MASTER SERVICES AGREEMENT
This Master Services Agreement (the "Agreement") is effective as of {todaysDate} (the "Effective Date") by and between {companyName} (the "Landlord") of the properties listed and described in Exhibit A attached hereto and incorporated herein (the "Property") and Build Whale, Inc., a Delaware corporation (the "Whale").
WHEREAS, Whale has developed a proprietary software as a service platform (the “Whale Platform”) that provides investment products and will provide to Landlord the Whale Products (the “Whale Products”) including an innovative solution for providing security for a lease agreement using a renter-owned [FDIC] high-yield account for the purpose of segregating deposit assets related to the lease agreement that can be locked for the benefit of the Landlord until they release the deposit, less any deductions, at move-out (“Whale Deposit”);
WHEREAS, Landlord is the landlord of certain tenants at the Property ("Tenants") that have executed that certain lease agreement by and between Landlord and Tenants ("Lease Agreement");
WHEREAS, Landlord agrees to market and promote the Whale Product to its Tenants and Landlord desires to engage Whale to manage and remit any applicable funds in the Whale Deposit (as defined below) with respect to damages inflicted upon the Property by Tenants, and
WHEREAS, any Tenant who receive any Whale Product will execute that certain Security Account Control Agreement ("Deposit Control Agreement") by and between Tenants, Landlord, Build Whale, Inc., and Alpaca Securities LLC ("Broker") that is substantially similar to the attached in Exhibit B;
NOW, THEREFORE, for good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the parties agree as follows:
1. Whale Responsibilities.
1.1 Services to be Provided. Whale will perform the following services with respect to the Whale Deposit:
(a) Open a Whale Deposit at Broker for the purpose of segregating deposit assets relating to the Lease Agreement (such assets, the “Deposit Assets”);
(b) Whale shall maintain and have certain access and/or authority with respect to each such Whale Deposit in accordance with applicable law.
(c) Be responsible for handling all aspects of the collection, holding, and returning of Deposit Assets in the Whale Deposit in compliance with applicable laws and regulations with the exception of Landlord Responsibilities (as defined in Section 2);
(d) Ensure the Deposit Assets do not exceed the legal limit, hold funds in an account type that complies with all applicable laws, pay the appropriate amount of interest, and return funds to the Tenant before the legal deadline as long as the Landlord provides Whale with the finalized move-out charge at least 24 hours prior;
(e) Hold and maintain the Deposit Assets in cash so the full Deposit Assets are guaranteed to the Landlord for any move-out charges due; and
(f) Upon written request by the Landlord under this Agreement and the Deposit Control Agreement, remit any Deposit Assets to the Landlord from the Whale Deposit in the ordinary course of business in accordance with the terms of the Lease Agreement and this Agreement.
1.2 Access to Account. Each Whale Deposit will be interest-bearing, segregated from other investments, and locked in order to protect the principal balance. The Landlord may withdraw funds from each Whale Deposit they are party to without Whale’s prior written consent in accordance with the terms of that certain Securities Account and Deposit Account Control Agreement.
1.3 Employees/Independent Contractors of Whale. Whale may employ employees and/or independent contractors to enable Whale to provide the services under this Agreement. All matters pertaining to the supervision of such employees and independent contractors shall be the responsibility of Whale.
1.4 Miscellaneous Duties. Whale shall (a) maintain electronic records which are readily accessible to the Landlord, of orderly files containing documents and papers pertaining to the Whale Deposit applicable to the Landlord; and (b) provide information about the Whale Deposit necessary for the preparation and filing by the Landlord of its income or other tax returns required by any governmental authority, including annual statements. All such records will be made available to the Landlord upon request.
1.5 Feedback. Landlord may from time to time provide suggestions, comments for enhancements or functionality or other feedback (“Feedback”) to Whale with respect to the Whale Products. Whale will have full discretion to determine whether or not to proceed with the development of the requested enhancements, new features or functionality. Landlord hereby grants Whale a royalty-free, fully paid up, worldwide, transferable, sublicensable, irrevocable, perpetual license to (i) copy, distribute, transmit, display, perform, and create derivative works of the Feedback; and (ii) use the Feedback and/or any subject matter thereof, including without limitation, the right to develop, manufacture, have manufactured, market, promote, sell, have sold, offer for sale, have offered for sale, import, have imported, rent, provide and/or lease products or services which practice or embody, or are configured for use in practicing, the Feedback and/or any subject matter of the Feedback.
