The following agreements, collectively referred to as the “WHALE CUSTOMER AGREEMENT”, govern the relationship between Whale and {companyName}: WHALE INVESTABLE ACCOUNT AGREEMENT, SECURITIES ACCOUNT AND DEPOSIT ACCOUNT CONTROL AGREEMENT, AND TRANSFER OF SECURITY DEPOSIT TO INVESTABLE ACCOUNT ADDENDUM. These agreements, taken together, set forth the terms, conditions, rights, and obligations of the parties with respect to the use of Build Whale, Inc.’s platform and services.
WHALE INVESTABLE ACCOUNT AGREEMENT
This WHALE INVESTABLE ACCOUNT AGREEMENT (the “Agreement”) is effective as of {todaysDate} (the “Effective Date”) by and between {companyName} (the “Landlord”) of the properties listed and described in Exhibit A attached hereto and incorporated herein (the “Project”) and Build Whale, Inc., a Delaware limited liability company (the “Independent Service Provider”).
WHEREAS, Landlord is the landlord of certain tenants (“Tenants”) at the Property that have executed that certain lease agreement by and between Landlord and Tenants, a copy of which is attached hereto and incorporated herein as Exhibit B;
WHEREAS, Tenants shall execute that certain investment advisory agreement by and between Build Whale, Inc. and Tenants;
WHEREAS, Tenants shall execute that certain security account and deposit control agreement (“Deposit Control Agreement”) by and between Tenants, Landlord, Build Whale, Inc., and Alpaca Securities LLC (“Broker”) that is substantially similar to the attached in Exhibit C, and transfer that certain investable deposit in connection with the lease agreement to Broker under that certain carrying agreement by and between Tenants and Broker;
WHEREAS, Tenants shall complete a transfer initiation form (“TIF”) to Broker;
NOW, THEREFORE, the Landlord desires to engage the Independent Service Provider to manage and remit any applicable funds in the Investable Account (as defined below) with respect to damages inflicted upon the Project by Tenants, and for good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the parties agree as follows:
1. Commencement and Termination Dates.
1.1. Commencement and Termination. The Independent Service Provider’s duties and responsibilities under this Agreement shall begin on the Effective Date.
1.2 Termination. This Agreement shall terminate pursuant to the termination provision as provided in Section 10. Notwithstanding the aforementioned, the Landlord and the Independent Service Provider may elect to extend this Agreement beyond the term set forth above by mutual written agreement.
2. Independent Service Provider’s Responsibilities.
2.1 Status of the Independent Service Provider. The Landlord and the Independent Service Provider do not intend to form a principal-agent, joint venture, partnership, or similar relationship. Instead, the parties intend that the Independent Service Provider shall act solely in the capacity of an independent contractor in relation to the Landlord. Nothing in this Agreement shall cause the Independent Service Provider and the Landlord to be a principal-agent, joint venturers or partners of each other, and neither shall have the power to bind, obligate, control or direct the other party, except as expressly provided in this Agreement. The parties shall operate independently of each other, and make decisions without one party exercising any control or authority over the other. Nothing in this Agreement shall imply any fiduciary duties between the parties. This Agreement shall not deprive or otherwise affect the right of the parties to this Agreement to own, invest in, manage or operate, or to conduct business activities that compete with the business of the Project.
2.2 Services to be Provided.
2.2.1 Pursuant to that certain investment advisory agreement (“Advisory Agreement”) by and between Build Whale, Inc. and Tenants (“Advisory Clients”), the Independent Service Provider shall open, a separate account(s) at Broker for the purpose of segregating such investment advisory assets pertaining to the Lease Agreement (“Investable Account”). The Independent Service Provider shall maintain, and have certain access and/or authority with respect to, such account in accordance with applicable law and/or the Advisory Agreement. The Independent Service Provider shall require the Broker or to hold the Investable Account for the benefit of such Advisory Client. Upon written request by the Landlord under this Agreement and the Deposit Control Agreement, the Independent Service Provider shall remit any applicable funds to the Landlord from the Investable Account in the ordinary course of business in accordance with the terms of the Lease Agreement and this Agreement.
