Course Creator 360 Inc.
Last updated: April 2026
This Customer Data Processing Addendum, including its exhibits and appendices (the "Addendum"), is entered into between Course Creator 360 Inc., a corporation incorporated under applicable law ("CC360"), and the counterparty accepting this Addendum ("Customer") (each, a "Party" and, collectively, the "Parties") by virtue of the Customer signing and accepting the Terms of Services Agreement (the "Agreement"). As of the effective date of the Agreement (the "Effective Date"), the terms of this Addendum shall be incorporated by reference and be part of the Agreement. In case of any conflict or inconsistency with the terms of the Agreement, this Addendum will take precedence over the terms of the Agreement to the extent of such conflict or inconsistency, and it will supersede any previous Addendum. For clarity, the Standard Contractual Clauses prevail over any other term of this Addendum. Except where the context requires otherwise, references in this Addendum to the Agreement are to the Agreement as amended or supplemented by, and including, this Addendum.
For the purpose of interpreting this Addendum, the following terms (and their applicable cognates) shall have the meanings set out below:
"Account" means any accounts or instances created by, or on behalf of, Customer or its Affiliates within the Services.
"Affiliate" means any entity within a controlled group of companies that directly or indirectly, through one or more intermediaries, is controlling, controlled by, or under common control with one of the Parties.
"Applicable Data Protection Laws" means all laws and regulations applicable to the Processing of Customer Personal Data, including but not limited to the laws and regulations identified in Exhibit B hereto as may be amended, modified, or supplemented from time to time, as applicable.
"Contracted Processor" means any third party appointed by or on behalf of CC360 to Process Customer Personal Data in connection with the Services.
"Customer Personal Data" means Personal Data contained within Customer Data that CC360 Processes by or on behalf of Customer to provide the Services in accordance with the Agreement. Customer Personal Data does not include Customer's Account information.
"Data Exporter" and "Data Importer" shall have the same meanings assigned to them in Part A of Exhibit A.
"GDPR" means the EU GDPR and UK GDPR as those terms are defined within Exhibit B, as applicable.
"Jurisdiction Specific Terms" means all terms applicable to the Processing of Personal Data that apply to the extent that CC360 Processes Customer Personal Data originating from, or protected by, Applicable Data Protection Laws in one of the jurisdictions identified in these terms. The Jurisdiction Specific Terms are currently available as Exhibit B to this Addendum.
"Restricted Transfer" means any transfer of Customer Personal Data protected by Applicable Data Protection Laws to a Third Country or an international organization in a Third Country (including data storage on foreign servers).
"SCCs" or "Standard Contractual Clauses" are the model clauses for Restricted Transfers adopted from time to time by the relevant authorities of the jurisdictions indicated in Exhibit B, insofar as their use is approved by the relevant authorities as an appropriate mechanism or safeguard for Restricted Transfers.
"Services" means the services and other activities carried out by or on behalf of CC360 for Customer upon Customer's creation of an Account, whether through a free trial or paid subscription. For the avoidance of doubt, Services exclude services CC360 performs as a Controller, such as managing customer relationships, account administration, and providing the areas of its website that can be accessed without creation of an Account.
"Sub-Processor" means a direct Processor of a Processor. For the avoidance of doubt, Contracted Processors are Sub-Processors.
The terms "Controller," "Data Protection Assessment," "Data Subject," "Member State," "Personal Data," "Personal Data Breach," "Processing," "Processor," "Rights of the Data Subjects," "Supervisory Authority," and "Third Country" shall have the same meanings as under Applicable Data Protection Laws, and their cognate and corresponding terms shall be construed accordingly.
Capitalized terms which are used but not defined herein shall have the meanings given to them in the Agreement. Except as modified or supplemented above, the definitions of the Agreement shall remain in full force and effect.
Duration. This Addendum shall take effect on the Effective Date and shall continue concurrently for the duration that Personal Data is Processed by CC360 pursuant to the Agreement.
Scope. This Addendum will apply to the Processing of all Customer Personal Data, regardless of country of origin, place of Processing, location of Data Subjects, or any other factor. The Processing of Personal Data that does not constitute Customer Personal Data is outside the scope of this Addendum.