1.6 Status. Whale shall act solely in the capacity of an independent contractor in relation to the Landlord. Nothing in this Agreement shall cause Whale and the Landlord to be a principal-agent, joint venturers or partners of each other, and neither shall have the power to bind, obligate, control or direct the other party, except as expressly provided in this Agreement. The parties shall operate independently of each other, and make decisions without one party exercising any control or authority over the other. Nothing in this Agreement shall imply any fiduciary duties between the parties. This Agreement shall not deprive or otherwise affect the right of the parties to this Agreement to own, invest in, manage or operate, or to conduct business activities that compete with the business of the Property.
2. Landlord Responsibilities.
2.1 Landlord shall (1) conduct any required move-in inspection and provide notice of the current condition of the property to the Tenants, (2) determine the appropriate amount of funds that can be legally deducted from the deposit, (3) send the finalized move-out statement to the Tenants as required by law, (4) provide the finalized move-out charge to Tenants and to Whale at least 24 hours prior to any legal deadline for doing so and (5) any other responsibilities not explicitly listed in Section 1.1 (collectively, “Landlord Responsibilities”).
3. Insurance.
3.1 Insurance. Whale will maintain the following insurance policies with minimum coverage limits no less than those specified below:
(a) Professional liability and errors and omissions insurance ($5,000,000 per incident, $5,000,000 aggregate)
(b) Director and officers insurance ($1,000,000 per incident, $1,000,000 aggregate)
(c) Cyber liability insurance ($5,000,000 per incident, $5,000,000 aggregate)
(d) Workers’ compensation and employers’ liability insurance ($1,000,000 per incident, $1,000,000 aggregate)
(e) Employment practices insurance ($1,000,000 per incident, $1,000,000 aggregate)
(f) Crime insurance ($2,000,000 per incident, $2,000,000 aggregate)
3.2 Waiver of Subrogation. To the extent available at commercially reasonable rates, all property damage insurance policies required hereunder shall contain language whereby the insurance carrier thereunder waives any right of subrogation it may have with respect to the Landlord or Whale.
4. Record Keeping.
4.1 Books of Accounts. Whale shall maintain adequate and separate books and records for the Whale Deposits with the entries supported by sufficient documentation to ascertain their accuracy with respect to the Whale Deposit. Whale shall maintain such books and records at Whale's office as set forth in Section 7. Whale shall bear the losses arising from the fraud or gross negligence of Whale or any of its employees or agents, including, without limitation, the following: (a) theft of assets by Whale's employees, principals, or officers or those individuals associated or affiliated with Whale or (b) overpayment or duplicate payment of Whale Deposit to the Advisory Client arising from either fraud or gross negligence, unless such Whale Deposit is subsequently received by the Landlord within 30 days of such overpayment or duplicate payment.
4.2 Tax Information. The Whale shall provide the Landlord with sufficient information so that the Landlord can prepare its income tax returns on the cash method of accounting or, if requested, with appropriate adjustment to convert the information to an accrual basis.
5. Audits.
The Landlord and its representatives may, at its expense and upon delivery of reasonable prior written notice, examine all books, records and files maintained that are related to the Whale Deposit by Whale during business hours and in such a manner as does not unreasonably interfere with Whale’s business operations; provided that Landlord may only perform such audit once in any twelve (12) month period. Should the Landlord discover defects in internal controls or errors in record keeping, Whale shall undertake reasonably appropriate diligence to correct such discrepancies either upon discovery or within a reasonable period of time. Whale shall inform the Landlord in writing of the action taken to correct any audit discrepancies.
6. Termination.
6.1 The term of this Agreement shall begin on the Effective Date and shall continue until terminated in accordance with this Agreement.
