Data Processing Agreement

This Data Processing Agreement (“DPA”) is incorporated into, and supplements, the J. J. Keller Terms of Use, as amended from time to time, or other agreement between J. J. Keller & Associates, Inc. (“J. J. Keller”) and Client governing J. J. Keller's provision, and Client’s receipt of the Services (collectively, the “Agreements”).

This DPA is an agreement between J. J. Keller and the entity who receives the Services from J. J. Keller pursuant to an Agreement that incorporates this DPA (“Client”) and is effective as of the date this DPA is incorporated into such Agreement (the “DPA Effective Date”). J. J. Keller and Client are individually referred to herein as a “Party” and, collectively, as the “Parties”.

1. Definitions
For purposes of this DPA, the following capitalized terms shall have the meanings ascribed thereto. Other capitalized terms used in this DPA are defined in the context in which they are used and shall have the meanings indicated. Capitalized terms which are not defined herein shall have the meanings ascribed to them in the applicable Agreements.

1.1 “CCPA” means the California Consumer Privacy Act, Cal. Civ. Code §1798.100 et. seq., as amended, including by the California Privacy Rights Act of 2020, and their implementing regulations.

1.2 “Client Instructions” means Client’s instructions to J. J. Keller to Process Client Personal Data on Client’s behalf: (1) as necessary to provide the Services to Client; (2) as documented in the Agreements and this DPA; and (3) as otherwise instructed by Client in writing and acknowledged and agreed by J. J. Keller.

1.3 “Client Personal Data” means any Personal Data Processed by J. J. Keller on behalf of Client via J. J. Keller's provision of the Services. Notwithstanding anything to the contrary herein, Client Personal Data does not include any Anonymized Data.

1.4 “Controller” means the natural or legal person or entity who determines the purposes and means of the Processing of Personal Data. For purposes of Data Protection Laws, the term “Controller” as used herein shall be interpreted to include applicable terms of similar import, as and to the extent applicable, used in the Data Protection Laws, including, without limitation, a “business” under the CCPA.

1.5 “Data Protection Law” means all laws, rules, regulations, and orders issued thereunder relating in any way to data protection, breach notification, privacy, or electronic marketing of any country, state, principality, or other territory that are applicable to the Processing of Client Personal Data under an Agreement, which may include, where applicable, the CCPA, FERPA or HIPAA.

1.6 “Data Subject” means the identified or identifiable natural person to whom Personal Data relates. For purposes of Data Protection Laws, the term “Data Subject” as used in this DPA shall be interpreted to include terms of similar import, as and to the extent applicable, used in the Data Protection Laws, including, but not limited to, a “consumer” under the CCPA.

1.7 “Data Subject Request” means a request from an individual seeking to exercise rights granted to individuals under the Data Protection Laws which may include, to the extent granted under applicable Data Protection Laws, right of access, right of rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, objection to the Processing, objection to the sale of the individual’s Personal Data or right not to be subject to automated individual decision making.

1.8 “FERPA” means the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g) and the Family Educational Rights and Privacy Act Regulations (34 CFR Part 99), as amended or otherwise modified from time to time.

1.9 “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act of 2009 and the regulations implemented thereunder, all as may be amended or otherwise modified from time to time.

1.10 “Personal Data” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable Data Subject.

1.11 “Processing” (including corollary terms) means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, including, without limitation, collection, recording, organization, structuring, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

1.12 “Processor” means the entity which Processes Personal Data on behalf of the Controller, or, as applicable, on behalf of a Processor. For purposes of the Data Protection Laws, the term “Processor” as used in this DPA shall be interpreted to include terms of similar import, as and to the extent applicable, used in the Data Protection Laws, including, without limitation, a “service provider” under the CCPA.

1.13 “Security Breach” means a breach of J. J. Keller's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Data on systems managed or otherwise controlled by J. J. Keller.

1.14 “Security Documentation” means the security documents applicable to the specific Services provided to Client, as updated from time to time and as made reasonably available to Client by J. J. Keller.