Exhibits and Appendices. This Addendum includes the following exhibits and appendices:
CC360 will act as a Processor of Customer Personal Data. Customer will act as the Controller of Customer Personal Data. To the extent Customer acts as a Processor to other parties when processing Customer Personal Data, CC360 will act as the Sub-Processor to Customer.
CC360 shall:
All necessary information relating to the details of Processing is set out within Exhibit A.
Customer instructs CC360 (and authorizes CC360 to instruct each Contracted Processor it engages) to Process Customer Personal Data and, in particular, transfer Customer Personal Data to any country or territory, only as reasonably necessary for the provision of the Services and consistent with the Agreement and this Addendum.
CC360 shall take reasonable steps to ensure:
CC360 shall implement and maintain the administrative, technical, and organizational security measures identified within Appendix I to Exhibit A, which ensure a level of security appropriate to the risk of Processing and take into account: the state of the art, costs of implementation, and the nature and purposes of Processing; the risk of varying likelihood and severity to the rights and freedoms of natural persons; and the risks presented by the Processing activities, particularly those risks related to Personal Data Breaches.
Customer authorizes CC360 to continue using those Contracted Processors engaged as of the Effective Date and set out within CC360's sub-processors list made available to Customer at https://coursecreator360.com/legal/subprocessors, which Customer acknowledges it has reviewed prior to the Effective Date. Customer further authorizes CC360 and its Contracted Processors to appoint additional Contracted Processors, provided the obligations of this Section 6 (and the respective obligations of Exhibit B) are met.
To appoint an additional Contracted Processor, CC360 will provide Customer with written notice, which will include the details of Processing to be undertaken. Customer may subscribe to receive such notifications through CC360's website or designated notification mechanism.
6.3.1 Customer will be deemed to have consented to the additional Contracted Processor if no objection is received within thirty (30) days of CC360's notice. Customer may object to the appointment of a Contracted Processor by providing a written objection, which shall include the name of the objected-to Contracted Processor and a reasonable statement of objection.
6.3.2 If an objection is received, the Parties will work together in good faith with a view of achieving a commercially reasonable resolution. If no mutually agreeable resolution is available, Customer may terminate the specific Services affected by the objection upon thirty (30) days' written notice to CC360, with a pro-rata refund of any prepaid fees attributable to the period after termination. Upon the effective date of termination, CC360 shall cease Processing the Customer Personal Data associated with the terminated Services.
With respect to each Contracted Processor, CC360 shall:
Where any Contracted Processor fails to fulfil its data protection obligations under such written contract (or in the absence thereof, as the case may be), CC360 shall remain liable to Customer for the performance of the respective Contracted Processors' data protection obligations under such contract and/or Applicable Data Protection Laws, subject to the limitations of liability set forth in Section 16.
Taking into account the nature of the Processing, CC360 shall assist Customer by implementing appropriate technical and organizational measures, insofar as possible, to respond to valid requests to exercise Rights of the Data Subjects under Applicable Data Protection Laws.
With regard to the Rights of the Data Subjects within the scope of this Section 7, CC360 shall:
If CC360 discovers, is notified of, or has reason to suspect a Personal Data Breach affecting Customer Personal Data under its or its Contracted Processors' control, CC360 will (i) without undue delay implement reasonable measures to stop the unauthorized access; (ii) secure the Customer Personal Data; and (iii) notify Customer without undue delay after confirming a Personal Data Breach, and in any event no later than seventy-two (72) hours after CC360 has reasonably determined that a Personal Data Breach has occurred.
Following notice of a Personal Data Breach, CC360 shall:
CC360's notification of or response to a Personal Data Breach under this Section will not be construed as an acknowledgement by CC360 of any fault or liability with respect to the Personal Data Breach.
CC360 shall provide Customer with relevant information and documentation, and assist Customer in complying with its obligations with regard to any data protection assessments or prior consultations with Supervisory Authorities when required pursuant to Applicable Data Protection Laws, but in each such case solely with regard to Customer Personal Data Processed by, and taking into account the nature of Processing and information available to, CC360 and its Contracted Processors.
