Lattice Integration Partner Data Processing Addendum

This Data Processing Addendum (“Addendum”) is incorporated into and forms part of the terms and conditions of the agreement (including where applicable the Lattice Technology Partner Data Sharing Agreement or "DSA") executed between Degree, Inc. d/b/a Lattice (“Company” or “Lattice”) and an authorized third party identified as a Lattice "Partner" (“Partner”) under which either or both Company and/or Partner may use a Lattice or Partner feature, integration, or other similar product or service to transfer Customer Data, including Personal Data of a Customer Data Subject to, from, or otherwise between Company’s and Partner’s respective products or services (the “Agreement”).

1. Subject Matter and Duration
   1. Subject Matter. This Addendum (including all exhibits hereto) reflects the parties’ respective commitments to abide by Data Protection Laws concerning the Processing of Customer Data in connection with the Agreement. This Addendum is supplemental to the Agreement and sets out the roles and obligations that apply when either Company or Partner processes Personal Data of a Customer Data Subject on behalf of a Customer in connection with the Agreement. If there is any conflict between the Agreement and this Addendum, the terms of this Addendum will prevail to the extent of such conflict, provided however that if Company and Partner have executed a written data processing agreement which is specifically intended to govern the processing of Customer Data Subject Personal Data under the Agreement, then the terms of such signed data processing agreement between the parties will supersede this Addendum. Any capitalized terms not defined in this Addendum will have the meanings given to them in the Agreement.
   2. Duration and Survival. This Addendum will become legally binding upon the effective date of the Agreement or upon the date that the parties sign this Addendum if it is completed after the effective date of the Agreement. Each party will Process Customer Data in accordance with this addendum until the relationship terminates as specified in the Agreement.
2. Definitions. Capitalized terms used in this Addendum shall have the meanings given to them in the Main Agreement unless otherwise defined herein. The following definitions are used in this Addendum:
   1. “CCPA” means Sections 1798.100 et seq. of the California Civil Code and any attendant regulations issued thereunder as may be amended from time to time, including but not limited to the California Privacy Rights Act of 2020 (the “CPRA”) and its implementing regulations.
   2. “Control” means an ownership, voting or similar interest representing fifty percent (50%) or more of the total interests (as measured on a fully-diluted basis) then outstanding of the entity in question. The term “Controlled” will be construed accordingly.
   3. “Customer” means a mutual customer of both Company and Partner that enables integration between Company’s and Partner’s respective platforms in order to transfer and Process data, including Customer Data Subject Personal Data, across such platforms for Customer’s benefit.
   4. “Customer Data” means Customer Data Subject Personal Data and all other confidential or proprietary information provided to, accessed by, or Processed by Service Provider, as more particularly described in Schedule A of this Addendum.
   5. “Customer Data Subject” means an identified or identifiable person to whom Personal Data relates, as defined in applicable Data Protection Laws, and whose Personal Data is processed by Company or Partner at Customer’s direction for Customer’s benefit.
   6. “Data Protection Laws” means all data protection and privacy laws regulations applicable to a party and its processing of Personal Data under the Main Agreement, including, where applicable: (a) the GDPR, (b) all applicable implementations of the GDPR into national law, (c) in respect of the United Kingdom, the Data Protection Act 2018 and the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 ("UK GDPR"), (d) the Swiss Federal Data Protection Act ("Swiss DPA"), and (e) the CCPA; in each case, as may be amended, superseded or replaced.
   7. “Europe” means for the purposes of this Addendum the European Economic Area ("EEA"), United Kingdom and Switzerland.
   8. “GDPR” means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (General Data Protection Regulation).
   9. "Personal Data" means any information protected as "personal data", "personal information" or "personally identifiable information" under Data Protection Laws.