1.15 “Services” means those services provided by J. J. Keller to Client pursuant to an Agreement where, in the performance of such services, J. J. Keller Processes Client Personal Data on behalf of Client and pursuant to the applicable Client Instructions.

1.16 “Sub-Processor” means a Processor engaged by J. J. Keller to Process Client Personal Data on Client’s behalf under this DPA. Sub-Processors may include third parties or Affiliates but will exclude any J. J. Keller employee or consultant. For clarity, any independent Processor Client instructs J. J. Keller to provide Client Personal Data to shall not be considered a Sub-Processor.

1.17 “Supervisory Authority” means any applicable federal, state, local, or foreign government or any provincial, departmental, or other political subdivision thereof, or any entity, body, or authority having or asserting executive, legislative, judicial, regulatory, administrative, or other governmental functions of any court, department, commission, board, bureau, agency, or instrumentality of any of the foregoing, responsible for or involved in the enforcement and/or oversight of the Data Protection Laws.

2. Scope of DPA

2.1 Role of the Parties. As between J. J. Keller and Client, Client shall be the Controller and J. J. Keller shall be the Processor with respect to Client Personal Data Processed by J. J. Keller on Client’s behalf in connection with J. J. Keller's provision of the Services to Client.

2.2 Scope of Processing. Except as otherwise provided herein, this DPA shall apply to all Processing of Client Personal Data by J. J. Keller on behalf of Client pursuant to the terms of the applicable Agreement and this DPA and in accordance with the Client Instructions.

2.3 Limitation of Obligations. Notwithstanding anything to the contrary in this DPA, Client acknowledges and agrees that J. J. Keller has no obligation to assess Client Personal Data in order to identify information subject to any legal requirements. Client further acknowledges and agrees that this DPA and J. J. Keller’s actions under this DPA do not, and shall not be interpreted to, relieve Client of its obligations under the Data Protection Laws and Client shall be solely responsible for its compliance therewith.

2.4 Excluded Processing. Notwithstanding anything to the contrary in the Agreements or this DPA, Client acknowledges and agrees that due to the nature of J. J. Keller’s operations and the services J. J. Keller provides, J. J. Keller acts as a Controller with respect to certain Personal Data Processed in connection with those operations and services (“J. J. Keller Personal Data”) and that such J. J. Keller Personal Data may include Client Personal Data. Client expressly agrees that any J. J. Keller Personal Data Processed by or on behalf of J. J. Keller in its role as a Controller is not subject to this DPA. Further, the Parties agree that with respect to any Personal Data to which either Party is a Controller, the Parties are independent Controllers with respect to such Personal Data.

2.5 Anonymized Data. Notwithstanding anything to the contrary in the Agreement or this DPA, Client acknowledges and agrees that J. J. Keller may aggregate, anonymize, and/or de-identify the Client Personal Data in accordance with the Data Protection Laws (“Anonymized Data”), and Client further acknowledges and agrees that Client shall not acquire any right, title, or interest in or to any Anonymized Data.

2.6 Protected Health Information. In the event the Client Personal Data includes protected health information (as defined under HIPAA), Client will notify J. J. Keller thereof and, if J. J. Keller acts as a business associate (as defined under HIPAA) in connection with the Processing of such protected health information through the Services, J. J. Keller and Client shall enter into good faith negotiations and agree to the terms of a separate Business Associate Agreement as and to the extent required under HIPAA. For clarity, unless and until the Parties enter into a Business Associate Agreement, J. J. Keller shall not be required to Process any protected health information and J. J. Keller may temporarily suspend Client’s access to and use of the applicable Services and/or Processing of any other affected Client Personal Data. In the event of any suspension pursuant to this Section 2.6, J. J. Keller shall not have any liability to Client due to the suspension, including, without limitation, any service level agreement or other service level commitment applicable to the affected Services set forth in the Agreements.

