This Data Processing Addendum (“DPA”) amends and forms part of the Terms of Service by and between Judgment, Inc. and Customer (the “Terms”). Judgment Labs and Customer hereby adopt this DPA for so long as Judgment Labs processes Customer Personal Information (as defined herein) on Customer’s behalf pursuant to the Terms. In the event of a conflict between this DPA and the Terms with respect to the subject matter of this DPA, this DPA will control to the extent of such conflict.
1. Definitions.
Capitalized terms used in this DPA and not defined herein will have the meanings given to them by the Terms. As used in this DPA:
- “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020.
- “Consumer” means a natural person. Where applicable, Consumer shall be interpreted consistent with the same or similar term under the U.S. Privacy Laws.
- “Controller” means a person or entity that collects individuals’ Personal Information and alone, or jointly with others, determines the purposes and means of the Processing of such Personal Information. Where applicable, Controller shall be interpreted consistent with the same or similar term under the U.S. Privacy Laws.
- “Customer Personal Information” means Customer Data that constitutes Personal Information subject to U.S. Privacy Laws.
- “Data Security Requirements” means the Data Security Requirements, available at [insert hyperlink].
- “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable natural person or that otherwise constitutes “nonpublic personal information” under the GLBA (“NPI”). Where applicable, Personal Information shall be interpreted consistent with the same or similar term under U.S. Privacy Laws.
- “Processor” means “Processor,” “Service Provider,” or “Contractor” as those terms are defined in U.S. Privacy Laws.
- “Sale” and “Selling” have the meaning defined in the U.S. Privacy Laws.
- “Share,” “Shared,” and “Sharing” have the meaning defined in the CCPA.
- “U.S. Privacy Laws” means, collectively , the Gramm-Leach-Bliley Act (“GLBA”) and all U.S. federal and state privacy Laws, as amended or superseded from time to time, that apply generally to the Processing of individuals' Personal Information and that do not otherwise apply solely to specific industry sectors (e.g., healthcare providers), specific demographics (e.g., children), or specific classes of information (e.g., health or biometric information), in each case where applicable to the Processing of Customer Personal Information by Judgment Labs pursuant to the Terms. U.S. Privacy Laws may include, but are not limited to, the CCPA. In the event of a conflict in the meanings of defined terms in U.S. Privacy Laws, the meaning from the Law applicable to the state of residence of the relevant Consumer applies.
2. Scope, Roles, and Termination
- Applicability – This DPA applies only to Judgment Labs’s Processing of Customer Personal Information for the nature, purposes, and duration set forth in the Terms
- Roles of the Parties – For the purposes of the Terms and this DPA, Customer is the party responsible for determining the purposes and means of Processing Customer Personal Information as the Controller and appoints Judgment Labs as a Processor to Process Customer Personal Information on Customer’s behalf for the limited and specific purposes set forth in the Terms
- Obligations at Termination – Upon termination of the Terms, except as set forth therein or herein, Judgment Labs will discontinue Processing and destroy or return Customer Personal Information in its or its subcontractors’ and sub-processors’ possession without undue delay in accordance with the Terms. Judgment Labs may retain Customer Personal Information to the extent required by Law but only to the extent and for such period as required by such Law and always provided that Judgment Labs shall take steps to ensure the confidentiality of all such Customer Personal Information.
3. Compliance
- Compliance with Obligations – Judgment Labs will take steps to ensure that its employees, agents, subcontractors, and sub-processors: (i) comply with applicable obligations of U.S. Privacy Laws; (ii) provide the level of privacy protection for Customer Personal Information required by applicable U.S. Privacy Laws; and (iii) provide Customer with reasonable assistance to enable Customer to fulfill Customer’s own obligations under applicable U.S. Privacy Laws.
- Compliance Assurance – Customer has the right to take reasonable and appropriate steps to ensure that Judgment Labs uses Customer Personal Information consistent with Customer’s obligations under applicable U.S. Privacy Laws.
- Compliance Monitoring – No more than once per calendar year, Judgment Labs will provide to Customer, upon Customer’s written request, information and documentation in Judgment Labs’s possession and control necessary to demonstrate Judgment Labs’s compliance with its obligations under this DPA.
- Compliance Remediation – Judgment Labs shall notify Customer if it determines that it can no longer meet its obligations under applicable U.S. Privacy Laws. Upon receiving notice from Judgment Labs in accordance with this subsection, Customer may direct Judgment Labs to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Information.
- Security – The parties shall implement and maintain no less than commercially reasonable security measures designed to protect Customer Personal Information from unauthorized access, destruction, use, modification, or disclosure. Such measures will comply in all material respects with the GLBA (including the FTC Safeguards Rule), as applicable, and will include, at a minimum, those measures set forth in the Data Security Requirements.
