1. Definitions. The following definitions and rules of interpretation apply in this Agreement:
(a) "CCPA" means the California Consumer Privacy Act of 2018, as amended (Cal. Civ. Code §§ 1798.100 to 1798.199), and any related regulations or guidance provided by the California Attorney General. Terms defined in the CCPA, including personal information and business purposes, carry the same meaning in this Agreement.
(b) "Contracted Business Purposes" means the services described in the Agreement for which the service provider receives or accesses personal information.
2. Corporate Customer's CCPA Obligations
(a) Corporate Customer will not make any CCPA-related requests or inquiries to Kandji in association with job applicants, employees, directors, officers, contractors or other parties identified in Section 1798.145 (g)(1)(A) of the CCPA.
(b) For individuals not included in Section 2(a), Corporate Customer shall only submit CCPA-related inquiries and requests for individuals located in California as defined in the CCPA and will not submit CCPA-related inquiries or requests for individuals located in other jurisdictions not subject to the CCPA.
(c) Kandji will reasonably cooperate and assist Corporate Customer with meeting it's CCPA compliance obligations and responding to CCPA-related inquiries, including responding to verifiable consumer requests, taking into account the nature of Kandji's processing and the information available to Kandji.
(d) Kandji will notify Corporate Customer immediately if it receives any complaint, notice, or communication that directly or indirectly relates either party's compliance with the CCPA. Specifically, Kandji will notify the Corporate Customer within 30 working days if it receives a verifiable consumer request under the CCPA.
3. Kandji's CCPA Obligations
(a) Kandji will only collect, use, retain, or disclose personal information for the Contracted Business Purposes for which Corporate Customer provides or permits personal information access.
(b) Kandji will not collect, use, retain, disclose, sell, or otherwise make personal information available for Kandji's own commercial purposes. If a law requires Kandji to disclose personal information for a purpose unrelated to the Contracted Business Purpose, Kandji will first inform the Corporate Customer of the legal requirement and give the Corporate Customer an opportunity to object or challenge the requirement, unless the law prohibits such notice.
(c) Kandji will promptly comply with any Corporate Customer request or instruction requiring the Kandji to provide, amend, transfer, or delete the personal information, or to stop, mitigate, or remedy any unauthorized processing which complies with the terms of this Addendum.
(d) Kandji may aggregate, deidentify, or anonymize personal information so it no longer meets the personal information definition, and may use such aggregated, deidentified, or anonymized data for its own purposes. Kandji will not attempt to or actually re-identify any previously aggregated, deidentified, or anonymized data.
Kandji uses subcontractors to provide Contracted Business Services, such as payment processing. The parties agree that Kandji may use subcontractors now and in the future so long as Kandji requires the subcontractors to follow all requirements of "service providers" as defined under the CCPA and complies with the CCPA. Kandji's current list may be found here
The terms and conditions of this Addendum are effective solely to the extent the CCPA applies to a particular consumer, Corporate Customer, or situation. Corporate Customer is solely liable for its compliance with the CCPA in its use of Kandji services. In the event of changes to the CCPA or issuance of an applicable regulation, court order or governmental guidance relating to the CCPA, Kandji may modify this Addendum.