FOS Hosting Consumer Privacy Protection Addendum

Last Updated: April 15, 2024

This Consumer Privacy Protection Addendum (“CPPA Addendum”) is an addendum to Master Services Agreement (“Agreement”). This CPPA Addendum defines the rights and responsibilities of each party under the California Consumer Privacy Act of 2018, Cal. Civil Code § 1798.100, et seq. (“CCPA”). This CPPA Addendum is only applicable if Customer is a Business, as defined under the CCPA. This CPPA Addendum prevails over any conflicting terms in the Agreement but does not otherwise modify the Agreement. All capitalized terms not defined in the Agreement (including this CPPA Addendum) will have the meanings defined in the CCPA.

1. Scope and Applicability.
   • This CPPA Addendum applies to the collection, retention, use, and disclosure of Personal Information to provide Services to Customer under the Agreement or to perform a Business Purpose.
   • Customer is a Business and has appointed FOS Hosting as a Service Provider to process Personal Information on Customer’s behalf. Customer is responsible for complying with CCPA’s requirements applicable to Businesses.
   • FOS Hosting’s collection, retention, use, or disclosure of Personal Information for its own purposes independent of providing Services specified in the Agreement are outside the scope of, and not subject to, this CPPA Addendum.
2. FOS Hosting Responsibilities.
   • As a Service Provider, FOS Hosting shall not:
     • Sell the Personal Information.
     • Retain, use, or disclose the Personal Information for any purpose other than for the specific purpose of (i) performing the Services specified in the Agreement for Customer, (ii) as set out in this CPPA Addendum, or (iii) as otherwise permitted by CCPA.
     • Further collect, sell, or use the Personal Information except as necessary to perform the Business Purpose. FOS Hosting shall not use the Personal Information to provide services to another person or entity (other than Customer’s Representatives or end users, consistent with providing the Services), except that FOS Hosting may combine Personal Information received from one or more entities to which it provides similar services if necessary to detect data security incidents or protect against fraudulent or illegal activity.
   • FOS Hosting shall respond to any Consumer request to exercise their rights by either asking the Consumer to make their request to Customer or notifying Customer of the Consumer request. FOS Hosting shall assist the Customer to respond to any request from a Consumer to exercise any of his or her rights under the CCPA by providing technical measures to provide Customer, in a manner consistent with the functionality of the Services and FOS Hosting’s role as a Service Provider, with the ability to itself access, correct, erase, restrict, or export Personal Information. For Personal Information within Customer Data, FOS Hosting’s sole assistance is to permit the Customer, in a manner and to the extent consistent with the functionality of the Services and FOS Hosting’s role as Service Provider, with the ability to itself access, correct, erase, restrict, or export Personal Information. This section 2.2 only applies to the extent that Customer does not itself hold or otherwise have access to the Personal Information and the extent that FOS Hosting can provide that assistance taking into account the nature of the Services provided.
3. Customer Responsibilities. Customer states that it has provided notice that the Personal Information is being used or shared consistent with Cal. Civ. Code § 1798.140(t)(2)(C)(i).
4. Miscellaneous.
   • Required by Law. Despite anything in the Agreement (including this CPPA Addendum) to the contrary, FOS Hosting will cooperate with law enforcement agencies concerning conduct or activity that it reasonably and in good faith believes might violate international, federal, state, or local law.
   • No Sale of Personal Information. Despite anything in the Agreement (including this CPPA Addendum) to the contrary, the pares acknowledge that Customer’s provision of access to Personal Information is not part of and explicitly excluded from the exchange of consideration, or any other thing of value, between the parties.