   10. "Restricted Transfer" means: (i) where the GDPR applies, a transfer of Customer Data from the European Economic Area to a country outside of the European Economic Area which is not subject to an adequacy determination by the European Commission ("EEA Restricted Transfer"); (ii) where the UK GDPR applies, a transfer of Customer Data from the United Kingdom to any other country which is not subject based on adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018 ("UK Restricted Transfer"); and (iii) where the Swiss DPA applies, a transfer of Customer Data from Switzerland to any other country which is not determined to provide adequate protection for personal data by the Federal Data Protection and Information Commission or Federal Council (as applicable) ("Swiss Restricted Transfer").
   11. “Standard Contractual Clauses” means the standard contractual clauses between processors and processors (Module 3) adopted by European Commission in its Implementing Decision (EU) 2021/91 of 4 June 2021 and currently located at: https://commission.europa.eu/system/files/2021-06/1_en_annexe_acte_autonome_cp_part1_v5_0.pdf, as amended, superseded or replaced from time to time.
   12. “Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Data, stored or otherwise processed by Company or Partner in connection with its performance under the Agreement or this Addendum. “Security Incident” does not include unsuccessful attempts or activities that do not compromise the security of Customer Data, including unsuccessful login attempts, pings, port scans, denial of services attacks, and other network attacks on firewalls or networked systems.
   13. “Subprocessor” means any Processor having access to Customer Data and engaged by Company or Partner to assist in fulfilling its respective obligations with respect to providing its products and/or services to a Customer.
   14. The terms “controller”, "data subject", “processor”, “processing”, “personal data” and "sensitive data" shall have the meanings given to them in Data Protection Laws or if not defined therein, the GDPR, and the terms "service provider", "business", “collects” (and “collected” and “collection”), “consumer”, “business purpose”, “sell” (and “selling”, “sale”, and “sold”), “share” (and “sharing” and “shared”), and “service provider” have the meanings given to them in §1798.140 of the CCPA, as applicable.
   15. “UK Addendum” means the International Data Transfer Addendum (version B1.0) to the EU Commission Standard Contractual Clauses issued by UK Information Commissioners Office under S.119(A) of the UK Data Protection Act 2018, as amended, superseded or replaced from time to time.
3. Roles and Scope of Processing
   1. Data Processing Roles. As between a Customer, Lattice, and Partner, for any Customer Data processed by Lattice or Partner for a Permitted Purpose on behalf of Customer, (a) under GDPR Customer is a controller, and under CCPA Customer is a business, and (b) under GDPR Company is a processor and Partner is a processor, and under CCPA Company is a service provider and Partner is a service provider. For the avoidance of doubt, it is the parties’ intent and understanding that with regard to Customer Data processed by either party under the Agreement or this Addendum, Company and Partner each act as an independent data processor for the Customer controller or business, and Company and Partner are neither joint controllers nor joint businesses, nor are they in a processor and sub-processors relationship with each other.
   2. Compliance with Laws. Each party shall comply with its obligations under Data Protection Laws applicable to any Customer Data it processes under the Agreement. Specifically, each party undertakes that all instructions for the Processing of Customer Data under the Agreement or this Addendum or as otherwise agreed by the parties will comply with applicable Data Protection Laws, and such instructions will not cause the other party to be in breach of any Data Protection Laws. As between Company and Partner, each party, to the extent that it provides its Customer Data to the other party, is responsible for how Customer Data was acquired.
   3. Processing Instructions. Each of Company and Partner will process Customer Data solely for the process of providing its products and services to customer. Specifically, each party will transfer, access, modify or otherwise process Customer Data through the other party’s feature, integration, or other product or service, including as contemplated under the Agreement and Schedule A hereto, only if and to the extent authorized or directed to in accordance with Customer’s documented lawful instructions (the “Permitted Purpose”, which, where CCPA applies, is a business purpose), unless obligated to do otherwise by applicable law, in which case a party will notify Customer, and where applicable the other party (unless that law prohibits a party from providing such notification so on important grounds of public interest).
4. Subprocessing
   
