This Data Processing Addendum (“Addendum”), forms part of the Master Services Agreement or other written or electronic agreement (“Master Agreement”) between Civia Inc. dba GovAI (“GovAI”), and the subscribing entity under the Master Agreement (the “Customer”, and collectively referred to as the “Parties”). This DPA forms an addendum to the Master Agreement, is subject to the terms thereof (including without limitation all provisions in respect of the disclaimer and limitation of liability) shall become legally binding as between the parties only where there is a Master Agreement in place between the parties that incorporates the terms of this DPA. Terms defined in the Master Agreement shall have the same meaning in this DPA unless otherwise indicated.
1. Definitions
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
“Applicable Law” means all laws and regulations that apply to the Processing of Personal Data under the Agreement.
“CCPA” means the California Consumer Privacy Act of 2018 (Cal. Civ. Code § 1798.100, et seq.), as may be amended, superseded or replaced from time to time, and its implementing regulations.
“Data Controller” means a person who alone or jointly with others determines the purposes and means of the Processing of Personal Data, including as applicable any “business” as that term is defined by CCPA.
“Data Processor” means a person who Processes Personal Data on behalf of the Data Controller, including as applicable any “service provider” as that term is defined by the CCPA.
“Data Security Measures” means technical and organisational measures that are aimed at ensuring a level of security of Personal Data that is appropriate to the risk of the Processing, including protecting Personal Data against accidental or unlawful loss, misuse, unauthorised access, disclosure, alteration, destruction, and all other forms of unlawful Processing, including measures to ensure the confidentiality of Personal Data.
“Data Subject” means an identified or identifiable natural person to which the Personal Data pertain.
“Instructions” means this Addendum and any further written agreement or documentation (including without limitation the Master Agreement) through which the Customer instructs GovAI to perform specific Processing of Personal Data.
“Personal Data” means any information relating to (i) an identified or identifiable natural person and, (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personal identifiable information under Applicable Law), in each case provided by Customer and Processed by GovAI in accordance with Customer’s Instructions pursuant to this Addendum; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data in the course of it being Processed by GovAI. “Process”, “Processed”, or “Processing” means any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable any “service provider” as that term is defined by the CCPA
“Services” means the services offered by GovAI and subscribed for by Customer under the Master Agreement.
“Sub-Processor” means the entity engaged by the Data Processor or any further Sub-Processor to Process Personal Data on behalf and under the authority of the Data Controller.
2. Obligations of Customer
The Customer is responsible for ensuring that the processing of Personal Data takes place in compliance with the Applicable Laws, and this Addendum. The Customer has the right and obligation to make decisions about the purposes and means of the processing of Personal Data. The Customer shall be responsible for ensuring that the processing of Personal Data, which the Data Processor is instructed to perform, has a legal basis and, if such legal basis is consent, the Customer shall retain copies of all relevant consents.
3. Obligations of GovAI
GovAI agrees to and warrants that it shall:
(a) Process Personal Data disclosed to it by Customer only on behalf of and in accordance with the Instructions of Customer, unless GovAI is otherwise required by Applicable Law, in which case GovAI shall inform Customer of that legal requirement before Processing the Personal Data, unless informing the Customer is prohibited by Applicable Law on important grounds of public interest. GovAI shall immediately inform Customer if, in GovAI’s opinion, an Instruction provided infringes Applicable Law;
(b) Ensure that any person authorised by GovAI to Process Personal Data in the context of the Services is subject to a duly enforceable contractual or statutory confidentiality obligation, and only processes Personal Data in accordance with the Instructions of the Data Controller;
(c) Notify Customer immediately in writing of any subpoena or other judicial or administrative order by a government authority or proceeding seeking access to or disclosure of Personal Data. Customer shall have the right to defend such action in lieu of and on behalf of GovAI. Customer may, if it so chooses, seek a protective order. GovAI shall reasonably cooperate with Customer in such defence;
(d) Provide assistance to Customer in complying with Customer’s obligations relating to the security of Personal Data, data protection impact assessments, and prior consultations with supervisory authorities, taking into account the nature of processing and the information available to GovAI;
(e) Maintain internal record(s) of Processing activities, copies of which shall be provided to Customer by GovAI or to supervisory authorities upon request; and (f) Inform Customer about any actions of a data protection authority against GovAI that could affect Customer’s Personal Data unless such notification is prohibited by Applicable Law.
