Schedule 6: CCPA Addendum
[PRIVACY_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025
This CCPA Addendum (“CCPA Addendum“) forms part of the Data Protection Addendum (“DPA“), to the extent applicable for the provision for the Product, between Customer and the applicable Scaleflex contracting entity (“Scaleflex”). In the event of a conflict between the terms and conditions of the DPA and those of this CCPA Addendum, this Addendum shall prevail. Capitalised terms used but not defined in this Addendum shall have the meanings given in the Agreement.
Definitions
“Business”, “Collects”, “Consumer”, “Business Purpose”, “Sell”, “Service Provider”, and “Share” shall have the meanings given to them in §1798.140 of the CCPA.
“Business Purpose” has the meaning given in Section 5 of this CCPA Addendum.
“California Consumer Privacy Act” or “CCPA” means Title 1.81.5 California Consumer Privacy Act of 2018 (California Civil Code §§1798.100—1798.199), as amended or superseded from time to time.
“California Privacy Rights Act” or “CPRA” means the California Privacy Rights Act of 2020 (2020 Cal. Legis. Serv. Proposition 24, codified at Cal. Civ. Code §§1798.100 et seq.), and its implementing regulations, as amended or superseded from time to time.
“Personal Information” means personal information as defined by §1798.140 of the CCPA submitted to Scaleflex for processing pursuant to the Agreement.
Scope. This CCPA Addendum only applies where, and to the extent that, Scaleflex processes Personal Information that is subject to the CCPA and/or the CPRA on behalf of Customer as a Service Provider in the course of providing the Product pursuant to the Agreement.
Business Purpose. Scaleflex shall only collect and process Personal Information as a Service Provider upon lawful documented instructions from Customer, including those in the Agreement, this CCPA Addendum, and Customer’s configuration of the Product or as otherwise necessary to provide the Product specified in the Agreement (the “Business Purpose”). Scaleflex will not process the Personal Information for any purpose other than for the Business Purpose, except where and to the extent permitted by the CCPA.
Scaleflex obligations
4.1. Customer is a Business and appoints Scaleflex as its Service Provider to Collect and process the Personal Information for the Business Purpose. Scaleflex is responsible for its compliance with its obligations under this CCPA Addendum and for compliance with its obligations as a Service Provider under the CCPA. Customer is responsible for compliance with its own obligations as a Business under CCPA and shall ensure that it has provided notice and has obtained (or shall obtain) all consents and rights necessary under the CCPA for Scaleflex to collect and process the Personal Information for the Business Purpose.
4.2. Scaleflex shall not: (a) Sell the Personal Information; (b) retain, use, or disclose the Personal Information for any purpose other than for the Business Purpose; (c) retain, use, or disclose the Personal Information outside of the direct business relationship between Scaleflex and Customer (except where Scaleflex has engaged a subprocessor to assist in the provision of services); (d) Share or process the Personal Information for targeted and/or cross context behavioural advertising; (e) combine Personal Information with any other data if and to the extent this would be inconsistent with the limitations on Service Providers under the CCPA. Scaleflex certifies that it understands and agrees to comply with the restrictions set out in this section 4.2. Scaleflex shall notify Customer if it determines that it cannot meet its obligations under the CCPA.
4.3. If the CCPA permits, Scaleflex may aggregate, de-identify, or anonymize Personal Information so it no longer meets the Personal Information definition, and may use such aggregated, de-identified, or anonymized data for its own research and development purposes
Assistance with Customer’s CCPA obligations
5.1. Scaleflex will reasonably cooperate and assist Customer with meeting Customer’s CCPA compliance obligations and responding to CCPA-related inquiries, including responding to verifiable consumer requests, taking into account the nature of Scaleflex' processing and the information available to Scaleflex.
5.2. Scaleflex must notify Customer without undue delay if it receives any complaint, notice, or communication that directly or indirectly relates to either party's compliance with the CCPA. Specifically, Scaleflex must notify Customer without undue delay, if it receives a verifiable consumer request under the CCPA.
Audits. Scaleflex permits Customer to monitor its compliance with this CCPA Addendum subject to Section 11 in the DPA “Customer Audits”.
Notification. Scaleflex agrees to notify Customer if Scaleflex makes a reasonable determination that it can no longer meet its obligations under this CCPA Addendum or CCPA requirements.
Selling. Scaleflex certifies that it understands the rules, requirements and definitions of the CCPA and agrees to refrain from selling (as such term is defined in the CCPA) any Personal Information.
Mis à jour