   1. Authorized Subprocessors. To the extent Customer has provided its authorization to a party, each party may engage Subprocessors and, where CCPA applies, other third-party service providers (hereinafter referred to as Subprocessors) in order to provide the Service. The Subprocessors currently engaged by Company are listed at https://www.Lattice.com/privacy/subprocessors (or such other URL as may be updated from time to time) (“Subprocessor Site”). Each party will remain responsible for (a) entering into written agreements with any Subprocessors it engages, and (b) any acts or omissions of any Subprocessor it engages that causes that party to breach any of its obligations under this Addendum or to Customer.
   2. Notification of New Subprocessors. Each of Company and Partner will make available to Customer a list of its engaged Subprocessors and provide Customer with a mechanism to obtain notice of and an opportunity to object to any additions to its engaged Subprocessors.
5. Security Measures and Security Incident Response
   
   1. Security Measures. Company and Partner will each implement and maintain appropriate and reasonable technical and organizational security measures that take into account the risks that are presented by Processing, and designed to protect Customer Data from Security Incidents and to preserve the security and confidentiality of the Customer Data, in particular the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data transmitted, stored or otherwise Processed. A detailed but non-exhaustive list of Company’s current Security Measures is maintained at https://lattice.com/privacy/security-measures (“Security Measures”), and may be updated from time to time subject to technical progress and development.
   2. Security Incident Response. Company or Partner, upon becoming aware of a Security Incident within its respective product or service, will notify without undue delay and, in any case within forty-eight (48) hours after becoming aware of the Security Incident, both Customer and the other party to this Addendum. The notifying party will provide information relating to the Security Incident to the notified parties promptly as it becomes known or as is reasonably requested in order to fulfill their obligations under applicable Data Protection Laws. The party experiencing the Security Incident will also take appropriate and reasonable steps to contain, investigate, and mitigate any Security Incident.
6. Data Transfers. As permitted by Customer, each of Lattice and Partner may transfer and process Customer Data to and in the United States and other locations in which Lattice or Partner, including as applicable their Affiliates, or Subprocessors, maintain data processing operations. Each party will ensure that any transfers it makes are made in compliance with Data Protection Laws and this Addendum.
7. Return or Deletion of Data. As between Company and Partner, each party is responsible for how Customer Data is retained, returned, and deleted as between that party and Customer. With respect to Customer Data processed by a party in connection with this Addendum, each of Lattice and Partner will delete or return Customer Data in its possession or control Promptly upon Customer’s request, or otherwise in accordance with its agreement with Customer under which it processes Customer Data. This requirement shall not apply to the extent either party is required by applicable law to retain some or all of the Customer Data, or to Customer Data it has archived on back-up systems, which Customer Data the party will securely isolate and protect from any further processing, except to the extent required by such laws.
8. Cooperation
   
   1. Data Subject and Consumer Rights Requests. Each party agrees that it will, taking into account the nature of the processing, reasonably assist Customer in responding to any requests from individuals or applicable data protection authorities relating to the processing of Customer Data for the Permitted Purposes. In the event that any such request is made to Lattice or Partner directly, Lattice or Partner will not respond to such communication directly (except to direct the data subject to contact Customer) without Customer’s prior authorization, unless legally compelled to do so. If either Lattice or Partner is required to respond to such a request, the party receiving the request will promptly notify Customer and provide it with a copy of the request unless legally prohibited from doing so.
   2. Data Protection Impact Assessments (DPIAs). To the extent required under Data Protection Laws applicable to Europe, Lattice and Partner will provide requested information regarding the Service necessary to enable Customer to carry out data protection impact assessments and prior consultations with data protection authorities.
9. Europe
   