2.2.2 Access to Account. The Independent Service Provider shall have access to all funds in the accounts described in Sections 2.2 as authorized by the Advisory Agreement, without the approval of the Landlord. The Landlord may not withdraw funds from such accounts without the Independent Service Provider’s prior written consent, except following the Independent Service Provider’s default after expiration of any applicable notice and cure periods or the termination of this Agreement.
2.2.3 Employees/Independent Contractors of Independent Service Provider. The Independent Service Provider may employ employees and/or independent contractors to enable the Independent Service Provider to provide the services under this Agreement. All matters pertaining to the supervision of such employees and independent contractors shall be the responsibility of the Independent Service Provider.
2.4 Compliance with Laws and Other Matters.
2.4.1. The Independent Service Provider shall comply with all applicable local, state and federal laws (collectively “Laws”). The Independent Service Provider may implement such procedures with respect to the Investable Account as the Independent Service Provider may deem advisable for the efficient and economic management and operation thereof.
2.5 Leases.
2.5.1 The Landlord hereby approves the all Lease Agreements.
2.6 Miscellaneous Duties. The Independent Service Provider shall (a) maintain at the Independent Service Provider’s office address as set forth in Section 12, and readily accessible to the Landlord, orderly files containing documents and papers pertaining to the Investable Account applicable to the Landlord; and (b) provide information about the Investable Account necessary for the preparation and filing by the Landlord of its income or other tax returns required by any governmental authority, including annual statements. All such records will be made available to the Landlord upon request.
3. Insurance.
3.1 Insurance.
3.1.1. The Independent Service Provider, will maintain professional liability, errors and omissions insurance, director and officers insurance and employment practices insurance with at least $1,000,000 of coverage per incident and $1,00,000 in aggregate.
3.2 Waiver of Subrogation. To the extent available at commercially reasonable rates, all property damage insurance policies required hereunder shall contain language whereby the insurance carrier thereunder waives any right of subrogation it may have with respect to the Landlord or the Independent Service Provider.
4. Record Keeping.
4.1 Books of Accounts. The Independent Service Provider shall maintain adequate and separate books and records for the Investable Account with the entries supported by sufficient documentation to ascertain their accuracy with respect to the Investable Account. The Independent Service Provider shall maintain such books and records at the Independent Service Provider’s office as set forth in Section 12. The Independent Service Provider shall bear the losses arising from the fraud or gross negligence of the Independent Service Provider or any of its employees or agents, including, without limitation, the following: (a) theft of assets by the Independent Service Provider’s employees, principals, or officers or those individuals associated or affiliated with the Independent Service Provider or (b) overpayment or duplicate payment of Investable Account to the Advisory Client arising from either fraud or gross negligence, unless such Investable Account is subsequently received by the Landlord within 30 days of such overpayment or duplicate payment.
4.2. Tax Information. The Independent Service Provider shall provide the Landlord with sufficient information so that the Landlord can prepare its income tax returns on the cash method of accounting or, if requested, with appropriate adjustment to convert the information to an accrual basis.
5. Audits. The Landlord and its representatives, including the lender under the Loan Documents, may examine all books, records and files maintained that are related to the Investable Account by the Independent Service Provider. Any such party may request in writing to perform any audit or investigations relating to such books, records, and files, subject to the Independent Service Provider’s written consent. Should the Landlord discover defects in internal controls or errors in record keeping, the Independent Service Provider shall undertake all appropriate diligence to correct such discrepancies either upon discovery or within a reasonable period of time. The Independent Service Provider shall inform the Landlord in writing of the action taken to correct any audit discrepancies. Any audit or investigation performed by the Landlord will be conducted at the Landlord’s sole expense.
6. Independent Service Provider’s Costs Not To Be Reimbursed.
6.1 Non-Reimbursable Costs. Costs attributable to losses arising from the gross negligence or fraud on the part of the Independent Service Provider, the Independent Service Provider’s agents or employees shall be at the sole cost and expense of the Independent Service Provider and shall not be reimbursed by the Landlord.
6.2 Litigation. The Independent Service Provider will be responsible for and hold the Landlord harmless from, all fees, costs, expenses, and damages relating to criminal activity involving employees, disputes with employees for worker’s compensation (to the extent not covered by insurance), discrimination or wrongful termination, including legal fees and other expenses, where it is determined by final judicial determination that such loss, cost or expense was the fault of the Independent Service Provider.
