Orange County NC Website
Browse       Search
DocuSign Envelope ID:90A54439-23B9-40AF-8246-BFCAAEAA529D <br /> (a) Submittable's Privacy Shield Framework self-certifications apply to the Service, <br /> subject to the additional terms of this Section 10; then <br /> (b) the Standard Contractual Clauses set forth in Appendix C to this DPA apply to <br /> the Services of the Standard Contractual Clauses (the "Services" as defined in Schedule 1 of the <br /> Standard Contractual Clauses), subject to the additional terms of this Section 10; and <br /> (c) in the event that Services are covered by more than one transfer mechanism, the <br /> transfer of Personal Information will be subject to a single transfer mechanism in accordance <br /> with the following order of precedence: (i) Submittable's Privacy Shield Framework self- <br /> certification; and (ii) the Standard Contractual Clauses. <br /> 10.5 Submittable self-certifies to and complies with the Privacy Shield Frameworks, as <br /> administered by the US Department of Commerce, and Submittable shall ensure that it maintains its <br /> self-certification to and compliance with the Privacy Shield Frameworks with respect to the <br /> Processing of Personal Information that is transferred from the European Economic Area and/or <br /> Switzerland to the United States. <br /> 10.6 The Standard Contractual Clauses and the additional terms specified in this Section <br /> apply to (a) the legal entity that has executed the Standard Contractual Clauses as a data exporter <br /> and its Authorized Affiliates; and (b) all Affiliates of Customer established within the European <br /> Economic Area, Switzerland, and the United Kingdom, which have signed Order Form(s) for the <br /> Services. For the purpose of the Standard Contractual Clauses and this Section, the aforementioned <br /> entities shall be deemed "data exporters". <br /> 10.7 This DPA and the TOS are Customer's complete and final instructions at the time of <br /> signature of the TOS to Submittable for the Processing of Personal Information. <br /> 10.8 The parties agree that any copies of the Sub-processor agreements that must be sent by <br /> Submittable to Customer may have all commercial information, or clauses unrelated to the Standard <br /> Contractual Clauses or their equivalent, removed by Submittable beforehand; and, that such copies <br /> will be provided by Submittable only upon reasonable request by Customer where such request is <br /> based on legitimate business reasons. <br /> 10.9 Upon Customer's request, Submittable shall provide Customer with reasonable <br /> cooperation and assistance needed to fulfill Customer's obligation under the GDPR to carry out a <br /> data protection impact assessment related to Customer's use of the Services, to the extent Customer <br /> does not otherwise have access to the relevant information, and to the extent such information is <br /> available to Submittable. Submittable shall provide reasonable assistance to Customer in the <br /> cooperation or prior consultation with the Supervisory Authority in the performance of its tasks <br /> relating to this Section, to the extent required under the GDPR. <br /> 11. Complaints, Data Subject Requests, and Third Party Rights. <br /> 11.1 Submittable must, to the extent legally permitted, promptly notify Customer if it <br /> receives any complaint, notice, or communication that directly or indirectly relates to the Personal <br /> Information processing or to either Party's compliance with the Privacy and Data Protection <br /> Requirements. <br /> 11.2 Submittable shall, to the extent legally permitted, promptly notify Customer if <br /> Submittable receives a request from a Data Subject to exercise the Data Subject's right of access, <br /> right to rectification, restriction of Processing, erasure (aka "right to be forgotten"), data portability, <br /> object to the Processing, or its right not to be subject to automated individual decision making ("Data <br /> Subject Request"). Taking into account the nature of the Processing, Submittable shall assist <br /> Customer by appropriate technical and organizational measures, insofar as is possible, for the <br /> fulfillment of Customer's obligation to respond to a Data Subject Request under Privacy and Data <br /> Protection Requirements. In addition, to the extent Customer, in its use of the Services, does not <br /> Submittable Customer Terms of Service v1.1—Exhibit B Page 8 of 12 <br />