3.1 Obligations

• Process Personal Data on your behalf and in accordance with your Instructions. April will not sell, retain, use or disclose Personal Data for any purpose other than for the specific purposes of performing the Services and to comply with applicable law, unless otherwise permitted by the Terms of Use (including this DPA), Applicable Data Protection Law, or any other agreement you enter into with April. April will inform you if, in our opinion, Instructions violate or infringe Applicable Data Protection Law;
• ensure that all persons April authorizes to Process Personal Data in connection with the Services are committed to respecting the confidentiality of Personal Data and are granted access to Personal Data on a need-to-know basis; and
• to the extent required by Applicable Data Protection Law:

• inform you of requests April receives from Data Subjects (including “verifiable consumer requests” as defined under the CCPA) exercising their applicable rights, if any, under Applicable Data Protection Law to (A) access their Personal Data (e.g., “right to know” as defined under the CCPA); (B) have their Personal Data corrected or erased; (C) restrict or object to April’s processing; or (D) data portability. Apart from requesting further information, identifying the Data Subject, and, if applicable, directing the Data Subject to you as Data Controller, April will not respond to these requests unless you so instruct April to do in writing;
• to the extent required by Applicable Data Protection Law, inform you of each law enforcement request April receives from a regulatory authority requiring April to disclose Personal Data or participate in an investigation involving Personal Data;
• provide you with reasonable assistance through appropriate technical and organizational measures, at your own expense, to assist you in complying with your obligations under Applicable Data Protection Law. That assistance may include conducting data protection impact assessments and consulting with a supervisory authority, taking into account the nature of the Processing and the information available to April;
• implement and maintain a written information security program with the Data Security Standards stated in Exhibit A of this DPA. Notwithstanding any provision to the contrary, April may update or modify the Data Security Standards at our discretion, provided that such modification or update does not result in a material degradation in the protection they offer. April also will execute a data security incident response plan that manages how April will address a security incident involving the unlawful or accidental loss, destruction, alteration, or unauthorized disclosure of or access to Personal Data (“Incident”). If Applicable Data Protection Law requires April to notify you of an Incident, April will do so without unreasonable delay or in no event later than any time period prescribed by Applicable Data Protection Law. For incidents affecting Personal Data subject to GDPR or its equivalent under United Kingdom data protection laws, April will notify you no later than forty-eight hours after April becomes aware of the Incident. The response to the Incident may include identification of key partners, investigation of the Incident, regular updates, and discussion of notice obligations. Except as required under Applicable Data Protection Law, April will notify your affected Data Subjects, if any, about an Incident without first consulting you;
• to the extent required by Applicable Data Protection Law and upon your valid written request, contribute to audits or inspections by making audit reports available to you, which reports are April’s confidential information. Upon your valid written request, and no more than once annually, April will provide documentation or complete a written data security questionnaire of reasonable scope and duration regarding April’s Processing of Personal Data. Any and all documentation provided, including any response to a security questionnaire, is April’s confidential information;
• engage Sub-processors as necessary to perform the Services on the basis of the general written authorization you provide to April under Section 3.2 of this DPA; and
• at your valid written request, and subject to April’s rights and obligations under the Terms of Use (including this DPA), return or delete all Personal Data to you after the Term, and delete existing copies April holds, unless April is authorized or required by Applicable Data Protection Law to store Personal Data for a longer period.

3.2 Sub-processors‍

• You expressly and specifically authorize April to engage its Sub-processors from the agreed list of Sub-processors (April Service Providers and Sub-processors). April reserves the right to maintain its list of Services Providers and Sub-processors through means such as publication of that list online. If you subscribe to the email notification, April will inform you via email of any changes regarding the addition or replacement of other Sub-processors to give you an opportunity to reasonably object on legitimate grounds to such change(s). In the event that you object to April’s change or addition of a Sub-processor, promptly notify April of your objections in writing within 14 days after receipt of notice of such change or addition. You acknowledge that April’s Sub-processors are essential to provide the Services and that if you object to April’s use of a Sub-processor, then notwithstanding anything to the contrary in the Terms of Use (including this DPA), April will not be obligated to provide you the Services for which April uses that Sub-processor.
• When engaging with a Sub-processor, April will enter into a written agreement that imposes obligations or protections comparable to those imposed on April under this DPA.

3.3 CCPA Certification

3.4 Disclaimer of Liability