DATA PROCESSING ADDENDUM

 
This DATA PROCESSING ADDENDUM (this “DPA”) forms part of the agreement (the “Agreement”) to which this DPA is attached or incorporated into by reference by and between or among HomeServe USA Corp. or any of its Affiliates (as defined below) party thereto (collectively, “HomeServe”) and the other party or parties thereto (collectively, the “Parties” and each, a “Party”).  Notwithstanding anything to the contrary contained in the Agreement, in the event of any conflict between this DPA and the Agreement, this DPA shall control.  Capitalized terms used in this DPA shall have the meaning set forth in this DPA or, if not defined in this DPA, in the applicable data protection, security, or privacy-related laws, statutes, directives, or regulations, including all equivalent laws and regulations, in any relevant jurisdiction relating to Personal Data (as defined below) and privacy, and as each may be amended, extended or re-enacted from time to time (“Data Protection Laws”).  Under the terms of this DPA, a HomeServe or another Party (the “Controller”) may provide Personal Data to another Party (“Processor”) for Processing (as defined below).

 

  1.1 Roles of the Parties. The Parties acknowledge and agree that with regard to the performance of any operation or set of operations, whether by manual or automated means, on Controller’s Personal Data by Processor or any of its Subprocessors (as defined below) in connection with the Agreement (“Controller Personal Data”), such as the collection, receipt, use, storage, disclosure, analysis, deletion, or modification of Personal Data, or as otherwise defined by Data Protection Laws (“Process”), Controller is the “Controller” or “Business” (within the meaning of the Data Protection Laws, as applicable), Processor is the “Processor” or “Service Provider” (within the meaning of Data Protection Laws, as applicable), and Processor will engage Subprocessors pursuant to the requirements set forth in Section 4.  Controller warrants and represents that it is and will at all relevant times remain duly and effectively authorized to give the instructions set out in Section 1.

 
  1.2 For purposes of this DPA, “Subprocessor” means any third party appointed by Processor to Process Controller Personal Data on behalf of Controller in connection with the Agreement; and “Personal Data” means information that identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with an identifiable consumer or household, or is otherwise defined as “personal data,” “personal information,” or “personally identifiable information” by Data Protection Laws.

 

1.3 Processor’s Processing of Personal Data. Processor shall treat Controller Personal Data as confidential and shall only Process Controller Personal Data as necessary to perform its obligations on behalf of and in accordance with Controller’s documented instructions for the following permitted purposes: (a) in accordance with the Agreement, applicable order or scope of work, or other written instructions provided by Controller (e.g., via email) where such instructions are consistent with the terms of the Agreement and Data Protection Laws; or (b) if initiated by any identified or identifiable natural person whose Personal Data is being Processed, including, without limitation, any “Consumer” (within the meaning of the Data Protection Laws) (“Data Subject”). Processor agrees that it shall notify Controller in writing if it is no longer able to Process Controller Personal Data in compliance with Data Protection Laws.

1.4 Compliance with DPA and Data Protection Laws. Each Party represents, warrants, and covenants that it and its Subprocessors’ Processing of Personal Data does and will comply with this DPA and all Data Protection Laws.  Without limiting the foregoing, Processor shall not: (a) Sell or Share Controller Personal Data, (b) retain, use, or disclose Controller Personal Data for any purpose other than for the Business Purposes specified in the Agreement; (c) retain, use, or disclose Controller Personal Data outside of the direct business relationship between or among the Parties; or (d) combine Controller Personal Data with Personal Data that it receives from, or on behalf of, another person or persons, or collects from its own interaction with Data Subjects, provided that Processor may combine Personal Data to perform a Business Purpose (with the exception of “advertising and marketing services,” as defined under the Data Protection Laws).  Processor shall comply with applicable obligations and provide the same level of privacy protection as required by the Data Protection Laws and shall assist Controller through appropriate technical and organizational measures to comply with the Data Protection Laws, considering the nature of the Processing.  Processor shall immediately notify Controller in writing if it can no longer meet its obligations under Data Protection Laws.

 

1.5 Limited and Specified Purposes.  Controller shall disclose Controller Personal Data to Processor only for the limited and specified purposes set out in the Agreement, which may include, but is not limited to, facilitating marketing, sales, enrollments, or billing for either Party in accordance with the terms of the Agreement.  Controller reserves the right, upon reasonable notice, to take reasonable and appropriate steps to ensure that Processor uses Controller Personal Data in a manner consistent with Controller’s obligations under the Data Protection Laws, including reasonable and appropriate steps to stop and remediate any actual or reasonably suspected event that compromises the security, confidentiality, or integrity of Controller Personal Data, including, without limitation, accidental, unauthorized or unlawful access or disclosure, loss or theft, or destruction or alteration of such Personal Data (“Data Breach”).  Controller agrees that Personal Data subject to this DPA will be transferred continuously to Processor or its approved Subprocessors, as applicable, throughout the term and any applicable post termination period of the Agreement.