4. Sub-Processing
(a) Customer acknowledges and agrees that (i) GovAI’s Affiliates may be retained as Sub-Processors; and (ii) GovAI and GovAI’s s Affiliates respectively may engage third-party Sub-Processors in connection with the provision of the Services where GovAI or a GovAI Affiliate has entered into a written agreement with each Sub-Processor containing data protection obligations not less protective than those in this Addendum and the Master Agreement with respect to the protection of Personal Data to the extent applicable to the nature of the Services provided by such Sub-Processor.
(b) GovAI’s current list of Sub-Processors for the Services identified is set out at https://trust.govai.com/subprocessors. Such Sub-Processor list shall include the identities of those Sub-Processors and the Processing purpose that they serve. Where Customer has a current paid subscription to the Services, GovAI shall provide written notification to Customer of a new Sub-Processor(s) in advance of GovAI’s authorizing or appointing any new Sub-Processor(s) to Process Personal Data in connection with the provision of the applicable Services. Customer hereby consents to these Sub-Processors, their locations and processing activities as it pertains to their Personal Data.
(c) Where Customer has a current paid subscription to the Services, Customer may object to GovAI’s use of a new Sub-Processor by notifying GovAI promptly in writing within thirty (30) days after receipt of GovAI’s notice in accordance with the mechanism set out above. In the event Customer objects to a new Sub-Processor, as permitted in the preceding sentence, GovAI will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-Processor without unreasonably burdening Customer. For the avoidance of doubt, Customer’s right of objection under this section 4(C) shall not delay GovAI’s appointment of any new Sub-Processor(s). If Customer objects to use of a new Sub-Processor(s), Customer should cease to use the affected Services until such time that Customer’s objection is addressed as described in this Section.
(d) GovAI shall be liable for the acts and omissions of its Sub-Processors to the same extent GovAI would be liable if performing the services of each Sub-Processor directly under the terms of this Addendum, except as otherwise set forth in the Master Agreement.
5. Compliance with Applicable Laws
(a) Each Party covenants and undertakes to the other that it shall comply with all Applicable Laws in the use of the Services.
(b) Without limiting the above, (i) Customer is responsible for ensuring that it has a lawful basis for the processing of Personal Information in the manner contemplated by this Master Agreement, and has adequate record of such basis (whether directly or through another third-party provider); and (ii) GovAI is not responsible for determining the requirements of laws applicable to Customer’s activities or that GovAI’s provision of the Services meet the requirements of such laws. As between the parties, Customer is responsible for the lawfulness of the Processing of the Customer Personal Data. Customer will not use the Services in conjunction with Personal Data to the extent that doing so would violate Applicable Laws.
6. Data Security and Retention
(a) GovAI will implement and maintain industry-standard technical and organizational measures to protect the security, confidentiality, and integrity of Personal Data as described in more detail in the Documentation available at https://trust.govai.com and, including: (i) encrypting Personal Data in transit over public networks using TLS or successor protocols; (ii) encrypting Personal Data at rest using industry-standard encryption; (iii) commercially reasonable measures to logically segregate Personal Data from other customers' data, including access controls; (iv) limiting personnel access to Personal Data on a need-to-know basis; (v) periodic security assessments appropriate to the nature of the Service; and (vi) privacy and security training for personnel who may access Personal Data. GovAI has obtained the third-party certifications and audits set forth in the Documentation, including without limitation SSAE 18 Service Organization Control (SOC) 2 report for the Service as described in the Documentation. Where Customer has a current paid subscription to the Services GovAI agrees to maintain these certifications or standards, or appropriate and comparable successors thereof, for the duration of the subscription term, and to make such reports available on request where Customer has a current paid subscription to the Services.
(b) In the event of a confirmed unauthorized acquisition of, or access to, Personal Data for which GovAI is responsible (a "Data Breach"), GovAI will notify Customer without undue delay and in any event within seventy-two (72) hours after becoming aware of the Data Breach, and will include, to the extent then known, the nature of the incident, categories of data affected, mitigation steps taken, and measures adopted to reduce the risk of recurrence.