7. Compensation. The Independent Service Provider and its Affiliates will receive the compensation set forth on Schedule 1.
8. Termination.
8.1. Either party shall have the right to terminate this Agreement upon thirty (30) days prior written notice indicating its termination of the Agreement.
8.2 Final Accounting. Within 45 days after termination of this Agreement, the Independent Service Provider shall deliver to the Landlord the following: (a) a final accounting, setting forth the applicable Investable Account to the Landlord as of the date of termination, and (b) transfer to any account indicated by the Landlord with respect to any applicable Investable Account held by the Independent Service Provider.
9. Notices. All notices, demands, consents, approvals, reports and other communications to the Landlord as provided for in this Agreement shall be in writing and shall be given to the Landlord as set forth below, or at such other address as they may specify hereafter in writing. All notices, demands, consents, approvals, reports, and other communications to the Independent Service Provider provided for in this Agreement shall be in writing and shall be given to the Independent Service Provider at the address set forth below or at such other address as it may specify hereafter in writing:
To the Independent Service Provider at: Build Whale, Inc. 332 S Michigan Ave - Suite #121-2234 - Chicago, IL 60604
To the Landlord: {companyName} {companyAddress}
10. Miscellaneous. The Independent Service Provider will comply with the Data Protection, Security, and Privacy requirements set forth in Exhibit D.
11. Miscellaneous.
11.1 Assignment. The Independent Service Provider may not assign this Agreement without the prior written consent of the Landlord, which consent may be withheld in the Landlord’s sole and absolute discretion, except with respect to an assignment to an affiliate, including, but not limited to a wholly-owned subsidiary, which shall be permissible under this Agreement.
11.2 Amendments. Each amendment, addition or deletion to this Agreement shall not be effective unless approved by the parties in writing, except as otherwise provided herein.
11.3 Attorneys’ Fees. In any action or proceeding between the Independent Service Provider and the Landlord arising from or relating to this Agreement or the enforcement or interpretation hereof, the party prevailing in such action or proceeding shall be entitled to recover from the other party all of its reasonable attorneys’ fees and other costs and expenses of the action or proceeding.
11.4 Governing Law; Venue. This Agreement shall be governed by and construed in accordance with the internal laws of the State of Delaware without regard to any choice of law rules. Any action relating to or arising out of this Agreement shall be brought only in a court of competent jurisdiction located in Delaware.
11.5 Headings. All headings are only for convenience and ease of reference and are irrelevant to the construction or interpretation of any provision of this Agreement.
11.6 Representations. The Independent Service Provider represents and warrants that it is or shall become fully qualified and licensed, to the extent required by applicable Law, to manage perform all obligations assumed by the Independent Service Provider hereunder. The Independent Service Provider shall use reasonable efforts to comply with all such laws now or hereafter in effect. If at any time it is determined that the Independent Service Provider does not have all applicable licenses or qualifications, the Independent Service Provider shall be given a reasonable opportunity to cure such deficiency by obtaining any required licenses or permits.
11.7 Indemnification by Independent Service Provider. The Independent Service Provider shall indemnify, defend and hold the Landlord and its shareholders, officers, directors, members, partners and employees harmless from any and all claims, demands, causes of action, losses, damages, fines, penalties, liabilities, costs and expenses, including reasonable attorneys’ fees and court costs, sustained or incurred by or asserted against the Landlord where it is determined by final judicial determination that such loss, cost or expense was the result of the acts of the Independent Service Provider which arise out of the gross negligence, willful misconduct or fraud of the Independent Service Provider, its agents or employees or the Independent Service Provider’s material breach of this Agreement. If any person or entity makes a claim or institutes a suit against the Landlord on a matter for which the Landlord claims the benefit of the foregoing indemnification, then (a) the Landlord shall give the Independent Service Provider prompt notice thereof in writing; (b) the Independent Service Provider may defend such claim or action by counsel of its own choosing provided such counsel is reasonably satisfactory to the Landlord; and (c) neither the Landlord nor the Independent Service Provider shall settle any claim without the other’s written consent.
