CCPA Service Provider Addendum

This CCPA Service Provider Addendum (“Addendum”) is entered into between Lending Tower (“Lending Tower”) and [Add service provider} (“Service Provider”) effective as of December 21, 2020 and supplements any and all service agreements, service orders, statements of work or other contractual arrangements (collectively, the “Agreement”) previously entered into between the parties whereby Service Provider provides certain services to Lending Tower. 

RECITALS

Lending Tower and its affiliates collect personal information that it may disclose to Service Provider for processing and other business purposes pursuant to the Agreement.  The parties want to ensure that there are adequate contractual terms in place between Lending Tower and Service Provider as necessary for the parties to comply with their respective obligations under the California Consumer Privacy Act of 2018 (the “CCPA”). 

TERMS OF AGREEMENT

• For purposes of this Addendum: (a) “business purpose,” “commercial purpose,” “processing,” “sell,” and “service provider” shall have the meanings given to them in the CCPA; (b) “Services” shall refer to the services provided to Lending Tower by Service Provider pursuant to the Agreement; (c) “Personal Information” means the personal information of California consumers that Service Provider has received from and processed on behalf of Lending Tower, whether before or after the date hereof, in connection with the provision of Services.

• With respect to the Personal Information of California consumers, Service Provider and Lending Tower agree that Service Provider is a service provider processing on behalf of Lending Tower.  Except as otherwise permitted by the CCPA, Service Provider is prohibited from: (a) selling Personal Information; and (b) retaining, using, or disclosing Personal Information for any purpose other than for the specific purpose of performing the Services which, for the avoidance of doubt, prohibits Service Provider from retaining, using, or disclosing Personal Information outside of its direct business relationship with Lending Tower or for any other commercial purpose.  Service Provider may, however, disclose the Personal Information to its own service providers where Service Provider has carried out adequate due diligence on each such service provider and included in its agreement with each such service provider terms that are equivalent to those set forth in this Addendum.

• Service Provider shall promptly and in good faith take such actions and provide such information and assistance as Lending Tower may reasonably request to enable Lending Tower to honor requests of individuals to exercise their rights under the CCPA and other applicable data privacy laws, including requests to access, delete, and opt-out of the sale of their Personal Information including: (a) providing Lending Tower with a mechanism to notify Service Provider of requests by California consumers to exercise their CCPA rights; (b) complying  with any notifications provided by Lending Tower to delete Personal Information from its systems and that of any service provider it may use to perform the Services under the Agreement; and (c) providing verification to Lending Tower that the applicable requests have been fulfilled.

• Service Provider shall give Lending Tower written notice of any requests under the CCPA or other applicable data privacy laws that Service Provider may receive directly from individuals that pertain to the Services provided under the Agreement. 

• Service Provider hereby certifies that it understands and will comply with the restrictions and requirements set forth in this Addendum.

• Lending Tower and Service Provider each acknowledge and agree that this Addendum is limited to the applicable Services. Should Lending Tower and Service Provider enter into any other agreement for any additional services or should the scope of the Services change such that Service Provider no longer serves as a service provider to Lending Tower for such Services, Service Provider shall provide Lending Tower with notice of such change. In such an event, the parties shall take such steps as are reasonably necessary to comply with the CCPA and applicable data privacy laws with respect to such Services. 

• If the Agreement is terminated and Service Provider no longer provides Services to Lending Tower, Service Provider shall promptly delete all Lending Tower data residing on Service Provider systems and on the systems of any of its service providers and shall provide Lending Tower with written certification of such deletion.

• Without limitation or exclusion of any other indemnification obligation in the Agreement, Service Provider will indemnify, defend and hold harmless Lending Tower, its employees, shareholders, licensees and agents (each an “Indemnitee”) from and against any and all losses, claims and expenses (including attorneys’ fees and costs) (each a “Loss”) to the extent arising from or related to any actual or alleged: (a) breach of Service Provider’s obligations under this Addendum; or (b) violation of the CCPA or other applicable data privacy laws by Service Provider or any entity that Service Provider provided Personal Information to.  This Section 8, along with Section 9 hereof, shall survive termination of the Agreement.

• If Lending Tower becomes aware of a third-party claim (a “Claim”) that (if successful) would result in a Loss under Section 8, it will promptly notify the Service Provider in writing. Failure or delay in giving such notice will not affect the right to indemnification except to the extent that it prejudices the defense of the subject Claim. Service Provider shall assume the defense of such Claim within 15 days after receiving the notice of the Claim. Until such assumption of the defense, the applicable Indemnitee(s) may take any action that it reasonably deem(s) appropriate to protect its/their interest(s) or those of Service Provider, provided such action is not prejudicial to Service Provider.   The applicable Indemnitee(s) shall reasonably cooperate with the defense of such Claim and may retain separate counsel at its/their own expense to participate in, but not control, the defense.  Neither Service Provider nor any Indemnitee may settle a Claim without the consent of the other party(ies), provided that such consent may not be unreasonably withheld, conditioned or delayed.
• Except as otherwise provided herein, all other terms and conditions of the Agreement shall remain unmodified and in full force and effect. This Addendum shall govern in the event of any conflict or inconsistency between this Addendum and the Agreement.

 

IN WITNESS WHEREOF, Lending Tower and Service Provider have caused this Addendum to be executed by their duly authorized representatives.