6.2 Termination for Convenience. Either party shall have the right to terminate this Agreement upon thirty (30) days prior written notice indicating its termination of the Agreement.
6.2 Termination for Cause. Either party may terminate this Agreement in the event that the other materially breaches this Agreement and fails to cure such breach within 30 days after receiving written notice of the same from the non-breaching party.
6.3 Final Accounting. Within 45 days after termination of this Agreement, the Whale shall deliver to the Landlord the following: (a) a final accounting, setting forth the applicable Whale Deposit to the Landlord as of the date of termination, and (b) transfer to any account indicated by the Landlord with respect to any applicable Whale Deposit held by the Whale.
6.4 Effect of Termination. Upon any expiration or termination of the Agreement, all rights granted hereunder and all obligations of Whale to perform services hereunder will immediately terminate and each party will return or destroy all copies or other embodiments of the other party’s confidential information. Upon any termination of the Agreement (and upon any transfer of ownership or control by Landlord of a Property covered by this Agreement), Whale will use commercially reasonable efforts to support the transition of any Whale Deposits relating to such Property or Properties as more fully described in the Deposit Control Agreement. Upon expiration or termination of this Agreement, all obligations in this Agreement will terminate, provided that Sections 6, 7, 9, 10 and 11 will survive.
7. Notices.
All notices under this Agreement will be in writing and sent to the addresses set forth in this Agreement and will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by facsimile or email; the day after it is sent, if sent for next day delivery by recognized overnight delivery service; and upon receipt, if sent by certified or registered mail, return receipt requested.
To Whale at:
Build Whale, Inc. 332 S Michigan Ave - Suite #121-2234 - Chicago, IL 60604; Email: legal@gowhale.com
To the Landlord: {companyName} {companyAddress}; Email: {signerEmail}
8. Data Protection, Security and Privacy.
Whale will comply with the Data Protection, Security, and Privacy requirements set forth in Exhibit C.
9. Representations and Warranties and Disclaimers.
9.1 Representations and Warranties. Each party represents and warrants to the other party that (i) such party has the required power and authority to enter into this Agreement and to perform its obligations hereunder; (ii) the execution of this Agreement and performance of its obligations thereunder do not and will not violate any other agreement to which it is a party; and (iii) this Agreement constitutes a legal, valid and binding obligation when signed by both parties.
9.2 Compliance with Laws and Other Matters. Each party will comply with all applicable local, state and federal laws (collectively "Laws") in connection with the performance of its obligations hereunder. Whale may implement such procedures with respect to the Whale Deposit as Whale may deem advisable for the efficient and economic management and operation thereof.
9.3 Indemnification by Whale. Whale will defend Landlord and the officers, directors, agents, and employees (“Landlord Indemnified Parties”) against any third party claim, allegation or legal action (a “Claim”) arising from an allegation that Whale’s performance of its obligations hereunder with respect to any Whale Deposit does not comply with applicable laws or regulations, excluding any Claim to the extent that such non-compliance is based on Landlord directly or indirectly collecting a security deposit with respect to a Lease Agreement in addition to amounts collected hereunder and under the Deposit Control Agreement. Further, Whale will indemnify the Landlord Indemnified Party against any damages actually awarded or paid in connection therewith, including any reasonable attorneys’ fees. Notwithstanding the foregoing, Whale’s indemnification obligation will not apply to claims to the extent arising from Landlord’s negligence, willful misconduct or violation of applicable laws or regulations.
9.4 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH HEREIN, THE WHALE PRODUCTS ARE PROVIDED ON AN “AS-IS” BASIS AND WHALE DISCLAIMS ANY AND ALL WARRANTIES. WHALE DOES NOT WARRANT THAT THE RESULTS GENERATED BY THE WHALE PRODUCTS ARE ACCURATE OR WILL LEAD TO ANY PARTICULAR OUTCOME, AND WHALE EXPRESSLY DISCLAIMS ALL LIABILITY WITH RESPECT TO SUCH RESULTS. EXCEPT AS OTHERWISE EXPRESSLY PROVIDED IN THIS AGREEMENT, NEITHER PARTY MAKES ANY ADDITIONAL REPRESENTATION OR WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED (EITHER IN FACT OR BY OPERATION OF LAW), OR STATUTORY, AS TO ANY MATTER WHATSOEVER. ALL OTHER EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES ARE HEREBY EXCLUDED TO THE EXTENT ALLOWED BY APPLICABLE LAW. EACH PARTY EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUALITY, ACCURACY, TITLE, AND NON-INFRINGEMENT.