11.8 Indemnification by the Landlord. The Landlord shall indemnify, defend and hold the Independent Service Provider and its shareholders, members, partners, officers, directors, managers and employees harmless from any and all claims, demands, causes of action, losses, damages, fines, penalties, liabilities, costs and expenses, including reasonable attorneys’ fees and court costs, sustained or incurred by or asserted against the Independent Service Provider by reason of the Independent Service Provider’s obligations under this Agreement, except those which arise from the Independent Service Provider’s gross negligence, willful misconduct or fraud. If any person or entity makes a claim or institutes a suit against the Independent Service Provider on matters for which the Independent Service Provider claims the benefit of the foregoing indemnification, then (a) the Independent Service Provider shall give the Landlord prompt notice thereof in writing; (b) the Landlord may defend such claim or action by counsel of its own choosing provided such counsel is reasonably satisfactory to the Independent Service Provider; (c) neither the Independent Service Provider nor the Landlord shall settle any claim without the other’s written consent; and (d) this subsection shall not be so construed as to release the Landlord or the Independent Service Provider from any liability to the other for a breach of any of the covenants agreed to be performed under the terms of this Agreement.
11.9 Complete Agreement. This Agreement shall supersede and take the place of any and all previous agreements entered into between the parties with respect to the the Investable Account.
11.10 Severability. If any provisions of this Agreement or application to any party or circumstances shall be determined by any court of competent jurisdiction to be invalid and unenforceable to any extent, the remainder of this Agreement, where the application of such provisions or circumstances other than those as to which it is determined to be invalid or unenforceable shall not be affected thereby, and each provision hereof shall be valid and shall be enforced to the fullest extent permitted by law.
11.11 No Waiver. The failure by any party to insist upon the strict performance of, or to seek remedy of, any one of the terms or conditions of this Agreement or to exercise any right, remedy, or election set forth herein or permitted by law shall not constitute or be construed as a waiver or relinquishment for the future of such term, condition, right, remedy or election, but such item shall continue and remain in full force and effect. All rights or remedies of the parties specified in this Agreement and all other rights or remedies that they may have at law, in equity or otherwise shall be distinct, separate and cumulative rights or remedies, and no one of them, whether exercised or not, shall be deemed to be in exclusion of any other right or remedy of the parties.
11.12 Binding Effect. This Agreement shall be binding and inure to the benefit of the parties and their respective successors and assigns.
11.13 Counterparts. This Agreement may be executed in several counterparts, which when executed shall constitute one Agreement, binding on all of the parties hereto, notwithstanding that all of the parties are not signatory to the original or the same counterpart.
11.14 Waiver of Right to Jury Trial. THE LANDLORD AND THE Independent Service Provider EACH KNOWINGLY, VOLUNTARILY AND INTENTIONALLY WAIVE TO THE EXTENT PERMITTED BY LAW, TRIAL BY JURY IN ANY ACTIONS BROUGHT BY OR AGAINST THE LANDLORD OR THE Independent Service Provider IN CONNECTION WITH THIS AGREEMENT.
IN WITNESS WHEREOF the parties hereby execute this Agreement to be effective as of the date set forth above.
Independent Service Provider:
Build Whale, Inc.
By: 
Name: Arthur J. Petraglia
Title: Founder & CEO
LANDLORD:
{companyName}
By: Signed electronically on {todaysDate} {time} by {firstName} {lastName}
Name: {firstName} {lastName}
Title: {title}
SCHEDULE 1
FEES TO Independent Service Provider & AFFILIATES
The Independent Service Provider and its Affiliates will receive the following compensation:
[N/A - DESCRIPTION]
EXHIBIT A
LEGAL DESCRIPTION
Property Owner(s) and/or Property Manager(s), the "Landlord", will provide a list of properties to Build Whale, Inc., "Independent Service Provider" in writing or by providing access to their Property Management System. Properties can be added or removed any time in writing.
EXHIBIT B
LEASE AGREEMENT
EXHIBIT C
SECURITY ACCOUNT AND DEPOSIT CONTROL AGREEMENT
EXHIBIT D
DATA PROTECTION, SECURITY, AND PRIVACY REQUIREMENTS
Definitions.
