, public relations efforts, and loss of any business income related to this Agreement. c. Grantee agrees to maintain written policies and procedures for PII and/or data classification. This plan must include disciplinary processes for employees that violate these guidelines. d. Grantee agrees at all times to maintain reasonable network security that, at a minimum, includes a network firewall. e. Grantee agrees to protect and maintain the security of data with protection security measures that include maintaining secure environments that are patched and up to date with all appropriate security updates as designated by a relevant authority (e.g. Microsoft notifications, Common Vulnerabilities and Exposures (CVE) database, etc.) Grantee agrees that PII shall be appropriately destroyed based on the format stored upon the expiration of any applicable retention schedules. f. Grantee agrees that any and all transmission or exchange of system application data with Florida Housing and/or any other parties shall take place via secure Advanced Encryption Standards (AES), e.g. HTTPS, FTPS, SFTP or equivalent means. All data stored as a part of backup and recovery processes shall be encrypted, using AES. g. If Grantee reasonably suspects that a cybersecurity event or breach of security has occurred, they must notify Florida Housing’s Contract Administrator within 48 hours. h. In the event of a breach of PII or other sensitive data, Grantee must abide by provisions set forth in Section 501.171, Fla. Stat. Additionally, Grantee must immediately notify Florida Housing in writing of the breach and any actions taken in response to such a breach. As the information becomes available the statement must include, at a minimum, the date(s) and number of records affected by unauthorized access, distribution, use, modification or disclosure of PII; Grantee’s corrective action plan; and the timelines associated with the corrective action plan.

  • Access to Personal Information by Subcontractors Supplier agrees to require any subcontractors or agents to which it discloses Personal Information under this Agreement or under any SOW to provide reasonable assurance, evidenced by written contract, that they will comply with the same or substantially similar confidentiality, privacy and security obligations with respect to such Personal Information as apply to Supplier under this Agreement or any SOW. Supplier shall confirm in writing to DXC that such contract is in place as a condition to DXC’s approval of use of a subcontractor in connection with any SOW. Upon request of DXC, Supplier will provide to DXC a copy of the subcontract or an extract of the relevant clauses. Supplier shall ensure that any failure on the part of any subcontractor or agent to comply with the Supplier obligations under this Agreement or any SOW shall be grounds to promptly terminate such subcontractor or agent. If during the term of this Agreement or any SOW, DXC determines, in its exclusive discretion, that any Supplier subcontractor or agent cannot comply with the Supplier obligations under this Agreement or with any SOW, then DXC may terminate this Agreement in whole or in part (with respect to any SOW for which such subcontractor or agent is providing services), if not cured by Supplier within the time prescribed in the notice of such deficiency.

  • Safeguards for Personal Information Supplier agrees to develop, implement, maintain, and use administrative, technical, and physical safeguards, as deemed appropriate by DXC, to preserve the security, integrity and confidentiality of, and to prevent intentional or unintentional non-permitted or violating use or disclosure of, and to protect against unauthorized access to or accidental or unlawful destruction, loss, or alteration of, the Personal Information Processed, created for or received from or on behalf of DXC in connection with the Services, functions or transactions to be provided under or contemplated by this Agreement. Such safeguards shall meet all applicable legal standards (including any encryption requirements imposed by law) and shall meet or exceed accepted security standards in the industry, such as ISO 27001/27002. Supplier agrees to document and keep these safeguards current and shall make the documentation available to DXC upon request. Supplier shall ensure that only Supplier’s employees or representatives who may be required to assist Supplier in meeting its obligations under this Agreement shall have access to the Personal Information.

  • ACCESS TO PROTECTED HEALTH INFORMATION 7.1 To the extent Covered Entity determines that Protected Health Information is maintained by Business Associate or its agents or Subcontractors in a Designated Record Set, Business Associate shall, within two (2) business days after receipt of a request from Covered Entity, make the Protected Health Information specified by Covered Entity available to the Individual(s) identified by Covered Entity as being entitled to access and shall provide such Individuals(s) or other person(s) designated by Covered Entity with a copy the specified Protected Health Information, in order for Covered Entity to meet the requirements of 45 C.F.R. § 164.524. 7.2 If any Individual requests access to Protected Health Information directly from Business Associate or its agents or Subcontractors, Business Associate shall notify Covered Entity in writing within two (2) days of the receipt of the request. Whether access shall be provided or denied shall be determined by Covered Entity. 7.3 To the extent that Business Associate maintains Protected Health Information that is subject to access as set forth above in one or more Designated Record Sets electronically and if the Individual requests an electronic copy of such information, Business Associate shall provide the Individual with access to the Protected Health Information in the electronic form and format requested by the Individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by Covered Entity and the Individual.