1.6 Data Subjects and Types of Personal Data.  The Data Subjects whose Personal Data is transferred under this DPA may include Controller’s former, current or prospective customers or employees.  The types of Personal Data processed under this DPA are determined by Controller.  Such Personal Data may include, but is not limited to:

 

(a) Identifiers. First and last name, date of birth, unique identifiers, business contact information (including company name, email address, phone number, and physical business address), and personal contact information (including email address, phone number, and physical personal address).

(b) Non-Sensitive Consumer Data. Demographic information (including age, gender, marital status, education, occupation, and income), health and lifestyle data, online activity, and public records.

(c) Transaction Information. Information related to how Data Subjects use Controller’s products and services subject to the Agreement.
(d) Payment Information. Credit card, ACH or other payment type information.
(e) IT Information. IP addresses, cookie or pixel data, and location data.
(f) Protected Health Information.  In the case of employees, it may include health information or data.
(g) No Sensitive Personal Information. The foregoing list is not exhaustive and may be changed or supplemented by Controller. However, unless specifically noted above, Controller will not share or transfer and does not authorize Processor to Process any Personal Data that may qualify as Sensitive Personal Information.

1.7 Data Retention.  Processor shall retain Controller Personal Data subject to this DPA only for so long as such retention continues to serve a legitimate Business Purpose under the Agreement.  Upon expiration or termination of the legitimate Business Purpose for which Controller Personal Data was originally collected and Processed, Processor shall, unless retention is required by applicable law, either return such Personal Data to Controller or securely delete or destroy such Personal Data in accordance with Controller’s written instructions or the terms of the Agreement.

 

Section 2. Rights of Data Subjects.  To the extent legally permitted, each Party shall assist the other Party in fulfilling a request from a Data Subject to exercise the Data Subject’s rights under Data Protection Laws (“Data Subject Request”).  If a Data Subject Request requires the deletion of Personal Data by either Party, each Party agrees to delete such Personal Data and instruct its respective Subprocessors, if any, to delete such Personal Data that such Subprocessors are Processing on behalf of such Party, as required by Data Protection Laws.  Nothing in this Section 2 shall require a Party to disclose or reveal any trade secrets.

Section 3. Personnel.  Processor shall ensure that its employees and agents and all of its subcontractors (“Subcontractors”) and all employees and agents of any Subcontractor (collectively, “Personnel”), engaged in the Processing of Controller Personal Data are informed of the confidential nature of the Controller Personal Data, will maintain all Controller Personal Data in confidence and have received appropriate training regarding the reasonable and adequate degree of care necessary to prevent loss or unauthorized access, use or disclosure of Controller Personal Data.  Processor shall endeavor, in the exercise of its reasonable business discretion, to ensure the reliability of any of its Personnel engaged in the Processing of Controller Personal Data.  Processor shall ensure that its access to Controller Personal Data is limited to those Personnel performing in accordance with the Agreement. Processor remains fully liable for any action or omissions of its Personnel.

Section 4. Subprocessors.

4.1 Appointment of Subprocessors; Preexisting Subprocessors. With respect to the Processing of Controller Personal Data, Controller authorizes Processor and each of its Affiliates to appoint Subprocessors to the extent necessary to perform its obligations under the Agreement, so long as Processor or its Affiliate has entered or will enter into a written agreement with each Subprocessor containing applicable data protection obligations substantially similar to those in this DPA.  Each Party agrees that any Subprocessor appointed in accordance with this Section 4.1 may further appoint Subprocessors subject to the same restrictions applicable to the Processor and enter into a written agreement containing applicable data protection obligations substantially similar to those in this DPA.  For the purposes of this DPA, “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, and “control” for the purposes of this definition means possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract interest or otherwise. In the case of any HomeServe entity, Affiliate shall mean and refer only to HomeServe USA Corp. and its direct and indirect subsidiaries.

4.2 Appointment of New Subprocessors.  Processor agrees to provide a list of its Subprocessors to Controller including details of the Processing to be undertaken by the Subprocessors, prior to the execution of this DPA.  Processor shall give Controller written notice at least 30 days prior to the engagement of any new Subprocessor, including details of the Processing to be undertaken by the Subprocessor, and shall not disclose any Controller Personal Data to any new Subprocessor without Controller’s prior written authorization.  Processor remains fully liable for any action or omissions of its Subprocessors as if such act or omission were by Processor.

