1. Definitions 

Data Protection Laws — means the US laws listed at clause 6, together with their implementing regulations, in each case as amended. 

Personal Data — means any information relating to an identified or identifiable natural person that (a) is included in the data We process on Your behalf in providing the Access Products and Services, and (b) is subject to the Data Protection Laws. 

Privacy Notice — means the Access Privacy Notice. 

2. Our role 

• 2.1 As between You and Us, and with respect to Personal Data, We are a “Service Provider”, “Processor” or equivalent term under the Data Protection Laws, and this Addendum applies to Us to the extent You are a “Business”, “Controller”, or equivalent, under the applicable Data Protection Laws. 

• 2.2 The Product Fact Sheet sets out the subject-matter and duration of the processing of Personal Data, its nature and purpose, the types of Personal Data, and the categories of data subjects.  

3. How We may process Personal Data 

• 3.1 Each of us complies with our respective obligations under the Data Protection Laws. You warrant that You will not instruct Us to process Personal Data in a way that would be unlawful. Any configuration of the Access Products and Services by You, or by Us on Your instruction, counts as a written instruction for these purposes. 

• 3.2 We process Personal Data only to provide the Access Products and Services and for the purposes described in the Agreement, or otherwise in line with Your documented and agreed lawful instructions - unless the law requires otherwise, in which case We will tell You of that legal requirement first, to the extent the law allows. Beyond this, We will not: 

• 3.2.1 “sell” or “share” Personal Data, as those terms are defined in the Data Protection Laws; 

• 3.2.2 retain, use or disclose Personal Data for any purpose other than performing the Access Products and Services as described in the Agreement and this Addendum, including for a commercial purpose of Our own; 

• 3.2.3 retain, use or disclose Personal Data outside the direct business relationship between Us and You; or 

• 3.2.4 except as the Data Protection Laws permit, combine Personal Data We receive from, or on behalf of, You with personal information We receive from, or on behalf of, another person, or that We collect from Our own interaction with the data subject. 

4. Compliance and remediation 

• 4.1 We will provide a level of privacy protection for Personal Data consistent with the Data Protection Laws, and will promptly notify You if We determine We can no longer meet Our obligations under this Addendum or the Data Protection Laws. Following that notice, You may take reasonable and appropriate steps to help ensure We use Personal Data consistently with those obligations, and to stop and remediate any unauthorised processing. 

• 4.2 You will indemnify, defend and hold Us harmless against all claims, damages, fines, penalties, and reasonable costs (including reasonable legal fees) arising out of or in connection with: (a) Your instructions to Us that are unlawful, or that You knew or ought reasonably to have known were unlawful; (b) Your breach of any warranty or obligation under this Addendum, including Your obligation to obtain and maintain the consents and/or lawful basis needed for the processing of Personal Data; or (c) Your provision to Us of Personal Data that You were not entitled to provide - except to the extent the claim, damage, fine, penalty or cost arises from Our breach of this Addendum or Our negligence. 

5. Your responsibilities 

• 5.1 You are responsible, for the Licence Term, for having and maintaining the consents and/or lawful basis needed for the processing of the Personal Data of the data subjects affected by the Agreement, and for complying with the Data Protection Laws in respect of all Personal Data You disclose to Us or collect in connection with Your use of the Access Products and Services. 

6. US Data Protection Laws 

• 6.1  This table lists the comprehensive US state consumer privacy laws We treat as “Data Protection Laws” for the purposes of the US Data Processing Addendum. We maintain and update this list.