10.1 CC360 shall provide Customer with the technical means, consistent with the way the Services are provided, to request the deletion of Customer Personal Data, with the exception of any Customer Personal Data that may be retained pursuant to applicable laws.
10.2 If requested by Customer and following the cessation of Services, CC360 shall use commercially reasonable efforts to delete or return all Customer Personal Data (including copies) to Customer, with the exception of any Customer Personal Data that may be retained pursuant to applicable laws.
10.3 CC360 shall use commercially reasonable efforts to cause all Contracted Processors that have received Customer Personal Data to delete or return such Customer Personal Data, consistent with the deletion capabilities of the underlying platform and subject to applicable legal retention requirements.
10.4 This Section 10 does not apply to Customer Personal Data that has been archived on back-up systems, which CC360 or its Contracted Processors, as applicable, shall securely isolate and protect from any further Processing, except to the extent required by applicable law.
CC360 shall allow for and contribute to audits, including remote inspections, by Customer or an auditor mandated by Customer (subject to a mutual non-disclosure agreement) no more than once per twelve (12) month period, except where additional audits are (i) required by Customer's Supervisory Authority, or (ii) reasonably necessary following a confirmed Personal Data Breach affecting Customer Personal Data. Customer shall provide at least thirty (30) days' prior written notice of any audit, and audits shall be conducted during normal business hours in a manner that does not unreasonably interfere with CC360's operations. CC360 may satisfy audit obligations by providing third-party audit reports (including HighLevel's SOC 2 or equivalent reports) to the extent they address the audit scope. Customer shall reimburse CC360 for time expended in connection with any such audit at CC360's then-current professional services rates, which shall be made available to Customer upon request.
To the extent CC360 Processes Customer Personal Data originating from or protected by Applicable Data Protection Laws in a jurisdiction listed in Exhibit B, then the terms and definitions specified in Exhibit B with respect to the applicable jurisdiction shall apply in addition to the terms of this Addendum.
Restricted Transfers of Customer Personal Data within the scope of this Addendum shall be conducted in accordance with Exhibit B and Applicable Data Protection Laws.
If the relevant authorities adopt a new version of SCCs as a lawful mechanism for Restricted Transfers in a jurisdiction governing the processing of Customer Personal Data, the Parties are deemed to have agreed to the execution of the new version of the SCCs by signing this Addendum, and, if necessary, CC360 shall be entitled to update Exhibit A and Exhibit B (and their appendices) accordingly.
If an alternative transfer mechanism, such as Binding Corporate Rules, is adopted by CC360 during the term of the Agreement (an "Alternative Mechanism"), and CC360 notifies Customer that some or all Restricted Transfers can be conducted in compliance with Applicable Data Protection Laws pursuant to the Alternative Mechanism, the Parties will rely on the Alternative Mechanism instead of the transfer mechanisms in Exhibit B for Restricted Transfers to which the Alternative Mechanism applies.
CC360 acknowledges and confirms that it does not receive any Customer Personal Data as consideration for any Services or other items that CC360 provides to Customer. As between Customer and CC360, Customer retains all rights and interests in Customer Personal Data. CC360 agrees to refrain from taking any action that would cause any transfers of Customer Personal Data to or from CC360 to qualify as selling Customer Personal Data under Applicable Data Protection Laws.
Subject to the conditions specified in this Addendum, CC360 may host the content of the exhibits and appendices of this Addendum online, and further update the Addendum and such exhibits and appendices, provided that prior notice is given to Customer.
15.1 If no objection is received within fourteen (14) days of receipt of the notice, Customer will be deemed to have consented to the update. If Customer issues notice of non-acceptance, the Parties will cooperate and negotiate in good faith regarding any required updates.
15.2 If no mutually agreeable resolution is available, Customer may terminate the specific Services affected by the objection upon thirty (30) days' written notice to CC360, with a pro-rata refund of any prepaid fees attributable to the period after termination. Upon the effective date of termination, CC360 shall cease Processing the Customer Personal Data associated with the terminated Services.