1.1 "Customer Data" means any and all type of information, facts, figures, statistics, details, information, insights, automations, metadata, and any other data of any kind regarding or pertaining to {companyName} (“Customer”), the Customer-owned properties wherein the residential units covered by this Agreement are contained ("Properties"), or the residents of the Properties ("Tenants"), including, without limitation: (i) data that is transmitted, stored, retrieved, or processed by Customer, a Tenant, or Independent Service Provider in, to, or through the Services (as defined below); (ii) data provided to Independent Service Provider by Customer at its direction in connection with this Agreement, (ii) data made available to, or otherwise obtained by, Independent Service Provider through the Services; and (iii) data made available to, or otherwise obtained by, Independent Service Provider in the course of providing the Services.
1.2 "Documentation" means any user guide, help information, and other documentation and information regarding the Services that is delivered by Independent Service Provider to Customer in electronic or other form, including any updates, modifications, or upgrades provided by Independent Service Provider from time to time; provided, however, if any updates, modifications, or upgrades require Customer to follow updated instructions, Customer shall have 45 days from receipt of any new Documentation from Independent Service Provider to begin compliance.
1.3 "Tenant Data" means any or all information in any way regarding or pertaining to any Tenant, including any such information (i) provided to Independent Service Provider by Customer or at its direction in connection with this Agreement or the Property at which the Tenant resides, (ii) provided to Independent Service Provider by any Tenant or at its direction in connection with this Agreement or the Property at which the Tenant resides, or (iii) made available to, or otherwise obtained by, Independent Service Provider during the course of Independent Service Provider's performance under this Agreement. Tenant Data includes any information that (a) identifies or can be used to identify or locate an individual (including, without limitation, names, signatures, addresses, telephone numbers, e-mail addresses and other unique identifiers), (b) can be used to authenticate an individual (including, without limitation, employee identification numbers, government-issued identification numbers, passwords or PINs, financial account numbers, credit report information, answers to security questions and other personal identifiers), (c) can be used to access or control any assets, accounts, credit, funds, payments or other transfers of value by or on behalf of any individual, or (d) records any action or election of any individual and is collected by, or transmitted to, Independent Service Provider through the Services.
1.4 "Services" means collectively, Independent Service Provider’s proprietary, Software-as-a-Service ("SaaS") solution for multi-source data analysis and management of business information, Documentation, and all software applications, databases, modules, source code, development tools, libraries, and utilities that UDP uses, creates, and/or maintains in order to provide the Services set forth in the Order Form to Customer. The Services includes any change, improvement, extension, or other new version thereof that is developed or otherwise made available to Customer.
1.5 "Services Data" means Tenant Data and Customer Data, collectively.
1.6 "Data Subject" means an identified or identifiable natural person.
1.7 "Processing" (including "Processed" and similar terms) means any operation or set of operations which is performed on Services Data or on sets of Services Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
1.8 "Authorized Employees" means Independent Service Provider's employees who have a need to know or otherwise access Services Data to enable Independent Service Provider to perform its obligations under the Agreement.
1.9 "Security Breach" means an actual or attempted act, omission, or event that compromises the security, confidentiality, availability, or integrity of Confidential Information and/or Services Data or the physical, technical, administrative, or organizational safeguards put in place by Independent Service Provider or its Non-Employees that relate to the protection of the security, confidentiality, or integrity of Confidential Information and/or Services Data. Security Breach includes, without limitation, any physical trespass on a secure facility or computing systems, intrusion/hacking, or theft of any information storage device or printed materials, exploitation of a vulnerability in Independent Service Provider's computing systems, unauthorized access to or use of any Services Data, accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Services Data transmitted, stored, or otherwise processed.
1.10 "Supervisory Authority" means a public authority which regulates Applicable Laws (as defined below) in any jurisdiction in which the Independent Service Provider provides goods or services.
Data Collection; Usage, Data Security.
2.1 Data Ownership. Customer owns all right, title, and interest in and to the Services Data, including all intellectual property rights therein, and Independent Service Provider hereby disclaims any interest the Services Data. If Independent Service Provider is deemed to have any ownership interest in any Services Data, including any derivative works thereof, then Independent Service Provider shall assign, and hereby does assign, irrevocably and on a royalty-free basis, all such ownership interest or other rights exclusively to Customer.