Section 5. Cooperation and Audits.

5.1 Cooperation. Processor shall, upon Controller’s reasonable request and to the extent required by Data Protection Laws, make available to Controller all information in Processor’s possession necessary to demonstrate Processor’s compliance with its obligations under this DPA and Data Protection Laws.

5.2 Privacy Audits and Assessments.  Processor shall reasonably cooperate with Controller in relation to any audit, assessment, or other review of Processor reasonably necessary to enable Controller to comply with its obligations under Data Protection Laws (“Audit”) and shall ensure the equivalent cooperation from relevant Subprocessors. Any Audit shall be: (i) conducted by Controller or an independent third party engaged by Controller; and (ii) subject to the confidentiality obligations in the Agreement.  Controller shall use reasonable endeavors to minimize any disruption caused by the Audit to Processor’s business activities. Audits shall take place no more than once in any calendar year except to the extent that Controller has reasonable grounds to suspect a Data Breach or any material breach of this DPA by Processor.  To the extent permitted by Data Protection Laws and subject to Controller’s prior written consent, Processor may elect instead to arrange for its own qualified and independent assessor to conduct the Audit, using an appropriate and accepted control standard or framework and assessment procedure, at Processor’s expense and provide a report of such assessment to Controller upon request.  Any information disclosed in connection with any Audit shall be the confidential information of the entity that is subject to the Audit and shall be treated as such, provided that such confidential information may be disclosed by the Controller to the extent necessary to assert or enforce any rights under the Agreement, this DPA or if otherwise required to be disclosed under applicable law or legal process.

Section 6. Return or Deletion.  Processor shall, on the written request and at the election of Controller, return to Controller or delete from its systems all Controller Personal Data.

Section 7. Deidentified Data.  Processor shall: (a) take reasonable measures to ensure that any information that cannot reasonably be used to infer information about, or otherwise be linked to, an identifiable consumer or household (“Deidentified Data”) received or created by Processor cannot be associated with an individual; (b) publicly commit to maintain and use the Deidentified Data only in deidentified form and not attempt to re-identify the data, unless otherwise permitted by Data Protection Laws and Controller; and (c) contractually obligate any recipients of the Deidentified Data to comply with the requirements of this Section 7.

Section 8. GDPR. To the extent this DPA is subject to Regulation (EU) 2016/679 or as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (collectively, the “GDPR”), the Parties acknowledge and agree that Data Subjects (as defined under the GDPR) are intended third-party beneficiaries of this DPA with the right to enforce against the Processor those provisions of this DPA that relate to the Processing of their Personal Data.  Nothing in this Section 8 shall limit or exclude any liability between the Controller and the Processor as set forth elsewhere in this DPA; and except as expressly provided in this Section 8 with respect to Data Subjects (as defined under the GDPR), no person who is not a party to this DPA shall have any right to enforce any term of this DPA.

Section 9. Ownership of HomeServe Data.  As between HomeServe and any Party receiving HomeServe Data (as defined below) in connection with the Agreement (a “Receiving Party”), HomeServe is and will remain the sole and exclusive owner of all right, title and interest in and to all HomeServe Data, including all intellectual property rights relating thereto.  For purposes of this DPA, “HomeServe Data” means any and all information, data, materials, works, expressions, or other content, including any that are uploaded, submitted, posted, transferred, transmitted, or otherwise provided or made available by or on behalf of HomeServe or any employees, contractors or service providers of HomeServe and other persons authorized by HomeServe to provide HomeServe Data to Receiving Party in connection with the Agreement for Processing in connection with the Agreement (collectively, “Users”).  All output, copies, reproductions, improvements, modifications, adaptations, translations, and other derivative works of, based on, derived from, or otherwise using any HomeServe Data are themselves also HomeServe Data.  For the avoidance of doubt, HomeServe Data includes, without limitation, any and all information reflecting the access or use of any of Receiving Party’s systems by or on behalf of HomeServe or any User, including any end user profile-, visit-, session-, impression-, click through- or click stream-data, and any statistical or other analysis, information, or data based on or derived from any of the foregoing, including, without limitation any User’s Personal Data (collectively, “User Data”).   Except as explicitly set forth in the Agreement or this DPA, nothing contained in this DPA or the Agreement shall be construed as granting Receiving Party or any third party any right, title, or interest in or to any HomeServe Data whether by implication, estoppel, or otherwise.

Section 10. Security, Privacy and AI.