To the extent that the Addendum or an exhibit or appendix is hosted online, the latest version online shall take precedence over the relevant exhibit or appendix within this Addendum.
Subject to Applicable Data Protection Laws, the liability of each Party under this Addendum shall be subject to the exclusions and limitations of liability set out in the Agreement. For the avoidance of doubt, CC360's aggregate liability arising out of or related to this Addendum, whether in contract, tort (including negligence), or under any other theory of liability, shall be subject to, and shall count toward, the aggregate liability cap set forth in the Agreement. Nothing in this Addendum shall be construed as creating liability in excess of the liability cap in the Agreement, except to the extent such limitation is not permitted under Applicable Data Protection Laws.
To the extent CC360 has an indemnification obligation to Customer under the Agreement or Applicable Data Protection Laws with respect to CC360's breach of its data protection obligations, such indemnification shall be subject to the limitations of liability set forth in Section 16.
Customer shall defend, indemnify, and hold harmless CC360 and its Affiliates, officers, directors, employees, and agents from and against any third-party claims, damages, fines, penalties, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from: (i) Customer's Processing instructions to CC360 that violate Applicable Data Protection Laws; (ii) Customer's failure to obtain any necessary consents, provide required notices, or establish a valid lawful basis for the Processing of Customer Personal Data; (iii) Customer's use of the Services in violation of Applicable Data Protection Laws; or (iv) the content of Customer Personal Data submitted to the Services. The indemnification obligations in this Section 17.2 shall not be subject to any liability cap in the Agreement.
Notice. The Parties shall use the Data Protection Contact provided in Part A of Exhibit A as contact points for all matters related to this Addendum, including notice of a Personal Data Breach and inquiries pursuant to Rights of the Data Subjects.
Prior Existing Agreement. This Addendum supersedes and replaces all prior and contemporaneous proposals, statements, sales materials or presentations, and agreements, oral and written, with regard to the subject matter of this Addendum, including any prior data processing addenda entered into between CC360 and Customer in connection with the Agreement. Notwithstanding, all clauses of the Agreement that are not explicitly amended or supplemented by the clauses of this Addendum remain in full force and effect and shall apply, as long as this does not contradict compulsory requirements of Applicable Data Protection Laws.
Annual Review. CC360 will review this Addendum (including Exhibit A and its appendices) at least annually and document such review. Customer acknowledges its own obligation to review this Addendum on a schedule appropriate to its use of the Services and any changes to the Personal Data, the purposes for Processing, or any risk assessments related to the Processing contemplated in this Addendum.
Conflicts. In the event of any conflict between the Agreement (including any annexures, exhibits, and appendices thereto) and this Addendum, the provisions of this Addendum shall prevail. In case of any conflict or ambiguity between the Jurisdiction Specific Terms and any other terms of this Addendum, the applicable Jurisdiction Specific Terms will prevail.
Severability. Should any provision of this Addendum be found legally invalid or unenforceable, then the invalid or unenforceable provision will be deemed superseded by a valid, enforceable provision that most closely matches the intent of the original provision, and the remainder of this Addendum will continue in effect.
Non-Compliance. If CC360 determines that it can no longer meet any of its obligations set out within this Addendum, Applicable Data Protection Laws, or the SCCs (where applicable), it shall (i) promptly notify Customer of that determination and (ii) cease the Processing, if requested by Customer, or promptly take other reasonable and appropriate steps to remediate the lack of compliance.
Ambiguity. CC360 may amend this Addendum without notice to or consent of Customer for the purposes of (a) curing any ambiguity, (b) curing, correcting or supplementing any defective provision contained herein, or (c) making any other provisions with respect to matters or questions arising under this Addendum; provided that such action shall not materially alter the Addendum.
Signature. If you are accepting the terms of this Addendum on behalf of either Party, you represent and warrant that you have the authority to bind that Party and its Affiliates, where applicable, to the terms and conditions of this Addendum.
Disclosure to Supervisory Authorities. The Parties acknowledge that either Party may disclose this Addendum and any relevant privacy provisions in the Agreement to Supervisory Authorities, or any other judicial or regulatory body, upon their request.
