Data Processing
Addendum

1 – Definitions

(a) “Applicable Privacy Laws” means all United States federal and state laws and regulations applicable to the Processing of Personal Information under this DPA, including, where applicable, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (collectively, the “CCPA”), the Colorado Privacy Act, Colo. Rev. Stat. § 6-1-1301 et seq., and its implementing rules (the “CPA”), the Virginia Consumer Data Protection Act, Va. Code § 59.1-575 et seq. (the “VCDPA”), and other comparable U.S. state privacy laws.

(b) “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, that Remora Processes on Client’s behalf in connection with the Services, including Customer Data and any personally identified or personally identifiable tracking, browsing, behavioral, or activity data collected through Client’s website(s). “Personal Information” has the meaning given to the terms “personal information” or “personal data” under Applicable Privacy Laws.

(c) “Processing” (and its cognates) means any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, use, storage, disclosure, analysis, deletion, and modification.

(d) “Business,” “Business Purpose,” “Consumer,” “Sell,” “Share,” “Service Provider,” and “Third Party” have the meanings given in the CCPA or, where the CCPA does not apply, their closest equivalents under other Applicable Privacy Laws, such as “controller” for Business and “processor” for Service Provider.

(e) “Deidentified Data” means data that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular Consumer, as further described under Applicable Privacy Laws.

(f) “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Personal Information Processed by Remora on Client’s behalf.

(g) “Subprocessor” means any Third Party engaged by Remora to Process Personal Information on Client’s behalf in connection with the Services.

2 – Relationship of the Parties

For purposes of Applicable Privacy Laws and this DPA, Client is the Business (or controller) and Remora is Client’s Service Provider (or processor) with respect to Personal Information Processed in connection with the Services. Client discloses Personal Information to Remora, and Remora collects Personal Information on Client’s behalf through Client’s website(s) and the Technology, solely for the limited and specified Business Purposes described in Appendix A (Description of Processing) and as otherwise necessary to perform the Services under the Agreement.

Remora shall Process Personal Information only on documented instructions from Client, which instructions consist of: (a) the Agreement, including the Subscription Documentation; (b) this DPA; (c) Client’s selection of a privacy compliance posture pursuant to Section 6.4 of the Agreement (Privacy Compliance Postures; California Compliance); and (d) any other documented, lawful instructions agreed by the parties.

This DPA does not apply to information Remora collects for its own purposes as an independent business, which is governed by Remora’s Privacy Policy.

3 – Remora’s Obligations as Service Provider

Remora certifies that it understands and will comply with the restrictions and obligations of this Section 3. With respect to Personal Information Processed on Client’s behalf, Remora shall not:

(a) Sell or Share the Personal Information;

(b) retain, use, or disclose the Personal Information for any purpose other than the Business Purposes specified in Appendix A and the Agreement, including any commercial purpose other than performing the Services, or as otherwise permitted for a Service Provider under Applicable Privacy Laws, including retention, use, or disclosure to detect or protect against security incidents or fraudulent or illegal activity, to comply with law, or for internal use to build or improve the quality of the Services to the extent permitted by the CCPA;

(c) retain, use, or disclose the Personal Information outside of the direct business relationship between Remora and Client, except as permitted by Applicable Privacy Laws; or

(d) combine the Personal Information with personal information that Remora receives from or on behalf of another person, or collects from its own interactions with a Consumer, except as permitted for a Service Provider under Applicable Privacy Laws.

Remora further agrees that it shall: (e) comply with all obligations applicable to Service Providers under Applicable Privacy Laws and provide the same level of privacy protection for the Personal Information as is required of Client as a Business; (f) promptly notify Client if Remora determines that it can no longer meet its obligations under Applicable Privacy Laws or this DPA; (g) upon reasonable notice, grant Client the rights described in Section 10 (Audits and Verification) to take reasonable and appropriate steps to help ensure that Remora Processes Personal Information in a manner consistent with Client’s obligations, and to stop and remediate any unauthorized use of Personal Information; (h) ensure that each person authorized by Remora to Process Personal Information is subject to a duty of confidentiality consistent with the Agreement; (i) upon Client’s reasonable written request, make available to Client all information in Remora’s possession reasonably necessary to demonstrate Remora’s compliance with its obligations under Applicable Privacy Laws, including the CPA and the VCDPA, and this DPA; and (j) taking into account the nature of the Processing and the information available to Remora, provide reasonable assistance and information to Client in connection with any data protection assessment Client is required to conduct under Applicable Privacy Laws.

4 – Consumer Rights Requests

Taking into account the nature of the Processing, Remora shall provide commercially reasonable assistance to Client in fulfilling Client’s obligations to respond to verifiable Consumer requests under Applicable Privacy Laws, including requests to know or access, delete, correct, and obtain a portable copy of Personal Information; requests to opt out of the Sale or Sharing of Personal Information, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects; and any appeals of Client’s decisions on such requests under Applicable Privacy Laws, including the CPA and the VCDPA.