10. Limitations of Liability.
10.1 Disclaimer of Consequential Damages. THE PARTIES HERETO AGREE THAT, NOTWITHSTANDING ANY OTHER PROVISION IN THIS AGREEMENT, IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER FOR ANY SPECIAL, INDIRECT, RELIANCE, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY KIND, LOST OR DAMAGED DATA, LOST PROFITS OR LOST REVENUE, WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, EVEN IF A PARTY HAS BEEN NOTIFIED OF THE POSSIBILITY THEREOF.
10.2 General Cap on Liability. NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, UNDER NO CIRCUMSTANCES WILL EITHER PARTY’S LIABILITY FOR ALL CLAIMS ARISING UNDER OR RELATING TO THIS AGREEMENT (INCLUDING BUT NOT LIMITED TO WARRANTY CLAIMS), REGARDLESS OF THE FORUM AND REGARDLESS OF WHETHER ANY ACTION OR CLAIM IS BASED ON CONTRACT, TORT, OR OTHERWISE, EXCEED [FIVE THOUSAND DOLLARS]. THIS LIMITATION OF LIABILITY IS CUMULATIVE AND NOT PER INCIDENT.
11. Miscellaneous.
Neither party may assign this Agreement or assign or delegate its rights or obligations under the Agreement without the other party’s prior written consent; provided however, that either party may assign this Agreement to an acquirer of or successor to all or substantially all of its business or assets to which this Agreement relates, whether by merger, sale of assets, sale of stock, reorganization or otherwise. Any assignment or attempted assignment by either party otherwise than in accordance with this Section will be null and void. Both parties agree that this Agreement is the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement, and that all waivers and modifications must be in a writing signed by both parties, except as otherwise provided herein. No agency, partnership, joint venture, or employment is created as a result of this Agreement and a party does not have any authority of any kind to bind the other party in any respect whatsoever. In any action or proceeding to enforce rights under this Agreement, the prevailing party will be entitled to recover costs and attorneys’ fees. Each party will be excused from performance for any period during which, and to the extent that, it is prevented from performing any obligation or service, in whole or in part, as a result of a cause beyond its reasonable control and without its fault or negligence, including, but not limited to, acts of God, acts of war, epidemics, fire, communication line failures, power failures, earthquakes, floods, blizzard, or other natural disasters (but excluding failure caused by a party's financial condition or any internal labor problems (including strikes, lockouts, work stoppages or slowdowns, or the threat thereof)) (a “Force Majeure Event”). Delays in performing obligations due to a Force Majeure Event will automatically extend the deadline for performing such obligations for a period equal to the duration of such Force Majeure Event. Except as otherwise agreed upon by the parties in writing, in the event such non-performance continues for a period of thirty (30) days or more, either party may terminate this Agreement by giving written notice thereof to the other party. Upon the occurrence of any Force Majeure Event, the affected party will give the other party written notice thereof as soon as reasonably practicable of its failure of performance, describing the cause and effect of such failure, and the anticipated duration of its inability to perform. This Agreement will be governed by the laws of the State of New York without regard to its conflict of laws provisions. For all disputes relating to this Agreement, each party submits to the exclusive jurisdiction of the state and federal courts located in New York, New York and waives any jurisdictional, venue, or inconvenient forum objections to such courts.
[End of Document]
IN WITNESS WHEREOF the parties hereby execute this Agreement to be effective as of the date set forth above.
Whale:
Build Whale, Inc.
