2020-887-E Economic Dev - Submittable Holdings Inc grant management software

Browse Search

DocuSign Envelope ID:90A54439-23B9-40AF-8246-BFCAAEAA529D 6.3 Where an Authorized Affiliate becomes a party to the DPA with Submittable, it shall, to the extent required under applicable Privacy and Data Protection Requirements, be entitled to exercise the rights and seek remedies under this DPA, subject to the following: (a) except where applicable Privacy and Data Protection Requirements require the Authorized Affiliate to exercise a right or seek any remedy under this DPA against Submittable directly by itself, the parties agree that (i) Customer shall exercise any such right or seek any such remedy on behalf of the Authorized Affiliate; and (ii) Customer shall exercise any such rights under this DPA not separately for each Authorized Affiliate individually but in a combined manner for all of its Authorized Affiliates together; and (b) Customer shall, when carrying out any audit of the procedures relevant to the protection of Personal Information, take all reasonable measures to limit any impact on Submittable and its Sub-Processors by combining, to the extent reasonably possible, several audit requests carried out on behalf of different Authorized Affiliates into one single audit. 7. Security. 7.1 Submittable must at all times implement industry standard, appropriate administrative, physical and technical safeguards and measures designed to safeguard Personal Information against unauthorized or unlawful processing, access, copying, modification, storage, reproduction, display, or distribution, and against accidental loss, destruction, or damage including, but not limited to, the security measures set out in Appendix B. Submittable must document those measures in writing and periodically review them, at least annually, to ensure they remain current and complete. 7.2 Submittable shall take reasonable measures, including the collection of industry- standard audit trails to protect Personal Information against deterioration or degradation of data quality and authenticity. 7.3 Each Party will promptly notify the other if it becomes aware of any advance in technology and methods of working, which indicate that the Parties should adjust their security measures. 7.4 Submittable must take industry standard and operationally reasonable precautions to preserve the integrity of any Personal Information it processes and to prevent any corruption or loss of the Personal Information, including but not limited to establishing effective backup and data restoration procedures. 7.5 Submittable must take industry standard and operationally reasonable precautions to ensure the Services are free of any system settings or defects that would create a potential Security Breach. 7.6 All electronic transmission of Personal Information between the Parties shall be performed in a secure and encrypted manner. All data transmissions between the Parties shall include detailed audit logs of all Personal Information transfer events. 8. Security Breaches and Personal Information Loss. 8.1 Submittable will promptly notify Customer if any Personal Information is lost or destroyed or becomes damaged, corrupted, or unusable. Submittable will use best efforts to rectify the impact of the loss or corruption of such Personal Information at its own expense. 8.2 Submittable will promptly notify Customer, within forty-eight (48) hours, if it becomes aware of: (a) any unauthorized or unlawful processing of the Personal Information; or (b) any Security Breach. Submittable Customer Terms of Service v1.1—Exhibit B Page 5 of 12