2.2 Data Usage. Customer hereby grants to Independent Service Provider during the Term of this Agreement the right to use Services Data in order to perform the Services and for no other purpose whatsoever. Independent Service Provider's right to use such information terminates concurrent with Independent Service Provider's right to provide Services. Independent Service Provider shall hold, and cause all Non-Employees to hold, Services Data, including, without limitation, all Services Data, and any information derived from such data or the Services, in strictest confidence, and Independent Service Provider may disclose such data only to Authorized Employees solely for purposes of performing the Services contemplated under this Agreement (“Confidential Information”). Independent Service Provider may not transfer Services Data to any location outside the U.S. unless agreed to in writing by Customer. Only duly Authorized Employees or non-employees, including contractors or sub-contractors, are permitted to access Services Data, and only to fulfill the obligations of this Agreement. Independent Service Provider shall not distribute, repurpose, sell, or share Services Data (i) across other applications, environments, or business units of Independent Service Provider, or (ii) to third parties.
2.3 Restrictions. Customer will not (and will not to allow any third party to): (i) access the Services for any benchmarking, penetration testing, or competitive purposes without Independent Service Provider’s express written consent; (ii) encumber, rent, market, sublicense, resell, lease, loan, transfer, or otherwise commercially exploit or make the Services available to any third party, except to a third party that manages Customer's computing environment or asset portfolio; (iii) modify, create derivative works, decompile, reverse engineer, attempt to gain access to the source code, or copy the Services, or any of their components; (iv) use or allow the transmission, transfer, export, re-export, or other transfer of any product, technology, or information Customer obtains or learns of pursuant to this Agreement (or any direct product thereof) in violation of any export control or other laws and regulations of the United States or any other relevant jurisdiction; or (v) use the Services other than in accordance with this Agreement and in compliance with all applicable current or future local, state, and federal laws, rules, regulations, orders, writs, ordinances, requirements, restrictions, and codes, and future modifications thereto, including all applicable federal, state, local privacy and data protection laws and export laws (collectively, "Applicable Laws").
2.3 Data Security. Independent Service Provider shall, taking into account those matters which are required to be considered under Applicable Laws, take, implement, and maintain security measures ("Data Security Standards"), which shall include industry-standard administrative, technical, and physical safeguards, to protect Confidential Information and Services Data from any Security Breach and to prevent any unauthorized control or monitoring of the Services by any person or entity other than Customer. Such Data Security Standards shall also include administrative permissions, access controls, server security, encryption, and other means, where appropriate. At a minimum, such Data Security Standards shall include: (i) limiting access to Confidential Information and Services Data to Authorized Employees, (ii) securing business facilities, data centers, paper files, servers, back-up systems, and computing equipment, including, but not limited to, all mobile devices and other equipment with information storage capability, (iii) implementing network, device application, database, and platform security, (iv) securing information transmission, storage, and disposal, (v) implementing authentication and access controls within media, applications, operating systems, and equipment, (vi) encrypting Services Data stored on any mobile media, (vii) encrypting Services Data in transit, (viii) strictly segregating Services Data from Independent Service Provider's information or information of Independent Service Provider's other customers so that Services Data is not commingled with any other types of information; (ix) implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with Applicable Laws, and (x) providing appropriate privacy and information security training to Independent Service Provider's employees. In addition, Independent Service Provider shall diligently work toward obtaining SOC 2 Type I and SOC 2 Type II data privacy certifications as soon a reasonably practicable following the effective date of the Agreement, and Independent Service Provider shall provide notice to Customer upon receipt of either such certification. Should Independent Service Provider fail to obtain, or otherwise stop pursuing, either its SOC 2 Type I certification or SOC 2 Type II certification, Independent Service Provider shall promptly notify Customer of same. At any time, upon 30 days' prior notice but not more than once per any 12-month period, Customer shall have the right (at its sole cost) to conduct, and Independent Service Provider shall facilitate, an audit with respect to Independent Service Provider's encryption, collection, transmittal, and storage of information obtained by Independent Service Provider through the Services or otherwise in connection with this Agreement. Independent Service Provider agrees that Customer shall have the right to periodically evaluate, validate and monitor, through its security questionnaire process and requests for additional information ("Periodic Security Evaluations"), that the Services, system configurations, and processes, including that of Independent Service Provider's Non-Employees, are in compliance with this Agreement.