{signatureJamie}
Name: Arthur J. Petraglia
Title: Founder & CEO
LANDLORD:
{companyName}
By: {signatureLandlord}
Name: {companyName}
EXHIBIT A
LEGAL DESCRIPTION
All properties owned or operated by the Landlord are included in and covered by this agreement. Properties may be enabled or disabled for Whale at any time at the discretion of the Landlord. This can be done by emailing support@gowhale.com or changing configuration settings in Whale’s admin tool. The Landlord reserves the right to add or remove properties any time without penalty or prior notice.
EXHIBIT B
Securities Account Control Agreement
EXHIBIT C
DATA PROTECTION, SECURITY, AND PRIVACY REQUIREMENTS
1. Definitions.
1.1 "Customer Data" means any and all type of information, facts, figures, statistics, details, information, insights, automations, metadata, and any other data of any kind regarding or pertaining to {companyName} ("Customer"), the Customer-owned properties wherein the residential units covered by this Agreement are contained ("Properties"), or the residents of the Properties ("Tenants"), including, without limitation: (i) data that is transmitted, stored, retrieved, or processed by Customer, a Tenant, or Whale in, to, or through the Services (as defined below); (ii) data provided to Whale by Customer at its direction in connection with this Agreement, (ii) data made available to, or otherwise obtained by, Whale through the Services; and (iii) data made available to, or otherwise obtained by, Whale in the course of providing the Services.
1.2 "Documentation" means any user guide, help information, and other documentation and information regarding the Services that is delivered by Whale to Customer in electronic or other form, including any updates, modifications, or upgrades provided by Whale from time to time; provided, however, if any updates, modifications, or upgrades require Customer to follow updated instructions, Customer shall have 45 days from receipt of any new Documentation from Whale to begin compliance.
1.3 "Tenant Data" means any or all information in any way regarding or pertaining to any Tenant, including any such information (i) provided to Whale by Customer or at its direction in connection with this Agreement or the Property at which the Tenant resides, (ii) provided to Whale by any Tenant or at its direction in connection with this Agreement or the Property at which the Tenant resides, or (iii) made available to, or otherwise obtained by, Whale during the course of Whale's performance under this Agreement. Tenant Data includes any information that (a) identifies or can be used to identify or locate an individual (including, without limitation, names, signatures, addresses, telephone numbers, e-mail addresses and other unique identifiers), (b) can be used to authenticate an individual (including, without limitation, employee identification numbers, government-issued identification numbers, passwords or PINs, financial account numbers, credit report information, answers to security questions and other personal identifiers), (c) can be used to access or control any assets, accounts, credit, funds, payments or other transfers of value by or on behalf of any individual, or (d) records any action or election of any individual and is collected by, or transmitted to, Whale through the “Services”.
1.4 "Services" means collectively, Whale's proprietary, Software-as-a-Service ("SaaS") solution for multi-source data analysis and management of business information, Documentation, and all software applications, databases, modules, source code, development tools, libraries, and utilities that UDP uses, creates, and/or maintains in order to provide the Services set forth in the Order Form to Customer. The Services includes any change, improvement, extension, or other new version thereof that is developed or otherwise made available to Customer.
1.5 "Services Data" means Tenant Data and Customer Data, collectively.
1.6 "Data Subject" means an identified or identifiable natural person.
1.7 "Processing" (including "Processed" and similar terms) means any operation or set of operations which is performed on Services Data or on sets of Services Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
1.8 "Authorized Employees" means Whale's employees who have a need to know or otherwise access Services Data to enable Whale to perform its obligations under the Agreement.
1.9 "Security Breach" means an actual or attempted act, omission, or event that compromises the security, confidentiality, availability, or integrity of Confidential Information and/or Services Data or the physical, technical, administrative, or organizational safeguards put in place by Whale or its Non-Employees that relate to the protection of the security, confidentiality, or integrity of Confidential Information and/or Services Data. Security Breach includes, without limitation, any physical trespass on a secure facility or computing systems, intrusion/hacking, or theft of any information storage device or printed materials, exploitation of a vulnerability in Whale's computing systems, unauthorized access to or use of any Services Data, accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Services Data transmitted, stored, or otherwise processed.
