California Service Provider Addendum

This California Service Provider Addendum (this “Addendum”) is attached to and made a part of the Compa SaaS Customer Agreement between Compa Technologies, Inc. (“Compa”) and [_____________] (“Business”) dated [________], as amended, supplemented, or otherwise modified by Compa and Business (the “Agreement”).  Capitalized terms used in this Addendum but not defined herein will have the same meaning as in the Agreement.  If there is any inconsistency between the terms of this Addendum and the Agreement relating to data protection or Personal Information, the terms of this Addendum shall prevail.  This Addendum shall continue in force until the termination of the Agreement.

This Addendum sets forth the requirements for the processing by Compa of the Personal Information of Consumers pursuant to the Agreement.

1. Definitions

1.1 “Aggregate Consumer Information” has the meaning provided in Section 1798.140(a) of the California Civil Code.

1.2 “California Consumer Privacy Act” means Sections 1798.100 et seq. of the California Civil Code.

1.3 “Commercial Purpose” has the meaning provided in Section 1798.140(f) of the California Civil Code.

1.4 “Consumer” has the meaning provided in Section 1798.140(g) of the California Civil Code.

1.5 “Deidentified” has the meaning provided in Section 1798.140(h) of the California Civil Code.

1.6 “Personal Information” has the meaning provided in Section 1798.140(o) of the California Civil Code.

1.7 “Sale” or “Sell” has the meaning provided in Section 1798.140(t) of the California Civil Code.

2. Representations and Warranties

2.1 Compa represents and warrants that it is a “service provider,” for the purposes of the services it provides to Business pursuant to the Agreement, according to the meaning given to that term in Section 1798.140(v) of the California Civil Code.

2.2 Business represents and warrants that Compa processes Personal Information on Business’s behalf and that it alone, or jointly with others, determines the purposes and means of processing Consumer Personal Information subject to the Agreement. 

2.3 Compa represents and warrants that, to the extent that Business discloses Consumer Personal Information to Compa, Compa will process that Personal Information only on behalf of Business pursuant to the Agreement and this Addendum.

3. Compa’s Processing of Personal Information of Consumers as a Service Provider

3.1 Business shall not Sell Consumer Personal Information for any reason, except as otherwise permitted by the California Consumer Privacy Act.

3.2 Business shall not process, retain, use, or disclose Consumer Personal Information for any purpose other than for the specific purpose of performing the services specified in the Agreement, except as otherwise permitted by the California Consumer Privacy Act. 

3.3 Business shall not process, retain, use, or disclose Consumer Personal Information for an impermissible Commercial Purpose, except as otherwise permitted by the California Consumer Privacy Act. 

3.4 Business shall not retain, use, or disclose Consumer Personal Information outside of the direct business relationship between Business and Compa, except as otherwise permitted by the California Consumer Privacy Act. 

3.5 Business certifies that it understands the restrictions listed in Sections 3.1, 3.2, 3.3, and 3.4 of this Addendum and will comply with them. 

4. Deidentified and Aggregated Information

4.1 Business agrees that Compa has the right to deidentify and aggregate Consumer Personal Information subject to the Agreement. 

4.2 Compa agrees to comply with all of the requirements in the California Consumer Privacy Act relating to Deidentified information and Aggregate Consumer Information. 

5. Consumer Requests 

5.1 Compa shall provide to Business any Consumer requests to exercise rights under the California Consumer Privacy Act, received directly by Compa relating to Business Consumer within a reasonable time period upon receiving such a request.   

5.2 Upon written request from Business, Compa shall delete a Consumer’s Personal Information from its systems within 30 business days.

__________________________ ___________________________

On behalf of Compa             On behalf of Business

__________________________ ____________________________

Date Date