CC360
Course Creator 360 Inc.
2699 E Gray Birch Dr, Saint George, UT 84790, USA
Customer
Customer Name as defined in CC360's Terms of Service and its relevant Affiliates.
Customer address as specified by Customer's Platform Account.
CC360
Customer
Customer's contact details, as specified by Customer's Platform Account.
Processing activities relating to the provision of the Services, as set forth in the Agreement. The Processing will involve collecting, storing, recording, and managing Customer Personal Data, in particular for the purpose of providing online course creation, delivery, and management services.
Customer as the Controller and CC360 as the Processor: To the extent Customer is the Controller of Customer Personal Data, CC360 is Customer's Processor.
Customer as the Processor and CC360 as the Sub-Processor: To the extent Customer is the Processor of Customer Personal Data, CC360 is Customer's Sub-Processor.
The subject matter of the Processing of Customer Personal Data pertains to the provision of Services pursuant to the Agreement.
CC360 will process Customer Personal Data as necessary to provide the Services under the Agreement, for the purposes specified in the Agreement and this Addendum, and in accordance with Customer's instructions as set forth in this Addendum.
The duration of the period in which the Customer accesses and uses the CC360 platform under the Services Agreement.
Customer may submit Personal Data as determined by Customer, which may include, but is not limited to, Personal Data relating to Customer, businesses and other entities contracting with Customer, and users of those businesses and other entities.
As applicable, any Customer Personal Data that Customer provides into the Services.
The Parties do not anticipate the transfer of special categories of data, unless Customer first notifies CC360 in which case the Parties agree to apply appropriate restrictions and safeguards taking into consideration the nature of the data and the risks involved.
Regular and repeating for as long as Customer uses the Services.
Same as above to the extent such information is provided to Contracted Processors for purposes of providing the Services.
Throughout the term of the Agreement and for so long as CC360 has access to any Customer Personal Data, CC360 shall implement and maintain at least the following (or superior) technical and organizational security measures ("TOMs") to safeguard such Customer Personal Data.
Platform Context: CC360 operates as a white-label agency partner of HighLevel (GoHighLevel / "GHL"). Customer Personal Data is hosted, stored, and processed on the HighLevel platform, which serves as CC360's primary sub-processor and infrastructure provider. Certain infrastructure-level TOMs are inherited from HighLevel's own TOMs, which are incorporated by reference and available at https://www.gohighlevel.com/data-processing-agreement. CC360's direct responsibilities are described below.
Ongoing Compliance Monitoring: CC360 conducts periodic internal audits of staff access and compliance with the policies described in this Appendix and remediates deviations as identified.
Personal Data at rest and in transit is encrypted through the underlying HighLevel platform (AES-256 at rest; TLS v1.2+ in transit). CC360 maintains policies requiring that any data transmitted between Customer and CC360 outside the platform (e.g., via email, support channels) be sent over SSL/TLS-encrypted connections.
Core platform availability, integrity, and resilience are maintained by HighLevel. CC360 supplements this with policies requiring: (a) role-based access controls for CC360 staff accessing Customer sub-accounts; (b) endpoint protection on CC360 employee devices used to access Customer data; (c) multi-factor authentication (MFA) for CC360 staff accounts with access to Customer sub-accounts; and (d) internal procedures requiring least-privilege access.
Data backup and disaster recovery for the underlying platform are performed by HighLevel on managed cloud infrastructure. CC360 maintains internal records and configurations in backed-up systems so that Customer accounts can be re-provisioned or restored within the platform if required.
Third-party vulnerability scanning and annual penetration testing of the underlying platform and infrastructure are conducted by HighLevel. CC360 reviews HighLevel's security documentation and incident disclosures as they become available, and conducts periodic internal reviews of its own access controls, staff permissions, and operational procedures.
Platform-level authentication (password protection, signed tokens, optional 2FA) is provided by HighLevel. CC360 maintains policies requiring password standards and multi-factor authentication for CC360 staff accounts with access to Customer sub-accounts, and applies role-based authorization so that staff only access sub-accounts necessary for their assigned duties.