   1. Scope. The terms in this Section 9 apply only if and to the extent, and within the limits of the subject matter of this Addendum, Customer is established in Europe or the Customer Data is otherwise subject to Data Protection Laws applicable to Europe.
   2. Transfer Mechanism. To the extent the transfer of Customer Data between Lattice and Partner is a Restricted Transfer and Data Protection Laws applicable to Europe require that appropriate safeguards are put in place, such transfer shall be governed by the Standard Contractual Clauses, which shall be incorporated by reference into and form an integral part of this Addendum, as follows:
      1. In connection with an EEA Restricted Transfer: (i) Module Three (processor to processor transfers) will apply and all other modules are deleted; (ii) in Clause 7, the optional docking clause will apply; (ii) in Clause 9 of Module Three, Option 3 will apply and the time period for prior notice of Sub-processor changes will be as set forth in a written agreement between the Customer and either Lattice or Partner, as applicable; (iii) in Clause 11, the optional language will not apply; (iv) in Clause 17, Option 1 will apply, and the Standard Contractual Clauses will be governed by Irish law; (v) in Clause 18(b), disputes shall be resolved before the courts of Ireland; and (vi) Annexes I, II, and III are deemed completed with the information set out either in the Agreement and this Addendum or, as applicable, in the respective agreement(s) between Customer and Lattice or Partner governing the processing of Customer Data in providing their respective products or services to Customer.
      2. In connection with a UK Restricted Transfer, the Standard Contractual Clauses shall apply in accordance with Section 9(ii)(a) above, but where applicable as between Lattice and Partner the UK Addendum will be deemed executed between the parties, and the EU SCCs will be deemed amended as specified by the UK Addendum in respect of the transfer of such Personal Data as modified and interpreted by the Part 2: Mandatory Clauses of the UK Addendum, which shall be incorporated into and form an integral part of this Addendum. Any conflict between the terms of the Standard Contractual Clauses and the UK Addendum shall be resolved in accordance with Section 10 and Section 11 of the UK Addendum. In addition, tables 1 to 3 in Part 1 of the UK Addendum shall be completed respectively with the information set out in Schedule A of this Addendum and as provided in the Agreement and this Addendum or, as applicable, in the respective agreement(s) between Customer and Lattice or Partner governing the processing of Customer Data in providing their respective products or services to Customer, and table 4 in Part 1 of the UK Addendum shall be deemed completed by selecting "neither party".
      3. In connection with a Swiss Restricted Transfer, the Standard Contractual Clauses shall apply in accordance with Section 9(ii)(a) above, but where applicable as between Lattice and Partner the Swiss DPA will be deemed executed between the parties, and with the following modifications: (i) any references in the Standard Contractual Clauses to "Regulation (EU) 2016/679" shall be interpreted as references to the Swiss DPA and the equivalent articles or sections therein; (ii) any references to "EU", "Union", "Member State" and "Member State law" shall be interpreted as references to Switzerland and Swiss law, as the case may be; (iii) any references to the "competent supervisory authority" and "competent courts" shall be interpreted as references to the relevant data protection authority and courts in Switzerland; and (iv) the Standard Contractual Clauses shall be governed by the laws of Switzerland and disputes shall be resolved before the competent Swiss courts.
      4. As between Lattice and Partner the rights and obligations afforded by Standard Contractual Clauses will be exercised in accordance with this Addendum, unless stated otherwise. It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses and, accordingly, if and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement (including this Addendum) the Standard Contractual Clauses shall prevail to the extent of such conflict.
   3. Data Transfer Arrangements. To the extent Customer instructs Lattice and Partner to adopt an alternative data export mechanism (including any new version of or successor to the Standard Contractual Clauses adopted pursuant to Data Protection Laws) for the transfer of Customer Data (“Alternative Transfer Mechanism”), the Alternative Transfer Mechanism shall apply instead of any applicable transfer mechanism described in this Addendum (but only to the extent such Alternative Transfer Mechanism complies with Data Protection Laws applicable to Europe and extends to territories to which Personal Data is transferred).
   4. Notification of Government Access Requests: For the purposes of Clause 15(1)(a) of Standard Contractual Clauses, each party shall notify Customer and not the data subject(s) in case of government access requests. Customer shall be solely responsible for promptly notifying the data subject, as necessary.
10. Limitation of Liability
    