3. Client Obligations

3.1 Compliance. Client shall comply with the Agreements, including this DPA, and the Data Protection Laws in connection with the Processing of Personal Data applicable to Client as a Controller, including, without limitation:

1. providing legally-compliant privacy notices to, and obtaining all necessary consents and permissions from, Data Subjects with respect to the Processing of such Data Subjects’ Personal Data included within the Client Personal Data;
2. complying with Data Subject Requests;
3. providing notice to Data Subjects of Client’s use of J. J. Keller as a Processor;
4. ensuring Client has the right to transfer, or provide access to, the Client Personal Data to J. J. Keller for the purpose of J. J. Keller Processing the Client Personal Data on Client’s behalf pursuant to the Agreements and this DPA; and
5. complying with all other obligations applicable to a Controller.

3.2 Accuracy and Quality of Client Personal Data. Client shall have the sole responsibility for the accuracy and quality of the Client Personal Data provided by Client to J. J. Keller for Processing through or in connection with the Services and complying with all applicable laws, including, without limitation, the Data Protection Laws, with respect to the means by which Client acquired such Client Personal Data.

3.3 Client Instructions. Client shall be solely responsible for ensuring that all Client Instructions comply with all applicable laws, including, without limitation, the Data Protection Laws.

3.4 Data Localization Requirements. Without limiting anything set forth in the Agreements or this DPA, Client shall notify J. J. Keller of any data localization requirement or restriction on the transfer of Client Personal Data to the extent that such requirement or restriction may affect J. J. Keller’s Processing of such Client Personal Data in accordance with the applicable Agreement or this DPA.

3.5 Restrictions on Client Personal Data. For the avoidance of doubt and without limiting anything set forth in the Agreements or this DPA, Client shall not provide or otherwise instruct J. J. Keller to Process any Personal Data subject to the data protection laws and regulations applicable to any country, state, principality, or other territory outside the United States of America or, if applicable to the Services provided to Client pursuant to the applicable Agreement, Canada, including, without limitation the European Union General Data Protection Regulation (Regulation (EU) 2016/679 ).

3.6 Additional Obligations for Student Information. Without limiting anything otherwise set forth in the Agreements or this DPA, in the event the Client Personal Data includes information that is protected under, or otherwise subject to, FERPA and/or other similar federal or state laws pertaining to the privacy and security of student information (such information is collectively referred to herein as “Student Information” and such laws are collectively referred to herein as “Student Privacy Laws”), Client shall notify J. J. Keller thereof. Further, in addition to, and not in lieu of, any other applicable obligations or requirements under the Agreements or this DPA, Client’s obligations with respect to the Processing of any such Student Information shall include the following:

1. Client shall comply with all applicable Student Privacy Laws. Without limiting the foregoing, Client represents, warrants, and covenants to J. J. Keller that, as applicable, Client has:
   1. complied with the Directory Information (as defined under FERPA) or similar exemption under the applicable Student Privacy Laws, including, without limitation, informing, as applicable, students or parents what information Client deems to be Directory Information and that such Directory Information may be disclosed, and allowing, as applicable, students or parents a reasonable amount of time to request Client not disclose Directory Information about such student, and, if applicable, Client shall not provide J. J. Keller any Directory Information for any student that has opted out of the disclosure of such student’s Directory Information;
   2. complied with the School Official (as defined under FERPA) exemption or similar exemption under the applicable Student Privacy Laws, including, without limitation, in Client’s annual notification of FERPA rights, defining “school official” to include service providers and defining “legitimate educational interest” to include services such as the type provided by J. J. Keller; and
   3. obtained all necessary written consent from, as applicable, students or parents to provide Student Information to J. J. Keller to enable J. J. Keller to provide the applicable Services.
2. Client shall employ administrative, physical and technical safeguards consistent with industry standards designed to protect usernames, passwords, and any other means of gaining access to the Services and/or hosted data from unauthorized access, disclosure, or acquisition by an unauthorized person.
3. Without limiting anything set forth in the Agreements or this DPA, except as otherwise agreed by the Parties, Client will only provide J. J. Keller Student Information where, and solely to the extent, necessary to enable J. J. Keller to provide the applicable Services.

