Orange County NC Website
Browse       Search
<br />Submittable Customer Terms of Service <br />v1.4 <br /> Page 14 of 28 <br />6.3. Customer may object to Submittable’s use of a new Sub-processor by notifying Submittable in writing within <br />ten (10) business days after such Sub-processor is added to the Updated Sub-processor List, provided <br />Customer’s objection is based on a commercially reasonable and objective belief that such Sub-processor <br />is not qualified to Process Personal Information. In the event Customer objects to a new Sub -processor, <br />Submittable will notify Customer within sixty (60) days if another Sub-processor is available for performing <br />the objected to Sub-processors’ duties. In the interim, provided Customer refuses to allow such new <br />objected to Sub-processor to Process Personal Information, or if Submittable is unable to make available <br />another Sub-processor, either Party may terminate the applicable Order Form in part or entirely by providing <br />written notice to the other Party. <br />7. Authorized Affiliates. <br />7.1. All access to and use of the Services by Authorized Affiliates must comply with the TOS and this DPA, and <br />any violation of the TOS or this DPA by an Authorized Affiliate shall be deemed a violation by Customer. <br />7.2. Where an Authorized Affiliate becomes subject to this DPA with Submittable, it shall, to the extent required <br />under applicable Privacy and Data Protection Requirements, be entitled to ex ercise the rights and seek <br />remedies under this DPA, subject to the following: <br />7.2.1. except where applicable Privacy and Data Protection Requirements require the Authorized <br />Affiliate to exercise a right or seek any remedy under this DPA against Submittable direct ly by <br />itself, the Parties agree that (i) Customer shall exercise any such right or seek any such remedy <br />on behalf of the Authorized Affiliate; and (ii) Customer shall exercise any such rights under this <br />DPA not separately for each Authorized Affiliate individually but in a combined manner for all of <br />its Authorized Affiliates together; and <br />7.2.2. Customer shall, when carrying out any audit of the procedures relevant to the protection of <br />Personal Information, take all reasonable measures to limit any impact on Submittable and its <br />Sub-Processors by combining, to the extent reasonably possible, several audit requests carried <br />out on behalf of different Authorized Affiliates into one single audit. <br />8. Security. <br />8.1. Submittable shall implement appropriate administrative, physical and technical safeguards and measures <br />designed to safeguard Personal Information against unauthorized or unlawful Processing, access, <br />disclosure, loss, misuse, copying, modification, storage, reproduction, display, or distribution, and against <br />accidental loss, disclosure, misuse, destruction, or damage including, but not limited to, the security <br />measures set out in Appendix 2. Submittable must document those measures in writing and periodically <br />review them, at least annually, to ensure they remain current and complete. <br />8.2. All electronic transmission of Personal Information by a Party shall be performed in a secure and encrypted <br />manner. All data transmissions between the Parties shall include detailed audit logs of all Personal <br />Information transfer events. <br />9. Security Breaches and Personal Information Loss. <br />9.1. Submittable will promptly notify Customer if it becomes aware of a Security Breach. <br />9.2. Immediately following any Security Breach, the Parties will coordinate with each other to investigate the <br />matter. Submittable will reasonably cooperate with Customer in Customer’s handling of the matter, <br />including: <br />9.2.1. taking such appropriate actions as may be necessary to preserve forensic evidence and to limit, <br />stop, or otherwise remedy the Security Breach; <br />9.2.2. assisting with the investigation; and <br />9.2.3. making available relevant information, records, data reporting, and other materials required to <br />comply with Privacy and Data Protection Requirements. All information provided to Customer <br />under this Section may be redacted or compiled in a new format as reasonably necessary to <br />minimize any risk to, or compromise of, Submittable’s security or the confidentiality of any third - <br />party confidential information, provided that such removal or compilation in a new format does <br />not prevent Customer from understanding the substance of the materials. <br />DocuSign Envelope ID: 367666E5-0A49-40C9-BFB5-74D495BAB8F1