2024-391-E-Housing Dept-Submittable Holdings-Online Application Software Process

Browse Search

Submittable Customer Terms of Service v1.4 Page 16 of 28 10.6. The Standard Contractual Clauses and the additional terms specified in this Section apply to (a) the legal entity that has executed the Standard Contractual Clauses as a data exporter; and (b) all Affiliates of Customer established within the European Economic Area, Switzerland, and the United Kingdom, which have signed Order Form(s) for the Services. For the purpose of the Standard Contractual Clauses and this Section, the aforementioned entities shall be deemed “data exporters”. 10.7. This DPA and the TOS are Customer’s instructions at the time of signature of the TOS to Submittable for the Processing of Personal Information. 10.8. The Parties agree that any copies of the Sub-processor agreements that must be sent by Submittable to Customer may have all commercial information, or clauses unrelated to the Standard Contractual Clauses or their equivalent, removed by Submittable beforehand; and, that such copies will be provided by Submittable only upon reasonable request by Customer where such request is based on legitimate business reasons. 11. Complaints, Data Subject Requests, and Third Party Rights. 11.1. Submittable shall, to the extent legally permitted, promptly notify Customer if it recei ves any complaint, notice, or communication that directly or indirectly relates to the Personal Information Processing or to either Party’s compliance with the Privacy and Data Protection Requirements. 11.2. Submittable shall, to the extent legally permitted, promptly notify Customer if Submittable receives a request from a Data Subject to exercise one or more of its rights under the Privacy and Data Protection Requirements for which Submittable is a Processor (“Data Subject Request”). Customer is fully responsible for responding to Data Subject Requests. Taking into account the nature of the Processing, Submittable shall assist Customer by providing measures, insofar as is possible, for the fulfillment of Customer’s obligation to respond to a Data Subject Request under Privacy and Data Protection Requirements. In addition, to the extent Customer, in its use of the Services, directs Submittable to respond to a Data Subject Request, Submittable shall, upon Customer’s request, provide commercially reasonable efforts to assist Customer in doing so, to the extent Submittable is legally permitted to do so and the response to such Data Subject Request is required under Privacy and Data Protection Requirements. If Submittable will incur costs beyond those associated with routine business or technical processes, Customer agrees to pay such costs. 11.3. Submittable shall not disclose Personal Information to any Data Subject or to a third-party unless the disclosure is either at Customer’s request or instruction, permitted by this D PA or is otherwise required by law. 11.4. If a law requires Submittable to Process or disclose Personal Information, Submittable must first inform Customer of the legal requirement and give Customer an opportunity to object or challenge the requirement, unless the law prohibits such notice. 12. Records. 12.1. Submittable will keep accurate records regarding any Processing of Personal Information, including but not limited to, the access, control, and security of the Personal Information, approved Sub -processors, the Processing purposes, and any other records required by the applicable Privacy and Data Protection Requirements (the “Records”). 12.2. Submittable shall annually cause a reputable independent third-party audit firm to conduct SOC 2 audits of Submittable (“Submittable Audit Report”). The Submittable Audit Report will address the control procedures used by Submittable at the Services locations. Upon Customer’s advance written request, and no more frequently than once per 12-month period, Submittable will provide Customer with access, on a confidential need-to-know basis, a redacted version of the Submittable Audit Report so that Customer can reasonably verify Submittable’s compliance with its security obligations under the TOS or this DPA. Submittable will make good faith, commercially reasonable efforts to promptly remediate: (1) any errors identified in a Submittable Audit Report that could reasonably be expected to have an adverse impact on Customer’s use of the Services as set forth in the TOS; and (2) material deficien cies identified in a Submittable Audit Report. During the Term, unless a Security Breach has occurred, Customer agrees that the Submittable Audit Report report shall constitute sufficient assurance regarding the adequacy of Submittable's data security and data privacy controls. 12.3. The Parties agree that the audits described in the Standard Contractual Clauses and the UK Standard Contractual Clauses shall be carried out in accordance with the following specifications: DocuSign Envelope ID: 367666E5-0A49-40C9-BFB5-74D495BAB8F1