1.10 "Supervisory Authority" means a public authority which regulates Applicable Laws (as defined below) in any jurisdiction in which the Whale provides goods or services.
2. Data Collection; Usage, Data Security.
2.1 Data Ownership. Customer owns all right, title, and interest in and to the Services Data, including all intellectual property rights therein, and Whale hereby disclaims any interest the Services Data. If Whale is deemed to have any ownership interest in any Services Data, including any derivative works thereof, then Whale shall assign, and hereby does assign, irrevocably and on a royalty-free basis, all such ownership interest or other rights exclusively to Customer.
2.2 Data Usage. Customer hereby grants to Whale during the Term of this Agreement the right to use Services Data in order to perform the Services and for no other purpose whatsoever. Whale's right to use such information terminates concurrent with Whale's right to provide Services. Whale shall hold, and cause all Non-Employees to hold, Services Data, including, without limitation, all Services Data, and any information derived from such data or the Services, in strictest confidence, and Whale may disclose such data only to Authorized Employees solely for purposes of performing the Services contemplated under this Agreement ("Confidential Information"). Whale may not transfer Services Data to any location outside the U.S. unless agreed to in writing by Customer. Only duly Authorized Employees or non-employees, including contractors or sub-contractors, are permitted to access Services Data, and only to fulfill the obligations of this Agreement. Whale shall not distribute, repurpose, sell, or share Services Data (i) across other applications, environments, or business units of Whale, or (ii) to third parties.
2.3 Restrictions. Customer will not (and will not to allow any third party to): (i) access the Services for any benchmarking, penetration testing, or competitive purposes without Whale's express written consent; (ii) encumber, rent, market, sublicense, resell, lease, loan, transfer, or otherwise commercially exploit or make the Services available to any third party, except to a third party that manages Customer's computing environment or asset portfolio; (iii) modify, create derivative works, decompile, reverse engineer, attempt to gain access to the source code, or copy the Services, or any of their components; (iv) use or allow the transmission, transfer, export, re-export, or other transfer of any product, technology, or information Customer obtains or learns of pursuant to this Agreement (or any direct product thereof) in violation of any export control or other laws and regulations of the United States or any other relevant jurisdiction; or (v) use the Services other than in accordance with this Agreement and in compliance with all applicable current or future local, state, and federal laws, rules, regulations, orders, writs, ordinances, requirements, restrictions, and codes, and future modifications thereto, including all applicable federal, state, local privacy and data protection laws and export laws (collectively, "Applicable Laws").
2.4 Data Security. Whale shall, taking into account those matters which are required to be considered under Applicable Laws, take, implement, and maintain security measures ("Data Security Standards"), which shall include industry-standard administrative, technical, and physical safeguards, to protect Confidential Information and Services Data from any Security Breach and to prevent any unauthorized control or monitoring of the Services by any person or entity other than Customer. Such Data Security Standards shall also include administrative permissions, access controls, server security, encryption, and other means, where appropriate. At a minimum, such Data Security Standards shall include: (i) limiting access to Confidential Information and Services Data to Authorized Employees, (ii) securing business facilities, data centers, paper files, servers, back-up systems, and computing equipment, including, but not limited to, all mobile devices and other equipment with information storage capability, (iii) implementing network, device application, database, and platform security, (iv) securing information transmission, storage, and disposal, (v) implementing authentication and access controls within media, applications, operating systems, and equipment, (vi) encrypting Services Data stored on any mobile media, (vii) encrypting Services Data in transit, (viii) strictly segregating Services Data from Whale's information or information of Whale's other customers so that Services Data is not commingled with any other types of information; (ix) implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with Applicable Laws, and (x) providing appropriate privacy and information security training to Whale's employees. In addition, Whale shall diligently work toward obtaining SOC 2 Type I and SOC 2 Type II data privacy certifications as soon a reasonably practicable following the effective date of the Agreement, and Whale shall provide notice to Customer upon receipt of either such certification. Should Whale fail to obtain, or otherwise stop pursuing, either its SOC 2 Type I certification or SOC 2 Type II certification, Whale shall promptly notify Customer of same. At any time, upon 30 days' prior notice but not more than once per any 12-month period, Customer shall have the right (at its sole cost) to conduct, and Whale shall facilitate, an audit with respect to Whale's encryption, collection, transmittal, and storage of information obtained by Whale through the Services or otherwise in connection with this Agreement. Whale agrees that Customer shall have the right to periodically evaluate, validate and monitor, through its security questionnaire process and requests for additional information ("Periodic Security Evaluations"), that the Services, system configurations, and processes, including that of Whale's Non-Employees, are in compliance with this Agreement.