If Remora receives a Consumer rights request directly that relates to Personal Information Processed on Client’s behalf, Remora will, to the extent legally permitted, promptly forward the request to Client and will not respond substantively except at Client’s direction, to confirm receipt and referral, or as required by law. Client is solely responsible for verifying and responding to Consumer requests directed to Client as the Business.

5 – Opt-Out Preference Signals and Consent Postures

Remora implements, on Client’s behalf, the cookie-compliance posture selected by Client pursuant to Section 6.4 of the Agreement. Where Client’s selected posture provides Consumers the ability to deny or opt out of tracking, or where a Consumer’s browser transmits a Global Privacy Control (“GPC”) or other recognized opt-out preference signal honored by Remora, which Remora honors on all Client websites regardless of the posture selected by Client, Remora will honor the Consumer’s choice by suppressing third-party scripts that transmit data to cookies residing on third-party servers outside of Remora’s network, as described in the Agreement and Remora’s Privacy Policy.

Client acknowledges that Client, not Remora, is responsible for determining whether Client’s selected posture satisfies Client’s obligations under Applicable Privacy Laws.

6 – Subprocessors

Client provides Remora general authorization to engage Subprocessors to Process Personal Information in connection with the Services. Remora shall: (a) make available to Client, upon written request, a current list of its Subprocessors; (b) provide Client with notice of the engagement of any new Subprocessor at least fifteen (15) days before the new Subprocessor Processes Personal Information on Client’s behalf, which notice may be provided by email or by updating a Subprocessor list made available to Client, thereby providing Client an opportunity to object; (c) enter into a written agreement with each Subprocessor imposing data protection obligations no less protective of Personal Information than those set forth in this DPA, including obligations meeting the requirements applicable to subcontractors under the CPA and the VCDPA; and (d) remain responsible for each Subprocessor’s performance of Remora’s obligations under this DPA.

If Client reasonably objects to a new Subprocessor on data protection grounds within the notice period, the parties will discuss the objection in good faith. If Remora cannot reasonably accommodate the objection, Client may terminate the affected Services in accordance with the Agreement, without early-termination liability and with a pro-rata refund of any prepaid Fees for the affected Services for the period after the effective date of termination.

7 – Security; Incident Notification

Remora shall implement and maintain administrative, physical, and technical safeguards for the protection of Personal Information as described in Section 2.14 of the Agreement (Security) and Appendix B (Security Measures).

Remora shall notify Client without undue delay, and in any event within seventy-two (72) hours, after determining that a Security Incident affecting Client’s Personal Information has occurred or is reasonably likely to have occurred. Remora may supplement or correct its notification as its investigation proceeds.

Remora’s notification will, to the extent then known, describe the nature of the Security Incident, the categories and approximate volume of Personal Information affected, the measures taken or planned to address the Security Incident, and a contact point for further information.

Remora will provide reasonable cooperation and information to assist Client in meeting any breach notification obligations Client may have under Applicable Privacy Laws, provided that Client is solely responsible for determining whether and how to notify Consumers, regulators, or other parties, except where such notification is legally required of Remora directly. Remora’s notification of or response to a Security Incident is not an acknowledgment of fault or liability.

8 – Deidentified and Aggregated Data

Remora may create Deidentified Data and aggregated data derived from Personal Information and may use such data for its lawful business purposes, including to maintain, improve, benchmark, and develop the Technology and the Services.

With respect to any Deidentified Data, Remora shall: (a) take reasonable measures to ensure the data cannot be associated with a Consumer or household; (b) publicly commit, including through this DPA, to maintain and use the data in deidentified form and not attempt to reidentify it, except as permitted by Applicable Privacy Laws to test the effectiveness of deidentification; and (c) contractually obligate any recipient of the data to comply with the requirements of this Section.

9 – Client Obligations

Client shall: (a) comply with its own obligations under Applicable Privacy Laws as the Business, including providing all required notices at collection, maintaining an accurate and legally sufficient privacy policy on its website(s) as described in Section 6.4 of the Agreement, and establishing a lawful basis for the collection and Processing of Personal Information through the Services; (b) ensure that its instructions to Remora comply with Applicable Privacy Laws; (c) not instruct Remora to Process Personal Information in a manner that would violate Applicable Privacy Laws; and (d) comply with Section 6.5 of the Agreement (No Resale of Consumer Data) and Remora’s Acceptable Use Policy with respect to all Personal Information collected through the Services.

Client acknowledges that Remora’s implementation of Client’s selected privacy posture is performed at Client’s direction, and that Client is solely responsible for its choice of posture as set forth in the Agreement.

10 – Audits and Verification

No more than once per twelve (12) month period, and upon at least thirty (30) days’ prior written notice, Client may verify Remora’s compliance with this DPA by: (a) submitting a written security and compliance questionnaire to Remora; or (b) reviewing summaries of Remora’s then-current Third-Party audit reports or certifications, to the extent available, provided that this frequency limit does not apply for six (6) months following a Security Incident affecting Client’s Personal Information.

If Applicable Privacy Laws grant Client a mandatory audit right that cannot be satisfied by the foregoing, Client may conduct an audit through a mutually agreed independent auditor, during normal business hours, subject to Remora’s reasonable security and confidentiality requirements, and at Client’s expense.