    1. In no event shall any party limit its liability with respect to any individual’s data protection rights under this Addendum or otherwise.
    2. Any claim or remedies either Lattice or Partner may have against the other party or its respective employees, agents, or Sub-processors arising under or in connection with this Addendum including: (i) for breach of this Addendum (including the Standard Contractual Clauses or the UK Addendum); (ii) as a result of fines (administrative, regulatory or otherwise) imposed upon a party or Customer; (iii) under Data Protection Laws, including but not limited to CCPA, GDPR, UK GDPR or Swiss DPA, including any claims relating to damages paid to a data subject, consumer, or other individual; and (iv) breach of its obligations under the Standard Contractual Clauses or UK Addendum, will, to the maximum extent permitted by law, be subject to any limitation and exclusion of liability provisions (including any agreed aggregate financial cap) that apply under the Agreement.
    3. For the avoidance of doubt, as between Lattice and Partner, Lattice’s, Partner’s, and their respective Affiliates’ total overall liability for all claims arising out of or related to the Agreement including this Addendum shall apply in the aggregate for all claims under the Agreement and this Addendum together.
11. CCPA
    1. Scope. The terms in this Section 12 apply only if and to the extent, and within the limits of the subject matter of this Addendum, the Customer Data is subject to Data Protection Laws applicable to the state of California.
    2. For the purposes of the CCPA, Lattice and Partner are each prohibited from:
       1. selling or sharing Customer Data;
       2. processing Customer Data for targeted and/or cross context behavioral advertising;
       3. retaining, using, or disclosing Customer Data for any purposes other than the specific purposes of performing the Service or as otherwise permitted under Main Agreement and this Addendum;
       4. retaining using or disclosing Customer Data outside the direct business relationship between Lattice or Partner, respectively, and Customer; or
       5. combining Customer Data with any other data if and to the extent doing so would be inconsistent with the Business Purpose or the limitations on service providers under the CCPA or other Data Protection Laws.
    3. Each of Lattice and Partner certifies that it understands the restrictions set out in Section 11 and will comply with them, and that it will notify Customer and the other party if it becomes unable to comply with the CCPA.
    4. Each of Lattice and Partner currently maintains, and will continue to maintain during the term of the Agreement, tools and resources for consumers to exercise their rights under the CCPA. If Lattice or Partner, directly or indirectly, receives a request submitted by a consumer who is an employee of Customer to exercise a right it has under the CCPA in relation to that Consumer’s Customer Data, the party receiving such request will follow the procedures described in Section 8 of this Addendum.
12. General
    1. Except as otherwise described in the Agreement (including this Addendum), in no event will this Addendum benefit or create any right or cause of action on behalf of a third party, but without prejudice to the rights or remedies available to data subjects under Data Protection Laws or this Addendum (including the Standard Contractual Clauses).
    2. Each party acknowledges that the other party may disclose the Standard Contractual Clauses, this Addendum, and any privacy related provisions in the Agreement to any regulator or supervisory authority upon request.
    3. Neither Lattice nor Partner may make modifications to this Addendum absent the written agreement of the other party, provided each party agrees it will not unreasonably object to proposed amendments to this Addendum that are required to comply with changes or updates to Data Protection Laws.
    4. Other than as required by applicable Data Protection Laws or the Standard Contractual Clauses, the dispute mechanisms, including those related to venue and jurisdiction, set forth in the Agreement govern any dispute pertaining to this Addendum.

SCHEDULE A

Description of Processing/Transfer

Annex 1(A) List of Parties:

Annex 1(B) Description of Transfer:

Annex 1(C): Competent supervisory authority

The competent supervisory authority shall be determined in accordance with Clause 13 of the 2021 Processor-to-Processor Clauses of the SCCs and the GDPR.