(c) Where Customer has a current paid subscription to the Services, Customer retains full control over the retention and deletion of Personal Data throughout the contract lifecycle, including during any Pilot, the Term, and upon termination or expiration. Customer may configure data retention periods through in-app settings and may export Personal Data at any time during the Term. When Personal Data is removed from active production systems under Customer's retention settings, or upon termination or expiration, GovAI will preserve a complete export in Secure Cold Storage. Customer may retrieve that export during the Term or following termination or expiration. Exports are provided in a standard, non-proprietary flat-file format (for example, JSON or CSV), with data schema documentation describing the structure of the export. “Secure Cold Storage” means data that is archived in a secure manner and which is not otherwise readily accessible for general use through the Service. After Customer retrieves the export—or per configured retention settings, or as otherwise agreed in writing—GovAI will permanently delete remaining copies of Personal Data from its systems and sub-processors. Residual copies in backups will expire under ordinary backup cycles.
(d) Where Customer has a current paid subscription to the Services, Personal Data will be hosted and stored in data centers located in the country listed on the Order Form.
7. Data Subject Rights
(a) GovAI shall take such technical and organisational measures as may be appropriate, and promptly provide such information to the Customer to enable the Customer to comply with: the rights of Data Subjects under the Applicable Laws, including subject access rights, the rights to rectify and erase personal data, object to the processing and automated processing of personal data, and restrict the processing of personal data; and information or assessment notices served on the Customer by any supervisory authority under the Applicable Laws.
(b) GovAI shall promptly inform the Customer in the event of receiving a Data Subject access request and will advise the Data Subject of the request having been forwarded to the Data Controller. GovAI shall not provide Data Subjects with access to their personal data nor will it engage directly with a Data Subject in relation to such requests, save for advising that their request has been forwarded to the Data Controller.
(c) GovAI shall provide such co-operation and assistance as may be reasonably required to enable the Customer to deal with any subject access request or other Data Subject right in accordance with the provisions of the Applicable Laws. In particular, GovAI shall assist the Customer in the fulfilment of the Data Controller’s obligation to respond to requests exercising Data Subjects’ rights under Applicable Laws.
8. Information request and Audit reports
(a) Where Customer has a current paid subscription for the Service, GovAI shall, on written request (but not more than once per year, other than in the event of a Personal Data Breach), make available to Customer all information necessary to demonstrate compliance with the obligations set forth in this Addendum. Where Customer has a current paid subscription for the Service, upon prior written request by Customer (provided that it shall be not more than once per year other than in the event of a Personal Data Breach), GovAI agrees to cooperate and, within reasonable time, provide Customer with: (a) such third party audit reports procured by GovAI in respect of the Service and as further detailed in the Documentation (the “Third Party Audit Reports”); and (b) confirmation that no audit, if conducted, has revealed any material vulnerability in GovAI’s systems, or to the extent that any such vulnerability was detected, that GovAI has fully remedied such vulnerability
9. California Consumer Privacy Act of 2018 (“CCPA”)
(a) For purposes of this Addendum, GovAI is a “Service Provider” as defined in CCPA Section 1798.140(v).
(b) Customer discloses Personal Data to GovAI (or facilitates such disclosure by Customer’s users) solely for (a) a valid business purpose as defined in the CCPA and (b) to facilitate GovAI’s performance of the Services.
(c) In connection with its processing of Personal Data as described in this Addendum and the Master Agreement, GovAI shall not (a) sell any Personal Data; or (b) retain, use, or disclose Personal Data for a commercial purpose other than providing the Services as provided in the Main Agreement and this Addendum, or as otherwise permitted by the CCPA; and (c) GovAI certifies that it understands and will comply with the restrictions described in this Section 9.
10. Transfers
(a) GovAI reserves the right to transfer information (including Personal Data) to a third party in the event of a sale, merger, liquidation, receivership, or transfer of all or substantially all of the assets of GovAI’s business provided that the third party agrees to adhere to GovAI’s terms relating to Personal Data and provided that the third party only uses Personal Data for the purposes that it has been provided to GovAI. The Customer will be notified in the event of any such transfer.
11. Agreement
(a) This DPA forms an addendum to the Master Agreement, is subject to the terms thereof (including without limitation all provisions in respect of the disclaimer and limitation of liability) shall become legally binding as between the parties only where there is a Master Agreement in place between the parties that incorporates the terms of this DPA. Terms defined in the Master Agreement shall have the same meaning in this DPA unless otherwise indicated.