4. J. J. Keller Obligations

4.1 Compliance. J. J. Keller shall only Process Client Personal Data as specified in the Agreement, this DPA, and as permitted under applicable Data Protection Laws. J. J. Keller shall comply with the Client Instructions with respect to J. J. Keller’s Processing of Client Personal Data unless applicable law to which J. J. Keller is subject requires J. J. Keller to undertake other Processing of Client Personal Data, in which case J. J. Keller will notify Client (unless otherwise prohibited by such applicable law) before undertaking such other Processing.

4.2 Restrictions. Without limiting anything set forth in the Agreements or this DPA, J. J. Keller shall not:

1. sell or share (as and to the extent such term is defined in the Data Protection Laws) Client Personal Data;
2. retain, use, or disclose the Client Personal Data for any purpose other than the business purposes specified in the applicable Agreement or this DPA, including, retaining, using, or disclosing Client Personal Data for a commercial purpose other than the applicable business purposes or as otherwise permitted under the Data Protection Laws;
3. retain, use, or disclose Client Personal Data outside of the direct relationship between J. J. Keller and Client except as necessary to perform the Services under the applicable Agreement or otherwise pursuant to the Client Instructions; and/or
4. combine the Client Personal Data which J. J. Keller receives from or on behalf of Client, with Personal Data J. J. Keller receives from or on behalf of any third party or collects through J. J. Keller’s own interactions with Data Subjects, provided that the J. J. Keller may combine personal information to perform any business purpose as defined under the CCPA where applicable.

4.3 Certification. J. J. Keller certifies to Client that

1. it understands and will comply with the foregoing restrictions placed on its Processing of Client Personal Data, including compiling with applicable obligations under the Data Protection Laws;
2. it will provide the same level of privacy protection as the Data Protection Laws require; and
3. it will notify Client without undue delay if J. J. Keller is or is likely to become unable to substantially comply with any of its material obligations under this DPA or its obligations under the Data Protection Laws.

4.4 Student Information. In addition to, and not in lieu of, any other applicable obligations or requirements under the Agreements or this DPA, J. J. Keller’s obligations with respect to any Processing of Student Information undertaken by J. J. Keller through or in connection with the Services shall include the following:

1. J. J. Keller will comply with all applicable Student Privacy Laws.
2. J. J. Keller will not:
   1. collect, retain, use, or disclose Student Information for any purpose other than the specific purpose of performing the Services specified in the Agreements, provided that, subject J. J. Keller’s compliance with applicable Student Privacy Laws, J. J. Keller may aggregate, de-identify or otherwise anonymize any Student Information (“Operational Student Information”) and shall own any such Operational Student Information;
   2. engage in targeted advertising or retargeting to students or parents using the Student Information;
   3. use Student Information, including persistent unique identifiers, created or gathered by the Services to amass a profile about a student;
   4. sell Student Information; or
   5. disclose Student Information, unless required by law, for legitimate research purposes, or as part of the maintenance, development, support, operation or improvement of the Services in accordance with applicable law.

   For clarity, the foregoing shall not prohibit J. J. Keller from using Student Information to provide the Services or as otherwise permitted under the Agreements or this DPA.