2.5 Data Storage. The Whale data center and disaster recovery site that contain Confidential Information must be located in the continental United States. Whale shall ensure that any facilities in which Confidential Information is processed, including Whale's data center and disaster recovery site, shall remain compliant with SOC 2 Type II subject to Section 2.3 above, or with a similar successor standard that may be in effect from time to time, for the Term and will provide Customer, upon request, with a copy of its SOC 2 Type II attestation and a bridge letter that covers the period after the date of the applicable SOC 2 Type II report date.
2.6 Usage of Services Data in Compliance with Applicable Laws. Whale covenants, represents, and warrants that its collection, access, use, storage, disposal, and disclosure of Services Data and that of its Non-Employees, will comply with Applicable Laws and regulations pertaining to privacy and data security, and the collection, Processing, disclosure, and storage of such Services Data.
2.7 Data Security Breach. In the event of a Security Breach, Whale shall notify Customer of the Security Breach as soon reasonably practical (and, in no event later than 24 hours thereafter) and use its best efforts to resolve the Security Breach and remediate the effects of the breach or potential breach to the reasonable satisfaction of Customer and in conformity with all Applicable Laws. Further, Whale shall reimburse Customer for the actual reasonable costs incurred by Customer in providing notice to any individuals affected by any Security Breach. Notwithstanding anything to the contrary herein, Whale shall have committed an event of default for which Customer may exercise all rights and remedies available hereunder, at law or in equity, without further notice or opportunity to cure, upon any default of its obligations under this Section 2.7. Customer agrees to notify Whale immediately of any unauthorized use of the Services and/or any unauthorized use or disclosure of any Services Data.
2.8 PCI DSS Compliance. To the extent Whale or its Non-Employees collect or handle information printed on the front or back of a debit, credit, or other payment card ("Cardholder Data") in connection with its Services, Whale and its Non-Employees shall comply with Payment Card Industry Data Security Standard ("PCI DSS") requirements for Cardholder Data, as prescribed by the PCI Security Standards Council from time to time.
2.9 Secure Coding Practices. All software, websites, mobile applications, or other technologies developed by Whale and used by Whale (including the Services under the Agreement) as part of the Agreement or Services or to help perform or provide the Services shall work as intended and be free of security vulnerabilities, malicious code, ad-supported software, Trojan Horses, root kits, worms, key-loggers, backdoors, viruses, corrupted files, and any similar code, file, or vulnerability that may damage the operation of or compromise the integrity and security of another computer, system (including the Properties' property management systems), or service or that may compromise the privacy or data security of individuals or end-users to whom the Customer owes legal duties. Additionally, Whale represents and warrants that any website, web application, mobile application, IoT service, or similar technology that it creates as part of the Services or to help perform or provide the Services shall meet the requirements set forth in Level 2 of the most recent Application Security Verification Standard published by the Open Web Application Security Property to the extent that the requirements are applicable to providing the Services without creating material adverse security risks.
2.10 Return/Destruction of Services Data. Upon expiration or earlier termination of this Agreement for any reason, Whale, with respect to Services Data received from Customer, or created, maintained, or received by Whale on behalf of Customer, shall return and destroy remaining Services Data maintained in any form as follows. Within 30 days of such expiration or earlier termination of this Agreement, Whale shall: (a) deliver to Customer a flat file, in a format reasonably acceptable to Customer, with all Services Data; and (b) ensure that all encryption keys for and copies of Services Data maintained in any form in Whale's possession (and that of its employees, agents, and Non-Employees) is permanently destroyed.