2.4 Data Storage. The Independent Service Provider data center and disaster recovery site that contain Confidential Information must be located in the continental United States. Independent Service Provider shall ensure that any facilities in which Confidential Information is processed, including Independent Service Provider's data center and disaster recovery site, shall remain compliant with SOC 2 Type II subject to Section 2.3 above, or with a similar successor standard that may be in effect from time to time, for the Term and will provide Customer, upon request, with a copy of its SOC 2 Type II attestation and a bridge letter that covers the period after the date of the applicable SOC 2 Type II report date.
2.5 Usage of Services Data in Compliance with Applicable Laws. Independent Service Provider covenants, represents, and warrants that its collection, access, use, storage, disposal, and disclosure of Services Data and that of its Non-Employees, will comply with Applicable Laws and regulations pertaining to privacy and data security, and the collection, Processing, disclosure, and storage of such Services Data.
2.6 Data Security Breach. In the event of a Security Breach, Independent Service Provider shall notify Customer of the Security Breach as soon reasonably practical (and, in no event later than 24 hours thereafter) and use its best efforts to resolve the Security Breach and remediate the effects of the breach or potential breach to the reasonable satisfaction of Customer and in conformity with all Applicable Laws. Further, Independent Service Provider shall reimburse Customer for the actual reasonable costs incurred by Customer in providing notice to any individuals affected by any Security Breach. Notwithstanding anything to the contrary herein, Independent Service Provider shall have committed an event of default for which Customer may exercise all rights and remedies available hereunder, at law or in equity, without further notice or opportunity to cure, upon any default of its obligations under this Section 2.6. Customer agrees to notify Independent Service Provider immediately of any unauthorized use of the Services and/or any unauthorized use or disclosure of any Services Data.
2.7 PCI DSS Compliance. To the extent Independent Service Provider or its Non-Employees collect or handle information printed on the front or back of a debit, credit, or other payment card ("Cardholder Data") in connection with its Services, Independent Service Provider and its Non-Employees shall comply with Payment Card Industry Data Security Standard ("PCI DSS") requirements for Cardholder Data, as prescribed by the PCI Security Standards Council from time to time.
2.8 Secure Coding Practices. All software, websites, mobile applications, or other technologies developed by Independent Service Provider and used by Independent Service Provider (including the Services under the Agreement) as part of the Agreement or Services or to help perform or provide the Services shall work as intended and be free of security vulnerabilities, malicious code, ad-supported software, Trojan Horses, root kits, worms, key-loggers, backdoors, viruses, corrupted files, and any similar code, file, or vulnerability that may damage the operation of or compromise the integrity and security of another computer, system (including the Properties' property management systems), or service or that may compromise the privacy or data security of individuals or end-users to whom the Customer owes legal duties. Additionally, Independent Service Provider represents and warrants that any website, web application, mobile application, IoT service, or similar technology that it creates as part of the Services or to help perform or provide the Services shall meet the requirements set forth in Level 2 of the most recent Application Security Verification Standard published by the Open Web Application Security Project to the extent that the requirements are applicable to providing the Services without creating material adverse security risks.
2.9 Return/Destruction of Services Data. Upon expiration or earlier termination of this Agreement for any reason, Independent Service Provider, with respect to Services Data received from Customer, or created, maintained, or received by Independent Service Provider on behalf of Customer, shall return and destroy remaining Services Data maintained in any form as follows. Within 30 days of such expiration or earlier termination of this Agreement, Independent Service Provider shall: (a) deliver to Customer a flat file, in a format reasonably acceptable to Customer, with all Services Data; and (b) ensure that all encryption keys for and copies of Services Data maintained in any form in Independent Service Provider's possession (and that of its employees, agents, and Non-Employees) is permanently destroyed.