3. As soon as reasonably practicable, and in any event, except as otherwise required under applicable laws or as otherwise provided under the Agreements, within one hundred eighty (180) days, after the expiration or termination of the Agreements or any Service provided under the Agreements, J. J. Keller will delete all applicable Student Information (including existing copies) in J. J. Keller’s possession or under its reasonable control in accordance with applicable law. For clarity, the foregoing shall not apply, without limitation, to Operational Student Information.
4. For parent or eligible student requests regarding Student Information:
   1. J. J. Keller will provide commercially reasonable assistance to Client for the fulfillment of Client’s obligations to respond to student requests regarding Student Information, including requests related to access, correction, or deletion of such Student Information. For clarity, Client acknowledges that J. J. Keller may, but is not required to, comply with its obligations to provide such commercially reasonable assistance to Client by making appropriate features and functionalities available to Client through the Services that enable Client to engage in or facilitate Client’s response to the foregoing requests. Without limiting the foregoing: (1) Client shall establish reasonable procedures by which a parent or eligible student may access, correct, or delete Student Information; and (2) J. J. Keller may, but has not obligation to, enable parents or eligible students to access (but not correct or delete) Student Information based on a direct request received by J. J. Keller from a parent or eligible student, provided, with respect to any requests provided by a parent, the foregoing shall only apply to a verified parent.
   2. Except as otherwise provided herein, should a third party, excluding a Sub-Processor, including, but not limited to, law enforcement or other government entities (a “Requesting Party”) contact J. J. Keller with a request for Student Information, J. J. Keller will advise the Requesting Party to request the Student Information directly from School and will not provide the requested Student Information to the Requesting Party, unless and to the extent that J. J. Keller reasonably believes it is compelled to grant such access to the Requesting Party because the disclosure is necessary: (1) pursuant to a court order or legal process; (2) to comply with statutes or regulations; (3) enforce the Agreements; or (4) to protect the rights, property, or personal safety of J. J. Keller’s users, employees or others. J. J. Keller will notify Client in advance of a compelled disclosure to a Requesting Party unless J. J. Keller is lawfully directed by the Requesting Party not to inform Client of the request or as otherwise prohibited under applicable laws.
5. J. J. Keller agrees to utilize administrative, physical, and technical safeguards designed to protect Student Information from unauthorized access, disclosure, acquisition, destruction, use, or modification.
6. Where required by law, Student Information shall be stored within the United States. Upon Client’s request, J. J. Keller will provide a list of the locations where Student Information is stored.
7. Client acknowledges and agrees that J. J. Keller may engage Sub-Processors to perform the Services. Where J. J. Keller engages any such Sub-Processor, J. J. Keller will:
   1. impose data protection terms on such Sub-Processor that provide the same level of protection for Student Information as those specified in this DPA, to the extent applicable to the nature of the services provided by such Sub-Processor;
   2. J. J. Keller will remain responsible for all obligations assigned to, and all acts and omissions of, each Sub-Processor with respect to such Sub-Processor’s Processing of Student Information; and
   3. upon Client’s reasonable written request, provide relevant information to Client about each such Sub-Processor’s Processing of Student Information.

5. Rights of Data Subjects

5.1 Notification of Requests. In the event J. J. Keller receives a Data Subject Request in relation to Client Personal Data and the request identifies Client as the Controller, J. J. Keller will advise the Data Subject to submit their request to Client. Client will be responsible for responding to any Data Subject Request.

5.2 J. J. Keller’s Assistance. Taking into account the nature of the Processing of Client Personal Data undertaken by J. J. Keller, J. J. Keller shall provide reasonable assistance to Client, through J. J. Keller’s appropriate technical and organizational measures, insofar as this is possible, in fulfilling J. J. Keller’s obligations under the Data Protection Laws as a Processor to respond to Data Subject Requests.

6. Disclosures of Personal Data by J. J. Keller

6.1 J. J. Keller Personnel. J. J. Keller shall take reasonable steps to ensure the reliability and confidentiality of any employee, agent, or contractor who J. J. Keller provides access to the Client Personal Data, ensuring that access is strictly limited to those individuals who need to access the relevant Client Personal Data for the purposes of providing the Services and as otherwise necessary to comply with J. J. Keller’s obligations under the Agreements, this DPA, and applicable laws.

6.2 Third Parties. J. J. Keller may disclose and Process the Client Personal Data: (1) as permitted under the applicable Agreement and this DPA; (2) to the extent required by applicable law (subject to compliance with the Data Protection Laws); (3) to a Supervisory Authority and/or otherwise as required by the Data Protection Laws; and (4) on a “need-to-know” basis under an obligation of confidentiality or professional secrecy to its legal counsel(s), data protection advisor(s), and accountant(s).