All Personal Data transmitted through the CC360 application is protected via SSL/TLS (TLS v1.2+) as provided by the HighLevel platform. CC360 maintains policies requiring staff to use encrypted channels (SSL-protected email, HTTPS web interfaces, secure support ticketing) when handling Customer Personal Data.
Personal Data is stored on HighLevel-managed cloud infrastructure and encrypted at rest using AES-256. CC360 does not maintain separate primary storage of Customer Personal Data outside the HighLevel platform, except for minimal records retained for billing, support, and compliance purposes, which are stored in access-controlled systems.
Physical security of servers and data centers is provided by HighLevel's cloud infrastructure providers, as described in their respective terms. CC360 operates on a remote-first basis and maintains policies requiring physical security controls for any CC360 offices and for employee devices used to access Customer Personal Data (device encryption, lock-screen requirements, secure storage of physical equipment).
Platform-level audit logs, user action logs, and infrastructure monitoring are maintained by HighLevel. CC360 maintains internal records of staff access to Customer sub-accounts and support ticket activity, and relies on HighLevel's audit logs for detailed application-level events.
Underlying platform configuration, container management, and patching are managed by HighLevel according to their standard policies. CC360 does not operate its own application servers. CC360's internal tooling (e.g., support, CRM) is maintained according to vendor best practices and kept up to date.
CC360 maintains an internal team responsible for staff IT administration, access management, onboarding/offboarding, and oversight of vendor security practices. CC360 relies on HighLevel for platform-level IT security governance and reviews HighLevel's publicly available security commitments.
CC360 maintains policies to collect only the minimum amount of Customer Personal Data necessary to deliver the requested services, consistent with CC360's Privacy Policy. Optional fields in CC360-configured intake forms are clearly marked as optional, and Customers determine what data their own end users provide.
Customers can review, correct, and update Personal Data stored within their CC360/HighLevel sub-account at any time through the platform interface. CC360 supports data correction requests through its support channel.
Customers (as administrators of their sub-accounts) may configure data retention with respect to specific records or individuals within the platform. CC360 retains account-level records only for the duration necessary to provide the services and meet legal/tax obligations, after which data is deleted or returned in accordance with the DPA.
Access to Customer Personal Data by CC360 staff is role-restricted and logged. CC360 maintains a designated privacy contact ([email protected]) for Data Subject and privacy-related requests, and responds to such requests through its documented support ticketing process.
Customers may obtain a copy of their Personal Data, correct their Personal Data, or request the complete removal of their Personal Data from CC360 systems by contacting [email protected], as set forth in CC360's Privacy Policy. CC360 uses its support ticketing process to track, action, and confirm completion of all portability and erasure requests.
When applicable, the Processing of Customer Personal Data shall be compliant with the Australian Privacy Principles, the Australian Privacy Act (1988), and any other applicable law, regulation, or decree of Australia pertaining to the protection of such information.
Wherever the Processing pursuant to the Addendum falls within the scope of Brazil's Lei Geral de Proteção de Dados, Law No. 13.709 of 14 August 2018 and any other applicable law, regulation, or decree of Brazil pertaining to the protection of such information (collectively "Brazilian Data Protection Laws"), the provisions of the Addendum and this Section shall apply to such Processing.
With regard to any Restricted Transfer subject to Brazilian Data Protection Laws, one of the following transfer mechanisms shall apply, in the following order of precedence:
The Addendum hereby incorporates by reference the Brazilian Standard Contractual Clauses, including Section II in its entirety. The Parties are deemed to have accepted, executed, and signed the Brazilian Standard Contractual Clauses where necessary in their entirety.
The Parties agree that any references to clauses, and choices within the Brazilian Standard Contractual Clauses shall be deemed to be the same as the cognate and corresponding references within any appropriate, updated Standard Contractual Clauses as may be applicable from time to time pursuant to the Addendum.
