This Data Processing Addendum (this "DPA") is subject to the terms of the Software as a Service (SaaS)
Agreement (the "Agreement") entered into between Subscriber (as
defined in the Agreement) and Federal Contractor Services Network, Inc. d/b/a ICAT Systems ("ICAT",
"We", "Us", or "Our"). This DPA supplements and is incorporated into the Agreement by reference. This
DPA is effective as of the effective date of the Agreement.
RECITALS
WHEREAS, ICAT and Subscriber entered into the Agreement under which Subscriber Data is submitted,
posted, or otherwise transmitted by or on behalf of Subscriber or an Authorized User through the
Services; and,
WHEREAS, to the extent such Subscriber Data includes Personal Information or Controlled Unclassified
Information ("CUI"), this DPA sets out the additional terms, requirements, and conditions applicable to
ICAT's Processing of such information in providing the Services;
NOW, THEREFORE, in consideration of the mutual covenants and agreements hereinafter set forth and for
other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the
parties hereto agree as follows:
1. Definitions and Interpretation
1.1. Except as otherwise defined herein, capitalized terms shall have the meaning provided for such terms in the Agreement.
1.2. As used in this DPA, the terms "You" or "Your" refers to Subscriber.
1.3. The following definitions apply in this DPA.
"Controlled Unclassified Information" or "CUI" means Subscriber Data that is information the U.S. Government creates or possesses, or that an entity creates or possesses for or on behalf of the U.S. Government, that a law, regulation, or U.S. Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls, subject to the exceptions provided in 32 CFR § 2002.4.
"Data Subject" means an individual who is the subject of the Personal Information and to whom or about whom the Personal Information relates or identifies, directly or indirectly.
"Personal Information" means any Subscriber Data that identifies or can be used to reasonably identify an individual and is protected as personal data under applicable state or federal privacy laws.
"Processing, processes, or process" means any action performed on Protected Information such as collection, storage, use, disclosure, retrieval, transfer, or deletion. Processing also includes transferring Protected Information to third parties.
"Protected Information" means, collectively, Personal Information and Controlled Unclassified Information contained in Subscriber Data and Processed in connection with the Services under the Agreement.
"Privacy and Data Protection Requirements" means all applicable federal and state laws and regulations relating to the Processing, protection, or privacy of Protected Information.
"Security Breach" means an event that compromises the confidentiality or security of Protected Information including any event characterized by applicable Privacy and Data Protection Requirements as a "security breach," or "personal data breach" or similar designated terms indicating unauthorized access, acquisition, or disclosure of Protected Information.
"Security Incident" means (i) any event that compromises, or is reasonably likely to compromise, the confidentiality, availability and/or integrity of the Services; (ii) the unauthorized disclosure, acquisition, or access to Subscriber Data; or, (iii) an event characterized by applicable Privacy and Data Protection Requirements as a "security breach," or "personal data breach" or similar designated terms. For clarity, the definition of Security Incident does not include inconsequential incidents that occur on a daily basis, such as scans, pings, or other unsuccessful attempts to penetrate computer networks or servers.
1.4. In the case of conflict between provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail.
2. Personal Information Processing
2.1. ICAT will Process Personal Information to the extent, and in such a manner, as is necessary to carry out its obligations under the Agreement and for no other purpose outside of the provision of Services and parties' business relationship.
2.2. ICAT will not share Personal Information for cross-context behavioral advertising (targeted advertising).
2.3. ICAT will not sell or otherwise make available Personal Information accessed through the Services to any third party for any use by such third party that does not directly support or facilitate the provision of, access to, or use of the Services.
2.4. Taking into account the nature of ICAT's Processing and the information available to the ICAT, ICAT will provide reasonable assistance and cooperation to Subscriber as Subscriber may reasonably request to comply with its obligations under applicable Privacy and Data Protection Requirements.
3. Data Subject Requests
3.1. ICAT will notify Subscriber within ten (10) working days if it receives a request from a Data Subject to exercise any rights the individual may have regarding their Personal Information under applicable law, such as access, correction, deletion, or to opt-out of or limit certain activities or processing actions.
3.2. ICAT will provide reasonable assistance and cooperation to Subscriber as Subscriber may reasonably request to resolve requests from Data Subjects.