7. Sub-Processors

7.1 Engagement. Client acknowledges and agrees that J. J. Keller may engage Sub-Processors to Process Client Personal Data on Client’s behalf. Where J. J. Keller engages any such Sub-Processor, J. J. Keller will impose data protection terms on such Sub-Processor that provide at least the same level of protection for Client Personal Data as those specified in this DPA, to the extent applicable to the nature of the services provided by such Sub-Processor. J. J. Keller will remain responsible for all obligations assigned to, and all acts and omissions, of each Sub-Processor with respect to each such Sub-Processor’s Processing of Client Personal Data on behalf of Client.

7.2 Notification of Sub-Processors. To the extent required under the Data Protection Laws, J. J. Keller shall make available to Client information about any Sub-Processor engaged by J. J. Keller to Process Client Personal Data on Client’s behalf.

8. Security and Additional Assistance

8.1 Security Measures. Taking into account the nature of the Processing of Client Personal Data undertaken by J. J. Keller on behalf of Client, J. J. Keller shall, in relation to its Processing of Client Data, implement and maintain appropriate technical, physical, and organizational measures described in the Security Documentation, provided that such measures shall provide appropriate protections for the Client Personal Data and include appropriate and commercially reasonable technical and organizational security controls designed to prevent reasonably foreseeable accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access to the Client Personal Data and other security controls required under the Data Protection Laws (the “Security Measures”).

8.2 Review of Security Documents. Upon Client’s written request at reasonable intervals, but no more frequently than annually, and subject to the confidentiality obligations set forth in the Agreements and this DPA, J. J. Keller will make available to Client a copy of J. J. Keller’s applicable Security Documents, which may include, based on the Services provided under the applicable Agreement, J. J. Keller’s most recent third party audits or certifications; provided, however, that such Security Documents, including, without limitation, any audits, certifications, and the results therefrom, and the documents reflecting the outcome of the audit and/or certifications contained therein, shall only be used by Client to assess J. J. Keller’s compliance with this DPA and/or the Data Protection Laws, and shall not be used for any other purpose or disclosed to any third party without J. J. Keller’s prior written approval and, upon J. J. Keller’s request, Client shall return all such Security Documents in Client’s possession or under its control.

8.3 Audits.

1. Solely to the extent required under the Data Protection Laws and subject to this Section 8.3, J. J. Keller will allow Client, no more frequently than annually, to conduct audits (including inspections) to verify J. J. Keller’s compliance with its obligations under this DPA (“Client Audit”); provided, however, any such Client Audit, including, without limitation, any observations, conclusions, or other results of any such Client Audit and any documents reflecting the foregoing (collectively, “Client Audit Results”), shall only be used by Client to assess J. J. Keller’s compliance with this DPA and/or the Data Protection Laws, and shall not be used for any other purpose or disclosed to any third party without J. J. Keller’s prior written approval and, subject to express requirements under the Data Protection Laws to the contrary, upon J. J. Keller’s request, Client shall return all such Client Audit Results in Client’s possession or under its control.
2. Client must send any requests to conduct a Client Audit of J. J. Keller to compliance@jjkeller.com. Following J. J. Keller’s receipt of such request, J. J. Keller and Client will discuss and agree in advance on the reasonable start date and duration of such Client Audit and the scope of J. J. Keller’s technical and organization measures in scope for such Client Audit. Notwithstanding the foregoing, unless otherwise agreed by J. J. Keller in writing, any Client Audit: (1) involving inspection of J. J. Keller business offices or data centers shall be limited to such J. J. Keller business offices or data centers where J. J. Keller Processes Client Personal Data on behalf of Client and shall expressly exclude inspection of or access to any premises and systems containing Personal Data J. J. Keller Processes on behalf of itself or any third party that is logically but not physically separated from Client Personal Data; (2) shall only occur during J. J. Keller’s normal business hours; (3) shall be conducted in a manner in a manner that minimizes any disruptions to J. J. Keller’s business operations; and (4) shall be subject to all confidentiality obligations set forth in the Agreements and security measures in effect at the applicable J. J. Keller business office or data center.
3. Except as otherwise expressly prohibited under the Data Protection Laws, J. J. Keller may charge a fee (based on J. J. Keller’s reasonable costs) for any Client Audit conducted pursuant to this Section 8.3. Upon Client’s written request, J. J. Keller will provide Client with further details of any applicable fee, and the basis of its calculation, in advance of the applicable Client Audit. Without limiting the foregoing, Client will be responsible for any fees charged by and auditor appointed by Client to execute any such Client Audit.
4. J. J. Keller may object in writing to any auditor appointed by Client to conduct any Client Audit under this Section 8.3 if the auditor is, in J. J. Keller’s reasonable opinion, not suitably qualified or independent, a competitor of J. J. Keller, or otherwise manifestly unsuitable. Any such objection by J. J. Keller will require Client to appoint another auditor or conduct the Client Audit itself.
5. Without limiting the foregoing, prior to conducting any Client Audit, Client shall undertake reasonable efforts to conduct any such Client Audit through a review of the Security Documents in accordance with the procedures described in Section 8.2.

