Data Processing Agreement
Last Updated: May, 2022
This Data Processing Agreement forms part of the Sona Master Services Agreement ("Agreement") between Sona Labs LLC ("Sona") and Customer, governing certain products or services ("Services").
1. Multi-State Privacy Laws Compliance
For personal information processing under the Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, or Virginia Consumer Data Protection Act where Sona is subject to these laws:
1.1 Subcontractor Management: Sona will engage subcontractors, if any, through a legally binding contract in accordance with the aforementioned statutes, ensuring the subcontractor adheres to Sona's obligations.
1.2 Confidentiality: Sona will guarantee that any individual involved in processing personal information will maintain confidentiality concerning the data.
1.3 Audit Rights: Sona will permit and collaborate with reasonable audits by Customer or an auditor appointed by Customer. Alternatively, Sona may engage an independent, qualified assessor to conduct an assessment of Sona's policies and technical and organizational measures, providing Customer with the assessment report upon request.
1.4 Data Deletion / Return: Upon Customer's directive, Sona will either delete or return all personal information at the termination of the Services, unless legally obligated to retain the data.
1.5 Compliance Information: At Customer's reasonable request, Sona will furnish any information required to demonstrate compliance with the applicable laws.
2. CCPA Compliance Obligations
For personal information subject to the California Consumer Privacy Act of 2018, as revised by the California Privacy Rights Act of 2020, where Sona is subject to the CCPA:
2.1 Sona must inform Customer if it concludes that it cannot fulfill its CCPA obligations.
2.2 Sona is obliged to adhere to the CCPA's provisions, ensuring the same level of privacy protection as businesses are mandated to provide.
2.3 Sona must facilitate Customer compliance with consumer inquiries under the CCPA, or notify Customer of any such consumer requests.
2.4 Sona will provide Customer the authority to take necessary measures to confirm that personal information gathered under the Agreement is used in compliance with the CCPA.
2.5 Sona will ensure Customer has the right to intervene and rectify any unauthorized use of personal information by Sona.
2.6 Business Purpose: The specific business purpose for which Sona is processing personal information is to provide, manage, operate, and secure the Services. Sona will process personal information only for the limited and specified business purpose set out in the Agreement.
2.7 Restrictions on Selling / Sharing: Sona is prohibited from selling or sharing personal information collected under the Agreement, as well as from retaining, using, or disclosing it outside the specified business purposes.
2.8 Limitation on Use: Sona is prohibited from retaining, utilizing, or disclosing the personal information acquired under the Agreement except for the business purposes detailed in the Agreement, or as otherwise permitted by the CCPA.
2.9 Commercial Activity Prohibition: Sona is prohibited from retaining, utilizing, or disclosing the personal information acquired under the Agreement for any commercial activities, including cross-context behavioral advertising, other than those explicitly outlined in the Agreement.
2.10 Direct Business Relationship: Sona is prohibited from retaining, using, or disclosing the personal information outside the direct business relationship between Sona and Customer, unless expressly permitted by the CCPA.
3. Personal Information Sharing / Selling Under CCPA
When either party shares or sells personal information falling within the scope of the CCPA:
3.1 The disclosing party has the right to ensure the receiving party utilizes the personal information in alignment with the CCPA obligations.
3.2 The disclosing party has the right to intervene and rectify any unauthorized use of personal information by the receiving party.
3.3 The receiving party must adhere to relevant CCPA provisions, ensuring privacy protection and practices as required under the CCPA.
3.4 The receiving party must notify the disclosing party if it is no longer able to meet the CCPA requirements.
3.5 Personal information exchanged is confined to the specific purposes outlined in the Agreement and must be used solely for those purposes.
3.6 Service Provision Purpose: The purpose of making personal information available to and by Sona is solely to facilitate the provision, management, operation, and security of the Services.