10.1 Security Program.  Receiving Party shall implement and maintain a written information security program that includes administrative, physical, and technical safeguards to protect HomeServe Data.  The program shall align with at least one of the following frameworks:  ISO/IEC 27001, NIST Cybersecurity Framework, or SOC 2 Trust Service Criteria. All safeguards shall comply with applicable laws and the terms of the Agreement.

10.2 Minimum Safeguards.  At a minimum, Receiving Party’s safeguards shall include: (i) limiting access to HomeServe Data to Personnel who have a need to know or otherwise access HomeServe Data to enable Receiving Party to perform its obligations under the Agreement (collectively, “Authorized Personnel”); (ii) securing business facilities, data centers, servers, backup systems, and all computing equipment (including mobile devices) with information storage capability; (iii) implementing network, application, database, and platform security, including securing data in transit, at rest, and upon disposal; (iv) implementing authentication and access controls within media, applications, operating systems, and equipment; (v) strictly segregating HomeServe Data from Receiving Party’s, its Affiliates’ and third-parties’ information so that HomeServe Data is not commingled with any other data; (vi) implementing personnel security procedures, including background checks consistent with applicable law; and (vii) providing privacy and information security training to Authorized Personnel.  

10.3 Data Breach.  Receiving Party shall (i) designate and provide HomeServe with the name and contact information of a primary security contact available 24/7 to assist with Data Breach obligations; (ii) notify HomeServe of a Data Breach no later than twenty-four (24) hours after becoming aware of it, by emailing informationsecurity@homeserveusa.com (with read receipt) and copying Receiving Party’s primary business contact within HomeServe; (iii) coordinate with HomeServe to investigate the Data Breach, including: assisting with any investigation; providing physical access to affected facilities; facilitating interviews with relevant Personnel; and making available all relevant records, logs, files, and data required to comply with applicable law, regulation, or industry standards, or as otherwise reasonably required by HomeServe; and (iv) at its sole cost and expense, use best efforts to immediately remedy the Data Breach and prevent recurrence in accordance with applicable laws. Nothing in this DPA shall be construed to require a Party to violate or delay compliance with any legal obligation with respect to a Data Breach.  Receiving Party shall reimburse HomeServe’s costs incurred in responding to, and mitigating damages caused by, any Data Breach, including all costs of notice, identity protection and monitoring services and remediation.  Any such reimbursement shall not limit any other remedy arising from a Data Breach available to HomeServe at law or in equity, or pursuant to the Agreement or this DPA. 

10.4 Data Security Audits.  At least once per year, Receiving Party shall obtain an application and network-level penetration test performed by a recognized third-party firm, conduct vulnerability scans, and perform risk assessments.  Receiving Party shall implement a corrective action plan to address all findings: mitigating all critical/severe findings within a reasonable period of time.  Receiving Party shall annually provide HomeServe with a current SOC 2 Type II report, ISO/IEC 27001 certificate, or equivalent attestation. Upon HomeServe’s written request, Receiving Party shall also make available any SSAE 18 (or successor) service organization reports.  HomeServe may conduct its own audit (or engage a third party) to validate Receiving Party’s security measures, annually, upon 30 days’ written notice. HomeServe shall treat all audit materials as Receiving Party’s confidential information.  Any exceptions or findings noted in audit reports or testing shall be addressed by Receiving Party through a documented corrective action plan within a reasonable period of time.

10.5 HomeServe Data.  Receiving Party agrees and covenants that it shall: (i) keep and maintain all HomeServe Data in strict confidence, using such degree of care as is reasonable and adequate to prevent loss or unauthorized access, use or disclosure; (ii) use and disclose HomeServe Data solely and exclusively for HomeServe for the purposes for which HomeServe Data, or access to it, is provided to Receiving Party pursuant to the terms and conditions of this DPA, and not use, sell, rent, transfer, distribute, or otherwise disclose or make available HomeServe Data for Receiving Party’s own purposes or for the benefit of anyone other than HomeServe, without HomeServe’s prior written consent; (iii) store all HomeServe Data in the United States or other jurisdictions approved by HomeServe in writing and shall not transfer HomeServe Data to any other countries or jurisdictions without the prior written consent of HomeServe; and (iv) not, directly or indirectly, disclose HomeServe Data to any person other than its Authorized Personnel without express written consent from HomeServe unless and to the extent required by government authorities or as otherwise, to the extent expressly required, by applicable law (“Authorized Third Party”) in which case, Receiving Party shall (x) use best efforts to notify HomeServe before such disclosure or as soon thereafter as reasonably possible; (y) be responsible for and remain liable to HomeServe for the actions and omissions of such Authorized Third Party concerning the treatment of such HomeServe Data as if they were Receiving Party’s own actions and omissions; and (z) require the Authorized Third Party that has access to HomeServe Data to execute a written agreement agreeing to comply with the terms and conditions of this DPA relating to the treatment of HomeServe Data.