8.4 Additional Reviews Under CCPA. Solely to the extent required under the CCPA and solely with respect to J. J. Keller’s Processing of Client Personal Data subject to the CCPA (“CCPA Data”):

1. J. J. Keller grants Client the right to: (1) take reasonable and appropriate steps to help ensure that J. J. Keller uses CCPA Data it receives from the Client in a manner consistent with Client’s obligations under the CCPA; and (2) upon notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Client Personal Data; and
2. subject to J. J. Keller’s agreement, in J. J. Keller’s sole and absolute discretion, no more frequently than annually, Client may monitor J. J. Keller’s compliance with this DPA with respect to J. J. Keller’s Processing of CCPA Data through additional measures that may include, without limitation, ongoing manual reviews, automated scans or other technical and operational testing.

For clarity, except where prohibited under the CCPA, the foregoing shall be subject to any applicable limitations or requirements set forth in the Agreements or this DPA, including, without limitation, all confidentiality obligations set forth in the Agreements and exceptions to J. J. Keller’s obligations to provide the Services in accordance with any service level agreement or other service level commitment. Additionally, except as otherwise prohibited or required under the CCPA, under no circumstances shall Section 8.4.B prohibit or otherwise preclude J. J. Keller from: (1) declining to agree to permit Client to perform any particular additional measure; or (2) conditioning J. J. Keller’s agreement to permit Client to perform any particular additional measure on Client’s agreement to comply with any restrictions or requirements specified by J. J. Keller.

8.5 Security Breach. In the event of a Security Breach, J. J. Keller will notify Client promptly and without undue delay after J. J. Keller discovers such Security Breach. Such notification of a Security Breach will be delivered to the notice address for Client provided in the applicable Agreement, or, at J. J. Keller’s discretion, by telephone or other direct communication. J. J. Keller will provide reasonable assistance to Client to investigate, remediate, and mitigate the effects of a Security Breach and to comply with any requirements to notify affected Data Subjects, applicable Supervisory Authorities, or other third parties, all as and to the extent required under the Data Protection Laws.

9. Retention and Destruction of Client Personal Data

9.1 Deletion During DPA Term. During the DPA Term, except in connection with the expiration or earlier termination of a Service, J. J. Keller will delete applicable Client Personal Data upon J. J. Keller’s receipt of an applicable Client Instruction during the DPA Term to do so in accordance with the procedures set forth in this Section 9.1. Without limiting the generality of the foregoing, in the event Client uses functionalities available via the Services (if any) to delete any Client Personal Data during the DPA Term and such Client Personal Data cannot be recovered by Client, this will constitute a Client Instruction to J. J. Keller to delete the relevant Client Personal Data from the applicable J. J. Keller systems in accordance with applicable law, including, without limitation, the Data Protection Laws. J. J. Keller will comply with such Client Instruction as soon as reasonably practicable and, in any event, unless applicable law requires J. J. Keller to retain such Client Personal Data for a longer period, within 180 days (or, if shorter, the maximum period permitted under the Data Protection Laws).

