DATA PROTECTION AGREEMENT 

 1.1 Data Security Breach. Impactable will notify Client in writing without undue delay whenever Impactable reasonably believes that there has been a Data Security Breach, whether involving Impactable’s facilities, systems or equipment or those of a third-party subcontractor, and will provide information regarding the nature and scope of the Data Security Breach, its actual or potential cause, and the measures being taken by Impactable to investigate, correct or mitigate the breach and prevent future breaches. Impactable will not, and will cause third-party subcontractors not to, move or alter files on the affected system or equipment, conduct a forensic analysis, or take any other steps that would knowingly hinder a full investigation of the Data Security Breach. Impactable will not notify any individual or any third party other than law enforcement of a Data Security Breach except as directed by Client or as required by law. Within 30 days of identifying or being informed of the Data Security Breach, Impactable will develop and execute a plan that reduces the likelihood of a recurrence of a Data Security Breach.

 1.2 Requests of Data Subjects. Upon receipt of any request by a Data Subject to access, modify, correct or delete Personal Data, Impactable will notify Client immediately and will not respond or otherwise communicate directly with any such individual, except as directed by Client. In the event of any request for deletion, Impactable may instead pseudonymize such data in order to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities. Where Client has received a request by a Data Subject to access, modify, correct or delete Personal Data, Client will notify Impactable immediately, and communicate with any such individual. Both parties agree to cooperate with all requests, and where one party is bound to modify, correct, or delete Personal Data, so shall the other do so. For example, if a Data Subject lawfully requests the deletion of his or her Personal Data to the Client, the Client shall inform Impactable of said request, and both parties delete the Personal Data in question. 

1.3 Requests of Law Enforcement Authorities. Both parties to this agreement will notify each other as soon as practicable (but no later than one business day from receipt) of any request made by any governmental, law enforcement or regulatory agency for information concerning, or access to, Personal Data, unless prohibited by law. If notification is made by phone or email, either party will confirm such notice in writing. Prior to responding to any such requests, both parties will comply with all reasonable directions of Client regarding the response. 

1.4 Requests in Legal Proceedings. If Impactable is requested or required to disclose any Personal Data to a third party, Impactable will notify Client of any such anticipated disclosure (except to the extent prohibited by law). Impactable will not disclose the Personal Data to the third party without providing Client at least 48 hours, following such notice, so that Client may, at its own expense, exercise such rights as it may have under law to prevent or limit such disclosure. 

1.5 Return or Destruction of Documents. Upon termination or expiration of the Agreement, or as requested in writing by Client at any time, Impactable will, (i) return promptly all Personal Data; or (ii) destroy all documents, materials, and other media that may contain Personal Data, without retaining any portion or copy thereof. Notwithstanding, Impactable will retain the right to use all data in an anonymized or aggregated format. 

1.6 Further Assistance. At Client’s expense, Impactable will execute and deliver such documents and take such further actions reasonably requested by Client to comply with notification to a data protection authority or other – 2 – obligations applicable to Client or its Affiliates under Applicable Data Protection Laws. Note, the Client is responsible for complying with all Applicable Data Protection Laws. 

 2.1 Regulator Investigations. If and to the extent that any regulatory investigation relates to Personal Data handled by Impactable on behalf of Client, Impactable will reasonably assist Client to comply with the regulatory process as required. Such assistance will be at Client’s sole expense. Indemnification and Liability. Use of our Site and services is at the Client’s own risk. In no event will Impactable, or any third party, be liable for any indirect, incidental, consequential or special damages in connection with these terms, whether or not such damages were foreseeable and even if we were advised that such damages were likely or possible. In no event will Impactable’s aggregate liability to Client for any and all claims arising in connection with these terms exceed $100.00 CDN. Client acknowledges that this limitation of liability is an essential term between both parties relating to the provision of the site, and the service, and Impactable would not enter into this DPA without this limitation.

 2.2 Privacy Notice and Consent. In connection with the Agreement, or Services provided pursuant to it, Impactable may provide Personal Data, such as name, and contact information, relating to its personnel (“Impactable Personal Information”) to Client. Impactable Personal Information may be transferred to, stored, accessed or otherwise Processed in countries that have privacy and data protection laws that differ from, or are not as stringent as, those where Impactable Personal Information originates. Client will Process Contractor Personal Information: (i) in connection with the services provided under this Agreement; (ii) to administer and enforce this Agreement; and (iii) for other actual or potential legal and business transactions involving the Parties. By executing and delivering this Agreement, Impactable represents and warrants that it has the right to provide Impactable Personal Information to Client for Processing as described in this paragraph. 

3.1 Processor and Controller. For the purposes of this Agreement, Client will be deemed the Controller, and Impactable will be deemed the Processor for the Controller. 

3.2 General Data Protection Regulation and the California Consumer Privacy Act. To the extent the EU General Data Protection Regulation (“GDPR”) applies to the Processing of Personal Data under the Agreement, Impactable is the Data Processor and Client is the Data Controller, as such terms are defined in the GDPR. To the extent the California Consumer Privacy Act (“CCPA”) applies to the Processing of Personal Data under the Agreement, the Parties acknowledge and agree that Impactable is a “Service Provider” within the meaning of section §1798.140(v) of the CCPA. The Client and Impactable acknowledge and agree that Impactable will not (i) sell Personal Data received pursuant to the Agreement; (ii) Process such Personal Data other than for the specific business purposes contemplated by the Agreement or Impactable’ Privacy Policy; nor (iii) Process such Personal Data outside the context of the direct business relationship between the Client and Impactable. Client and Impactable each certifies to having understood the restrictions in this paragraph and agrees to comply with the same.

 3.3 Conflict; Survival. In the event of a conflict or inconsistency between this DPA and any other portion of the Agreement, this DPA will govern. For the avoidance of doubt, this DPA governs the treatment of Personal Data notwithstanding that it may be considered Confidential or proprietary information that is subject to other obligations regarding confidentiality and use under the Agreement. 

4.1 Employees and Subprocessors. Impactable will ensure that its employees and Subprocessors who have access to Personal Data or Confidential Information: (i) are appropriately qualified to perform their duties; and, (ii) are obligated to protect Personal Data and Confidential Information in accordance with the requirements of the Agreement and this DPA during the term of their employment or retention. Impactable will agree with any Subprocessor that is at least as comprehensive as this DPA.