Data Processing Addendum

This Data Processing Addendum ("Addendum") forms part of, and is incorporated by reference into, the YourStanding Terms of Service between you (the "Customer") and YourStanding ("YourStanding," "we," "us"). Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), applies to your use of the Service, this Addendum governs our processing of Customer Data and prevails over any conflicting term in the Terms of Service.

"Customer Data" means the compliance records and related information you, or someone acting on your behalf, submit to the Service — for example license, permit, registration, bond, insurance, and vehicle-registration records and the supporting documents attached to them. To the extent Customer Data includes personal information of a California resident, the Customer acts as the business and YourStanding acts as a service provider processing that personal information solely on the Customer's behalf for the limited, specified business purpose of providing the Service.

Except where this Addendum prevails on the scope of CCPA processing, all other terms of the Terms of Service — including its warranty disclaimers, limitations of liability, and indemnification — apply to this Addendum.

With respect to personal information contained in Customer Data, YourStanding will:

1. Process for limited purposes only. Process the personal information solely to provide the Service to you, and for no other purpose, unless otherwise permitted by the CCPA.
2. Not sell or share. Not sell or share the personal information within the meaning of the CCPA.
3. Not retain, use, or disclose outside the relationship. Not retain, use, or disclose the personal information for any purpose other than the business purposes specified above, including outside the direct business relationship between you and YourStanding, except where permitted by the CCPA.
4. Not combine personal information. Not combine the personal information with personal information received from, or on behalf of, another party, or collected from our own interactions, except as permitted by the CCPA.
5. Comply with the CCPA and protect the data. Comply with the obligations applicable to a service provider under the CCPA, provide the same level of privacy protection the CCPA requires of you, and implement reasonable security procedures and practices appropriate to the nature of the personal information, consistent with California Civil Code § 1798.81.5. Customer Data is encrypted at rest and in transit (see the Privacy Policy).
6. Allow you to monitor compliance. Grant you the right to take reasonable and appropriate steps to help ensure that we use the personal information in a manner consistent with your obligations under the CCPA, including reasonable assessments on request.
7. Notify you if we cannot comply. Notify you if we determine that we can no longer meet our obligations under the CCPA.
8. Let you remediate unauthorized use. Allow you, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of the personal information.
9. Bind sub-processors and support data-subject requests. Engage sub-processors only under a written contract requiring the same level of protection described here, and assist you in responding to verifiable consumer requests to access, delete, or correct personal information, or notify you of any such request we receive directly.