10.6 Use of Artificial Intelligence.  Receiving Party hereby represents, warrants and covenants to HomeServe that it does not and will not use HomeServe Data in connection with any feature, functionality, or component that incorporates, uses, depends on, or employs any machine learning, deep learning, or other artificial intelligence technologies including, without limitation, statistical learning algorithms, models (including large language models), neural networks, and other artificial intelligence tools or methodologies.

10.7 Bulk Data Rule.  Receiving Party represents, warrants and covenants to HomeServe that (a) neither Receiving Party nor any its Personnel who have access to HomeServe Data is or will be at any time during the term of the Agreement a “covered person,” as such term is defined in 28 CFR part 202 (the “Bulk Data Rule”); and (b) neither Receiving Party nor any of its Affiliates will engage or attempt to engage in, or permit others to engage or attempt to engage in, the selling, licensing of access to, or other similar commercial transactions, such as reselling, sub-licensing, leasing, or transferring, HomeServe Data or any part thereof to “countries of concern” or “covered persons,” as such terms are defined in the Bulk Data Rule.  If Receiving Party knows or suspects that a “country of concern” or “covered person” has gained access to the HomeServe Data from or through Receiving Party or any of its Personnel, Receiving Party will immediately inform HomeServe in writing.  Receiving Party agrees to certify to HomeServe in writing Receiving Party’s compliance with the Bulk Data Rule upon HomeServe’s written request, which shall be made no more frequently than annually.

10.8 Material Breach of Security Provisions. Any failure of Receiving Party to meet the requirements of this DPA with respect to the security of any HomeServe Data or other confidential information of HomeServe is a material breach of the Agreement, including, without limitation, Section 10 of this DPA, for which HomeServe, at its option, may terminate the Agreement, including, without limitation, this DPA, immediately on written notice to Receiving Party without any notice or cure period, and Receiving Party shall promptly reimburse to HomeServe any amounts prepaid by HomeServe prorated to the date of such termination.

Section 11. Subcontractors.  Receiving Party shall ensure each of its Subcontractors complies with all relevant terms of this DPA, including all provisions relating to HomeServe Data or other confidential information of HomeServe.  Receiving Party shall remain responsible and liable for any and all: (i) performance required under this DPA; and (ii) acts and omissions of each Subcontractor to the same extent as if such performance, acts or omissions were by Receiving Party.

Section 12. Indemnification.  Receiving Party shall indemnify, defend, and hold harmless HomeServe and each of HomeServe’s Affiliates, and its and their respective officers, directors, employees, agents, contractors, successors, and assigns (each of the foregoing Persons, a “HomeServe Indemnitee”) from and against any and all Adverse Consequences (as defined below) incurred or suffered by any HomeServe Indemnitee to the extent that such Adverse Consequences arise out of or result from, or are alleged to arise out of or result from:  (a) Receiving Party’s breach of any representation, warranty, covenant, or obligation of Receiving Party under this DPA (including, any action or failure to act by any Personnel that, if taken or not taken by Receiving Party, would constitute such a breach by Receiving Party); or (b) any Data Breach.  Notwithstanding anything to the contrary set forth in the Agreement or this DPA, the foregoing indemnification shall not be subject to any limitations on consequential, indirect, special, or similar damages or any cap on the amount of damages set forth in the Agreement.  For purposes of this DPA, “Adverse Consequences” means all actions, suits, proceedings, arbitrations, hearings, investigations, violations, summons, subpoenas, investigations, charges, complaints, claims, demands, injunctions, judgments, orders, decrees, rulings, damages, dues, penalties, fines, costs, amounts paid in settlement, liabilities, obligations, taxes, liens, losses, expenses, and fees, including court costs and reasonable attorneys’ fees and expenses and the costs of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers.

Section 13. Amendment.  HomeServe reserves the right to change, amend, modify or restate this DPA at any time, without giving notice to the other Parties. This DPA amends and restates in their entirety any prior version(s) of this DPA.  The most current version of this DPA, which supersedes all previous versions, is available at https://www.homeserve.com/sc/legal/HomeServeDataPrivacyAddendum.  Parties to the Agreement shall review the DPA available at the link above from time to time and acknowledge that their continued performance under the Agreement constitutes binding acceptance of such DPA.