3. Data Privacy.
3.1 In relation to any Tenant Data or any Confidential Information of Customer's and its employees, contractors, agents, invitees, or Tenants Processed hereunder, Independent Service Provider shall act only on the instructions of Customer in Processing any such data and information.
3.2 Independent Service Provider shall not use Services Data in connection with unsolicited or solicited direct marketing or offers.
3.3 Independent Service Provider shall ensure that it has appropriate consents and/or notices in place to enable Customer to receive the products and Services under this Agreement. This includes but is not limited to when Services Data is being transferred outside of the jurisdiction in which it is collected.
3.4 Independent Service Provider shall take reasonable steps to verify the reliability of any persons authorized by Independent Service Provider to Process any Services Data, and it shall ensure that all such persons are subject to binding agreements with Independent Service Provider which contain substantially similar data protection provisions as those set forth herein.
3.5 Independent Service Provider shall provide reasonable support to Customer in complying with any legally mandated request for access to or correction or deletion of any Services Data by any Services Data Subject or access or demand made by any court or Supervisory Authority, and where such request or demand is submitted to Independent Service Provider, promptly notify Customer of it; and take any actions reasonably requested by Customer so that any such request is redirected directly to Customer. Independent Service Provider shall not, without the prior written consent of Customer, respond to such request or demand, including a request or demand by a Supervisory Authority, unless Independent Service Provider is required to do so under Applicable Laws.
3.6 Independent Service Provider shall provide reasonable assistance to Customer to assist Customer's obligation to respond to requests by any Data Subject exercising rights under Applicable Laws.
3.7 Independent Service Provider shall provide reasonable assistance to Customer in connection with Customer's compliance with any other Customer obligations under Applicable Laws in connection with this Agreement, including the circulation by Customer of data protection notices to Data Subjects, and Customer's privacy policy as updated from time to time.
3.8 Independent Service Provider shall make available to Customer all information necessary to demonstrate compliance with these data protection obligations.
4. California Consumer Privacy.
4.1 Definitions. Except as otherwise defined in this Agreement, all capitalized terms in this Section 4 will have the meanings given to them under the California Consumer Privacy Act of 2018 and regulations promulgated thereunder (as amended, supplemented, or replaced, the "CCPA").
4.2 Information. Customer and its representatives may disclose limited Personal Information to Independent Service Provider, from time to time ("Customer-supplied Information"). Independent Service Provider may also have or obtain Personal Information, other than Customer-supplied Information ("Other Information"). All Customer-supplied Information is disclosed solely for purposes of maintaining or servicing accounts, providing customer service, maintaining quality and safety of services, processing or fulfilling orders, and protecting against malicious, deceptive, fraudulent, or illegal activity, as specified in this Agreement, and Independent Service Provider shall not retain, use, or disclose Customer-supplied Information for any other purpose. Independent Service Provider shall not Sell Customer-supplied Information or use Customer-supplied Information for any Commercial Purpose. Independent Service Provider certifies that it understands the restrictions in this Section 4 and will comply with them.
4.3 Compliance. Independent Service Provider shall: (i) fully comply with the CCPA with respect to Customer-supplied Information and Other Information; (ii) implement and maintain reasonable security procedures and practices to protect Customer-supplied Information and Other Information; (iii) promptly and timely comply with Customer requests with respect to Customer-supplied Information (e.g., disclosure, deletion, opt-out) that are communicated to Independent Service Provider by Customer; and (iv) indemnify, defend, and hold harmless Customer, its management companies, and their respective shareholders, members, partners, managers, affiliates, directors, employees, and agents against any civil or enforcement action arising, or alleged to arise from, Independent Service Provider's failure to comply with the requirements of this Section 4.
5. Equitable Relief. Independent Service Provider acknowledges that any breach of its covenants or obligations set forth in this Exhibit D may cause Customer irreparable harm for which monetary damages would not be adequate compensation and agrees that, in the event of such breach or threatened breach, Customer is entitled to seek equitable relief, including a restraining order, injunctive relief, specific performance, and any other relief that may be available from any court, in addition to any other remedy to which Customer may be entitled at law or in equity. Such remedies shall not be deemed to be exclusive but shall be in addition to all other remedies available at law or in equity, subject to any express exclusions or limitations in this Agreement to the contrary.