For the purposes of the Brazilian Standard Contractual Clauses and any substantially similar Standard Contractual Clauses which may be adopted by the relevant authorities in the future, the Parties agree to apply the following:
In cases where the Brazilian Standard Contractual Clauses apply and there is a conflict between the terms of the Addendum and the terms of the Brazilian Standard Contractual Clauses, the terms of the Brazilian Standard Contractual Clauses shall prevail with regard to the Restricted Transfer in question.
When applicable, the Processing of Customer Personal Data shall be compliant with the Canadian Federal Personal Information Protection and Electronic Documents Act and any other applicable law, regulation, or decree of Canada pertaining to the protection of such information.
"EEA" means the European Economic Area, consisting of the EU Member States, and Iceland, Liechtenstein, and Norway.
"EEA Data Protection Laws" means the EU GDPR and all laws and regulations of the EU and the EEA countries applicable to the Processing of Customer Personal Data.
"EU 2021 SCCs" means the contractual clauses adopted by the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679.
"EU GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, as may be amended from time to time.
With regard to any Restricted Transfer subject to EEA Data Protection Laws between the Parties, one of the following transfer mechanisms shall apply, in the following order of precedence:
The Addendum hereby incorporates by reference the SCCs. The Parties are deemed to have accepted, executed, and signed the SCCs where necessary in their entirety (including the annexures thereto).
The Parties agree that any references to clauses, annexures, modules and choices within this Section shall be deemed to be the same as the cognate and corresponding references within any appropriate, updated SCCs as may be applicable from time to time pursuant to the Addendum.
For the purposes of the EU 2021 SCCs and any substantially similar SCCs which may be adopted by the relevant authorities in the future:
In cases where the SCCs apply and there is a conflict between the terms of the Addendum and the terms of the SCCs, the terms of the SCCs shall prevail with regard to the Restricted Transfer in question.
"FDPIC" means the Swiss Federal Data Protection and Information Commissioner.
"Swiss Data Protection Laws" includes the Federal Act on Data Protection of 19 June 1992 ("FADP") and the Ordinance to the Federal Act on Data Protection.
With regard to any Restricted Transfer subject to Swiss Data Protection Laws between the Parties, one of the following transfer mechanisms shall apply, in the following order of precedence:
The Addendum hereby incorporates by reference the EU 2021 SCCs, which have been adopted for use by the FDPIC with certain modifications. The Parties are deemed to have accepted, executed, and signed the EU 2021 SCCs where necessary in their entirety. The Parties incorporate and adopt the EU 2021 SCCs for Restricted Transfers subject to Swiss Data Protection Laws in the same manner set forth in Section 4 of these Jurisdiction Specific Terms, subject to the following modifications:
In cases where the SCCs apply and there is a conflict between the terms of the Addendum and the terms of the SCCs, the terms of the SCCs shall prevail with regard to the Restricted Transfer in question.
"UK Data Protection Laws" includes the Data Protection Act 2018 and the UK GDPR.
"UK GDPR" means the United Kingdom General Data Protection Regulation, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.
"UK ICO" means the UK Information Commissioner's Office.
"UK Transfer Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued pursuant to Section 119A(1) of the Data Protection Act 2018 and approved by the UK Parliament.
With regard to any Restricted Transfer subject to UK Data Protection Laws between the Parties, one of the following transfer mechanisms shall apply, in the following order of precedence:
The Addendum hereby incorporates by reference the EU 2021 SCCs, as adopted for use by the UK ICO with certain modifications, together with the UK Transfer Addendum. The Parties are deemed to have accepted, executed, and signed the EU 2021 SCCs where necessary in their entirety. For the purposes of the tables to the UK Transfer Addendum:
The Parties incorporate and adopt the EU 2021 SCCs for UK Restricted Transfers subject to the following modifications:
In cases where the SCCs, in conjunction with the UK Transfer Addendum, apply and there is a conflict between the terms of the Addendum and the terms of the SCCs or UK Transfer Addendum, the terms of the UK Transfer Addendum shall prevail with regard to the Restricted Transfer in question.
Wherever the Processing pursuant to the Addendum falls within the scope of United States Data Protection Laws (defined below), the provisions of the Addendum and this Section shall apply to such Processing.