Alternatively, and to the extent permitted by Applicable Privacy Laws, including the CPA and the VCDPA, Remora may, in lieu of an audit by Client, arrange for a qualified and independent assessor to conduct an assessment of Remora’s policies and technical and organizational measures in support of its obligations under Applicable Privacy Laws, using an appropriate and accepted control standard or framework and assessment procedure, at Remora’s expense, and provide a report of such assessment to Client upon Client’s written request.

All information disclosed in connection with this Section is Remora’s Confidential Information under the Agreement.

11 – Data Retention and Deletion

Remora shall retain Personal Information only as long as reasonably necessary to provide the Services and for the purposes permitted under this DPA. With respect to Personal Information, this Section 11 controls over Section 2.15 of the Agreement (Storage).

Upon expiration or termination of the Agreement, Remora will, at Client’s written request made within thirty (30) days of expiration or termination and subject to Client’s payment of all undisputed Fees then due, delete or return the Personal Information then in Remora’s possession, in the manner described in Section 9.4 of the Agreement (Effect of Termination), except to the extent that: (a) retention is required or permitted by applicable law; (b) the Personal Information has been deidentified or aggregated in accordance with Section 8; or (c) the Personal Information resides in routine backup media, in which case it will be deleted in the ordinary course of Remora’s backup rotation and remain protected under this DPA until deleted.

If Client does not make a timely request, Remora will delete the Personal Information within ninety (90) days after termination, except as provided in clauses (a) through (c) above.

12 – GLBA Acknowledgment

The parties acknowledge that Personal Information Processed under this DPA may include “nonpublic personal information” subject to the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq. (“GLBA”), and its implementing regulations, including the FTC Safeguards Rule.

To the extent GLBA applies, Remora shall Process such information in accordance with Section 2.14 of the Agreement (Security), and the CCPA and comparable state privacy laws may not apply to such information to the extent of applicable GLBA exemptions. Nothing in this DPA limits either party’s obligations under GLBA.

13 – General Provisions

This DPA is effective as of the effective date of the Agreement or, for existing clients, the date this DPA is first incorporated into the Agreement, and terminates automatically upon expiration or termination of the Agreement, except that its obligations survive as long as Remora Processes Personal Information on Client’s behalf.

This DPA does not create any third-party beneficiary rights, including for Consumers. Each party’s liability arising out of or related to this DPA is subject to the disclaimers, exclusions, and limitations of liability set forth in Section 10 of the Agreement (Limitations of Liability).

Remora may update this DPA from time to time as reasonably necessary to reflect changes in Applicable Privacy Laws, provided that no update will materially diminish the protections for Personal Information under this DPA. Remora will provide notice of material updates to this DPA in accordance with Section 14.20 (Amendment) of the Agreement. This DPA is governed by the governing law and dispute-resolution provisions of the Agreement.

Appendix A – Description of Processing

Nature and purposes of Processing. Remora Processes Personal Information as necessary to provide the Services described in the Agreement and the applicable Subscription Documentation, including: hosting and operating Client’s website(s); collecting, storing, and organizing leads, inquiries, and Customer communications on Client’s behalf; website analytics, tracking, and reporting; web stack health monitoring; inventory management and related reporting; facilitating text, chat, and other communications between Client and its Customers; implementing Client’s selected privacy compliance posture, including consent banners and script suppression; detecting and protecting against security incidents and fraudulent or illegal activity; and providing customer support.

Duration of Processing. For the term of the Agreement, plus the retention and deletion periods described in Section 11 of this DPA.

Categories of Consumers. Client’s Customers and prospective Customers; visitors to Client’s website(s); and individuals who communicate with Client through the Services.

Categories of Personal Information. Identifiers, such as name, postal address, email address, telephone number, IP address, device and advertising identifiers; Social Security numbers if Remora is processing credit applications; commercial information, such as vehicle purchase or service inquiries, transaction history, and preferences; internet or other electronic network activity information, such as browsing history, pages viewed, searches, and interactions with Client’s website(s), including personally identified tracking data; approximate geolocation information; audio or electronic communications, such as SMS, chat, and call-related metadata and content transmitted through the Services; inferences drawn from the foregoing; and, to the extent submitted through the Services, financial application information that may constitute nonpublic personal information under GLBA.

Sensitive Personal Information. Processed only to the extent Client or its Customers submit it through the Services, for example in a financing application, and only as necessary to provide the Services.

Appendix B – Security Measures

Remora maintains the administrative, physical, and technical safeguards described in Section 2.14 of the Agreement (Security), which at a minimum include: limiting access to Personal Information to authorized personnel with a need to know; securing business facilities, data centers, servers, backup systems, and computing equipment; network, device, application, database, and platform security; encryption of Personal Information at rest using industry-standard encryption technologies, including within databases and backup systems; secure information transmission, storage, and disposal; authentication and access controls; personnel security and integrity procedures, including background checks consistent with applicable law; and privacy and information-security training.

Remora reviews and updates its safeguards from time to time to reflect accepted industry practices and the evolving threat landscape.