9.2 Deletion Upon Expiration or Termination of Applicable Agreement or Service(s). Client hereby provides J. J. Keller a Client Instruction to delete all applicable Client Personal Data (including existing copies) from the applicable J. J. Keller systems in accordance with applicable law upon the expiration or termination of the applicable Agreement or any Service provided under an Agreement. J. J. Keller will comply with such Client Instruction as soon as reasonably practicable and, in any event, unless applicable law requires J. J. Keller to retain such Client Personal Data for a longer period, within 30 days (or, if shorter, the maximum period permitted under the Data Protection Laws) after the expiration or earlier termination of the applicable Agreement or any Service, as applicable. For clarity, except as expressly required under applicable law or the applicable Agreement, in no event shall J. J. Keller be required or otherwise obligated to retain any applicable Client Personal Data more than thirty (30) days after the expiration or termination of the applicable Agreement or the applicable Service(s).

10. Additional Terms

10.1 Liability and Indemnification. With respect to any claim, loss, or liability based upon, arising out of, resulting from, or in any way connected with a Party’s performance or breach of this DPA: (1) such Party shall only be obligated to indemnify, defend, and hold the other Party harmless to the extent such obligation exists pursuant to such Party’s indemnification, defense, and hold harmless obligations set forth in the applicable Agreement; and (2) each Party’s total liability to the other Party is limited in accordance with the applicable limitations of liability set forth in the applicable Agreement.

10.2 Term. This DPA shall be effective as of the DPA Effective Date and continue in full force and effect until J. J. Keller ceases providing all Services to Client under and in accordance with the Agreements (the “DPA Term”). The provisions of this DPA which by their nature are intended to survive the expiration or earlier termination of this DPA shall continue as valid and enforceable obligations of the Parties notwithstanding any such termination or expiration. Without limitation, the provisions regarding confidentiality, compliance with the Data Protection Laws, and restrictions on the Processing of Client Personal Data shall survive the expiration or earlier termination of this DPA.

10.3 Relationship to Agreement. This DPA shall be governed by and construed in accordance with the terms set out in the applicable Agreement as if fully set forth herein. Without limiting anything set forth herein, the Parties acknowledge and agree that they have taken all actions (if any) required under each Agreement to incorporate this DPA into such Agreement. Any dispute arising out of this DPA shall be resolved as set out in the applicable Agreement. The requirements set forth in this DPA are in addition to, and not in lieu of, any similar requirements set forth in the applicable Agreement. Notwithstanding anything to the contrary in the applicable Agreement, to the extent of any conflict or inconsistency between the terms of this DPA and such Agreement, this DPA shall control. Except as set forth in this DPA, the Agreements remain in full force and effect, as amended, and is hereby ratified and confirmed in all respects.

10.4 Invalidity. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either: (1) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as completely as possible; or (2) if (1) is not possible, construed in a manner as if the invalid or unenforceable part had never been contained in this DPA.

10.5 Amendments. J. J. Keller may update or modify this DPA from time to time by, without limitation, posting a revised version of this DPA on J. J. Keller’s website and publishing a general notice of such changes via the J. J. Keller website or, as applicable and feasible, through the Services. Subject to compliance with applicable laws, Client’s access to or use of the Services after receiving notice of changes to this DPA, whether by general notice or direct notice provided by J. J. Keller to Client, shall constitute Client’s acceptance of such updates or modifications.

10.6 Changes to Data Protection Laws. J. J. Keller and Client acknowledge that the Data Protection Laws as of the DPA Effective Date may change during the DPA Term, including, without limitation, the California Privacy Rights Act (effective January 1, 2023), the Virginia Consumer Data Protection Act (effective January 1, 2023), and the Colorado Privacy Act (effective July 1, 2023). J. J. Keller and Client shall comply with any and all such changes to the extent applicable to the Processing Client Personal Data under the Agreement and this DPA, including, without limitation, entering into any necessary amendments to this DPA and/or separate agreements to the extent necessary to comply with such changes.