"United States Data Protection Laws" include, individually and collectively, enacted state and federal laws, acts, and regulations of the United States of America that apply to the Processing of Personal Data, as may be amended from time to time. Such laws include, without limitation, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and similar state privacy laws including the Colorado Privacy Act, Connecticut Act Concerning Personal Data Privacy and Online Monitoring, Delaware Personal Data Privacy Act, Iowa Consumer Data Protection Act, Maryland Online Data Privacy Act, Minnesota Consumer Data Privacy Act, Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire Privacy Act, New Jersey Senate Bill 332, Oregon Consumer Privacy Act, Tennessee Information Protection Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act, and Virginia Consumer Data Protection Act.
"Personal Data Breach" (as used in this Section) includes "Breach of Security" and "Breach of the Security of the System" as defined under applicable United States Data Protection Laws.
The terms "Business Purpose," "Commercial Purpose," "Sell," and "Share" shall have the same meanings as under applicable United States Data Protection Laws.
Upon termination of the Agreement, CC360 shall, as soon as reasonably practicable, destroy all Customer Personal Data it has Processed on behalf of Customer after the end of the provision of Services relating to the Processing and destroy all copies of the Customer Personal Data unless applicable law requires or permits storage of such Customer Personal Data.
By this Appendix (this "Appendix"), the Parties provide additional safeguards and redress to the Data Subjects whose Personal Data is transferred pursuant to SCCs. This Appendix supplements and is made part of, but is not in variation or modification of, the SCCs that may be applicable to the Restricted Transfer.
For the purpose of interpreting this Appendix, the following terms shall have the meanings set out below:
"EO 12333" means the U.S. Executive Order 12333.
"FISA" means the U.S. Foreign Intelligence Surveillance Act.
"Schrems II Judgment" means the judgment of the European Court of Justice in Case C-311/18, Data Protection Commissioner v. Facebook Ireland Limited and Maximilian Schrems.
To the best of Data Importer's knowledge as of the Effective Date, Data Importer has not received any national security orders of the type described in Paragraphs 150-202 of the Schrems II Judgment. Data Importer will notify Data Exporter if it becomes aware of any such orders to the extent legally permitted.
To the best of Data Importer's knowledge, Data Importer reasonably believes that it is not eligible to be required to provide information, facilities, or assistance of any type under FISA Section 702 because: (a) no court has found Data Importer to be an entity eligible to receive legal process issued under FISA Section 702 as an "electronic communication service provider" within the meaning of 50 U.S.C. § 1881(b)(4); and (b) if Data Importer were to be found eligible for process under FISA Section 702, it is not the type of provider eligible to be subject to UPSTREAM collection.
To the best of Data Importer's knowledge, EO 12333 does not provide the U.S. government the ability to order or demand that Data Importer provide assistance for the bulk collection of information, and Data Importer shall take no action pursuant to EO 12333.
To the best of Data Importer's knowledge, Data Importer certifies that:
Data Exporter will be entitled to terminate the contract on short notice in cases in which Data Importer does not reveal the existence of a back door or similar programming or manipulated business processes or any requirement to implement any of these or fails to promptly inform Data Exporter once their existence comes to its knowledge.
Data Importer will provide Data Exporter with information about legal prohibitions on Data Importer to provide information under this Appendix. Data Importer may choose the means to provide this information.
Notwithstanding the application of the security measures set forth in the Addendum, Data Importer will implement internal policies establishing that:
This Appendix shall automatically terminate with respect to the Processing of Customer Personal Data transferred in reliance of the SCCs if the Supervisory Authority or a competent regulator approves a different transfer mechanism that would be applicable to the Restricted Transfers covered by the SCCs (and if such mechanism applies only to some of the data transfers, this Appendix will terminate only with respect to those transfers) and that does not require the additional safeguards set forth in this Appendix.
This Addendum is incorporated into and forms part of the Agreement between CC360 and Customer. By accepting the Agreement and/or continuing to use the Services, Customer acknowledges and agrees to the terms of this Addendum. No separate signature is required for this Addendum to take effect. Customers who require a countersigned copy for their compliance records may request one by emailing [email protected].