California Consumer

Privacy Act Addendum

This supplement to the EComposer Data Processing Agreement (DPA) is integrated by reference into the EComposer Terms of Service, available at https://ecomposer.io/pages/terms-of-service. It pertains to the agreement between EComposer and you (referred to as the "Customer"). This addendum outlines the mutual understanding concerning the handling and access to personal information in compliance with the California Consumer Privacy Act (CCPA), where applicable.

For CCPA purposes, the Parties acknowledge that EComposer will function as a "Service Provider" as defined by the CCPA in fulfilling its obligations under this DPA or the Agreement. Throughout this Agreement, EComposer will be referred to as the "Service Provider." The Customer will serve as the primary point of contact for its Affiliates concerning CCPA compliance. If the Service Provider provides notice to the Customer, it will be considered received by the Customer's Affiliates. The Parties acknowledge that any CCPA-related claims under this DPA will be filed by the Customer on its own behalf or on behalf of an Affiliate.

- Affiliates: Entities directly or indirectly controlling, controlled by, or under common control with the entity. "Control" implies ownership or control of more than 50% of voting interests.

- CCPA: The California Consumer Privacy Act, Cal. Civ. Code 1798.100 et seq., including subsequent amendments and implementing regulations.

- CCPA Consumer: A "consumer" as defined in the CCPA.

- CCPA Personal Information: "Personal information" (as per CCPA) processed by the Service Provider on behalf of the Customer and/or Customer's Affiliates in connection with the Service Provider's service provision.

- Data Processing Services: Processing of CCPA Personal Information for CCPA-allowed purposes, such as "business purposes" defined by CCPA or other CCPA-permitted purposes.

- Processing: As defined in the CCPA.

- Sell: Includes selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating CCPA Personal Information for monetary or other valuable consideration.

- Services: Assessment services and other services provided by the Service Provider to the Customer under the Agreement, including Data Processing Services.

- Subprocessor: Any subcontractor engaged by the Service Provider to Process CCPA Personal Information on its behalf.

2.1.1. The Contracted Business Purposes involve providing the Services and processing Customer Data as outlined in the Agreement.

2.1.2. Personal Information Categories: This Agreement encompasses the following Personal Information categories, classified according to CCPA Cal. Civ. Code § 1798.140(o):

A. Identifiers: None

B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)): None

C. Protected classification characteristics under California or federal law: None

D. Commercial information: Purchased product/service transactions on pages created with the EComposer app

E. Biometric information: None

F. Internet or other similar network activity: Visits to pages built with the EComposer app, clicks on tracking objects on the EComposer app-built pages

G. Geolocation data: None

H. Sensory data: None

I. Professional or employment-related information: None

J. Non-public education information (per the Family Educational Rights and Privacy Act): None

K. Inferences drawn from other personal information: None

The Customer is responsible for CCPA compliance regarding the collection, use, and storage of CCPA Personal Information. It must obtain all necessary consents and provide required notices for lawful Processing by the Service Provider under the Agreement.

EComposer may employ subcontractors to provide Contracted Business Services per the Agreement and subject to this CCPA Addendum. Such subcontractors must qualify as "service providers" under the CCPA, and EComposer will not disclose information to them in a manner treated as a sale under the CCPA. EComposer remains fully accountable to the Customer for subcontractor actions or omissions.

The Service Provider shall not disclose, release, transfer, make available, or otherwise communicate CCPA Personal Information to another business or third party without the Customer's prior written consent. This clause does not restrict the Service Provider's ability to disclose CCPA Personal Information to comply with applicable laws or as allowed by the CCPA.

The Service Provider shall not Sell any CCPA Personal Information to another business or third party without the Customer's prior written consent.

Effective from the CCPA's effective date, the Service Provider shall adhere to all relevant CCPA requirements. Upon a detailed written request from the Customer and where feasible, the Service Provider will assist the Customer in responding to CCPA Consumer Rights Requests in accordance with CCPA requirements.

The Service Provider will promptly inform the Customer of any verified request it receives from a CCPA Consumer or authorized representative regarding CCPA Personal Information. The Service Provider will direct such CCPA Consumers or authorized representatives to contact the Customer.