  • Collection of Personal Information 10.1 The Subscriber acknowledges and consents to the fact that the Issuer is collecting the Subscriber’s personal information for the purpose of fulfilling this Agreement and completing the Offering. The Subscriber acknowledges that its personal information (and, if applicable, the personal information of those on whose behalf the Subscriber is contracting hereunder) may be included in record books in connection with the Offering and may be disclosed by the Issuer to: (a) stock exchanges or securities regulatory authorities, (b) the Issuer's registrar and transfer agent, (c) tax authorities, (d) authorities pursuant to the PATRIOT Act (U.S.A.) and (e) any of the other parties involved in the Offering, including the Issuer’s Counsel. By executing this Agreement, the Subscriber is deemed to be consenting to the foregoing collection, use and disclosure of the Subscriber's personal information (and, if applicable, the personal information of those on whose behalf the Subscriber is contracting hereunder) for the foregoing purposes and to the retention of such personal information for as long as permitted or required by applicable laws. Notwithstanding that the Subscriber may be purchasing the Note as agent on behalf of an undisclosed principal, the Subscriber agrees to provide, on request, particulars as to the nature and identity of such undisclosed principal, and any interest that such undisclosed principal has in the Issuer, all as may be required by the Issuer in order to comply with the foregoing. 10.2 Furthermore, the Subscriber is hereby notified that the Issuer may deliver to any government authority having jurisdiction over the Issuer, the Subscriber or this Subscription, including the SEC and/or any state securities commissions, certain personal information pertaining to the Subscriber, including the Subscriber’s full name, residential address and telephone number, the number of Shares or other securities of the Issuer owned by the Subscriber, the principal amount of Note purchased by the Subscriber, the total Subscription Amount paid for the Note and the date of distribution of the Note.

  • Access to Company Information (a) During the period from the date of this Agreement to the Effective Time, the Company shall permit representatives of the Parent to have reasonable access (at all reasonable times, and in a manner so as not to interfere with the normal business operations of the Company) to all premises, properties, financial and accounting records, contracts, other records and documents, and personnel, of or pertaining to the Company. (b) The Parent and each of its Subsidiaries (i) shall treat and hold as confidential any Company Confidential Information (as defined below), (ii) shall not use any of the Company Confidential Information except in connection with this Agreement, and (iii) if this Agreement is terminated for any reason whatsoever, shall return to the Company all tangible embodiments (and all copies) thereof which are in its possession. For purposes of this Agreement, “Company Confidential Information” means any information of the Company that is furnished to the Parent or any of its Subsidiaries by the Company in connection with this Agreement; provided, however, that it shall not include any information (A) which, at the time of disclosure, is available publicly other than as a result of non-permitted disclosure by the Parent, any of its Subsidiaries or their respective directors, officers, or employees, (B) which, after disclosure, becomes available publicly through no fault of the Parent, any of its Subsidiaries or their respective directors, officers, or employees, (C) which the Parent or any of its Subsidiaries knew or to which the Parent or any of its Subsidiaries had access prior to disclosure, as demonstrated by competent evidence, provided that the source of such information is not known by the Parent or any of its Subsidiaries to be bound by a confidentiality obligation to the Company, or (D) which the Parent or any of its Subsidiaries rightfully obtains from a source other than the Company, provided that the source of such information is not known by the Parent or any of its Subsidiaries to be bound by a confidentiality obligation to the Company.

  • Use of De-identified information De-identified information may be used by the Contractor for the purposes of development, research, and improvement of educational sites, services, or applications, as any other member of the public or party would be able to use de-identified data pursuant to 34 CFR 99.31(b). Contractor agrees not to attempt to re-identify de-identified Student Data.

  • Access; Information (a) Each of the Company and the Acquiror agrees that upon reasonable notice and subject to applicable laws relating to the exchange of information, it shall afford the other party and the other party's officers, employees, counsel, accountants and other authorized representatives, such access during normal business hours throughout the period prior to the Effective Time to the books, records (including, without limitation, tax returns and work papers of independent auditors), properties, personnel and to such other information as any party may reasonably request and, during such period, it shall furnish promptly to such other party (i) a copy of each material report, schedule and other document filed by it pursuant to the requirements of federal or state securities or banking laws, and (ii) all other information concerning the business, properties and personnel of it as the other may reasonably request. (b) Each of the Company and the Acquiror agrees that it will not, and will cause its representatives not to, use any information obtained pursuant to this Section 5.05 for any purpose unrelated to the consummation of the transactions contemplated by this Agreement. Subject to the requirements of law, each party will keep confidential, and will cause its representatives to keep confidential, all information and documents obtained pursuant to this Section 6.05 unless such information (i) was already known to such party, (ii) becomes available to such party from other sources not known by such party to be bound by a confidentiality obligation, (iii) is disclosed with the prior written approval of the party to which such information pertains or (iv) is or becomes readily ascertainable from published information or trade sources. In the event that this Agreement is terminated or the transactions contemplated by this Agreement shall otherwise fail to be consummated, each party shall promptly cause all copies of documents or extracts thereof containing information and data as to another party hereto to be returned to the party which furnished the same. No investigation by either party of the business and affairs of the other shall affect or be deemed to modify or waive any representation, warranty, covenant or agreement in this Agreement, or the conditions to either party's obligation to consummate the transactions contemplated by this Agreement.

