2020-887-E Economic Dev - Submittable Holdings Inc grant management software

Browse Search

DocuSign Envelope ID:90A54439-23B9-40AF-8246-BFCAAEAA529D have the ability to address a Data Subject Request, Submittable shall, upon Customer's request, provide commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent Submittable is legally permitted to do so and the response to such Data Subject Request is required under Privacy and Data Protection Requirements. If Submittable will incur costs beyond those associated with routine business or technical processes, and provided Submittable is not already required to pay for such costs, Submittable shall notify Customer of such costs and receive written approval from Customer to perform support of Customer in satisfying Data Subject request. In such case, Customer shall be responsible for agreed-upon costs arising from Submittable's provision of such assistance. 11.3 Submittable must not disclose the Personal Information to any Data Subject or to a third-party unless the disclosure is either at Customer's request or instruction, permitted by this DPA or is otherwise required by Law. 11.4 If a Law requires Submittable to Process or disclose Personal Information, Submittable must first inform Customer of the legal requirement and give Customer an opportunity to object or challenge the requirement, unless the Law prohibits such notice. 12. Records. 12.1 Submittable will keep detailed, accurate, and up-to-date records regarding any Processing of Personal Information it carries out for Customer, including but not limited to, the access, control, and security of the Personal Information, approved Sub-processors and affiliates, the Processing purposes, and any other records required by the applicable Privacy and Data Protection Requirements (the "Records"). 12.2 Submittable will ensure that the Records are sufficient to enable Customer to verify Submittable's compliance with its obligations under this DPA. 13. Audits. 13.1 If a Security Breach occurs or is occurring, or Submittable becomes aware of a breach of any of its obligations under this DPA or any Privacy and Data Protection Requirements, Submittable will: (a) promptly conduct its own audit to determine the cause; (b) produce a written report that includes detailed plans to remedy any deficiencies identified by the audit, on a confidential need-to-know basis, and a redacted version of the audit report itself so that Customer can reasonably verify Submittable's compliance with its security obligations under this DPA; (c) provide Customer with a copy of the written audit report; and (d) promptly remedy any deficiencies identified by the audit within. 13.2 Additionally, Submittable shall annually (a) cause a reputable independent third-party audit firm to conduct SOC II audits of Submittable, its Sub-processors, and their data centers that are used under the TOS; and (b) provide to Customer the audit reports resulting from the cost audits as set forth below ("Submittable Audit Report"). The Submittable Audit Report will address the control procedures used by Submittable at the Service locations, including specifically an assessment of whether (a) the control procedures were suitably designed to provide reasonable assurance that the stated internal control objectives would be achieved if the procedures operated as designed; and (b) the control procedures operated effectively at all times during the reporting period. Upon Customer's advance written request, no more frequently than once per 12-month period, Submittable will provide access to Customer, on a confidential need-to-know basis, a redacted version of the Submittable Audit Report so that Customer can reasonably verify Submittable's compliance with its security obligations under the TOS or this DPA. Submittable may remove any information from the Submittable Audit Submittable Customer Terms of Service v1.1—Exhibit B Page 9 of 12