3. Data Privacy.
3.1 In relation to any Tenant Data or any Confidential Information of Customer's and its employees, contractors, agents, invitees, or Tenants Processed hereunder, Whale shall act only on the instructions of Customer in Processing any such data and information.
3.2 Whale shall not use Services Data in connection with unsolicited or solicited direct marketing or offers.
3.3 Whale shall ensure that it has appropriate consents and/or notices in place to enable Customer to receive the products and Services under this Agreement. This includes but is not limited to when Services Data is being transferred outside of the jurisdiction in which it is collected.
3.4 Whale shall take reasonable steps to verify the reliability of any persons authorized by Whale to Process any Services Data, and it shall ensure that all such persons are subject to binding agreements with Whale which contain substantially similar data protection provisions as those set forth herein.
3.5 Whale shall provide reasonable support to Customer in complying with any legally mandated request for access to or correction or deletion of any Services Data by any Services Data Subject or access or demand made by any court or Supervisory Authority, and where such request or demand is submitted to Whale, promptly notify Customer of it; and take any actions reasonably requested by Customer so that any such request is redirected directly to Customer. Whale shall not, without the prior written consent of Customer, respond to such request or demand, including a request or demand by a Supervisory Authority, unless Whale is required to do so under Applicable Laws.
3.6 Whale shall provide reasonable assistance to Customer to assist Customer's obligation to respond to requests by any Data Subject exercising rights under Applicable Laws.
3.7 Whale shall provide reasonable assistance to Customer in connection with Customer's compliance with any other Customer obligations under Applicable Laws in connection with this Agreement, including the circulation by Customer of data protection notices to Data Subjects, and Customer's privacy policy as updated from time to time.
3.8 Whale shall make available to Customer all information necessary to demonstrate compliance with these data protection obligations.
4. California Consumer Privacy.
4.1 Definitions. Except as otherwise defined in this Agreement, all capitalized terms in this Section 4 will have the meanings given to them under the California Consumer Privacy Act of 2018 and regulations promulgated thereunder (as amended, supplemented, or replaced, the "CCPA").
4.2 Information. Customer and its representatives may disclose limited Personal Information to Whale, from time to time ("Customer-supplied Information"). Whale may also have or obtain Personal Information, other than Customer-supplied Information ("Other Information"). All Customer-supplied Information is disclosed solely for purposes of maintaining or servicing accounts, providing customer service, maintaining quality and safety of services, processing or fulfilling orders, and protecting against malicious, deceptive, fraudulent, or illegal activity, as specified in this Agreement, and Whale shall not retain, use, or disclose Customer-supplied Information for any other purpose. Whale shall not Sell Customer-supplied Information or use Customer-supplied Information for any Commercial Purpose. Whale certifies that it understands the restrictions in this Section 4 and will comply with them.
4.3 Compliance. Whale shall: (i) fully comply with the CCPA with respect to Customer-supplied Information and Other Information; (ii) implement and maintain reasonable security procedures and practices to protect Customer-supplied Information and Other Information; (iii) promptly and timely comply with Customer requests with respect to Customer-supplied Information (e.g., disclosure, deletion, opt-out) that are communicated to Whale by Customer; and (iv) indemnify, defend, and hold harmless Customer, its management companies, and their respective shareholders, members, partners, managers, affiliates, directors, employees, and agents against any civil or enforcement action arising, or alleged to arise from, Whale's failure to comply with the requirements of this Section 4.
5. Equitable Relief.
Whale acknowledges that any breach of its covenants or obligations set forth in this Exhibit C may cause Customer irreparable harm for which monetary damages would not be adequate compensation and agrees that, in the event of such breach or threatened breach, Customer is entitled to seek equitable relief, including a restraining order, injunctive relief, specific performance, and any other relief that may be available from any court, in addition to any other remedy to which Customer may be entitled at law or in equity. Such remedies shall not be deemed to be exclusive but shall be in addition to all other remedies available at law or in equity, subject to any express exclusions or limitations in this Agreement to the contrary.