  • Verizon OSS Information 8.5.1 Subject to the provisions of this Section 8 and Applicable Law, Verizon grants to Reconex a non-exclusive license to use Verizon OSS Information. 8.5.2 All Verizon OSS Information shall at all times remain the property of Verizon. Except as expressly stated in this Section 8, Reconex shall acquire no rights in or to any Verizon OSS Information. 8.5.2.1 The provisions of this Section 8.5.2 shall apply to all Verizon OSS Information, except (a) Reconex Usage Information, (b) CPNI of Reconex, and (c) CPNI of a Verizon Customer or a Reconex Customer, to the extent the Customer has authorized Reconex to use the Customer Information. 8.5.2.2 Verizon OSS Information may be accessed and used by Reconex only to provide Telecommunications Services to Reconex Customers. 8.5.2.3 Reconex shall treat Verizon OSS Information that is designated by Verizon, through written or electronic notice (including, but not limited to, through the Verizon OSS Services), as “Confidential” or “Proprietary” as Confidential Information of Verizon pursuant to Section 10 of the Agreement. 8.5.2.4 Except as expressly stated in this Section 8, this Agreement does not grant to Reconex any right or license to grant sublicenses to other persons, or permission to other persons (except Reconex’s employees, agents or contractors, in accordance with Section 8.5.2.5 below, to access, use or disclose Verizon OSS Information. 8.5.2.5 Reconex’s employees, agents and contractors may access, use and disclose Verizon OSS Information only to the extent necessary for Reconex’s access to, and use and disclosure of, Verizon OSS Information permitted by this Section 8. Any access to, or use or disclosure of, Verizon OSS Information by Reconex’s employees, agents or contractors, shall be subject to the provisions of this Agreement, including, but not limited to, Section 10 of the Agreement and Section 8.5.2.3 above. 8.5.2.6 Reconex’s license to use Verizon OSS Information shall expire upon the earliest of: (a) the time when the Verizon OSS Information is no longer needed by Reconex to provide Telecommunications Services to Reconex Customers; (b) termination of the license in accordance with this Section 8; or (c) expiration or termination of the Agreement. 8.5.2.7 All Verizon OSS Information received by Reconex shall be destroyed or returned by Reconex to Verizon, upon expiration, suspension or termination of the license to use such Verizon OSS Information. 8.5.3 Unless sooner terminated or suspended in accordance with the Agreement or this Section 8 (including, but not limited to, Section 2.2 of the Agreement and Section 8.6.1 below), Reconex’s access to Verizon OSS Information through Verizon OSS Services shall terminate upon the expiration or termination of the Agreement. 8.5.3.1 Verizon shall have the right (but not the obligation) to audit Reconex to ascertain whether Reconex is complying with the requirements of Applicable Law and this Agreement with regard to Reconex’s access to, and use and disclosure of, Verizon OSS Information. 8.5.3.2 Without in any way limiting any other rights Verizon may have under the Agreement or Applicable Law, Verizon shall have the right (but not the obligation) to monitor Reconex’s access to and use of Verizon OSS Information which is made available by Verizon to Reconex pursuant to this Agreement, to ascertain whether Reconex is complying with the requirements of Applicable Law and this Agreement, with regard to Reconex’s access to, and use and disclosure of, such Verizon OSS Information. The foregoing right shall include, but not be limited to, the right (but not the obligation) to electronically monitor Reconex’s access to and use of Verizon OSS Information which is made available by Verizon to Reconex through Verizon OSS Facilities. 8.5.3.3 Information obtained by Verizon pursuant to this Section 8.5.3.3 shall be treated by Verizon as Confidential Information of Reconex pursuant to Section 10 of the Agreement; provided that, Verizon shall have the right (but not the obligation) to use and disclose information obtained by Verizon pursuant to this Section 8.5.3.3 to enforce Verizon’s rights under the Agreement or Applicable Law.

Draft better contracts in just 5 minutes Get the weekly Law Insider newsletter packed with expert videos, webinars, ebooks, and more!