4. Restrictions on Processing
- Limitations on Processing – Judgment Labs will Process Customer Personal Information as instructed in the Terms. Except as expressly permitted by U.S. Privacy Laws, Judgment Labs is prohibited from: (i) Selling or Sharing Customer Personal Information; (ii) retaining, using, or disclosing Customer Personal Information for any purpose other than for the specific purpose of performing the Services; (iii) retaining, using, or disclosing Customer Personal Information outside of the direct business relationship between the parties; and (iv) combining Customer Personal Information with Personal Information obtained from, or on behalf of, sources other than Customer, except as expressly permitted under applicable U.S. Privacy Laws.
- Confidentiality – Judgment Labs shall take steps to ensure that its employees, agents, subcontractors, and sub-processors are subject to a duty of confidentiality with respect to Customer Personal Information.
- Sub-processors and Notice – Customer generally authorizes Judgment Labs to use the subprocessors identified in the subprocessor list available at [Subprocessor List URL]. Judgment Labs will maintain that list and provide notice of an intended addition or replacement by email to Customer's designated privacy or account-administration contact at least 30 calendar days before the new subprocessor begins processing Customer Personal Information for Customer. The notice will identify the subprocessor, its function, relevant processing locations, and intended start date. Customer is responsible for maintaining an accurate notice address. Posting the list alone does not replace the email notice. Customer may authorize earlier processing in writing. Judgment Labs shall take steps to ensure that Judgment Labs’s sub-processors who Process Customer Personal Information on Judgment Labs’s behalf agree in writing to the same or materially equivalent restrictions and requirements that apply to Judgment Labs in this DPA and the Terms with respect to Customer Personal Information, as well as to comply with U.S. Privacy Laws.
- Right to Object – Customer may object in writing within 30 calendar days after receipt of the notice, identifying reasonable, specific grounds relating to the protection of Customer Personal Information. In the absence of a timely objection, Customer is deemed not to object to the notified change. The parties will work in good faith to resolve a timely objection for up to 30 calendar days after Judgment Labs receives it. Judgment Labs may address the concern through additional safeguards or a commercially reasonable alternative, but is not required to develop custom functionality or incur disproportionate expense. Subject to the urgent-replacement provision below and applicable law, Judgment Labs will not permit the disputed subprocessor to process the objecting Customer's Personal Information while the objection is being resolved; this does not prevent use for customers who have not objected.
- Unresolved Objections – If no commercially reasonable resolution is available at the end of that period, either party may terminate only the affected Services on written notice before the disputed processing begins. Judgment Labs will refund prepaid fees attributable to the unused period of the terminated Services, and Customer will not owe future fees for those Services after the effective termination date. Fees already incurred and obligations for unaffected Services remain payable. This termination and limited refund are Customer's sole contractual remedy solely for an unresolved objection to an otherwise compliant subprocessor change; they do not limit remedies for a breach of the Terms or this DPA or rights that cannot be limited by law.
- Urgent Replacements – Where a replacement is reasonably necessary to address an urgent security risk, a legal requirement, or an unexpected provider failure that threatens service continuity, Judgment Labs may use a shorter notice period only to the extent permitted by applicable law, subject to equivalent contractual safeguards. Judgment Labs will give as much prior notice as reasonably practicable, explain the need for the shortened period, and retain the objection and affected-service termination process above. Customer may request that the affected processing be suspended while a timely objection is resolved. If the urgent replacement cannot lawfully proceed for that Customer, Judgment Labs may suspend or terminate only the affected Services, with the same treatment of unused prepaid fees.
5. Consumer Rights
- Judgment Labs shall provide commercially reasonable assistance to Customer for the fulfillment of Customer’s obligations to respond to U.S. Privacy Law-related Consumer rights requests regarding Customer Personal Information.
- Where applicable, Customer shall inform Judgment Labs of any Consumer rights request made pursuant to U.S. Privacy Laws with which Judgment Labs must comply. Customer shall provide Judgment Labs with the information necessary for Judgment Labs to comply with the request.
- Judgment Labs shall not be required to delete any Customer Personal Information to comply with a Consumer’s rights request directed by Customer if retaining such information is specifically permitted by applicable U.S. Privacy Laws; provided, however, that in such case, Judgment Labs shall not use Customer Personal Information retained for any purpose other than provided for by that exception.
6. Exemptions
- Notwithstanding any provision to the contrary in the Terms or this DPA, except with respect to NPI, the terms of this DPA shall not apply to Judgment Labs’s Processing of Customer Personal Information that is exempt from applicable U.S. Privacy Laws.
7. Changes to Applicable Privacy Laws
- The parties agree to cooperate in good faith to enter into additional terms to address any modifications, amendments, or updates to applicable statutes, regulations, or other laws pertaining to privacy and information security, including, where applicable, U.S. Privacy Laws.