4. Government Contract Obligations
4.1. ICAT acknowledges that if Subscriber is a government contractor, Subscriber may be subject to various federal laws, executive orders, and regulations in connection with the Services. ICAT shall be responsible for compliance with government contractor requirements and FAR flow-down clauses only if such requirements are: (i) specifically identified in this DPA; (ii) applicable to the Services; (iii) required by law to be flowed down to subcontractors; and, (iv) provided to ICAT by Subscriber in writing. ICAT shall have no responsibility for certifications relating to Subscriber's activities, contracts, representations, or compliance obligations as a prime contractor. Subscriber shall promptly notify ICAT in writing of any new or modified government contractor requirements applicable to the Services. To the extent compliance with any such requirement materially increases Company's costs or materially changes the scope of the Services, the parties shall negotiate in good faith an equitable adjustment to the applicable fees.
4.2. ICAT acknowledges that misuse of CUI is subject to penalties established in applicable laws, regulations, or Government-wide policies. ICAT will promptly report Processing of CUI in violation of this DPA to Subscriber.
5. Subscriber Obligations
5.1. Subscriber remains responsible for its compliance obligations under the applicable Privacy and Data Protection Requirements, including providing any required notices and obtaining any required consents necessary for ICAT to Process the Personal Information to provide the Services.
5.2. Subscriber acknowledges and agrees that to the extent you or your Authorized Users use the Services to submit, post, or otherwise transmit Subscriber Data that includes Protected Information, you have complied with all applicable laws and received the proper authority or consent to allow us to process such Protected Information to provide the Services contemplated in the Agreement and consistent with our Privacy Notice.
5.3. Subscriber will not request ICAT to Process Protected Information in any manner that would violate applicable Privacy and Data Protection Requirements if done by Subscriber.
5.4. Subscriber will notify ICAT in writing of any privacy or security obligations required by applicable law or regulation pertaining to ICAT's Processing of Subscriber Data beyond those specified in this DPA prior to submitting, posting, or otherwise transmitting Subscriber Data through the Services.
6. Subcontractors
6.1. ICAT may authorize and utilize a third party, including an affiliate or other subcontractor, to process Protected Information where such third party provides support or services to ICAT. ICAT will ensure that such third party agrees to safeguard Protected Information to the same extent as ICAT is required to safeguard such information.
7. Security
7.1. ICAT will implement and maintain reasonable administrative, physical, and technical safeguards designed to prevent unauthorized access to, or unauthorized use or disclosure of, Protected Information.
7.2. When destroying Protected Information, ICAT shall use a methodology to ensure such Protected Information is rendered inaccessible, irretrievable, and unreadable by unauthorized persons.
8. Security Breaches
8.1. Without unreasonable delay, and in no case more than 72 hours from ICAT's discovery, ICAT will notify Subscriber of a Security Breach of which it becomes aware.
8.2. ICAT will reasonably cooperate with Subscriber's requests for assistance and information to permit Subscriber's compliance with applicable notice to Data Subjects, regulators, law enforcement agencies, or others, as required by law or regulation.
8.3. To the extent practicable, ICAT will mitigate harmful effects of a Security Breach, including reasonable measures necessary to prevent a similar Security Breach from recurring.
9. Term and Termination
This DPA will remain in full force and effect so long as the Agreement remains in effect; or for so long as ICAT retains any Subscriber Protected Information related to the Agreement in its possession (the "Term").
10. Data Return and Destruction
10.1. On termination of the Agreement for any reason or expiration of its term, ICAT will destroy Protected Information in its possession, if any, except for information retained in an archive, which will be securely destroyed in the ordinary course of business. Subscriber will need to access QuickBooks to obtain access to any Protected Information entered into QuickBooks.
10.2. ICAT may retain configuration data and information related to the provision of Services for 365 days past termination or so long as needed for ICAT to exercise its rights and obligations under the Agreement.
11. Records
ICAT will maintain documentation sufficient to establish its compliance the with the obligations under this DPA and comply with Subscriber's reasonable requests to confirm such compliance.
12. Amendment
Any amendments to this DPA must be agreed to in a written amendment signed by the parties.